From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:5.8 commit in: /
Date: Wed, 9 Sep 2020 18:02:24 +0000 (UTC) [thread overview]
Message-ID: <1599674532.9823217538d25d8a5408a78372823d3649ae9eed.mpagano@gentoo> (raw)
commit: 9823217538d25d8a5408a78372823d3649ae9eed
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 9 18:02:12 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 9 18:02:12 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=98232175
Linux patch 5.8.8
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1007_linux-5.8.8.patch | 7178 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7182 insertions(+)
diff --git a/0000_README b/0000_README
index 62e43d7..93860e0 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch: 1006_linux-5.8.7.patch
From: http://www.kernel.org
Desc: Linux 5.8.7
+Patch: 1007_linux-5.8.8.patch
+From: http://www.kernel.org
+Desc: Linux 5.8.8
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1007_linux-5.8.8.patch b/1007_linux-5.8.8.patch
new file mode 100644
index 0000000..1dd4fdb
--- /dev/null
+++ b/1007_linux-5.8.8.patch
@@ -0,0 +1,7178 @@
+diff --git a/Documentation/devicetree/bindings/mmc/mtk-sd.txt b/Documentation/devicetree/bindings/mmc/mtk-sd.txt
+index 8a532f4453f26..09aecec47003a 100644
+--- a/Documentation/devicetree/bindings/mmc/mtk-sd.txt
++++ b/Documentation/devicetree/bindings/mmc/mtk-sd.txt
+@@ -49,6 +49,8 @@ Optional properties:
+ error caused by stop clock(fifo full)
+ Valid range = [0:0x7]. if not present, default value is 0.
+ applied to compatible "mediatek,mt2701-mmc".
++- resets: Phandle and reset specifier pair to softreset line of MSDC IP.
++- reset-names: Should be "hrst".
+
+ Examples:
+ mmc0: mmc@11230000 {
+diff --git a/Documentation/filesystems/affs.rst b/Documentation/filesystems/affs.rst
+index 7f1a40dce6d3d..5776cbd5fa532 100644
+--- a/Documentation/filesystems/affs.rst
++++ b/Documentation/filesystems/affs.rst
+@@ -110,13 +110,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as follows:
+
+ - R maps to r for user, group and others. On directories, R implies x.
+
+- - If both W and D are allowed, w will be set.
++ - W maps to w.
+
+ - E maps to x.
+
+- - H and P are always retained and ignored under Linux.
++ - D is ignored.
+
+- - A is always reset when a file is written to.
++ - H, S and P are always retained and ignored under Linux.
++
++ - A is cleared when a file is written to.
+
+ User id and group id will be used unless set[gu]id are given as mount
+ options. Since most of the Amiga file systems are single user systems
+@@ -128,11 +130,13 @@ Linux -> Amiga:
+
+ The Linux rwxrwxrwx file mode is handled as follows:
+
+- - r permission will set R for user, group and others.
++ - r permission will allow R for user, group and others.
++
++ - w permission will allow W for user, group and others.
+
+- - w permission will set W and D for user, group and others.
++ - x permission of the user will allow E for plain files.
+
+- - x permission of the user will set E for plain files.
++ - D will be allowed for user, group and others.
+
+ - All other flags (suid, sgid, ...) are ignored and will
+ not be retained.
+diff --git a/Makefile b/Makefile
+index 5081bd85af29f..dba4d8f2f7862 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 8
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+
+diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
+index 661fd842ea97d..79849f37e782c 100644
+--- a/arch/arc/kernel/perf_event.c
++++ b/arch/arc/kernel/perf_event.c
+@@ -562,7 +562,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
+ {
+ struct arc_reg_pct_build pct_bcr;
+ struct arc_reg_cc_build cc_bcr;
+- int i, has_interrupts;
++ int i, has_interrupts, irq;
+ int counter_size; /* in bits */
+
+ union cc_name {
+@@ -637,13 +637,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
+ .attr_groups = arc_pmu->attr_groups,
+ };
+
+- if (has_interrupts) {
+- int irq = platform_get_irq(pdev, 0);
+-
+- if (irq < 0) {
+- pr_err("Cannot get IRQ number for the platform\n");
+- return -ENODEV;
+- }
++ if (has_interrupts && (irq = platform_get_irq(pdev, 0) >= 0)) {
+
+ arc_pmu->irq = irq;
+
+@@ -652,9 +646,9 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
+ this_cpu_ptr(&arc_pmu_cpu));
+
+ on_each_cpu(arc_cpu_pmu_irq_init, &irq, 1);
+-
+- } else
++ } else {
+ arc_pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
++ }
+
+ /*
+ * perf parser doesn't really like '-' symbol in events name, so let's
+diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
+index e7bdc2ac1c87c..8fcb9e25aa648 100644
+--- a/arch/arc/mm/init.c
++++ b/arch/arc/mm/init.c
+@@ -27,8 +27,8 @@ static unsigned long low_mem_sz;
+
+ #ifdef CONFIG_HIGHMEM
+ static unsigned long min_high_pfn, max_high_pfn;
+-static u64 high_mem_start;
+-static u64 high_mem_sz;
++static phys_addr_t high_mem_start;
++static phys_addr_t high_mem_sz;
+ #endif
+
+ #ifdef CONFIG_DISCONTIGMEM
+@@ -70,6 +70,7 @@ void __init early_init_dt_add_memory_arch(u64 base, u64 size)
+ high_mem_sz = size;
+ in_use = 1;
+ memblock_add_node(base, size, 1);
++ memblock_reserve(base, size);
+ #endif
+ }
+
+@@ -158,7 +159,7 @@ void __init setup_arch_memory(void)
+ min_high_pfn = PFN_DOWN(high_mem_start);
+ max_high_pfn = PFN_DOWN(high_mem_start + high_mem_sz);
+
+- max_zone_pfn[ZONE_HIGHMEM] = max_high_pfn;
++ max_zone_pfn[ZONE_HIGHMEM] = min_low_pfn;
+
+ high_memory = (void *)(min_high_pfn << PAGE_SHIFT);
+ kmap_init();
+@@ -167,22 +168,26 @@ void __init setup_arch_memory(void)
+ free_area_init(max_zone_pfn);
+ }
+
+-/*
+- * mem_init - initializes memory
+- *
+- * Frees up bootmem
+- * Calculates and displays memory available/used
+- */
+-void __init mem_init(void)
++static void __init highmem_init(void)
+ {
+ #ifdef CONFIG_HIGHMEM
+ unsigned long tmp;
+
+- reset_all_zones_managed_pages();
++ memblock_free(high_mem_start, high_mem_sz);
+ for (tmp = min_high_pfn; tmp < max_high_pfn; tmp++)
+ free_highmem_page(pfn_to_page(tmp));
+ #endif
++}
+
++/*
++ * mem_init - initializes memory
++ *
++ * Frees up bootmem
++ * Calculates and displays memory available/used
++ */
++void __init mem_init(void)
++{
+ memblock_free_all();
++ highmem_init();
+ mem_init_print_info(NULL);
+ }
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+index 1a39e0ef776bb..5b9ec032ce8d8 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -686,6 +686,8 @@
+ clocks = <&pericfg CLK_PERI_MSDC30_0_PD>,
+ <&topckgen CLK_TOP_MSDC50_0_SEL>;
+ clock-names = "source", "hclk";
++ resets = <&pericfg MT7622_PERI_MSDC0_SW_RST>;
++ reset-names = "hrst";
+ status = "disabled";
+ };
+
+diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
+index efce5defcc5cf..011eb6bbf81a5 100644
+--- a/arch/mips/kernel/perf_event_mipsxx.c
++++ b/arch/mips/kernel/perf_event_mipsxx.c
+@@ -1898,8 +1898,8 @@ static const struct mips_perf_event *mipsxx_pmu_map_raw_event(u64 config)
+ (base_id >= 64 && base_id < 90) ||
+ (base_id >= 128 && base_id < 164) ||
+ (base_id >= 192 && base_id < 200) ||
+- (base_id >= 256 && base_id < 274) ||
+- (base_id >= 320 && base_id < 358) ||
++ (base_id >= 256 && base_id < 275) ||
++ (base_id >= 320 && base_id < 361) ||
+ (base_id >= 384 && base_id < 574))
+ break;
+
+diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
+index 2f513506a3d52..1dbfb5aadffd6 100644
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -239,6 +239,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle)
+ */
+ static void bmips_init_secondary(void)
+ {
++ bmips_cpu_setup();
++
+ switch (current_cpu_type()) {
+ case CPU_BMIPS4350:
+ case CPU_BMIPS4380:
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index e664d8b43e72b..2e9d0637591c9 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -1286,6 +1286,18 @@ static int enable_restore_fp_context(int msa)
+ err = own_fpu_inatomic(1);
+ if (msa && !err) {
+ enable_msa();
++ /*
++ * with MSA enabled, userspace can see MSACSR
++ * and MSA regs, but the values in them are from
++ * other task before current task, restore them
++ * from saved fp/msa context
++ */
++ write_msa_csr(current->thread.fpu.msacsr);
++ /*
++ * own_fpu_inatomic(1) just restore low 64bit,
++ * fix the high 64bit
++ */
++ init_msa_upper();
+ set_thread_flag(TIF_USEDMSA);
+ set_thread_flag(TIF_MSA_CTX_LIVE);
+ }
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 49569e5666d7a..cb32a00d286e1 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1712,7 +1712,11 @@ static void setup_scache(void)
+ printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n",
+ scache_size >> 10,
+ way_string[c->scache.ways], c->scache.linesz);
++
++ if (current_cpu_type() == CPU_BMIPS5000)
++ c->options |= MIPS_CPU_INCLUSIVE_CACHES;
+ }
++
+ #else
+ if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT))
+ panic("Dunno how to handle MIPS32 / MIPS64 second level cache");
+diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
+index 1493c49ca47a1..55d7b7fd18b6f 100644
+--- a/arch/mips/oprofile/op_model_mipsxx.c
++++ b/arch/mips/oprofile/op_model_mipsxx.c
+@@ -245,7 +245,6 @@ static int mipsxx_perfcount_handler(void)
+
+ switch (counters) {
+ #define HANDLE_COUNTER(n) \
+- fallthrough; \
+ case n + 1: \
+ control = r_c0_perfctrl ## n(); \
+ counter = r_c0_perfcntr ## n(); \
+@@ -256,8 +255,11 @@ static int mipsxx_perfcount_handler(void)
+ handled = IRQ_HANDLED; \
+ }
+ HANDLE_COUNTER(3)
++ fallthrough;
+ HANDLE_COUNTER(2)
++ fallthrough;
+ HANDLE_COUNTER(1)
++ fallthrough;
+ HANDLE_COUNTER(0)
+ }
+
+diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c
+index 0ecffb65fd6d1..b09dc844985a8 100644
+--- a/arch/mips/sni/a20r.c
++++ b/arch/mips/sni/a20r.c
+@@ -222,8 +222,8 @@ void __init sni_a20r_irq_init(void)
+ irq_set_chip_and_handler(i, &a20r_irq_type, handle_level_irq);
+ sni_hwint = a20r_hwint;
+ change_c0_status(ST0_IM, IE_IRQ0);
+- if (request_irq(SNI_A20R_IRQ_BASE + 3, sni_isa_irq_handler, 0, "ISA",
+- NULL))
++ if (request_irq(SNI_A20R_IRQ_BASE + 3, sni_isa_irq_handler,
++ IRQF_SHARED, "ISA", sni_isa_irq_handler))
+ pr_err("Failed to register ISA interrupt\n");
+ }
+
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index 4907a5149a8a3..79e074ffad139 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -30,7 +30,7 @@ config GENERIC_BUG_RELATIVE_POINTERS
+ def_bool y
+
+ config GENERIC_LOCKBREAK
+- def_bool y if PREEMPTTION
++ def_bool y if PREEMPTION
+
+ config PGSTE
+ def_bool y if KVM
+diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
+index 50b4ce8cddfdc..918f0ba4f4d20 100644
+--- a/arch/s390/include/asm/percpu.h
++++ b/arch/s390/include/asm/percpu.h
+@@ -29,7 +29,7 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ old__, new__, prev__; \
+ pcp_op_T__ *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ prev__ = *ptr__; \
+ do { \
+@@ -37,7 +37,7 @@
+ new__ = old__ op (val); \
+ prev__ = cmpxchg(ptr__, old__, new__); \
+ } while (prev__ != old__); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ new__; \
+ })
+
+@@ -68,7 +68,7 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ val__ = (val); \
+ pcp_op_T__ old__, *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ if (__builtin_constant_p(val__) && \
+ ((szcast)val__ > -129) && ((szcast)val__ < 128)) { \
+@@ -84,7 +84,7 @@
+ : [val__] "d" (val__) \
+ : "cc"); \
+ } \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ }
+
+ #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int)
+@@ -95,14 +95,14 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ val__ = (val); \
+ pcp_op_T__ old__, *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ asm volatile( \
+ op " %[old__],%[val__],%[ptr__]\n" \
+ : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \
+ : [val__] "d" (val__) \
+ : "cc"); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ old__ + val__; \
+ })
+
+@@ -114,14 +114,14 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ val__ = (val); \
+ pcp_op_T__ old__, *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ asm volatile( \
+ op " %[old__],%[val__],%[ptr__]\n" \
+ : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \
+ : [val__] "d" (val__) \
+ : "cc"); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ }
+
+ #define this_cpu_and_4(pcp, val) arch_this_cpu_to_op(pcp, val, "lan")
+@@ -136,10 +136,10 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ ret__; \
+ pcp_op_T__ *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ ret__ = cmpxchg(ptr__, oval, nval); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ ret__; \
+ })
+
+@@ -152,10 +152,10 @@
+ ({ \
+ typeof(pcp) *ptr__; \
+ typeof(pcp) ret__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ ret__ = xchg(ptr__, nval); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ ret__; \
+ })
+
+@@ -171,11 +171,11 @@
+ typeof(pcp1) *p1__; \
+ typeof(pcp2) *p2__; \
+ int ret__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ p1__ = raw_cpu_ptr(&(pcp1)); \
+ p2__ = raw_cpu_ptr(&(pcp2)); \
+ ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ ret__; \
+ })
+
+diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
+index f09288431f289..606c4e25ee934 100644
+--- a/arch/x86/entry/common.c
++++ b/arch/x86/entry/common.c
+@@ -55,8 +55,16 @@ static noinstr void check_user_regs(struct pt_regs *regs)
+ * state, not the interrupt state as imagined by Xen.
+ */
+ unsigned long flags = native_save_fl();
+- WARN_ON_ONCE(flags & (X86_EFLAGS_AC | X86_EFLAGS_DF |
+- X86_EFLAGS_NT));
++ unsigned long mask = X86_EFLAGS_DF | X86_EFLAGS_NT;
++
++ /*
++ * For !SMAP hardware we patch out CLAC on entry.
++ */
++ if (boot_cpu_has(X86_FEATURE_SMAP) ||
++ (IS_ENABLED(CONFIG_64_BIT) && boot_cpu_has(X86_FEATURE_XENPV)))
++ mask |= X86_EFLAGS_AC;
++
++ WARN_ON_ONCE(flags & mask);
+
+ /* We think we came from user mode. Make sure pt_regs agrees. */
+ WARN_ON_ONCE(!user_mode(regs));
+diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
+index 255b2dde2c1b7..9675d8b2c6666 100644
+--- a/arch/x86/include/asm/ptrace.h
++++ b/arch/x86/include/asm/ptrace.h
+@@ -322,8 +322,8 @@ static inline unsigned long regs_get_kernel_argument(struct pt_regs *regs,
+ static const unsigned int argument_offs[] = {
+ #ifdef __i386__
+ offsetof(struct pt_regs, ax),
+- offsetof(struct pt_regs, cx),
+ offsetof(struct pt_regs, dx),
++ offsetof(struct pt_regs, cx),
+ #define NR_REG_ARGUMENTS 3
+ #else
+ offsetof(struct pt_regs, di),
+diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
+index 9f69cc497f4b6..0e059b73437b4 100644
+--- a/arch/x86/include/asm/switch_to.h
++++ b/arch/x86/include/asm/switch_to.h
+@@ -12,6 +12,27 @@ struct task_struct *__switch_to_asm(struct task_struct *prev,
+ __visible struct task_struct *__switch_to(struct task_struct *prev,
+ struct task_struct *next);
+
++/* This runs runs on the previous thread's stack. */
++static inline void prepare_switch_to(struct task_struct *next)
++{
++#ifdef CONFIG_VMAP_STACK
++ /*
++ * If we switch to a stack that has a top-level paging entry
++ * that is not present in the current mm, the resulting #PF will
++ * will be promoted to a double-fault and we'll panic. Probe
++ * the new stack now so that vmalloc_fault can fix up the page
++ * tables if needed. This can only happen if we use a stack
++ * in vmap space.
++ *
++ * We assume that the stack is aligned so that it never spans
++ * more than one top-level paging entry.
++ *
++ * To minimize cache pollution, just follow the stack pointer.
++ */
++ READ_ONCE(*(unsigned char *)next->thread.sp);
++#endif
++}
++
+ asmlinkage void ret_from_fork(void);
+
+ /*
+@@ -46,6 +67,8 @@ struct fork_frame {
+
+ #define switch_to(prev, next, last) \
+ do { \
++ prepare_switch_to(next); \
++ \
+ ((last) = __switch_to_asm((prev), (next))); \
+ } while (0)
+
+diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
+index fd945ce78554e..e6d7894ad1279 100644
+--- a/arch/x86/kernel/setup_percpu.c
++++ b/arch/x86/kernel/setup_percpu.c
+@@ -287,9 +287,9 @@ void __init setup_per_cpu_areas(void)
+ /*
+ * Sync back kernel address range again. We already did this in
+ * setup_arch(), but percpu data also needs to be available in
+- * the smpboot asm and arch_sync_kernel_mappings() doesn't sync to
+- * swapper_pg_dir on 32-bit. The per-cpu mappings need to be available
+- * there too.
++ * the smpboot asm. We can't reliably pick up percpu mappings
++ * using vmalloc_fault(), because exception dispatch needs
++ * percpu data.
+ *
+ * FIXME: Can the later sync in setup_cpu_entry_areas() replace
+ * this call?
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index b7cb3e0716f7d..69cc823109740 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -733,20 +733,9 @@ static bool is_sysenter_singlestep(struct pt_regs *regs)
+ #endif
+ }
+
+-static __always_inline void debug_enter(unsigned long *dr6, unsigned long *dr7)
++static __always_inline unsigned long debug_read_clear_dr6(void)
+ {
+- /*
+- * Disable breakpoints during exception handling; recursive exceptions
+- * are exceedingly 'fun'.
+- *
+- * Since this function is NOKPROBE, and that also applies to
+- * HW_BREAKPOINT_X, we can't hit a breakpoint before this (XXX except a
+- * HW_BREAKPOINT_W on our stack)
+- *
+- * Entry text is excluded for HW_BP_X and cpu_entry_area, which
+- * includes the entry stack is excluded for everything.
+- */
+- *dr7 = local_db_save();
++ unsigned long dr6;
+
+ /*
+ * The Intel SDM says:
+@@ -759,15 +748,12 @@ static __always_inline void debug_enter(unsigned long *dr6, unsigned long *dr7)
+ *
+ * Keep it simple: clear DR6 immediately.
+ */
+- get_debugreg(*dr6, 6);
++ get_debugreg(dr6, 6);
+ set_debugreg(0, 6);
+ /* Filter out all the reserved bits which are preset to 1 */
+- *dr6 &= ~DR6_RESERVED;
+-}
++ dr6 &= ~DR6_RESERVED;
+
+-static __always_inline void debug_exit(unsigned long dr7)
+-{
+- local_db_restore(dr7);
++ return dr6;
+ }
+
+ /*
+@@ -867,6 +853,19 @@ out:
+ static __always_inline void exc_debug_kernel(struct pt_regs *regs,
+ unsigned long dr6)
+ {
++ /*
++ * Disable breakpoints during exception handling; recursive exceptions
++ * are exceedingly 'fun'.
++ *
++ * Since this function is NOKPROBE, and that also applies to
++ * HW_BREAKPOINT_X, we can't hit a breakpoint before this (XXX except a
++ * HW_BREAKPOINT_W on our stack)
++ *
++ * Entry text is excluded for HW_BP_X and cpu_entry_area, which
++ * includes the entry stack is excluded for everything.
++ */
++ unsigned long dr7 = local_db_save();
++
+ nmi_enter();
+ instrumentation_begin();
+ trace_hardirqs_off_finish();
+@@ -890,6 +889,8 @@ static __always_inline void exc_debug_kernel(struct pt_regs *regs,
+ trace_hardirqs_on_prepare();
+ instrumentation_end();
+ nmi_exit();
++
++ local_db_restore(dr7);
+ }
+
+ static __always_inline void exc_debug_user(struct pt_regs *regs,
+@@ -901,6 +902,15 @@ static __always_inline void exc_debug_user(struct pt_regs *regs,
+ */
+ WARN_ON_ONCE(!user_mode(regs));
+
++ /*
++ * NB: We can't easily clear DR7 here because
++ * idtentry_exit_to_usermode() can invoke ptrace, schedule, access
++ * user memory, etc. This means that a recursive #DB is possible. If
++ * this happens, that #DB will hit exc_debug_kernel() and clear DR7.
++ * Since we're not on the IST stack right now, everything will be
++ * fine.
++ */
++
+ idtentry_enter_user(regs);
+ instrumentation_begin();
+
+@@ -913,36 +923,24 @@ static __always_inline void exc_debug_user(struct pt_regs *regs,
+ /* IST stack entry */
+ DEFINE_IDTENTRY_DEBUG(exc_debug)
+ {
+- unsigned long dr6, dr7;
+-
+- debug_enter(&dr6, &dr7);
+- exc_debug_kernel(regs, dr6);
+- debug_exit(dr7);
++ exc_debug_kernel(regs, debug_read_clear_dr6());
+ }
+
+ /* User entry, runs on regular task stack */
+ DEFINE_IDTENTRY_DEBUG_USER(exc_debug)
+ {
+- unsigned long dr6, dr7;
+-
+- debug_enter(&dr6, &dr7);
+- exc_debug_user(regs, dr6);
+- debug_exit(dr7);
++ exc_debug_user(regs, debug_read_clear_dr6());
+ }
+ #else
+ /* 32 bit does not have separate entry points. */
+ DEFINE_IDTENTRY_RAW(exc_debug)
+ {
+- unsigned long dr6, dr7;
+-
+- debug_enter(&dr6, &dr7);
++ unsigned long dr6 = debug_read_clear_dr6();
+
+ if (user_mode(regs))
+ exc_debug_user(regs, dr6);
+ else
+ exc_debug_kernel(regs, dr6);
+-
+- debug_exit(dr7);
+ }
+ #endif
+
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 1ead568c01012..370c314b8f44d 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -215,6 +215,44 @@ void arch_sync_kernel_mappings(unsigned long start, unsigned long end)
+ }
+ }
+
++/*
++ * 32-bit:
++ *
++ * Handle a fault on the vmalloc or module mapping area
++ */
++static noinline int vmalloc_fault(unsigned long address)
++{
++ unsigned long pgd_paddr;
++ pmd_t *pmd_k;
++ pte_t *pte_k;
++
++ /* Make sure we are in vmalloc area: */
++ if (!(address >= VMALLOC_START && address < VMALLOC_END))
++ return -1;
++
++ /*
++ * Synchronize this task's top level page-table
++ * with the 'reference' page table.
++ *
++ * Do _not_ use "current" here. We might be inside
++ * an interrupt in the middle of a task switch..
++ */
++ pgd_paddr = read_cr3_pa();
++ pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
++ if (!pmd_k)
++ return -1;
++
++ if (pmd_large(*pmd_k))
++ return 0;
++
++ pte_k = pte_offset_kernel(pmd_k, address);
++ if (!pte_present(*pte_k))
++ return -1;
++
++ return 0;
++}
++NOKPROBE_SYMBOL(vmalloc_fault);
++
+ /*
+ * Did it hit the DOS screen memory VA from vm86 mode?
+ */
+@@ -279,6 +317,79 @@ out:
+
+ #else /* CONFIG_X86_64: */
+
++/*
++ * 64-bit:
++ *
++ * Handle a fault on the vmalloc area
++ */
++static noinline int vmalloc_fault(unsigned long address)
++{
++ pgd_t *pgd, *pgd_k;
++ p4d_t *p4d, *p4d_k;
++ pud_t *pud;
++ pmd_t *pmd;
++ pte_t *pte;
++
++ /* Make sure we are in vmalloc area: */
++ if (!(address >= VMALLOC_START && address < VMALLOC_END))
++ return -1;
++
++ /*
++ * Copy kernel mappings over when needed. This can also
++ * happen within a race in page table update. In the later
++ * case just flush:
++ */
++ pgd = (pgd_t *)__va(read_cr3_pa()) + pgd_index(address);
++ pgd_k = pgd_offset_k(address);
++ if (pgd_none(*pgd_k))
++ return -1;
++
++ if (pgtable_l5_enabled()) {
++ if (pgd_none(*pgd)) {
++ set_pgd(pgd, *pgd_k);
++ arch_flush_lazy_mmu_mode();
++ } else {
++ BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_k));
++ }
++ }
++
++ /* With 4-level paging, copying happens on the p4d level. */
++ p4d = p4d_offset(pgd, address);
++ p4d_k = p4d_offset(pgd_k, address);
++ if (p4d_none(*p4d_k))
++ return -1;
++
++ if (p4d_none(*p4d) && !pgtable_l5_enabled()) {
++ set_p4d(p4d, *p4d_k);
++ arch_flush_lazy_mmu_mode();
++ } else {
++ BUG_ON(p4d_pfn(*p4d) != p4d_pfn(*p4d_k));
++ }
++
++ BUILD_BUG_ON(CONFIG_PGTABLE_LEVELS < 4);
++
++ pud = pud_offset(p4d, address);
++ if (pud_none(*pud))
++ return -1;
++
++ if (pud_large(*pud))
++ return 0;
++
++ pmd = pmd_offset(pud, address);
++ if (pmd_none(*pmd))
++ return -1;
++
++ if (pmd_large(*pmd))
++ return 0;
++
++ pte = pte_offset_kernel(pmd, address);
++ if (!pte_present(*pte))
++ return -1;
++
++ return 0;
++}
++NOKPROBE_SYMBOL(vmalloc_fault);
++
+ #ifdef CONFIG_CPU_SUP_AMD
+ static const char errata93_warning[] =
+ KERN_ERR
+@@ -1111,6 +1222,29 @@ do_kern_addr_fault(struct pt_regs *regs, unsigned long hw_error_code,
+ */
+ WARN_ON_ONCE(hw_error_code & X86_PF_PK);
+
++ /*
++ * We can fault-in kernel-space virtual memory on-demand. The
++ * 'reference' page table is init_mm.pgd.
++ *
++ * NOTE! We MUST NOT take any locks for this case. We may
++ * be in an interrupt or a critical region, and should
++ * only copy the information from the master page table,
++ * nothing more.
++ *
++ * Before doing this on-demand faulting, ensure that the
++ * fault is not any of the following:
++ * 1. A fault on a PTE with a reserved bit set.
++ * 2. A fault caused by a user-mode access. (Do not demand-
++ * fault kernel memory due to user-mode accesses).
++ * 3. A fault caused by a page-level protection violation.
++ * (A demand fault would be on a non-present page which
++ * would have X86_PF_PROT==0).
++ */
++ if (!(hw_error_code & (X86_PF_RSVD | X86_PF_USER | X86_PF_PROT))) {
++ if (vmalloc_fault(address) >= 0)
++ return;
++ }
++
+ /* Was the fault spurious, caused by lazy TLB invalidation? */
+ if (spurious_kernel_fault(hw_error_code, address))
+ return;
+diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
+index c5174b4e318b4..683cd12f47938 100644
+--- a/arch/x86/mm/numa_emulation.c
++++ b/arch/x86/mm/numa_emulation.c
+@@ -321,7 +321,7 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
+ u64 addr, u64 max_addr, u64 size)
+ {
+ return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size,
+- 0, NULL, NUMA_NO_NODE);
++ 0, NULL, 0);
+ }
+
+ static int __init setup_emu2phys_nid(int *dfl_phys_nid)
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index a8a924b3c3358..0b0d1cdce2e73 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -447,7 +447,13 @@ static void __init pti_clone_user_shared(void)
+ * the sp1 and sp2 slots.
+ *
+ * This is done for all possible CPUs during boot to ensure
+- * that it's propagated to all mms.
++ * that it's propagated to all mms. If we were to add one of
++ * these mappings during CPU hotplug, we would need to take
++ * some measure to make sure that every mm that subsequently
++ * ran on that CPU would have the relevant PGD entry in its
++ * pagetables. The usual vmalloc_fault() mechanism would not
++ * work for page faults taken in entry_SYSCALL_64 before RSP
++ * is set up.
+ */
+
+ unsigned long va = (unsigned long)&per_cpu(cpu_tss_rw, cpu);
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 1a3569b43aa5b..cf81902e6992f 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -317,6 +317,34 @@ void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ local_irq_restore(flags);
+ }
+
++static void sync_current_stack_to_mm(struct mm_struct *mm)
++{
++ unsigned long sp = current_stack_pointer;
++ pgd_t *pgd = pgd_offset(mm, sp);
++
++ if (pgtable_l5_enabled()) {
++ if (unlikely(pgd_none(*pgd))) {
++ pgd_t *pgd_ref = pgd_offset_k(sp);
++
++ set_pgd(pgd, *pgd_ref);
++ }
++ } else {
++ /*
++ * "pgd" is faked. The top level entries are "p4d"s, so sync
++ * the p4d. This compiles to approximately the same code as
++ * the 5-level case.
++ */
++ p4d_t *p4d = p4d_offset(pgd, sp);
++
++ if (unlikely(p4d_none(*p4d))) {
++ pgd_t *pgd_ref = pgd_offset_k(sp);
++ p4d_t *p4d_ref = p4d_offset(pgd_ref, sp);
++
++ set_p4d(p4d, *p4d_ref);
++ }
++ }
++}
++
+ static inline unsigned long mm_mangle_tif_spec_ib(struct task_struct *next)
+ {
+ unsigned long next_tif = task_thread_info(next)->flags;
+@@ -525,6 +553,15 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ */
+ cond_ibpb(tsk);
+
++ if (IS_ENABLED(CONFIG_VMAP_STACK)) {
++ /*
++ * If our current stack is in vmalloc space and isn't
++ * mapped in the new pgd, we'll double-fault. Forcibly
++ * map it.
++ */
++ sync_current_stack_to_mm(next);
++ }
++
+ /*
+ * Stop remote flushes for the previous mm.
+ * Skip kernel threads; we never send init_mm TLB flushing IPIs,
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 03252af8c82c8..619a3dcd3f5e7 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -526,6 +526,7 @@ struct request_queue *__blk_alloc_queue(int node_id)
+ goto fail_stats;
+
+ q->backing_dev_info->ra_pages = VM_READAHEAD_PAGES;
++ q->backing_dev_info->io_pages = VM_READAHEAD_PAGES;
+ q->backing_dev_info->capabilities = BDI_CAP_CGROUP_WRITEBACK;
+ q->node = node_id;
+
+diff --git a/block/blk-iocost.c b/block/blk-iocost.c
+index 86ba6fd254e1d..27c05e3caf75a 100644
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -2094,14 +2094,15 @@ static void ioc_pd_free(struct blkg_policy_data *pd)
+ {
+ struct ioc_gq *iocg = pd_to_iocg(pd);
+ struct ioc *ioc = iocg->ioc;
++ unsigned long flags;
+
+ if (ioc) {
+- spin_lock(&ioc->lock);
++ spin_lock_irqsave(&ioc->lock, flags);
+ if (!list_empty(&iocg->active_list)) {
+ propagate_active_weight(iocg, 0, 0);
+ list_del_init(&iocg->active_list);
+ }
+- spin_unlock(&ioc->lock);
++ spin_unlock_irqrestore(&ioc->lock, flags);
+
+ hrtimer_cancel(&iocg->waitq_timer);
+ hrtimer_cancel(&iocg->delay_timer);
+diff --git a/block/blk-stat.c b/block/blk-stat.c
+index 7da302ff88d0d..ae3dd1fb8e61d 100644
+--- a/block/blk-stat.c
++++ b/block/blk-stat.c
+@@ -137,6 +137,7 @@ void blk_stat_add_callback(struct request_queue *q,
+ struct blk_stat_callback *cb)
+ {
+ unsigned int bucket;
++ unsigned long flags;
+ int cpu;
+
+ for_each_possible_cpu(cpu) {
+@@ -147,20 +148,22 @@ void blk_stat_add_callback(struct request_queue *q,
+ blk_rq_stat_init(&cpu_stat[bucket]);
+ }
+
+- spin_lock(&q->stats->lock);
++ spin_lock_irqsave(&q->stats->lock, flags);
+ list_add_tail_rcu(&cb->list, &q->stats->callbacks);
+ blk_queue_flag_set(QUEUE_FLAG_STATS, q);
+- spin_unlock(&q->stats->lock);
++ spin_unlock_irqrestore(&q->stats->lock, flags);
+ }
+
+ void blk_stat_remove_callback(struct request_queue *q,
+ struct blk_stat_callback *cb)
+ {
+- spin_lock(&q->stats->lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&q->stats->lock, flags);
+ list_del_rcu(&cb->list);
+ if (list_empty(&q->stats->callbacks) && !q->stats->enable_accounting)
+ blk_queue_flag_clear(QUEUE_FLAG_STATS, q);
+- spin_unlock(&q->stats->lock);
++ spin_unlock_irqrestore(&q->stats->lock, flags);
+
+ del_timer_sync(&cb->timer);
+ }
+@@ -183,10 +186,12 @@ void blk_stat_free_callback(struct blk_stat_callback *cb)
+
+ void blk_stat_enable_accounting(struct request_queue *q)
+ {
+- spin_lock(&q->stats->lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&q->stats->lock, flags);
+ q->stats->enable_accounting = true;
+ blk_queue_flag_set(QUEUE_FLAG_STATS, q);
+- spin_unlock(&q->stats->lock);
++ spin_unlock_irqrestore(&q->stats->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(blk_stat_enable_accounting);
+
+diff --git a/block/partitions/core.c b/block/partitions/core.c
+index 78951e33b2d7c..534e11285a8d4 100644
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -524,19 +524,20 @@ int bdev_add_partition(struct block_device *bdev, int partno,
+ int bdev_del_partition(struct block_device *bdev, int partno)
+ {
+ struct block_device *bdevp;
+- struct hd_struct *part;
+- int ret = 0;
+-
+- part = disk_get_part(bdev->bd_disk, partno);
+- if (!part)
+- return -ENXIO;
++ struct hd_struct *part = NULL;
++ int ret;
+
+- ret = -ENOMEM;
+- bdevp = bdget(part_devt(part));
++ bdevp = bdget_disk(bdev->bd_disk, partno);
+ if (!bdevp)
+- goto out_put_part;
++ return -ENOMEM;
+
+ mutex_lock(&bdevp->bd_mutex);
++ mutex_lock_nested(&bdev->bd_mutex, 1);
++
++ ret = -ENXIO;
++ part = disk_get_part(bdev->bd_disk, partno);
++ if (!part)
++ goto out_unlock;
+
+ ret = -EBUSY;
+ if (bdevp->bd_openers)
+@@ -545,16 +546,14 @@ int bdev_del_partition(struct block_device *bdev, int partno)
+ sync_blockdev(bdevp);
+ invalidate_bdev(bdevp);
+
+- mutex_lock_nested(&bdev->bd_mutex, 1);
+ delete_partition(bdev->bd_disk, part);
+- mutex_unlock(&bdev->bd_mutex);
+-
+ ret = 0;
+ out_unlock:
++ mutex_unlock(&bdev->bd_mutex);
+ mutex_unlock(&bdevp->bd_mutex);
+ bdput(bdevp);
+-out_put_part:
+- disk_put_part(part);
++ if (part)
++ disk_put_part(part);
+ return ret;
+ }
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b1cd4d97bc2a7..1be73d29119ab 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3868,9 +3868,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
+ { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, },
+
+- /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on
+- SD7SN6S256G and SD8SN8U256G */
+- { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, },
++ /* Sandisk SD7/8/9s lock up hard on large trims */
++ { "SanDisk SD[789]*", NULL, ATA_HORKAGE_MAX_TRIM_128M, },
+
+ /* devices which puke on READ_NATIVE_MAX */
+ { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 46336084b1a90..cc7bedafb3923 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2080,6 +2080,7 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf)
+
+ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf)
+ {
++ struct ata_device *dev = args->dev;
+ u16 min_io_sectors;
+
+ rbuf[1] = 0xb0;
+@@ -2105,7 +2106,12 @@ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf)
+ * with the unmap bit set.
+ */
+ if (ata_id_has_trim(args->id)) {
+- put_unaligned_be64(65535 * ATA_MAX_TRIM_RNUM, &rbuf[36]);
++ u64 max_blocks = 65535 * ATA_MAX_TRIM_RNUM;
++
++ if (dev->horkage & ATA_HORKAGE_MAX_TRIM_128M)
++ max_blocks = 128 << (20 - SECTOR_SHIFT);
++
++ put_unaligned_be64(max_blocks, &rbuf[36]);
+ put_unaligned_be32(1, &rbuf[28]);
+ }
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index ce7e9f223b20b..bc9dc1f847e19 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1360,6 +1360,8 @@ static void nbd_set_cmd_timeout(struct nbd_device *nbd, u64 timeout)
+ nbd->tag_set.timeout = timeout * HZ;
+ if (timeout)
+ blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ);
++ else
++ blk_queue_rq_timeout(nbd->disk->queue, 30 * HZ);
+ }
+
+ /* Must be called with config_lock held */
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 87197319ab069..2fe4f3cdf54d7 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -153,7 +153,8 @@ static void enter_s2idle_proper(struct cpuidle_driver *drv,
+ */
+ stop_critical_timings();
+ drv->states[index].enter_s2idle(dev, drv, index);
+- WARN_ON(!irqs_disabled());
++ if (WARN_ON_ONCE(!irqs_disabled()))
++ local_irq_disable();
+ /*
+ * timekeeping_resume() that will be called by tick_unfreeze() for the
+ * first CPU executing it calls functions containing RCU read-side
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index 73a20780744bf..626819b33a325 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1650,13 +1650,17 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ dmac_pdev = of_find_device_by_node(dma_spec->np);
++ if (!dmac_pdev)
++ return NULL;
+
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+
+ atslave = kmalloc(sizeof(*atslave), GFP_KERNEL);
+- if (!atslave)
++ if (!atslave) {
++ put_device(&dmac_pdev->dev);
+ return NULL;
++ }
+
+ atslave->cfg = ATC_DST_H2SEL_HW | ATC_SRC_H2SEL_HW;
+ /*
+@@ -1685,8 +1689,11 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ atslave->dma_dev = &dmac_pdev->dev;
+
+ chan = dma_request_channel(mask, at_dma_filter, atslave);
+- if (!chan)
++ if (!chan) {
++ put_device(&dmac_pdev->dev);
++ kfree(atslave);
+ return NULL;
++ }
+
+ atchan = to_at_dma_chan(chan);
+ atchan->per_if = dma_spec->args[0] & 0xff;
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index ed430ad9b3dd8..b971505b87152 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -405,7 +405,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
+ if (xfer->cyclic) {
+ burst->dar = xfer->xfer.cyclic.paddr;
+ } else {
+- burst->dar = sg_dma_address(sg);
++ burst->dar = dst_addr;
+ /* Unlike the typical assumption by other
+ * drivers/IPs the peripheral memory isn't
+ * a FIFO memory, in this case, it's a
+@@ -413,14 +413,13 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
+ * and destination addresses are increased
+ * by the same portion (data length)
+ */
+- src_addr += sg_dma_len(sg);
+ }
+ } else {
+ burst->dar = dst_addr;
+ if (xfer->cyclic) {
+ burst->sar = xfer->xfer.cyclic.paddr;
+ } else {
+- burst->sar = sg_dma_address(sg);
++ burst->sar = src_addr;
+ /* Unlike the typical assumption by other
+ * drivers/IPs the peripheral memory isn't
+ * a FIFO memory, in this case, it's a
+@@ -428,12 +427,14 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
+ * and destination addresses are increased
+ * by the same portion (data length)
+ */
+- dst_addr += sg_dma_len(sg);
+ }
+ }
+
+- if (!xfer->cyclic)
++ if (!xfer->cyclic) {
++ src_addr += sg_dma_len(sg);
++ dst_addr += sg_dma_len(sg);
+ sg = sg_next(sg);
++ }
+ }
+
+ return vchan_tx_prep(&chan->vc, &desc->vd, xfer->flags);
+diff --git a/drivers/dma/fsldma.h b/drivers/dma/fsldma.h
+index 56f18ae992332..308bed0a560ac 100644
+--- a/drivers/dma/fsldma.h
++++ b/drivers/dma/fsldma.h
+@@ -205,10 +205,10 @@ struct fsldma_chan {
+ #else
+ static u64 fsl_ioread64(const u64 __iomem *addr)
+ {
+- u32 fsl_addr = lower_32_bits(addr);
+- u64 fsl_addr_hi = (u64)in_le32((u32 *)(fsl_addr + 1)) << 32;
++ u32 val_lo = in_le32((u32 __iomem *)addr);
++ u32 val_hi = in_le32((u32 __iomem *)addr + 1);
+
+- return fsl_addr_hi | in_le32((u32 *)fsl_addr);
++ return ((u64)val_hi << 32) + val_lo;
+ }
+
+ static void fsl_iowrite64(u64 val, u64 __iomem *addr)
+@@ -219,10 +219,10 @@ static void fsl_iowrite64(u64 val, u64 __iomem *addr)
+
+ static u64 fsl_ioread64be(const u64 __iomem *addr)
+ {
+- u32 fsl_addr = lower_32_bits(addr);
+- u64 fsl_addr_hi = (u64)in_be32((u32 *)fsl_addr) << 32;
++ u32 val_hi = in_be32((u32 __iomem *)addr);
++ u32 val_lo = in_be32((u32 __iomem *)addr + 1);
+
+- return fsl_addr_hi | in_be32((u32 *)(fsl_addr + 1));
++ return ((u64)val_hi << 32) + val_lo;
+ }
+
+ static void fsl_iowrite64be(u64 val, u64 __iomem *addr)
+diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
+index b2c2b5e8093cf..0db816eb8080d 100644
+--- a/drivers/dma/of-dma.c
++++ b/drivers/dma/of-dma.c
+@@ -71,12 +71,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
+- if (chan) {
+- chan->router = ofdma->dma_router;
+- chan->route_data = route_data;
+- } else {
++ if (IS_ERR_OR_NULL(chan)) {
+ ofdma->dma_router->route_free(ofdma->dma_router->dev,
+ route_data);
++ } else {
++ chan->router = ofdma->dma_router;
++ chan->route_data = route_data;
+ }
+
+ /*
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 88b884cbb7c1b..9d8a235a5b884 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2788,6 +2788,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ while (burst != (1 << desc->rqcfg.brst_size))
+ desc->rqcfg.brst_size++;
+
++ desc->rqcfg.brst_len = get_burst_len(desc, len);
+ /*
+ * If burst size is smaller than bus width then make sure we only
+ * transfer one at a time to avoid a burst stradling an MFIFO entry.
+@@ -2795,7 +2796,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+ desc->rqcfg.brst_len = 1;
+
+- desc->rqcfg.brst_len = get_burst_len(desc, len);
+ desc->bytes_requested = len;
+
+ desc->txd.flags = flags;
+diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
+index 6c879a7343604..3e488d963f246 100644
+--- a/drivers/dma/ti/k3-udma.c
++++ b/drivers/dma/ti/k3-udma.c
+@@ -2109,9 +2109,9 @@ udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl,
+ return NULL;
+ }
+
+- cppi5_tr_init(&tr_req[i].flags, CPPI5_TR_TYPE1, false, false,
+- CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
+- cppi5_tr_csf_set(&tr_req[i].flags, CPPI5_TR_CSF_SUPR_EVT);
++ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false,
++ false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0);
++ cppi5_tr_csf_set(&tr_req[tr_idx].flags, CPPI5_TR_CSF_SUPR_EVT);
+
+ tr_req[tr_idx].addr = sg_addr;
+ tr_req[tr_idx].icnt0 = tr0_cnt0;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 666ebe04837af..3f7eced92c0c8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2822,12 +2822,18 @@ static int amdgpu_dm_mode_config_init(struct amdgpu_device *adev)
+ &dm_atomic_state_funcs);
+
+ r = amdgpu_display_modeset_create_props(adev);
+- if (r)
++ if (r) {
++ dc_release_state(state->context);
++ kfree(state);
+ return r;
++ }
+
+ r = amdgpu_dm_audio_init(adev);
+- if (r)
++ if (r) {
++ dc_release_state(state->context);
++ kfree(state);
+ return r;
++ }
+
+ return 0;
+ }
+@@ -2844,6 +2850,8 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm)
+ #if defined(CONFIG_ACPI)
+ struct amdgpu_dm_backlight_caps caps;
+
++ memset(&caps, 0, sizeof(caps));
++
+ if (dm->backlight_caps.caps_valid)
+ return;
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index e5ecc5affa1eb..5098fc98cc255 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -67,7 +67,7 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
+ result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload,
+ &operation_result);
+
+- if (payload.write)
++ if (payload.write && result >= 0)
+ result = msg->size;
+
+ if (result < 0)
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 31aa31c280ee6..885beb0bcc199 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -767,6 +767,7 @@ static bool detect_dp(struct dc_link *link,
+ sink_caps->signal = dp_passive_dongle_detection(link->ddc,
+ sink_caps,
+ audio_support);
++ link->dpcd_caps.dongle_type = sink_caps->dongle_type;
+ }
+
+ return true;
+@@ -3265,10 +3266,10 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx)
+ core_link_set_avmute(pipe_ctx, true);
+ }
+
+- dc->hwss.blank_stream(pipe_ctx);
+ #if defined(CONFIG_DRM_AMD_DC_HDCP)
+ update_psp_stream_config(pipe_ctx, true);
+ #endif
++ dc->hwss.blank_stream(pipe_ctx);
+
+ if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+ deallocate_mst_payload(pipe_ctx);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index 91cd884d6f257..7728fd71d1f3a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -4346,9 +4346,9 @@ bool dc_link_get_backlight_level_nits(struct dc_link *link,
+ link->connector_signal != SIGNAL_TYPE_DISPLAY_PORT))
+ return false;
+
+- if (!core_link_read_dpcd(link, DP_SOURCE_BACKLIGHT_CURRENT_PEAK,
++ if (core_link_read_dpcd(link, DP_SOURCE_BACKLIGHT_CURRENT_PEAK,
+ dpcd_backlight_get.raw,
+- sizeof(union dpcd_source_backlight_get)))
++ sizeof(union dpcd_source_backlight_get)) != DC_OK)
+ return false;
+
+ *backlight_millinits_avg =
+@@ -4387,9 +4387,9 @@ bool dc_link_read_default_bl_aux(struct dc_link *link, uint32_t *backlight_milli
+ link->connector_signal != SIGNAL_TYPE_DISPLAY_PORT))
+ return false;
+
+- if (!core_link_read_dpcd(link, DP_SOURCE_BACKLIGHT_LEVEL,
++ if (core_link_read_dpcd(link, DP_SOURCE_BACKLIGHT_LEVEL,
+ (uint8_t *) backlight_millinits,
+- sizeof(uint32_t)))
++ sizeof(uint32_t)) != DC_OK)
+ return false;
+
+ return true;
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+index 49aad691e687e..ccac2315a903a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+@@ -222,7 +222,7 @@ struct dc_stream_state {
+ union stream_update_flags update_flags;
+ };
+
+-#define ABM_LEVEL_IMMEDIATE_DISABLE 0xFFFFFFFF
++#define ABM_LEVEL_IMMEDIATE_DISABLE 255
+
+ struct dc_stream_update {
+ struct dc_stream_state *stream;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+index 17d5cb422025e..8939541ad7afc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+@@ -1213,6 +1213,7 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont
+ bool video_large = false;
+ bool desktop_large = false;
+ bool dcc_disabled = false;
++ bool mpo_enabled = false;
+
+ for (i = 0; i < context->stream_count; i++) {
+ if (context->stream_status[i].plane_count == 0)
+@@ -1221,6 +1222,9 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont
+ if (context->stream_status[i].plane_count > 2)
+ return DC_FAIL_UNSUPPORTED_1;
+
++ if (context->stream_status[i].plane_count > 1)
++ mpo_enabled = true;
++
+ for (j = 0; j < context->stream_status[i].plane_count; j++) {
+ struct dc_plane_state *plane =
+ context->stream_status[i].plane_states[j];
+@@ -1244,6 +1248,10 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont
+ }
+ }
+
++ /* Disable MPO in multi-display configurations. */
++ if (context->stream_count > 1 && mpo_enabled)
++ return DC_FAIL_UNSUPPORTED_1;
++
+ /*
+ * Workaround: On DCN10 there is UMC issue that causes underflow when
+ * playing 4k video on 4k desktop with video downscaled and single channel
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+index eff87c8968380..0e7ae58180347 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+@@ -374,8 +374,18 @@ static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
+ /* compare them in unit celsius degree */
+ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)
+ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+- if (high > tdp_table->usSoftwareShutdownTemp)
+- high = tdp_table->usSoftwareShutdownTemp;
++
++ /*
++ * As a common sense, usSoftwareShutdownTemp should be bigger
++ * than ThotspotLimit. For any invalid usSoftwareShutdownTemp,
++ * we will just use the max possible setting VEGA10_THERMAL_MAXIMUM_ALERT_TEMP
++ * to avoid false alarms.
++ */
++ if ((tdp_table->usSoftwareShutdownTemp >
++ range->hotspot_crit_max / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)) {
++ if (high > tdp_table->usSoftwareShutdownTemp)
++ high = tdp_table->usSoftwareShutdownTemp;
++ }
+
+ if (low > high)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index ad54f4500af1f..63016c14b9428 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -37,6 +37,7 @@
+ #include "cgs_common.h"
+ #include "atombios.h"
+ #include "pppcielanes.h"
++#include "smu7_smumgr.h"
+
+ #include "smu/smu_7_0_1_d.h"
+ #include "smu/smu_7_0_1_sh_mask.h"
+@@ -2948,6 +2949,7 @@ const struct pp_smumgr_func ci_smu_funcs = {
+ .request_smu_load_specific_fw = NULL,
+ .send_msg_to_smc = ci_send_msg_to_smc,
+ .send_msg_to_smc_with_parameter = ci_send_msg_to_smc_with_parameter,
++ .get_argument = smu7_get_argument,
+ .download_pptable_settings = NULL,
+ .upload_pptable_settings = NULL,
+ .get_offsetof = ci_get_offsetof,
+diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c
+index 2cbc4619b4ce6..525658fd201fd 100644
+--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
+@@ -336,8 +336,10 @@ int intel_hdcp_validate_v_prime(struct intel_connector *connector,
+
+ /* Fill up the empty slots in sha_text and write it out */
+ sha_empty = sizeof(sha_text) - sha_leftovers;
+- for (j = 0; j < sha_empty; j++)
+- sha_text |= ksv[j] << ((sizeof(sha_text) - j - 1) * 8);
++ for (j = 0; j < sha_empty; j++) {
++ u8 off = ((sizeof(sha_text) - j - 1 - sha_leftovers) * 8);
++ sha_text |= ksv[j] << off;
++ }
+
+ ret = intel_write_sha_text(dev_priv, sha_text);
+ if (ret < 0)
+@@ -435,7 +437,7 @@ int intel_hdcp_validate_v_prime(struct intel_connector *connector,
+ /* Write 32 bits of text */
+ intel_de_write(dev_priv, HDCP_REP_CTL,
+ rep_ctl | HDCP_SHA1_TEXT_32);
+- sha_text |= bstatus[0] << 24 | bstatus[1] << 16;
++ sha_text |= bstatus[0] << 8 | bstatus[1];
+ ret = intel_write_sha_text(dev_priv, sha_text);
+ if (ret < 0)
+ return ret;
+@@ -450,17 +452,29 @@ int intel_hdcp_validate_v_prime(struct intel_connector *connector,
+ return ret;
+ sha_idx += sizeof(sha_text);
+ }
++
++ /*
++ * Terminate the SHA-1 stream by hand. For the other leftover
++ * cases this is appended by the hardware.
++ */
++ intel_de_write(dev_priv, HDCP_REP_CTL,
++ rep_ctl | HDCP_SHA1_TEXT_32);
++ sha_text = DRM_HDCP_SHA1_TERMINATOR << 24;
++ ret = intel_write_sha_text(dev_priv, sha_text);
++ if (ret < 0)
++ return ret;
++ sha_idx += sizeof(sha_text);
+ } else if (sha_leftovers == 3) {
+- /* Write 32 bits of text */
++ /* Write 32 bits of text (filled from LSB) */
+ intel_de_write(dev_priv, HDCP_REP_CTL,
+ rep_ctl | HDCP_SHA1_TEXT_32);
+- sha_text |= bstatus[0] << 24;
++ sha_text |= bstatus[0];
+ ret = intel_write_sha_text(dev_priv, sha_text);
+ if (ret < 0)
+ return ret;
+ sha_idx += sizeof(sha_text);
+
+- /* Write 8 bits of text, 24 bits of M0 */
++ /* Write 8 bits of text (filled from LSB), 24 bits of M0 */
+ intel_de_write(dev_priv, HDCP_REP_CTL,
+ rep_ctl | HDCP_SHA1_TEXT_8);
+ ret = intel_write_sha_text(dev_priv, bstatus[1]);
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index 1d330204c465c..2dd1cf1ffbe25 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -207,6 +207,16 @@ static int a6xx_gmu_start(struct a6xx_gmu *gmu)
+ {
+ int ret;
+ u32 val;
++ u32 mask, reset_val;
++
++ val = gmu_read(gmu, REG_A6XX_GMU_CM3_DTCM_START + 0xff8);
++ if (val <= 0x20010004) {
++ mask = 0xffffffff;
++ reset_val = 0xbabeface;
++ } else {
++ mask = 0x1ff;
++ reset_val = 0x100;
++ }
+
+ gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1);
+
+@@ -218,7 +228,7 @@ static int a6xx_gmu_start(struct a6xx_gmu *gmu)
+ gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 0);
+
+ ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_CM3_FW_INIT_RESULT, val,
+- val == 0xbabeface, 100, 10000);
++ (val & mask) == reset_val, 100, 10000);
+
+ if (ret)
+ DRM_DEV_ERROR(gmu->dev, "GMU firmware initialization timed out\n");
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 969d95aa873c4..1026e1e5bec10 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -827,7 +827,7 @@ static void dpu_crtc_enable(struct drm_crtc *crtc,
+ {
+ struct dpu_crtc *dpu_crtc;
+ struct drm_encoder *encoder;
+- bool request_bandwidth;
++ bool request_bandwidth = false;
+
+ if (!crtc) {
+ DPU_ERROR("invalid crtc\n");
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 0946a86b37b28..c0cd936314e66 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -586,7 +586,10 @@ static int dpu_encoder_virt_atomic_check(
+ dpu_kms = to_dpu_kms(priv->kms);
+ mode = &crtc_state->mode;
+ adj_mode = &crtc_state->adjusted_mode;
+- global_state = dpu_kms_get_existing_global_state(dpu_kms);
++ global_state = dpu_kms_get_global_state(crtc_state->state);
++ if (IS_ERR(global_state))
++ return PTR_ERR(global_state);
++
+ trace_dpu_enc_atomic_check(DRMID(drm_enc));
+
+ /*
+@@ -621,12 +624,15 @@ static int dpu_encoder_virt_atomic_check(
+ /* Reserve dynamic resources now. */
+ if (!ret) {
+ /*
+- * Avoid reserving resources when mode set is pending. Topology
+- * info may not be available to complete reservation.
++ * Release and Allocate resources on every modeset
++ * Dont allocate when active is false.
+ */
+ if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+- ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
+- drm_enc, crtc_state, topology);
++ dpu_rm_release(global_state, drm_enc);
++
++ if (!crtc_state->active_changed || crtc_state->active)
++ ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
++ drm_enc, crtc_state, topology);
+ }
+ }
+
+@@ -1175,7 +1181,6 @@ static void dpu_encoder_virt_disable(struct drm_encoder *drm_enc)
+ struct dpu_encoder_virt *dpu_enc = NULL;
+ struct msm_drm_private *priv;
+ struct dpu_kms *dpu_kms;
+- struct dpu_global_state *global_state;
+ int i = 0;
+
+ if (!drm_enc) {
+@@ -1194,7 +1199,6 @@ static void dpu_encoder_virt_disable(struct drm_encoder *drm_enc)
+
+ priv = drm_enc->dev->dev_private;
+ dpu_kms = to_dpu_kms(priv->kms);
+- global_state = dpu_kms_get_existing_global_state(dpu_kms);
+
+ trace_dpu_enc_disable(DRMID(drm_enc));
+
+@@ -1224,8 +1228,6 @@ static void dpu_encoder_virt_disable(struct drm_encoder *drm_enc)
+
+ DPU_DEBUG_ENC(dpu_enc, "encoder disabled\n");
+
+- dpu_rm_release(global_state, drm_enc);
+-
+ mutex_unlock(&dpu_enc->enc_lock);
+ }
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index 3b9c33e694bf4..994d23bad3870 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -866,9 +866,9 @@ static int dpu_plane_atomic_check(struct drm_plane *plane,
+ crtc_state = drm_atomic_get_new_crtc_state(state->state,
+ state->crtc);
+
+- min_scale = FRAC_16_16(1, pdpu->pipe_sblk->maxdwnscale);
++ min_scale = FRAC_16_16(1, pdpu->pipe_sblk->maxupscale);
+ ret = drm_atomic_helper_check_plane_state(state, crtc_state, min_scale,
+- pdpu->pipe_sblk->maxupscale << 16,
++ pdpu->pipe_sblk->maxdwnscale << 16,
+ true, true);
+ if (ret) {
+ DPU_DEBUG_PLANE(pdpu, "Check plane state failed (%d)\n", ret);
+diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
+index 5ccfad794c6a5..561bfa48841c3 100644
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -27,6 +27,34 @@ int msm_atomic_prepare_fb(struct drm_plane *plane,
+ return msm_framebuffer_prepare(new_state->fb, kms->aspace);
+ }
+
++/*
++ * Helpers to control vblanks while we flush.. basically just to ensure
++ * that vblank accounting is switched on, so we get valid seqn/timestamp
++ * on pageflip events (if requested)
++ */
++
++static void vblank_get(struct msm_kms *kms, unsigned crtc_mask)
++{
++ struct drm_crtc *crtc;
++
++ for_each_crtc_mask(kms->dev, crtc, crtc_mask) {
++ if (!crtc->state->active)
++ continue;
++ drm_crtc_vblank_get(crtc);
++ }
++}
++
++static void vblank_put(struct msm_kms *kms, unsigned crtc_mask)
++{
++ struct drm_crtc *crtc;
++
++ for_each_crtc_mask(kms->dev, crtc, crtc_mask) {
++ if (!crtc->state->active)
++ continue;
++ drm_crtc_vblank_put(crtc);
++ }
++}
++
+ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
+ {
+ unsigned crtc_mask = BIT(crtc_idx);
+@@ -44,6 +72,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
+
+ kms->funcs->enable_commit(kms);
+
++ vblank_get(kms, crtc_mask);
++
+ /*
+ * Flush hardware updates:
+ */
+@@ -58,6 +88,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
+ kms->funcs->wait_flush(kms, crtc_mask);
+ trace_msm_atomic_wait_flush_finish(crtc_mask);
+
++ vblank_put(kms, crtc_mask);
++
+ mutex_lock(&kms->commit_lock);
+ kms->funcs->complete_commit(kms, crtc_mask);
+ mutex_unlock(&kms->commit_lock);
+@@ -221,6 +253,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
+ */
+ kms->pending_crtc_mask &= ~crtc_mask;
+
++ vblank_get(kms, crtc_mask);
++
+ /*
+ * Flush hardware updates:
+ */
+@@ -235,6 +269,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
+ kms->funcs->wait_flush(kms, crtc_mask);
+ trace_msm_atomic_wait_flush_finish(crtc_mask);
+
++ vblank_put(kms, crtc_mask);
++
+ mutex_lock(&kms->commit_lock);
+ kms->funcs->complete_commit(kms, crtc_mask);
+ mutex_unlock(&kms->commit_lock);
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index f6ce40bf36998..b4d61af7a104e 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1328,6 +1328,13 @@ static int msm_pdev_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void msm_pdev_shutdown(struct platform_device *pdev)
++{
++ struct drm_device *drm = platform_get_drvdata(pdev);
++
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static const struct of_device_id dt_match[] = {
+ { .compatible = "qcom,mdp4", .data = (void *)KMS_MDP4 },
+ { .compatible = "qcom,mdss", .data = (void *)KMS_MDP5 },
+@@ -1340,6 +1347,7 @@ MODULE_DEVICE_TABLE(of, dt_match);
+ static struct platform_driver msm_platform_driver = {
+ .probe = msm_pdev_probe,
+ .remove = msm_pdev_remove,
++ .shutdown = msm_pdev_shutdown,
+ .driver = {
+ .name = "msm",
+ .of_match_table = dt_match,
+diff --git a/drivers/gpu/drm/omapdrm/omap_crtc.c b/drivers/gpu/drm/omapdrm/omap_crtc.c
+index 6d40914675dad..328a4a74f534e 100644
+--- a/drivers/gpu/drm/omapdrm/omap_crtc.c
++++ b/drivers/gpu/drm/omapdrm/omap_crtc.c
+@@ -451,11 +451,12 @@ static void omap_crtc_atomic_enable(struct drm_crtc *crtc,
+ if (omap_state->manually_updated)
+ return;
+
+- spin_lock_irq(&crtc->dev->event_lock);
+ drm_crtc_vblank_on(crtc);
++
+ ret = drm_crtc_vblank_get(crtc);
+ WARN_ON(ret != 0);
+
++ spin_lock_irq(&crtc->dev->event_lock);
+ omap_crtc_arm_event(crtc);
+ spin_unlock_irq(&crtc->dev->event_lock);
+ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 7cfa9785bfbb0..6ea3619842d8d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -727,6 +727,9 @@
+ #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067
+ #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085
+ #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d
++#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
++#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e
++#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093 0x6093
+
+ #define USB_VENDOR_ID_LG 0x1fd2
+ #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index c242150d35a3a..a65aef6a322fb 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -105,6 +105,9 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M406XE), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS), HID_QUIRK_NOGET },
+diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
+index 92ee0fe4c919e..a4e8d96513c22 100644
+--- a/drivers/hv/hv_util.c
++++ b/drivers/hv/hv_util.c
+@@ -282,26 +282,52 @@ static struct {
+ spinlock_t lock;
+ } host_ts;
+
+-static struct timespec64 hv_get_adj_host_time(void)
++static inline u64 reftime_to_ns(u64 reftime)
+ {
+- struct timespec64 ts;
+- u64 newtime, reftime;
++ return (reftime - WLTIMEDELTA) * 100;
++}
++
++/*
++ * Hard coded threshold for host timesync delay: 600 seconds
++ */
++static const u64 HOST_TIMESYNC_DELAY_THRESH = 600 * (u64)NSEC_PER_SEC;
++
++static int hv_get_adj_host_time(struct timespec64 *ts)
++{
++ u64 newtime, reftime, timediff_adj;
+ unsigned long flags;
++ int ret = 0;
+
+ spin_lock_irqsave(&host_ts.lock, flags);
+ reftime = hv_read_reference_counter();
+- newtime = host_ts.host_time + (reftime - host_ts.ref_time);
+- ts = ns_to_timespec64((newtime - WLTIMEDELTA) * 100);
++
++ /*
++ * We need to let the caller know that last update from host
++ * is older than the max allowable threshold. clock_gettime()
++ * and PTP ioctl do not have a documented error that we could
++ * return for this specific case. Use ESTALE to report this.
++ */
++ timediff_adj = reftime - host_ts.ref_time;
++ if (timediff_adj * 100 > HOST_TIMESYNC_DELAY_THRESH) {
++ pr_warn_once("TIMESYNC IC: Stale time stamp, %llu nsecs old\n",
++ (timediff_adj * 100));
++ ret = -ESTALE;
++ }
++
++ newtime = host_ts.host_time + timediff_adj;
++ *ts = ns_to_timespec64(reftime_to_ns(newtime));
+ spin_unlock_irqrestore(&host_ts.lock, flags);
+
+- return ts;
++ return ret;
+ }
+
+ static void hv_set_host_time(struct work_struct *work)
+ {
+- struct timespec64 ts = hv_get_adj_host_time();
+
+- do_settimeofday64(&ts);
++ struct timespec64 ts;
++
++ if (!hv_get_adj_host_time(&ts))
++ do_settimeofday64(&ts);
+ }
+
+ /*
+@@ -361,10 +387,23 @@ static void timesync_onchannelcallback(void *context)
+ struct ictimesync_ref_data *refdata;
+ u8 *time_txf_buf = util_timesynch.recv_buffer;
+
+- vmbus_recvpacket(channel, time_txf_buf,
+- HV_HYP_PAGE_SIZE, &recvlen, &requestid);
++ /*
++ * Drain the ring buffer and use the last packet to update
++ * host_ts
++ */
++ while (1) {
++ int ret = vmbus_recvpacket(channel, time_txf_buf,
++ HV_HYP_PAGE_SIZE, &recvlen,
++ &requestid);
++ if (ret) {
++ pr_warn_once("TimeSync IC pkt recv failed (Err: %d)\n",
++ ret);
++ break;
++ }
++
++ if (!recvlen)
++ break;
+
+- if (recvlen > 0) {
+ icmsghdrp = (struct icmsg_hdr *)&time_txf_buf[
+ sizeof(struct vmbuspipe_hdr)];
+
+@@ -622,9 +661,7 @@ static int hv_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
+
+ static int hv_ptp_gettime(struct ptp_clock_info *info, struct timespec64 *ts)
+ {
+- *ts = hv_get_adj_host_time();
+-
+- return 0;
++ return hv_get_adj_host_time(ts);
+ }
+
+ static struct ptp_clock_info ptp_hyperv_info = {
+diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
+index 3166184093157..a18887990f4a2 100644
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -753,15 +753,18 @@ static ssize_t applesmc_light_show(struct device *dev,
+ }
+
+ ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length);
++ if (ret)
++ goto out;
+ /* newer macbooks report a single 10-bit bigendian value */
+ if (data_length == 10) {
+ left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
+ goto out;
+ }
+ left = buffer[2];
++
++ ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
+ if (ret)
+ goto out;
+- ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
+ right = buffer[2];
+
+ out:
+@@ -810,12 +813,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev,
+ to_index(attr));
+
+ ret = applesmc_read_key(newkey, buffer, 2);
+- speed = ((buffer[0] << 8 | buffer[1]) >> 2);
+-
+ if (ret)
+ return ret;
+- else
+- return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
++
++ speed = ((buffer[0] << 8 | buffer[1]) >> 2);
++ return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
+ }
+
+ static ssize_t applesmc_store_fan_speed(struct device *dev,
+@@ -851,12 +853,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev,
+ u8 buffer[2];
+
+ ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
+- manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
+-
+ if (ret)
+ return ret;
+- else
+- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
++
++ manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
++ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
+ }
+
+ static ssize_t applesmc_store_fan_manual(struct device *dev,
+@@ -872,10 +873,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev,
+ return -EINVAL;
+
+ ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
+- val = (buffer[0] << 8 | buffer[1]);
+ if (ret)
+ goto out;
+
++ val = (buffer[0] << 8 | buffer[1]);
++
+ if (input)
+ val = val | (0x01 << to_index(attr));
+ else
+@@ -951,13 +953,12 @@ static ssize_t applesmc_key_count_show(struct device *dev,
+ u32 count;
+
+ ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4);
+- count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
+- ((u32)buffer[2]<<8) + buffer[3];
+-
+ if (ret)
+ return ret;
+- else
+- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
++
++ count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
++ ((u32)buffer[2]<<8) + buffer[3];
++ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
+ }
+
+ static ssize_t applesmc_key_at_index_read_show(struct device *dev,
+diff --git a/drivers/hwmon/pmbus/isl68137.c b/drivers/hwmon/pmbus/isl68137.c
+index 0c622711ef7e0..58aa95a3c010c 100644
+--- a/drivers/hwmon/pmbus/isl68137.c
++++ b/drivers/hwmon/pmbus/isl68137.c
+@@ -67,6 +67,7 @@ enum variants {
+ raa_dmpvr1_2rail,
+ raa_dmpvr2_1rail,
+ raa_dmpvr2_2rail,
++ raa_dmpvr2_2rail_nontc,
+ raa_dmpvr2_3rail,
+ raa_dmpvr2_hv,
+ };
+@@ -241,6 +242,10 @@ static int isl68137_probe(struct i2c_client *client,
+ info->pages = 1;
+ info->read_word_data = raa_dmpvr2_read_word_data;
+ break;
++ case raa_dmpvr2_2rail_nontc:
++ info->func[0] &= ~PMBUS_HAVE_TEMP;
++ info->func[1] &= ~PMBUS_HAVE_TEMP;
++ fallthrough;
+ case raa_dmpvr2_2rail:
+ info->pages = 2;
+ info->read_word_data = raa_dmpvr2_read_word_data;
+@@ -304,7 +309,7 @@ static const struct i2c_device_id raa_dmpvr_id[] = {
+ {"raa228000", raa_dmpvr2_hv},
+ {"raa228004", raa_dmpvr2_hv},
+ {"raa228006", raa_dmpvr2_hv},
+- {"raa228228", raa_dmpvr2_2rail},
++ {"raa228228", raa_dmpvr2_2rail_nontc},
+ {"raa229001", raa_dmpvr2_2rail},
+ {"raa229004", raa_dmpvr2_2rail},
+ {}
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index 688e928188214..d8295b1c379d1 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -720,7 +720,7 @@ static int bcm_iproc_i2c_xfer_internal(struct bcm_iproc_i2c_dev *iproc_i2c,
+
+ /* mark the last byte */
+ if (!process_call && (i == msg->len - 1))
+- val |= 1 << M_TX_WR_STATUS_SHIFT;
++ val |= BIT(M_TX_WR_STATUS_SHIFT);
+
+ iproc_i2c_wr_reg(iproc_i2c, M_TX_OFFSET, val);
+ }
+@@ -738,7 +738,7 @@ static int bcm_iproc_i2c_xfer_internal(struct bcm_iproc_i2c_dev *iproc_i2c,
+ */
+ addr = i2c_8bit_addr_from_msg(msg);
+ /* mark it the last byte out */
+- val = addr | (1 << M_TX_WR_STATUS_SHIFT);
++ val = addr | BIT(M_TX_WR_STATUS_SHIFT);
+ iproc_i2c_wr_reg(iproc_i2c, M_TX_OFFSET, val);
+ }
+
+diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
+index b0f308cb7f7c2..201b2718f0755 100644
+--- a/drivers/iommu/Kconfig
++++ b/drivers/iommu/Kconfig
+@@ -143,7 +143,7 @@ config AMD_IOMMU
+ select IOMMU_API
+ select IOMMU_IOVA
+ select IOMMU_DMA
+- depends on X86_64 && PCI && ACPI
++ depends on X86_64 && PCI && ACPI && HAVE_CMPXCHG_DOUBLE
+ help
+ With this option you can enable support for AMD IOMMU hardware in
+ your system. An IOMMU is a hardware component which provides
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 6ebd4825e3206..bf45f8e2c7edd 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1518,7 +1518,14 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ iommu->mmio_phys_end = MMIO_REG_END_OFFSET;
+ else
+ iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET;
+- if (((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0))
++
++ /*
++ * Note: GA (128-bit IRTE) mode requires cmpxchg16b supports.
++ * GAM also requires GA mode. Therefore, we need to
++ * check cmpxchg16b support before enabling it.
++ */
++ if (!boot_cpu_has(X86_FEATURE_CX16) ||
++ ((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0))
+ amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
+ break;
+ case 0x11:
+@@ -1527,8 +1534,18 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ iommu->mmio_phys_end = MMIO_REG_END_OFFSET;
+ else
+ iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET;
+- if (((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0))
++
++ /*
++ * Note: GA (128-bit IRTE) mode requires cmpxchg16b supports.
++ * XT, GAM also requires GA mode. Therefore, we need to
++ * check cmpxchg16b support before enabling them.
++ */
++ if (!boot_cpu_has(X86_FEATURE_CX16) ||
++ ((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0)) {
+ amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
++ break;
++ }
++
+ /*
+ * Note: Since iommu_update_intcapxt() leverages
+ * the IOMMU MMIO access to MSI capability block registers
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 2f22326ee4dfe..200ee948f6ec1 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -3283,6 +3283,7 @@ out:
+ static int modify_irte_ga(u16 devid, int index, struct irte_ga *irte,
+ struct amd_ir_data *data)
+ {
++ bool ret;
+ struct irq_remap_table *table;
+ struct amd_iommu *iommu;
+ unsigned long flags;
+@@ -3300,10 +3301,18 @@ static int modify_irte_ga(u16 devid, int index, struct irte_ga *irte,
+
+ entry = (struct irte_ga *)table->table;
+ entry = &entry[index];
+- entry->lo.fields_remap.valid = 0;
+- entry->hi.val = irte->hi.val;
+- entry->lo.val = irte->lo.val;
+- entry->lo.fields_remap.valid = 1;
++
++ ret = cmpxchg_double(&entry->lo.val, &entry->hi.val,
++ entry->lo.val, entry->hi.val,
++ irte->lo.val, irte->hi.val);
++ /*
++ * We use cmpxchg16 to atomically update the 128-bit IRTE,
++ * and it cannot be updated by the hardware or other processors
++ * behind us, so the return value of cmpxchg16 should be the
++ * same as the old value.
++ */
++ WARN_ON(!ret);
++
+ if (data)
+ data->ref = entry;
+
+@@ -3841,6 +3850,7 @@ int amd_iommu_deactivate_guest_mode(void *data)
+ struct amd_ir_data *ir_data = (struct amd_ir_data *)data;
+ struct irte_ga *entry = (struct irte_ga *) ir_data->entry;
+ struct irq_cfg *cfg = ir_data->cfg;
++ u64 valid = entry->lo.fields_remap.valid;
+
+ if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) ||
+ !entry || !entry->lo.fields_vapic.guest_mode)
+@@ -3849,6 +3859,7 @@ int amd_iommu_deactivate_guest_mode(void *data)
+ entry->lo.val = 0;
+ entry->hi.val = 0;
+
++ entry->lo.fields_remap.valid = valid;
+ entry->lo.fields_remap.dm = apic->irq_dest_mode;
+ entry->lo.fields_remap.int_type = apic->irq_delivery_mode;
+ entry->hi.fields.vector = cfg->vector;
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 04e82f1756010..fbe0b0cc56edf 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -123,29 +123,29 @@ static inline unsigned int level_to_offset_bits(int level)
+ return (level - 1) * LEVEL_STRIDE;
+ }
+
+-static inline int pfn_level_offset(unsigned long pfn, int level)
++static inline int pfn_level_offset(u64 pfn, int level)
+ {
+ return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
+ }
+
+-static inline unsigned long level_mask(int level)
++static inline u64 level_mask(int level)
+ {
+- return -1UL << level_to_offset_bits(level);
++ return -1ULL << level_to_offset_bits(level);
+ }
+
+-static inline unsigned long level_size(int level)
++static inline u64 level_size(int level)
+ {
+- return 1UL << level_to_offset_bits(level);
++ return 1ULL << level_to_offset_bits(level);
+ }
+
+-static inline unsigned long align_to_level(unsigned long pfn, int level)
++static inline u64 align_to_level(u64 pfn, int level)
+ {
+ return (pfn + level_size(level) - 1) & level_mask(level);
+ }
+
+ static inline unsigned long lvl_to_nr_pages(unsigned int lvl)
+ {
+- return 1 << min_t(int, (lvl - 1) * LEVEL_STRIDE, MAX_AGAW_PFN_WIDTH);
++ return 1UL << min_t(int, (lvl - 1) * LEVEL_STRIDE, MAX_AGAW_PFN_WIDTH);
+ }
+
+ /* VT-d pages must always be _smaller_ than MM pages. Otherwise things
+diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c
+index aa096b333a991..4828f4fe09ab5 100644
+--- a/drivers/iommu/intel/irq_remapping.c
++++ b/drivers/iommu/intel/irq_remapping.c
+@@ -507,12 +507,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu)
+
+ /* Enable interrupt-remapping */
+ iommu->gcmd |= DMA_GCMD_IRE;
+- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */
+ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
+-
+ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
+ readl, (sts & DMA_GSTS_IRES), sts);
+
++ /* Block compatibility-format MSIs */
++ if (sts & DMA_GSTS_CFIS) {
++ iommu->gcmd &= ~DMA_GCMD_CFI;
++ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
++ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
++ readl, !(sts & DMA_GSTS_CFIS), sts);
++ }
++
+ /*
+ * With CFI clear in the Global Command register, we should be
+ * protected from dangerous (i.e. compatibility) interrupts
+diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c
+index 9f3da4260ca65..b61a8901ef722 100644
+--- a/drivers/irqchip/irq-ingenic.c
++++ b/drivers/irqchip/irq-ingenic.c
+@@ -125,7 +125,7 @@ static int __init ingenic_intc_of_init(struct device_node *node,
+ irq_reg_writel(gc, IRQ_MSK(32), JZ_REG_INTC_SET_MASK);
+ }
+
+- if (request_irq(parent_irq, intc_cascade, 0,
++ if (request_irq(parent_irq, intc_cascade, IRQF_NO_SUSPEND,
+ "SoC intc cascade interrupt", NULL))
+ pr_err("Failed to register SoC intc cascade interrupt\n");
+ return 0;
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 151aa95775be2..af6d4f898e4c1 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -537,12 +537,16 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd,
+ CACHE_MAX_CONCURRENT_LOCKS);
+ if (IS_ERR(cmd->bm)) {
+ DMERR("could not create block manager");
+- return PTR_ERR(cmd->bm);
++ r = PTR_ERR(cmd->bm);
++ cmd->bm = NULL;
++ return r;
+ }
+
+ r = __open_or_format_metadata(cmd, may_format_device);
+- if (r)
++ if (r) {
+ dm_block_manager_destroy(cmd->bm);
++ cmd->bm = NULL;
++ }
+
+ return r;
+ }
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 000ddfab5ba05..195ff0974ece9 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -736,7 +736,7 @@ static int crypt_iv_eboiv_gen(struct crypt_config *cc, u8 *iv,
+ u8 buf[MAX_CIPHER_BLOCKSIZE] __aligned(__alignof__(__le64));
+ struct skcipher_request *req;
+ struct scatterlist src, dst;
+- struct crypto_wait wait;
++ DECLARE_CRYPTO_WAIT(wait);
+ int err;
+
+ req = skcipher_request_alloc(any_tfm(cc), GFP_NOIO);
+@@ -933,7 +933,7 @@ static int crypt_iv_elephant(struct crypt_config *cc, struct dm_crypt_request *d
+ u8 *es, *ks, *data, *data2, *data_offset;
+ struct skcipher_request *req;
+ struct scatterlist *sg, *sg2, src, dst;
+- struct crypto_wait wait;
++ DECLARE_CRYPTO_WAIT(wait);
+ int i, r;
+
+ req = skcipher_request_alloc(elephant->tfm, GFP_NOIO);
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index a83a1de1e03fa..8b4289014c00d 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2487,6 +2487,7 @@ next_chunk:
+ range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
+ if (unlikely(range.logical_sector >= ic->provided_data_sectors)) {
+ if (ic->mode == 'B') {
++ block_bitmap_op(ic, ic->recalc_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_CLEAR);
+ DEBUG_print("queue_delayed_work: bitmap_flush_work\n");
+ queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, 0);
+ }
+@@ -2564,6 +2565,17 @@ next_chunk:
+ goto err;
+ }
+
++ if (ic->mode == 'B') {
++ sector_t start, end;
++ start = (range.logical_sector >>
++ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) <<
++ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
++ end = ((range.logical_sector + range.n_sectors) >>
++ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) <<
++ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
++ block_bitmap_op(ic, ic->recalc_bitmap, start, end - start, BITMAP_OP_CLEAR);
++ }
++
+ advance_and_next:
+ cond_resched();
+
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 78cff42d987ee..dc5846971d6cc 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1247,17 +1247,25 @@ static void multipath_wait_for_pg_init_completion(struct multipath *m)
+ static void flush_multipath_work(struct multipath *m)
+ {
+ if (m->hw_handler_name) {
+- set_bit(MPATHF_PG_INIT_DISABLED, &m->flags);
+- smp_mb__after_atomic();
++ unsigned long flags;
++
++ if (!atomic_read(&m->pg_init_in_progress))
++ goto skip;
++
++ spin_lock_irqsave(&m->lock, flags);
++ if (atomic_read(&m->pg_init_in_progress) &&
++ !test_and_set_bit(MPATHF_PG_INIT_DISABLED, &m->flags)) {
++ spin_unlock_irqrestore(&m->lock, flags);
+
+- if (atomic_read(&m->pg_init_in_progress))
+ flush_workqueue(kmpath_handlerd);
+- multipath_wait_for_pg_init_completion(m);
++ multipath_wait_for_pg_init_completion(m);
+
+- clear_bit(MPATHF_PG_INIT_DISABLED, &m->flags);
+- smp_mb__after_atomic();
++ spin_lock_irqsave(&m->lock, flags);
++ clear_bit(MPATHF_PG_INIT_DISABLED, &m->flags);
++ }
++ spin_unlock_irqrestore(&m->lock, flags);
+ }
+-
++skip:
+ if (m->queue_mode == DM_TYPE_BIO_BASED)
+ flush_work(&m->process_queued_bios);
+ flush_work(&m->trigger_event);
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index 76b6b323bf4bd..b461836b6d263 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -739,12 +739,16 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f
+ THIN_MAX_CONCURRENT_LOCKS);
+ if (IS_ERR(pmd->bm)) {
+ DMERR("could not create block manager");
+- return PTR_ERR(pmd->bm);
++ r = PTR_ERR(pmd->bm);
++ pmd->bm = NULL;
++ return r;
+ }
+
+ r = __open_or_format_metadata(pmd, format_device);
+- if (r)
++ if (r) {
+ dm_block_manager_destroy(pmd->bm);
++ pmd->bm = NULL;
++ }
+
+ return r;
+ }
+@@ -954,7 +958,7 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd)
+ }
+
+ pmd_write_lock_in_core(pmd);
+- if (!dm_bm_is_read_only(pmd->bm) && !pmd->fail_io) {
++ if (!pmd->fail_io && !dm_bm_is_read_only(pmd->bm)) {
+ r = __commit_transaction(pmd);
+ if (r < 0)
+ DMWARN("%s: __commit_transaction() failed, error = %d",
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 5358894bb9fdc..1533419f18758 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -231,6 +231,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ pfn_t pfn;
+ int id;
+ struct page **pages;
++ sector_t offset;
+
+ wc->memory_vmapped = false;
+
+@@ -245,9 +246,16 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ goto err1;
+ }
+
++ offset = get_start_sect(wc->ssd_dev->bdev);
++ if (offset & (PAGE_SIZE / 512 - 1)) {
++ r = -EINVAL;
++ goto err1;
++ }
++ offset >>= PAGE_SHIFT - 9;
++
+ id = dax_read_lock();
+
+- da = dax_direct_access(wc->ssd_dev->dax_dev, 0, p, &wc->memory_map, &pfn);
++ da = dax_direct_access(wc->ssd_dev->dax_dev, offset, p, &wc->memory_map, &pfn);
+ if (da < 0) {
+ wc->memory_map = NULL;
+ r = da;
+@@ -269,7 +277,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ i = 0;
+ do {
+ long daa;
+- daa = dax_direct_access(wc->ssd_dev->dax_dev, i, p - i,
++ daa = dax_direct_access(wc->ssd_dev->dax_dev, offset + i, p - i,
+ NULL, &pfn);
+ if (daa <= 0) {
+ r = daa ? daa : -EINVAL;
+diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c
+index 749ec268d957d..54c089a50b152 100644
+--- a/drivers/md/persistent-data/dm-block-manager.c
++++ b/drivers/md/persistent-data/dm-block-manager.c
+@@ -493,7 +493,7 @@ int dm_bm_write_lock(struct dm_block_manager *bm,
+ void *p;
+ int r;
+
+- if (bm->read_only)
++ if (dm_bm_is_read_only(bm))
+ return -EPERM;
+
+ p = dm_bufio_read(bm->bufio, b, (struct dm_buffer **) result);
+@@ -562,7 +562,7 @@ int dm_bm_write_lock_zero(struct dm_block_manager *bm,
+ struct buffer_aux *aux;
+ void *p;
+
+- if (bm->read_only)
++ if (dm_bm_is_read_only(bm))
+ return -EPERM;
+
+ p = dm_bufio_new(bm->bufio, b, (struct dm_buffer **) result);
+@@ -602,7 +602,7 @@ EXPORT_SYMBOL_GPL(dm_bm_unlock);
+
+ int dm_bm_flush(struct dm_block_manager *bm)
+ {
+- if (bm->read_only)
++ if (dm_bm_is_read_only(bm))
+ return -EPERM;
+
+ return dm_bufio_write_dirty_buffers(bm->bufio);
+@@ -616,19 +616,21 @@ void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b)
+
+ bool dm_bm_is_read_only(struct dm_block_manager *bm)
+ {
+- return bm->read_only;
++ return (bm ? bm->read_only : true);
+ }
+ EXPORT_SYMBOL_GPL(dm_bm_is_read_only);
+
+ void dm_bm_set_read_only(struct dm_block_manager *bm)
+ {
+- bm->read_only = true;
++ if (bm)
++ bm->read_only = true;
+ }
+ EXPORT_SYMBOL_GPL(dm_bm_set_read_only);
+
+ void dm_bm_set_read_write(struct dm_block_manager *bm)
+ {
+- bm->read_only = false;
++ if (bm)
++ bm->read_only = false;
+ }
+ EXPORT_SYMBOL_GPL(dm_bm_set_read_write);
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index da11036ad804d..6b1a6851ccb0b 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -728,7 +728,7 @@ config VIDEO_HI556
+ config VIDEO_IMX214
+ tristate "Sony IMX214 sensor support"
+ depends on GPIOLIB && I2C && VIDEO_V4L2
+- depends on V4L2_FWNODE
++ select V4L2_FWNODE
+ select MEDIA_CONTROLLER
+ select VIDEO_V4L2_SUBDEV_API
+ select REGMAP_I2C
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index d7064d664d528..38aa0c2de243f 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1292,6 +1292,10 @@ static ssize_t store_protocols(struct device *device,
+ }
+
+ mutex_lock(&dev->lock);
++ if (!dev->registered) {
++ mutex_unlock(&dev->lock);
++ return -ENODEV;
++ }
+
+ old_protocols = *current_protocols;
+ new_protocols = old_protocols;
+@@ -1430,6 +1434,10 @@ static ssize_t store_filter(struct device *device,
+ return -EINVAL;
+
+ mutex_lock(&dev->lock);
++ if (!dev->registered) {
++ mutex_unlock(&dev->lock);
++ return -ENODEV;
++ }
+
+ new_filter = *filter;
+ if (fattr->mask)
+@@ -1544,6 +1552,10 @@ static ssize_t store_wakeup_protocols(struct device *device,
+ int i;
+
+ mutex_lock(&dev->lock);
++ if (!dev->registered) {
++ mutex_unlock(&dev->lock);
++ return -ENODEV;
++ }
+
+ allowed = dev->allowed_wakeup_protocols;
+
+@@ -1601,25 +1613,25 @@ static void rc_dev_release(struct device *device)
+ kfree(dev);
+ }
+
+-#define ADD_HOTPLUG_VAR(fmt, val...) \
+- do { \
+- int err = add_uevent_var(env, fmt, val); \
+- if (err) \
+- return err; \
+- } while (0)
+-
+ static int rc_dev_uevent(struct device *device, struct kobj_uevent_env *env)
+ {
+ struct rc_dev *dev = to_rc_dev(device);
++ int ret = 0;
+
+- if (dev->rc_map.name)
+- ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name);
+- if (dev->driver_name)
+- ADD_HOTPLUG_VAR("DRV_NAME=%s", dev->driver_name);
+- if (dev->device_name)
+- ADD_HOTPLUG_VAR("DEV_NAME=%s", dev->device_name);
++ mutex_lock(&dev->lock);
+
+- return 0;
++ if (!dev->registered)
++ ret = -ENODEV;
++ if (ret == 0 && dev->rc_map.name)
++ ret = add_uevent_var(env, "NAME=%s", dev->rc_map.name);
++ if (ret == 0 && dev->driver_name)
++ ret = add_uevent_var(env, "DRV_NAME=%s", dev->driver_name);
++ if (ret == 0 && dev->device_name)
++ ret = add_uevent_var(env, "DEV_NAME=%s", dev->device_name);
++
++ mutex_unlock(&dev->lock);
++
++ return ret;
+ }
+
+ /*
+@@ -2011,14 +2023,14 @@ void rc_unregister_device(struct rc_dev *dev)
+ del_timer_sync(&dev->timer_keyup);
+ del_timer_sync(&dev->timer_repeat);
+
+- rc_free_rx_device(dev);
+-
+ mutex_lock(&dev->lock);
+ if (dev->users && dev->close)
+ dev->close(dev);
+ dev->registered = false;
+ mutex_unlock(&dev->lock);
+
++ rc_free_rx_device(dev);
++
+ /*
+ * lirc device should be freed with dev->registered = false, so
+ * that userspace polling will get notified.
+diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
+index e879290727ef4..25c4ca6884dda 100644
+--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
++++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
+@@ -1994,6 +1994,7 @@ static int vicodec_request_validate(struct media_request *req)
+ }
+ ctrl = v4l2_ctrl_request_hdl_ctrl_find(hdl,
+ vicodec_ctrl_stateless_state.id);
++ v4l2_ctrl_request_hdl_put(hdl);
+ if (!ctrl) {
+ v4l2_info(&ctx->dev->v4l2_dev,
+ "Missing required codec control\n");
+diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c
+index 59608d1bac880..baa4e66d4c457 100644
+--- a/drivers/misc/habanalabs/device.c
++++ b/drivers/misc/habanalabs/device.c
+@@ -1027,7 +1027,7 @@ again:
+ goto out_err;
+ }
+
+- hl_set_max_power(hdev, hdev->max_power);
++ hl_set_max_power(hdev);
+ } else {
+ rc = hdev->asic_funcs->soft_reset_late_init(hdev);
+ if (rc) {
+@@ -1268,6 +1268,11 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
+ goto out_disabled;
+ }
+
++ /* Need to call this again because the max power might change,
++ * depending on card type for certain ASICs
++ */
++ hl_set_max_power(hdev);
++
+ /*
+ * hl_hwmon_init() must be called after device_late_init(), because only
+ * there we get the information from the device about which
+diff --git a/drivers/misc/habanalabs/firmware_if.c b/drivers/misc/habanalabs/firmware_if.c
+index d27841cb5bcb3..345c228a7971e 100644
+--- a/drivers/misc/habanalabs/firmware_if.c
++++ b/drivers/misc/habanalabs/firmware_if.c
+@@ -13,6 +13,7 @@
+ #include <linux/io-64-nonatomic-lo-hi.h>
+ #include <linux/slab.h>
+
++#define FW_FILE_MAX_SIZE 0x1400000 /* maximum size of 20MB */
+ /**
+ * hl_fw_load_fw_to_device() - Load F/W code to device's memory.
+ * @hdev: pointer to hl_device structure.
+@@ -45,6 +46,14 @@ int hl_fw_load_fw_to_device(struct hl_device *hdev, const char *fw_name,
+
+ dev_dbg(hdev->dev, "%s firmware size == %zu\n", fw_name, fw_size);
+
++ if (fw_size > FW_FILE_MAX_SIZE) {
++ dev_err(hdev->dev,
++ "FW file size %zu exceeds maximum of %u bytes\n",
++ fw_size, FW_FILE_MAX_SIZE);
++ rc = -EINVAL;
++ goto out;
++ }
++
+ fw_data = (const u64 *) fw->data;
+
+ memcpy_toio(dst, fw_data, fw_size);
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 637a9d608707f..ca183733847b6 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -154,6 +154,29 @@ static const u16 gaudi_packet_sizes[MAX_PACKET_ID] = {
+ [PACKET_LOAD_AND_EXE] = sizeof(struct packet_load_and_exe)
+ };
+
++static inline bool validate_packet_id(enum packet_id id)
++{
++ switch (id) {
++ case PACKET_WREG_32:
++ case PACKET_WREG_BULK:
++ case PACKET_MSG_LONG:
++ case PACKET_MSG_SHORT:
++ case PACKET_CP_DMA:
++ case PACKET_REPEAT:
++ case PACKET_MSG_PROT:
++ case PACKET_FENCE:
++ case PACKET_LIN_DMA:
++ case PACKET_NOP:
++ case PACKET_STOP:
++ case PACKET_ARB_POINT:
++ case PACKET_WAIT:
++ case PACKET_LOAD_AND_EXE:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static const char * const
+ gaudi_tpc_interrupts_cause[GAUDI_NUM_OF_TPC_INTR_CAUSE] = {
+ "tpc_address_exceed_slm",
+@@ -424,7 +447,7 @@ static int gaudi_get_fixed_properties(struct hl_device *hdev)
+ prop->num_of_events = GAUDI_EVENT_SIZE;
+ prop->tpc_enabled_mask = TPC_ENABLED_MASK;
+
+- prop->max_power_default = MAX_POWER_DEFAULT;
++ prop->max_power_default = MAX_POWER_DEFAULT_PCI;
+
+ prop->cb_pool_cb_cnt = GAUDI_CB_POOL_CB_CNT;
+ prop->cb_pool_cb_size = GAUDI_CB_POOL_CB_SIZE;
+@@ -2541,6 +2564,7 @@ static void gaudi_set_clock_gating(struct hl_device *hdev)
+ {
+ struct gaudi_device *gaudi = hdev->asic_specific;
+ u32 qman_offset;
++ bool enable;
+ int i;
+
+ /* In case we are during debug session, don't enable the clock gate
+@@ -2550,46 +2574,43 @@ static void gaudi_set_clock_gating(struct hl_device *hdev)
+ return;
+
+ for (i = GAUDI_PCI_DMA_1, qman_offset = 0 ; i < GAUDI_HBM_DMA_1 ; i++) {
+- if (!(hdev->clock_gating_mask &
+- (BIT_ULL(gaudi_dma_assignment[i]))))
+- continue;
++ enable = !!(hdev->clock_gating_mask &
++ (BIT_ULL(gaudi_dma_assignment[i])));
+
+ qman_offset = gaudi_dma_assignment[i] * DMA_QMAN_OFFSET;
+- WREG32(mmDMA0_QM_CGM_CFG1 + qman_offset, QMAN_CGM1_PWR_GATE_EN);
++ WREG32(mmDMA0_QM_CGM_CFG1 + qman_offset,
++ enable ? QMAN_CGM1_PWR_GATE_EN : 0);
+ WREG32(mmDMA0_QM_CGM_CFG + qman_offset,
+- QMAN_UPPER_CP_CGM_PWR_GATE_EN);
++ enable ? QMAN_UPPER_CP_CGM_PWR_GATE_EN : 0);
+ }
+
+ for (i = GAUDI_HBM_DMA_1 ; i < GAUDI_DMA_MAX ; i++) {
+- if (!(hdev->clock_gating_mask &
+- (BIT_ULL(gaudi_dma_assignment[i]))))
+- continue;
++ enable = !!(hdev->clock_gating_mask &
++ (BIT_ULL(gaudi_dma_assignment[i])));
+
+ qman_offset = gaudi_dma_assignment[i] * DMA_QMAN_OFFSET;
+- WREG32(mmDMA0_QM_CGM_CFG1 + qman_offset, QMAN_CGM1_PWR_GATE_EN);
++ WREG32(mmDMA0_QM_CGM_CFG1 + qman_offset,
++ enable ? QMAN_CGM1_PWR_GATE_EN : 0);
+ WREG32(mmDMA0_QM_CGM_CFG + qman_offset,
+- QMAN_COMMON_CP_CGM_PWR_GATE_EN);
++ enable ? QMAN_COMMON_CP_CGM_PWR_GATE_EN : 0);
+ }
+
+- if (hdev->clock_gating_mask & (BIT_ULL(GAUDI_ENGINE_ID_MME_0))) {
+- WREG32(mmMME0_QM_CGM_CFG1, QMAN_CGM1_PWR_GATE_EN);
+- WREG32(mmMME0_QM_CGM_CFG, QMAN_COMMON_CP_CGM_PWR_GATE_EN);
+- }
++ enable = !!(hdev->clock_gating_mask & (BIT_ULL(GAUDI_ENGINE_ID_MME_0)));
++ WREG32(mmMME0_QM_CGM_CFG1, enable ? QMAN_CGM1_PWR_GATE_EN : 0);
++ WREG32(mmMME0_QM_CGM_CFG, enable ? QMAN_COMMON_CP_CGM_PWR_GATE_EN : 0);
+
+- if (hdev->clock_gating_mask & (BIT_ULL(GAUDI_ENGINE_ID_MME_2))) {
+- WREG32(mmMME2_QM_CGM_CFG1, QMAN_CGM1_PWR_GATE_EN);
+- WREG32(mmMME2_QM_CGM_CFG, QMAN_COMMON_CP_CGM_PWR_GATE_EN);
+- }
++ enable = !!(hdev->clock_gating_mask & (BIT_ULL(GAUDI_ENGINE_ID_MME_2)));
++ WREG32(mmMME2_QM_CGM_CFG1, enable ? QMAN_CGM1_PWR_GATE_EN : 0);
++ WREG32(mmMME2_QM_CGM_CFG, enable ? QMAN_COMMON_CP_CGM_PWR_GATE_EN : 0);
+
+ for (i = 0, qman_offset = 0 ; i < TPC_NUMBER_OF_ENGINES ; i++) {
+- if (!(hdev->clock_gating_mask &
+- (BIT_ULL(GAUDI_ENGINE_ID_TPC_0 + i))))
+- continue;
++ enable = !!(hdev->clock_gating_mask &
++ (BIT_ULL(GAUDI_ENGINE_ID_TPC_0 + i)));
+
+ WREG32(mmTPC0_QM_CGM_CFG1 + qman_offset,
+- QMAN_CGM1_PWR_GATE_EN);
++ enable ? QMAN_CGM1_PWR_GATE_EN : 0);
+ WREG32(mmTPC0_QM_CGM_CFG + qman_offset,
+- QMAN_COMMON_CP_CGM_PWR_GATE_EN);
++ enable ? QMAN_COMMON_CP_CGM_PWR_GATE_EN : 0);
+
+ qman_offset += TPC_QMAN_OFFSET;
+ }
+@@ -3859,6 +3880,12 @@ static int gaudi_validate_cb(struct hl_device *hdev,
+ PACKET_HEADER_PACKET_ID_MASK) >>
+ PACKET_HEADER_PACKET_ID_SHIFT);
+
++ if (!validate_packet_id(pkt_id)) {
++ dev_err(hdev->dev, "Invalid packet id %u\n", pkt_id);
++ rc = -EINVAL;
++ break;
++ }
++
+ pkt_size = gaudi_packet_sizes[pkt_id];
+ cb_parsed_length += pkt_size;
+ if (cb_parsed_length > parser->user_cb_size) {
+@@ -4082,6 +4109,12 @@ static int gaudi_patch_cb(struct hl_device *hdev,
+ PACKET_HEADER_PACKET_ID_MASK) >>
+ PACKET_HEADER_PACKET_ID_SHIFT);
+
++ if (!validate_packet_id(pkt_id)) {
++ dev_err(hdev->dev, "Invalid packet id %u\n", pkt_id);
++ rc = -EINVAL;
++ break;
++ }
++
+ pkt_size = gaudi_packet_sizes[pkt_id];
+ cb_parsed_length += pkt_size;
+ if (cb_parsed_length > parser->user_cb_size) {
+@@ -6208,6 +6241,15 @@ static int gaudi_armcp_info_get(struct hl_device *hdev)
+ strncpy(prop->armcp_info.card_name, GAUDI_DEFAULT_CARD_NAME,
+ CARD_NAME_MAX_LEN);
+
++ hdev->card_type = le32_to_cpu(hdev->asic_prop.armcp_info.card_type);
++
++ if (hdev->card_type == armcp_card_type_pci)
++ prop->max_power_default = MAX_POWER_DEFAULT_PCI;
++ else if (hdev->card_type == armcp_card_type_pmc)
++ prop->max_power_default = MAX_POWER_DEFAULT_PMC;
++
++ hdev->max_power = prop->max_power_default;
++
+ return 0;
+ }
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudiP.h b/drivers/misc/habanalabs/gaudi/gaudiP.h
+index 41a8d9bff6bf9..00f1efeaa8832 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudiP.h
++++ b/drivers/misc/habanalabs/gaudi/gaudiP.h
+@@ -41,7 +41,8 @@
+
+ #define GAUDI_MAX_CLK_FREQ 2200000000ull /* 2200 MHz */
+
+-#define MAX_POWER_DEFAULT 200000 /* 200W */
++#define MAX_POWER_DEFAULT_PCI 200000 /* 200W */
++#define MAX_POWER_DEFAULT_PMC 350000 /* 350W */
+
+ #define GAUDI_CPU_TIMEOUT_USEC 15000000 /* 15s */
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi_coresight.c b/drivers/misc/habanalabs/gaudi/gaudi_coresight.c
+index bf0e062d7b874..cc3d03549a6e4 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi_coresight.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi_coresight.c
+@@ -523,7 +523,7 @@ static int gaudi_config_etf(struct hl_device *hdev,
+ }
+
+ static bool gaudi_etr_validate_address(struct hl_device *hdev, u64 addr,
+- u32 size, bool *is_host)
++ u64 size, bool *is_host)
+ {
+ struct asic_fixed_properties *prop = &hdev->asic_prop;
+ struct gaudi_device *gaudi = hdev->asic_specific;
+@@ -535,6 +535,12 @@ static bool gaudi_etr_validate_address(struct hl_device *hdev, u64 addr,
+ return false;
+ }
+
++ if (addr > (addr + size)) {
++ dev_err(hdev->dev,
++ "ETR buffer size %llu overflow\n", size);
++ return false;
++ }
++
+ /* PMMU and HPMMU addresses are equal, check only one of them */
+ if ((gaudi->hw_cap_initialized & HW_CAP_MMU) &&
+ hl_mem_area_inside_range(addr, size,
+diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
+index 88460b2138d88..c179085ced7b8 100644
+--- a/drivers/misc/habanalabs/goya/goya.c
++++ b/drivers/misc/habanalabs/goya/goya.c
+@@ -139,6 +139,25 @@ static u16 goya_packet_sizes[MAX_PACKET_ID] = {
+ [PACKET_STOP] = sizeof(struct packet_stop)
+ };
+
++static inline bool validate_packet_id(enum packet_id id)
++{
++ switch (id) {
++ case PACKET_WREG_32:
++ case PACKET_WREG_BULK:
++ case PACKET_MSG_LONG:
++ case PACKET_MSG_SHORT:
++ case PACKET_CP_DMA:
++ case PACKET_MSG_PROT:
++ case PACKET_FENCE:
++ case PACKET_LIN_DMA:
++ case PACKET_NOP:
++ case PACKET_STOP:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static u64 goya_mmu_regs[GOYA_MMU_REGS_NUM] = {
+ mmDMA_QM_0_GLBL_NON_SECURE_PROPS,
+ mmDMA_QM_1_GLBL_NON_SECURE_PROPS,
+@@ -3381,6 +3400,12 @@ static int goya_validate_cb(struct hl_device *hdev,
+ PACKET_HEADER_PACKET_ID_MASK) >>
+ PACKET_HEADER_PACKET_ID_SHIFT);
+
++ if (!validate_packet_id(pkt_id)) {
++ dev_err(hdev->dev, "Invalid packet id %u\n", pkt_id);
++ rc = -EINVAL;
++ break;
++ }
++
+ pkt_size = goya_packet_sizes[pkt_id];
+ cb_parsed_length += pkt_size;
+ if (cb_parsed_length > parser->user_cb_size) {
+@@ -3616,6 +3641,12 @@ static int goya_patch_cb(struct hl_device *hdev,
+ PACKET_HEADER_PACKET_ID_MASK) >>
+ PACKET_HEADER_PACKET_ID_SHIFT);
+
++ if (!validate_packet_id(pkt_id)) {
++ dev_err(hdev->dev, "Invalid packet id %u\n", pkt_id);
++ rc = -EINVAL;
++ break;
++ }
++
+ pkt_size = goya_packet_sizes[pkt_id];
+ cb_parsed_length += pkt_size;
+ if (cb_parsed_length > parser->user_cb_size) {
+diff --git a/drivers/misc/habanalabs/goya/goya_coresight.c b/drivers/misc/habanalabs/goya/goya_coresight.c
+index 1258724ea5106..c23a9fcb74b57 100644
+--- a/drivers/misc/habanalabs/goya/goya_coresight.c
++++ b/drivers/misc/habanalabs/goya/goya_coresight.c
+@@ -358,11 +358,17 @@ static int goya_config_etf(struct hl_device *hdev,
+ }
+
+ static int goya_etr_validate_address(struct hl_device *hdev, u64 addr,
+- u32 size)
++ u64 size)
+ {
+ struct asic_fixed_properties *prop = &hdev->asic_prop;
+ u64 range_start, range_end;
+
++ if (addr > (addr + size)) {
++ dev_err(hdev->dev,
++ "ETR buffer size %llu overflow\n", size);
++ return false;
++ }
++
+ if (hdev->mmu_enable) {
+ range_start = prop->dmmu.start_addr;
+ range_end = prop->dmmu.end_addr;
+diff --git a/drivers/misc/habanalabs/habanalabs.h b/drivers/misc/habanalabs/habanalabs.h
+index 194d833526964..1072f300252a4 100644
+--- a/drivers/misc/habanalabs/habanalabs.h
++++ b/drivers/misc/habanalabs/habanalabs.h
+@@ -1408,6 +1408,8 @@ struct hl_device_idle_busy_ts {
+ * details.
+ * @in_reset: is device in reset flow.
+ * @curr_pll_profile: current PLL profile.
++ * @card_type: Various ASICs have several card types. This indicates the card
++ * type of the current device.
+ * @cs_active_cnt: number of active command submissions on this device (active
+ * means already in H/W queues)
+ * @major: habanalabs kernel driver major.
+@@ -1503,6 +1505,7 @@ struct hl_device {
+ u64 clock_gating_mask;
+ atomic_t in_reset;
+ enum hl_pll_frequency curr_pll_profile;
++ enum armcp_card_types card_type;
+ int cs_active_cnt;
+ u32 major;
+ u32 high_pll;
+@@ -1587,7 +1590,7 @@ struct hl_ioctl_desc {
+ *
+ * Return: true if the area is inside the valid range, false otherwise.
+ */
+-static inline bool hl_mem_area_inside_range(u64 address, u32 size,
++static inline bool hl_mem_area_inside_range(u64 address, u64 size,
+ u64 range_start_address, u64 range_end_address)
+ {
+ u64 end_address = address + size;
+@@ -1792,7 +1795,7 @@ int hl_get_pwm_info(struct hl_device *hdev,
+ void hl_set_pwm_info(struct hl_device *hdev, int sensor_index, u32 attr,
+ long value);
+ u64 hl_get_max_power(struct hl_device *hdev);
+-void hl_set_max_power(struct hl_device *hdev, u64 value);
++void hl_set_max_power(struct hl_device *hdev);
+ int hl_set_voltage(struct hl_device *hdev,
+ int sensor_index, u32 attr, long value);
+ int hl_set_current(struct hl_device *hdev,
+diff --git a/drivers/misc/habanalabs/memory.c b/drivers/misc/habanalabs/memory.c
+index 47da84a177197..e30b1b1877efa 100644
+--- a/drivers/misc/habanalabs/memory.c
++++ b/drivers/misc/habanalabs/memory.c
+@@ -66,6 +66,11 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args,
+ num_pgs = (args->alloc.mem_size + (page_size - 1)) >> page_shift;
+ total_size = num_pgs << page_shift;
+
++ if (!total_size) {
++ dev_err(hdev->dev, "Cannot allocate 0 bytes\n");
++ return -EINVAL;
++ }
++
+ contiguous = args->flags & HL_MEM_CONTIGUOUS;
+
+ if (contiguous) {
+@@ -93,7 +98,7 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args,
+ phys_pg_pack->contiguous = contiguous;
+
+ phys_pg_pack->pages = kvmalloc_array(num_pgs, sizeof(u64), GFP_KERNEL);
+- if (!phys_pg_pack->pages) {
++ if (ZERO_OR_NULL_PTR(phys_pg_pack->pages)) {
+ rc = -ENOMEM;
+ goto pages_arr_err;
+ }
+@@ -683,7 +688,7 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx,
+
+ phys_pg_pack->pages = kvmalloc_array(total_npages, sizeof(u64),
+ GFP_KERNEL);
+- if (!phys_pg_pack->pages) {
++ if (ZERO_OR_NULL_PTR(phys_pg_pack->pages)) {
+ rc = -ENOMEM;
+ goto page_pack_arr_mem_err;
+ }
+diff --git a/drivers/misc/habanalabs/mmu.c b/drivers/misc/habanalabs/mmu.c
+index a290d6b49d788..eb582bd4937ba 100644
+--- a/drivers/misc/habanalabs/mmu.c
++++ b/drivers/misc/habanalabs/mmu.c
+@@ -450,7 +450,7 @@ int hl_mmu_init(struct hl_device *hdev)
+ hdev->mmu_shadow_hop0 = kvmalloc_array(prop->max_asid,
+ prop->mmu_hop_table_size,
+ GFP_KERNEL | __GFP_ZERO);
+- if (!hdev->mmu_shadow_hop0) {
++ if (ZERO_OR_NULL_PTR(hdev->mmu_shadow_hop0)) {
+ rc = -ENOMEM;
+ goto err_pool_add;
+ }
+diff --git a/drivers/misc/habanalabs/pci.c b/drivers/misc/habanalabs/pci.c
+index 9f634ef6f5b37..77022c0b42027 100644
+--- a/drivers/misc/habanalabs/pci.c
++++ b/drivers/misc/habanalabs/pci.c
+@@ -378,15 +378,17 @@ int hl_pci_init(struct hl_device *hdev)
+ rc = hdev->asic_funcs->init_iatu(hdev);
+ if (rc) {
+ dev_err(hdev->dev, "Failed to initialize iATU\n");
+- goto disable_device;
++ goto unmap_pci_bars;
+ }
+
+ rc = hl_pci_set_dma_mask(hdev);
+ if (rc)
+- goto disable_device;
++ goto unmap_pci_bars;
+
+ return 0;
+
++unmap_pci_bars:
++ hl_pci_bars_unmap(hdev);
+ disable_device:
+ pci_clear_master(pdev);
+ pci_disable_device(pdev);
+diff --git a/drivers/misc/habanalabs/sysfs.c b/drivers/misc/habanalabs/sysfs.c
+index 70b6b1863c2ef..87dadb53ac59d 100644
+--- a/drivers/misc/habanalabs/sysfs.c
++++ b/drivers/misc/habanalabs/sysfs.c
+@@ -81,7 +81,7 @@ u64 hl_get_max_power(struct hl_device *hdev)
+ return result;
+ }
+
+-void hl_set_max_power(struct hl_device *hdev, u64 value)
++void hl_set_max_power(struct hl_device *hdev)
+ {
+ struct armcp_packet pkt;
+ int rc;
+@@ -90,7 +90,7 @@ void hl_set_max_power(struct hl_device *hdev, u64 value)
+
+ pkt.ctl = cpu_to_le32(ARMCP_PACKET_MAX_POWER_SET <<
+ ARMCP_PKT_CTL_OPCODE_SHIFT);
+- pkt.value = cpu_to_le64(value);
++ pkt.value = cpu_to_le64(hdev->max_power);
+
+ rc = hdev->asic_funcs->send_cpu_message(hdev, (u32 *) &pkt, sizeof(pkt),
+ 0, NULL);
+@@ -316,7 +316,7 @@ static ssize_t max_power_store(struct device *dev,
+ }
+
+ hdev->max_power = value;
+- hl_set_max_power(hdev, value);
++ hl_set_max_power(hdev);
+
+ out:
+ return count;
+@@ -419,6 +419,7 @@ int hl_sysfs_init(struct hl_device *hdev)
+ hdev->pm_mng_profile = PM_AUTO;
+ else
+ hdev->pm_mng_profile = PM_MANUAL;
++
+ hdev->max_power = hdev->asic_prop.max_power_default;
+
+ hdev->asic_funcs->add_device_attr(hdev, &hl_dev_clks_attr_group);
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 39e7fc54c438f..0319eac3a05d7 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -22,6 +22,7 @@
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+ #include <linux/interrupt.h>
++#include <linux/reset.h>
+
+ #include <linux/mmc/card.h>
+ #include <linux/mmc/core.h>
+@@ -414,6 +415,7 @@ struct msdc_host {
+ struct pinctrl_state *pins_uhs;
+ struct delayed_work req_timeout;
+ int irq; /* host interrupt */
++ struct reset_control *reset;
+
+ struct clk *src_clk; /* msdc source clock */
+ struct clk *h_clk; /* msdc h_clk */
+@@ -1516,6 +1518,12 @@ static void msdc_init_hw(struct msdc_host *host)
+ u32 val;
+ u32 tune_reg = host->dev_comp->pad_tune_reg;
+
++ if (host->reset) {
++ reset_control_assert(host->reset);
++ usleep_range(10, 50);
++ reset_control_deassert(host->reset);
++ }
++
+ /* Configure to MMC/SD mode, clock free running */
+ sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_MODE | MSDC_CFG_CKPDN);
+
+@@ -2273,6 +2281,11 @@ static int msdc_drv_probe(struct platform_device *pdev)
+ if (IS_ERR(host->src_clk_cg))
+ host->src_clk_cg = NULL;
+
++ host->reset = devm_reset_control_get_optional_exclusive(&pdev->dev,
++ "hrst");
++ if (IS_ERR(host->reset))
++ return PTR_ERR(host->reset);
++
+ host->irq = platform_get_irq(pdev, 0);
+ if (host->irq < 0) {
+ ret = -EINVAL;
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index d8b76cb8698aa..2d9f79b50a7fa 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -535,6 +535,11 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_qcom_sd = {
+ .caps = MMC_CAP_NONREMOVABLE,
+ };
+
++struct amd_sdhci_host {
++ bool tuned_clock;
++ bool dll_enabled;
++};
++
+ /* AMD sdhci reset dll register. */
+ #define SDHCI_AMD_RESET_DLL_REGISTER 0x908
+
+@@ -554,26 +559,66 @@ static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host)
+ }
+
+ /*
+- * For AMD Platform it is required to disable the tuning
+- * bit first controller to bring to HS Mode from HS200
+- * mode, later enable to tune to HS400 mode.
++ * The initialization sequence for HS400 is:
++ * HS->HS200->Perform Tuning->HS->HS400
++ *
++ * The re-tuning sequence is:
++ * HS400->DDR52->HS->HS200->Perform Tuning->HS->HS400
++ *
++ * The AMD eMMC Controller can only use the tuned clock while in HS200 and HS400
++ * mode. If we switch to a different mode, we need to disable the tuned clock.
++ * If we have previously performed tuning and switch back to HS200 or
++ * HS400, we can re-enable the tuned clock.
++ *
+ */
+ static void amd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host);
++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host);
+ unsigned int old_timing = host->timing;
++ u16 val;
+
+ sdhci_set_ios(mmc, ios);
+- if (old_timing == MMC_TIMING_MMC_HS200 &&
+- ios->timing == MMC_TIMING_MMC_HS)
+- sdhci_writew(host, 0x9, SDHCI_HOST_CONTROL2);
+- if (old_timing != MMC_TIMING_MMC_HS400 &&
+- ios->timing == MMC_TIMING_MMC_HS400) {
+- sdhci_writew(host, 0x80, SDHCI_HOST_CONTROL2);
+- sdhci_acpi_amd_hs400_dll(host);
++
++ if (old_timing != host->timing && amd_host->tuned_clock) {
++ if (host->timing == MMC_TIMING_MMC_HS400 ||
++ host->timing == MMC_TIMING_MMC_HS200) {
++ val = sdhci_readw(host, SDHCI_HOST_CONTROL2);
++ val |= SDHCI_CTRL_TUNED_CLK;
++ sdhci_writew(host, val, SDHCI_HOST_CONTROL2);
++ } else {
++ val = sdhci_readw(host, SDHCI_HOST_CONTROL2);
++ val &= ~SDHCI_CTRL_TUNED_CLK;
++ sdhci_writew(host, val, SDHCI_HOST_CONTROL2);
++ }
++
++ /* DLL is only required for HS400 */
++ if (host->timing == MMC_TIMING_MMC_HS400 &&
++ !amd_host->dll_enabled) {
++ sdhci_acpi_amd_hs400_dll(host);
++ amd_host->dll_enabled = true;
++ }
+ }
+ }
+
++static int amd_sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
++{
++ int err;
++ struct sdhci_host *host = mmc_priv(mmc);
++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host);
++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host);
++
++ amd_host->tuned_clock = false;
++
++ err = sdhci_execute_tuning(mmc, opcode);
++
++ if (!err && !host->tuning_err)
++ amd_host->tuned_clock = true;
++
++ return err;
++}
++
+ static const struct sdhci_ops sdhci_acpi_ops_amd = {
+ .set_clock = sdhci_set_clock,
+ .set_bus_width = sdhci_set_bus_width,
+@@ -601,6 +646,7 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev,
+
+ host->mmc_host_ops.select_drive_strength = amd_select_drive_strength;
+ host->mmc_host_ops.set_ios = amd_set_ios;
++ host->mmc_host_ops.execute_tuning = amd_sdhci_execute_tuning;
+ return 0;
+ }
+
+@@ -612,6 +658,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = {
+ SDHCI_QUIRK_32BIT_ADMA_SIZE,
+ .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA,
+ .probe_slot = sdhci_acpi_emmc_amd_probe_slot,
++ .priv_size = sizeof(struct amd_sdhci_host),
+ };
+
+ struct sdhci_acpi_uid_slot {
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index bb6802448b2f4..af413805bbf1a 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -232,6 +232,14 @@ static void sdhci_pci_dumpregs(struct mmc_host *mmc)
+ sdhci_dumpregs(mmc_priv(mmc));
+ }
+
++static void sdhci_cqhci_reset(struct sdhci_host *host, u8 mask)
++{
++ if ((host->mmc->caps2 & MMC_CAP2_CQE) && (mask & SDHCI_RESET_ALL) &&
++ host->mmc->cqe_private)
++ cqhci_deactivate(host->mmc);
++ sdhci_reset(host, mask);
++}
++
+ /*****************************************************************************\
+ * *
+ * Hardware specific quirk handling *
+@@ -718,7 +726,7 @@ static const struct sdhci_ops sdhci_intel_glk_ops = {
+ .set_power = sdhci_intel_set_power,
+ .enable_dma = sdhci_pci_enable_dma,
+ .set_bus_width = sdhci_set_bus_width,
+- .reset = sdhci_reset,
++ .reset = sdhci_cqhci_reset,
+ .set_uhs_signaling = sdhci_set_uhs_signaling,
+ .hw_reset = sdhci_pci_hw_reset,
+ .irq = sdhci_cqhci_irq,
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index db1a8d1c96b36..0919ff11d8173 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -101,6 +101,12 @@
+ #define NVQUIRK_DIS_CARD_CLK_CONFIG_TAP BIT(8)
+ #define NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING BIT(9)
+
++/*
++ * NVQUIRK_HAS_TMCLK is for SoC's having separate timeout clock for Tegra
++ * SDMMC hardware data timeout.
++ */
++#define NVQUIRK_HAS_TMCLK BIT(10)
++
+ /* SDMMC CQE Base Address for Tegra Host Ver 4.1 and Higher */
+ #define SDHCI_TEGRA_CQE_BASE_ADDR 0xF000
+
+@@ -131,6 +137,7 @@ struct sdhci_tegra_autocal_offsets {
+ struct sdhci_tegra {
+ const struct sdhci_tegra_soc_data *soc_data;
+ struct gpio_desc *power_gpio;
++ struct clk *tmclk;
+ bool ddr_signaling;
+ bool pad_calib_required;
+ bool pad_control_available;
+@@ -1424,7 +1431,8 @@ static const struct sdhci_tegra_soc_data soc_data_tegra210 = {
+ NVQUIRK_HAS_PADCALIB |
+ NVQUIRK_DIS_CARD_CLK_CONFIG_TAP |
+ NVQUIRK_ENABLE_SDR50 |
+- NVQUIRK_ENABLE_SDR104,
++ NVQUIRK_ENABLE_SDR104 |
++ NVQUIRK_HAS_TMCLK,
+ .min_tap_delay = 106,
+ .max_tap_delay = 185,
+ };
+@@ -1462,6 +1470,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra186 = {
+ NVQUIRK_DIS_CARD_CLK_CONFIG_TAP |
+ NVQUIRK_ENABLE_SDR50 |
+ NVQUIRK_ENABLE_SDR104 |
++ NVQUIRK_HAS_TMCLK |
+ NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING,
+ .min_tap_delay = 84,
+ .max_tap_delay = 136,
+@@ -1474,7 +1483,8 @@ static const struct sdhci_tegra_soc_data soc_data_tegra194 = {
+ NVQUIRK_HAS_PADCALIB |
+ NVQUIRK_DIS_CARD_CLK_CONFIG_TAP |
+ NVQUIRK_ENABLE_SDR50 |
+- NVQUIRK_ENABLE_SDR104,
++ NVQUIRK_ENABLE_SDR104 |
++ NVQUIRK_HAS_TMCLK,
+ .min_tap_delay = 96,
+ .max_tap_delay = 139,
+ };
+@@ -1602,6 +1612,43 @@ static int sdhci_tegra_probe(struct platform_device *pdev)
+ goto err_power_req;
+ }
+
++ /*
++ * Tegra210 has a separate SDMMC_LEGACY_TM clock used for host
++ * timeout clock and SW can choose TMCLK or SDCLK for hardware
++ * data timeout through the bit USE_TMCLK_FOR_DATA_TIMEOUT of
++ * the register SDHCI_TEGRA_VENDOR_SYS_SW_CTRL.
++ *
++ * USE_TMCLK_FOR_DATA_TIMEOUT bit default is set to 1 and SDMMC uses
++ * 12Mhz TMCLK which is advertised in host capability register.
++ * With TMCLK of 12Mhz provides maximum data timeout period that can
++ * be achieved is 11s better than using SDCLK for data timeout.
++ *
++ * So, TMCLK is set to 12Mhz and kept enabled all the time on SoC's
++ * supporting separate TMCLK.
++ */
++
++ if (soc_data->nvquirks & NVQUIRK_HAS_TMCLK) {
++ clk = devm_clk_get(&pdev->dev, "tmclk");
++ if (IS_ERR(clk)) {
++ rc = PTR_ERR(clk);
++ if (rc == -EPROBE_DEFER)
++ goto err_power_req;
++
++ dev_warn(&pdev->dev, "failed to get tmclk: %d\n", rc);
++ clk = NULL;
++ }
++
++ clk_set_rate(clk, 12000000);
++ rc = clk_prepare_enable(clk);
++ if (rc) {
++ dev_err(&pdev->dev,
++ "failed to enable tmclk: %d\n", rc);
++ goto err_power_req;
++ }
++
++ tegra_host->tmclk = clk;
++ }
++
+ clk = devm_clk_get(mmc_dev(host->mmc), NULL);
+ if (IS_ERR(clk)) {
+ rc = PTR_ERR(clk);
+@@ -1645,6 +1692,7 @@ err_add_host:
+ err_rst_get:
+ clk_disable_unprepare(pltfm_host->clk);
+ err_clk_get:
++ clk_disable_unprepare(tegra_host->tmclk);
+ err_power_req:
+ err_parse_dt:
+ sdhci_pltfm_free(pdev);
+@@ -1662,6 +1710,7 @@ static int sdhci_tegra_remove(struct platform_device *pdev)
+ reset_control_assert(tegra_host->rst);
+ usleep_range(2000, 4000);
+ clk_disable_unprepare(pltfm_host->clk);
++ clk_disable_unprepare(tegra_host->tmclk);
+
+ sdhci_pltfm_free(pdev);
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 8dcb8a49ab67f..238417db26f9b 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1501,7 +1501,7 @@ unsupported:
+ phylink_set(mask, 100baseT_Full);
+
+ if (state->interface != PHY_INTERFACE_MODE_MII) {
+- phylink_set(mask, 1000baseT_Half);
++ /* This switch only supports 1G full-duplex. */
+ phylink_set(mask, 1000baseT_Full);
+ if (port == 5)
+ phylink_set(mask, 1000baseX_Full);
+diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c
+index 0187dbf3b87df..54cdafdd067db 100644
+--- a/drivers/net/ethernet/arc/emac_mdio.c
++++ b/drivers/net/ethernet/arc/emac_mdio.c
+@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
+ if (IS_ERR(data->reset_gpio)) {
+ error = PTR_ERR(data->reset_gpio);
+ dev_err(priv->dev, "Failed to request gpio: %d\n", error);
++ mdiobus_free(bus);
+ return error;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index b25356e21a1ea..e6ccc2122573d 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2462,8 +2462,10 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+ priv->tx_rings = devm_kcalloc(&pdev->dev, txq,
+ sizeof(struct bcm_sysport_tx_ring),
+ GFP_KERNEL);
+- if (!priv->tx_rings)
+- return -ENOMEM;
++ if (!priv->tx_rings) {
++ ret = -ENOMEM;
++ goto err_free_netdev;
++ }
+
+ priv->is_lite = params->is_lite;
+ priv->num_rx_desc_words = params->num_rx_desc_words;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 7463a1847cebd..cd5c7a1412c6d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1141,6 +1141,9 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+
+ static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
+ {
++ if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
++ return;
++
+ if (BNXT_PF(bp))
+ queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
+ else
+@@ -1157,10 +1160,12 @@ static void bnxt_queue_sp_work(struct bnxt *bp)
+
+ static void bnxt_cancel_sp_work(struct bnxt *bp)
+ {
+- if (BNXT_PF(bp))
++ if (BNXT_PF(bp)) {
+ flush_workqueue(bnxt_pf_wq);
+- else
++ } else {
+ cancel_work_sync(&bp->sp_task);
++ cancel_delayed_work_sync(&bp->fw_reset_task);
++ }
+ }
+
+ static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
+@@ -8987,16 +8992,19 @@ static ssize_t bnxt_show_temp(struct device *dev,
+ struct hwrm_temp_monitor_query_input req = {0};
+ struct hwrm_temp_monitor_query_output *resp;
+ struct bnxt *bp = dev_get_drvdata(dev);
+- u32 temp = 0;
++ u32 len = 0;
+
+ resp = bp->hwrm_cmd_resp_addr;
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1);
+ mutex_lock(&bp->hwrm_cmd_lock);
+- if (!_hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT))
+- temp = resp->temp * 1000; /* display millidegree */
++ if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT))
++ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */
+ mutex_unlock(&bp->hwrm_cmd_lock);
+
+- return sprintf(buf, "%u\n", temp);
++ if (len)
++ return len;
++
++ return sprintf(buf, "unknown\n");
+ }
+ static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
+
+@@ -9178,15 +9186,15 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ }
+ }
+
+- bnxt_enable_napi(bp);
+- bnxt_debug_dev_init(bp);
+-
+ rc = bnxt_init_nic(bp, irq_re_init);
+ if (rc) {
+ netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
+- goto open_err;
++ goto open_err_irq;
+ }
+
++ bnxt_enable_napi(bp);
++ bnxt_debug_dev_init(bp);
++
+ if (link_re_init) {
+ mutex_lock(&bp->link_lock);
+ rc = bnxt_update_phy_setting(bp);
+@@ -9217,10 +9225,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ bnxt_vf_reps_open(bp);
+ return 0;
+
+-open_err:
+- bnxt_debug_dev_exit(bp);
+- bnxt_disable_napi(bp);
+-
+ open_err_irq:
+ bnxt_del_napi(bp);
+
+@@ -11501,6 +11505,7 @@ static void bnxt_remove_one(struct pci_dev *pdev)
+ unregister_netdev(dev);
+ bnxt_dl_unregister(bp);
+ bnxt_shutdown_tc(bp);
++ clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
+ bnxt_cancel_sp_work(bp);
+ bp->sp_event = 0;
+
+@@ -12065,6 +12070,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ (long)pci_resource_start(pdev, 0), dev->dev_addr);
+ pcie_print_link_status(pdev);
+
++ pci_save_state(pdev);
+ return 0;
+
+ init_err_cleanup:
+@@ -12260,6 +12266,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ "Cannot re-enable PCI device after reset.\n");
+ } else {
+ pci_set_master(pdev);
++ pci_restore_state(pdev);
++ pci_save_state(pdev);
+
+ err = bnxt_hwrm_func_reset(bp);
+ if (!err) {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index b4aa56dc4f9fb..bc2c76fa54cad 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -494,20 +494,13 @@ static int bnxt_get_num_tpa_ring_stats(struct bnxt *bp)
+ static int bnxt_get_num_ring_stats(struct bnxt *bp)
+ {
+ int rx, tx, cmn;
+- bool sh = false;
+-
+- if (bp->flags & BNXT_FLAG_SHARED_RINGS)
+- sh = true;
+
+ rx = NUM_RING_RX_HW_STATS + NUM_RING_RX_SW_STATS +
+ bnxt_get_num_tpa_ring_stats(bp);
+ tx = NUM_RING_TX_HW_STATS;
+ cmn = NUM_RING_CMN_SW_STATS;
+- if (sh)
+- return (rx + tx + cmn) * bp->cp_nr_rings;
+- else
+- return rx * bp->rx_nr_rings + tx * bp->tx_nr_rings +
+- cmn * bp->cp_nr_rings;
++ return rx * bp->rx_nr_rings + tx * bp->tx_nr_rings +
++ cmn * bp->cp_nr_rings;
+ }
+
+ static int bnxt_get_num_stats(struct bnxt *bp)
+@@ -847,7 +840,7 @@ static void bnxt_get_channels(struct net_device *dev,
+ int max_tx_sch_inputs;
+
+ /* Get the most up-to-date max_tx_sch_inputs. */
+- if (BNXT_NEW_RM(bp))
++ if (netif_running(dev) && BNXT_NEW_RM(bp))
+ bnxt_hwrm_func_resc_qcaps(bp, false);
+ max_tx_sch_inputs = hw_resc->max_tx_sch_inputs;
+
+@@ -2270,6 +2263,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data)
+ if (rc != 0)
+ return rc;
+
++ if (!dir_entries || !entry_length)
++ return -EIO;
++
+ /* Insert 2 bytes of directory info (count and size of entries) */
+ if (len < 2)
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index e471b14fc6e98..f0074c873da3b 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1364,7 +1364,7 @@ static int bcmgenet_validate_flow(struct net_device *dev,
+ case ETHER_FLOW:
+ eth_mask = &cmd->fs.m_u.ether_spec;
+ /* don't allow mask which isn't valid */
+- if (VALIDATE_MASK(eth_mask->h_source) ||
++ if (VALIDATE_MASK(eth_mask->h_dest) ||
+ VALIDATE_MASK(eth_mask->h_source) ||
+ VALIDATE_MASK(eth_mask->h_proto)) {
+ netdev_err(dev, "rxnfc: Unsupported mask\n");
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index ebff1fc0d8cef..4515804d1ce4c 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -7221,8 +7221,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp)
+
+ static inline void tg3_reset_task_cancel(struct tg3 *tp)
+ {
+- cancel_work_sync(&tp->reset_task);
+- tg3_flag_clear(tp, RESET_TASK_PENDING);
++ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags))
++ cancel_work_sync(&tp->reset_task);
+ tg3_flag_clear(tp, TX_RECOVERY_PENDING);
+ }
+
+@@ -11209,18 +11209,27 @@ static void tg3_reset_task(struct work_struct *work)
+
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
+ err = tg3_init_hw(tp, true);
+- if (err)
++ if (err) {
++ tg3_full_unlock(tp);
++ tp->irq_sync = 0;
++ tg3_napi_enable(tp);
++ /* Clear this flag so that tg3_reset_task_cancel() will not
++ * call cancel_work_sync() and wait forever.
++ */
++ tg3_flag_clear(tp, RESET_TASK_PENDING);
++ dev_close(tp->dev);
+ goto out;
++ }
+
+ tg3_netif_start(tp);
+
+-out:
+ tg3_full_unlock(tp);
+
+ if (!err)
+ tg3_phy_start(tp);
+
+ tg3_flag_clear(tp, RESET_TASK_PENDING);
++out:
+ rtnl_unlock();
+ }
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c
+index 3de8a5e83b6c7..d7fefdbf3e575 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c
+@@ -62,6 +62,7 @@ static struct thermal_zone_device_ops cxgb4_thermal_ops = {
+ int cxgb4_thermal_init(struct adapter *adap)
+ {
+ struct ch_thermal *ch_thermal = &adap->ch_thermal;
++ char ch_tz_name[THERMAL_NAME_LENGTH];
+ int num_trip = CXGB4_NUM_TRIPS;
+ u32 param, val;
+ int ret;
+@@ -82,7 +83,8 @@ int cxgb4_thermal_init(struct adapter *adap)
+ ch_thermal->trip_type = THERMAL_TRIP_CRITICAL;
+ }
+
+- ch_thermal->tzdev = thermal_zone_device_register("cxgb4", num_trip,
++ snprintf(ch_tz_name, sizeof(ch_tz_name), "cxgb4_%s", adap->name);
++ ch_thermal->tzdev = thermal_zone_device_register(ch_tz_name, num_trip,
+ 0, adap,
+ &cxgb4_thermal_ops,
+ NULL, 0, 0);
+@@ -97,7 +99,9 @@ int cxgb4_thermal_init(struct adapter *adap)
+
+ int cxgb4_thermal_remove(struct adapter *adap)
+ {
+- if (adap->ch_thermal.tzdev)
++ if (adap->ch_thermal.tzdev) {
+ thermal_zone_device_unregister(adap->ch_thermal.tzdev);
++ adap->ch_thermal.tzdev = NULL;
++ }
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 62e271aea4a50..ffec0f3dd9578 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -2446,8 +2446,8 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ port->reset = devm_reset_control_get_exclusive(dev, NULL);
+ if (IS_ERR(port->reset)) {
+ dev_err(dev, "no reset\n");
+- clk_disable_unprepare(port->pclk);
+- return PTR_ERR(port->reset);
++ ret = PTR_ERR(port->reset);
++ goto unprepare;
+ }
+ reset_control_reset(port->reset);
+ usleep_range(100, 500);
+@@ -2502,25 +2502,25 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ IRQF_SHARED,
+ port_names[port->id],
+ port);
+- if (ret) {
+- clk_disable_unprepare(port->pclk);
+- return ret;
+- }
++ if (ret)
++ goto unprepare;
+
+ ret = register_netdev(netdev);
+- if (!ret) {
++ if (ret)
++ goto unprepare;
++
++ netdev_info(netdev,
++ "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n",
++ port->irq, &dmares->start,
++ &gmacres->start);
++ ret = gmac_setup_phy(netdev);
++ if (ret)
+ netdev_info(netdev,
+- "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n",
+- port->irq, &dmares->start,
+- &gmacres->start);
+- ret = gmac_setup_phy(netdev);
+- if (ret)
+- netdev_info(netdev,
+- "PHY init failed, deferring to ifup time\n");
+- return 0;
+- }
++ "PHY init failed, deferring to ifup time\n");
++ return 0;
+
+- port->netdev = NULL;
++unprepare:
++ clk_disable_unprepare(port->pclk);
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 23f278e46975b..22522f8a52999 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -2282,8 +2282,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ priv->enet_ver = AE_VERSION_1;
+ else if (acpi_dev_found(hns_enet_acpi_match[1].id))
+ priv->enet_ver = AE_VERSION_2;
+- else
+- return -ENXIO;
++ else {
++ ret = -ENXIO;
++ goto out_read_prop_fail;
++ }
+
+ /* try to find port-idx-in-ae first */
+ ret = acpi_node_get_property_reference(dev->fwnode,
+@@ -2299,7 +2301,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ priv->fwnode = args.fwnode;
+ } else {
+ dev_err(dev, "cannot read cfg data from OF or acpi\n");
+- return -ENXIO;
++ ret = -ENXIO;
++ goto out_read_prop_fail;
+ }
+
+ ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index d2986f1f2db02..d7444782bfdd0 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
+ goto err_out;
+
+ for (i = 0; i <= buddy->max_order; ++i) {
+- s = BITS_TO_LONGS(1 << (buddy->max_order - i));
++ s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
+ buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO);
+ if (!buddy->bits[i])
+ goto err_out_free;
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+index 2df3deedf9fd8..7248d248f6041 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+@@ -61,6 +61,7 @@ struct nfp_tun_active_tuns {
+ * @flags: options part of the request
+ * @tun_info.ipv6: dest IPv6 address of active route
+ * @tun_info.egress_port: port the encapsulated packet egressed
++ * @tun_info.extra: reserved for future use
+ * @tun_info: tunnels that have sent traffic in reported period
+ */
+ struct nfp_tun_active_tuns_v6 {
+@@ -70,6 +71,7 @@ struct nfp_tun_active_tuns_v6 {
+ struct route_ip_info_v6 {
+ struct in6_addr ipv6;
+ __be32 egress_port;
++ __be32 extra[2];
+ } tun_info[];
+ };
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 99f7aae102ce1..df89d09b253e2 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1342,6 +1342,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,
+ return error;
+ }
+
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++ struct platform_device *pdev = priv->pdev;
++ struct device *dev = &pdev->dev;
++ int error;
++
++ /* Bitbang init */
++ priv->mdiobb.ops = &bb_ops;
++
++ /* MII controller setting */
++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++ if (!priv->mii_bus)
++ return -ENOMEM;
++
++ /* Hook up MII support for ethtool */
++ priv->mii_bus->name = "ravb_mii";
++ priv->mii_bus->parent = dev;
++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++ pdev->name, pdev->id);
++
++ /* Register MDIO bus */
++ error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++ if (error)
++ goto out_free_bus;
++
++ return 0;
++
++out_free_bus:
++ free_mdio_bitbang(priv->mii_bus);
++ return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++ /* Unregister mdio bus */
++ mdiobus_unregister(priv->mii_bus);
++
++ /* Free bitbang info */
++ free_mdio_bitbang(priv->mii_bus);
++
++ return 0;
++}
++
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+@@ -1350,6 +1395,13 @@ static int ravb_open(struct net_device *ndev)
+ struct device *dev = &pdev->dev;
+ int error;
+
++ /* MDIO bus init */
++ error = ravb_mdio_init(priv);
++ if (error) {
++ netdev_err(ndev, "failed to initialize MDIO\n");
++ return error;
++ }
++
+ napi_enable(&priv->napi[RAVB_BE]);
+ napi_enable(&priv->napi[RAVB_NC]);
+
+@@ -1427,6 +1479,7 @@ out_free_irq:
+ out_napi_off:
+ napi_disable(&priv->napi[RAVB_NC]);
+ napi_disable(&priv->napi[RAVB_BE]);
++ ravb_mdio_release(priv);
+ return error;
+ }
+
+@@ -1736,6 +1789,8 @@ static int ravb_close(struct net_device *ndev)
+ ravb_ring_free(ndev, RAVB_BE);
+ ravb_ring_free(ndev, RAVB_NC);
+
++ ravb_mdio_release(priv);
++
+ return 0;
+ }
+
+@@ -1887,51 +1942,6 @@ static const struct net_device_ops ravb_netdev_ops = {
+ .ndo_set_features = ravb_set_features,
+ };
+
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+- struct platform_device *pdev = priv->pdev;
+- struct device *dev = &pdev->dev;
+- int error;
+-
+- /* Bitbang init */
+- priv->mdiobb.ops = &bb_ops;
+-
+- /* MII controller setting */
+- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+- if (!priv->mii_bus)
+- return -ENOMEM;
+-
+- /* Hook up MII support for ethtool */
+- priv->mii_bus->name = "ravb_mii";
+- priv->mii_bus->parent = dev;
+- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+- pdev->name, pdev->id);
+-
+- /* Register MDIO bus */
+- error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+- if (error)
+- goto out_free_bus;
+-
+- return 0;
+-
+-out_free_bus:
+- free_mdio_bitbang(priv->mii_bus);
+- return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+- /* Unregister mdio bus */
+- mdiobus_unregister(priv->mii_bus);
+-
+- /* Free bitbang info */
+- free_mdio_bitbang(priv->mii_bus);
+-
+- return 0;
+-}
+-
+ static const struct of_device_id ravb_match_table[] = {
+ { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+ { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -2174,13 +2184,6 @@ static int ravb_probe(struct platform_device *pdev)
+ eth_hw_addr_random(ndev);
+ }
+
+- /* MDIO bus init */
+- error = ravb_mdio_init(priv);
+- if (error) {
+- dev_err(&pdev->dev, "failed to initialize MDIO\n");
+- goto out_dma_free;
+- }
+-
+ netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+ netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+
+@@ -2202,8 +2205,6 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+-out_dma_free:
+ dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ priv->desc_bat_dma);
+
+@@ -2235,7 +2236,6 @@ static int ravb_remove(struct platform_device *pdev)
+ unregister_netdev(ndev);
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+ pm_runtime_disable(&pdev->dev);
+ free_netdev(ndev);
+ platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 88832277edd5a..c7c9980e02604 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -172,6 +172,8 @@ void am65_cpsw_nuss_adjust_link(struct net_device *ndev)
+ if (phy->speed == 10 && phy_interface_is_rgmii(phy))
+ /* Can be used with in band mode only */
+ mac_control |= CPSW_SL_CTL_EXT_EN;
++ if (phy->speed == 100 && phy->interface == PHY_INTERFACE_MODE_RMII)
++ mac_control |= CPSW_SL_CTL_IFCTL_A;
+ if (phy->duplex)
+ mac_control |= CPSW_SL_CTL_FULLDUPLEX;
+
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 9b17bbbe102fe..4a65edc5a3759 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -1116,7 +1116,7 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
+ HOST_PORT_NUM, ALE_VLAN, vid);
+ ret |= cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast,
+ 0, ALE_VLAN, vid);
+- ret |= cpsw_ale_flush_multicast(cpsw->ale, 0, vid);
++ ret |= cpsw_ale_flush_multicast(cpsw->ale, ALE_PORT_HOST, vid);
+ err:
+ pm_runtime_put(cpsw->dev);
+ return ret;
+diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c
+index 1247d35d42ef3..8ed78577cdedf 100644
+--- a/drivers/net/ethernet/ti/cpsw_new.c
++++ b/drivers/net/ethernet/ti/cpsw_new.c
+@@ -1032,19 +1032,34 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
+ return ret;
+ }
+
++ /* reset the return code as pm_runtime_get_sync() can return
++ * non zero values as well.
++ */
++ ret = 0;
+ for (i = 0; i < cpsw->data.slaves; i++) {
+ if (cpsw->slaves[i].ndev &&
+- vid == cpsw->slaves[i].port_vlan)
++ vid == cpsw->slaves[i].port_vlan) {
++ ret = -EINVAL;
+ goto err;
++ }
+ }
+
+ dev_dbg(priv->dev, "removing vlanid %d from vlan filter\n", vid);
+- cpsw_ale_del_vlan(cpsw->ale, vid, 0);
+- cpsw_ale_del_ucast(cpsw->ale, priv->mac_addr,
+- HOST_PORT_NUM, ALE_VLAN, vid);
+- cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast,
+- 0, ALE_VLAN, vid);
+- cpsw_ale_flush_multicast(cpsw->ale, 0, vid);
++ ret = cpsw_ale_del_vlan(cpsw->ale, vid, 0);
++ if (ret)
++ dev_err(priv->dev, "cpsw_ale_del_vlan() failed: ret %d\n", ret);
++ ret = cpsw_ale_del_ucast(cpsw->ale, priv->mac_addr,
++ HOST_PORT_NUM, ALE_VLAN, vid);
++ if (ret)
++ dev_err(priv->dev, "cpsw_ale_del_ucast() failed: ret %d\n",
++ ret);
++ ret = cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast,
++ 0, ALE_VLAN, vid);
++ if (ret)
++ dev_err(priv->dev, "cpsw_ale_del_mcast failed. ret %d\n",
++ ret);
++ cpsw_ale_flush_multicast(cpsw->ale, ALE_PORT_HOST, vid);
++ ret = 0;
+ err:
+ pm_runtime_put(cpsw->dev);
+ return ret;
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index 21640a035d7df..8e47d0112e5dc 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -1179,6 +1179,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
+ goto nlmsg_failure;
+
+ if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) ||
++ nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) ||
+ nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) ||
+ nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr))
+ goto nla_put_failure;
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index f3c04981b8da6..cd7032628a28c 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -215,9 +215,9 @@ static int dp83867_set_wol(struct phy_device *phydev,
+ if (wol->wolopts & WAKE_MAGICSECURE) {
+ phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP1,
+ (wol->sopass[1] << 8) | wol->sopass[0]);
+- phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP1,
++ phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP2,
+ (wol->sopass[3] << 8) | wol->sopass[2]);
+- phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP1,
++ phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP3,
+ (wol->sopass[5] << 8) | wol->sopass[4]);
+
+ val_rxcfg |= DP83867_WOL_SEC_EN;
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index e39f41efda3ec..7bc6e8f856fe0 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -296,7 +296,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal)
+
+ netdev_dbg(dev->net, "asix_get_phy_addr()\n");
+
+- if (ret < 0) {
++ if (ret < 2) {
+ netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret);
+ goto out;
+ }
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index f38548e6d55ec..fa0039dcacc66 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4148,7 +4148,7 @@ static void nvme_free_ctrl(struct device *dev)
+ container_of(dev, struct nvme_ctrl, ctrl_device);
+ struct nvme_subsystem *subsys = ctrl->subsys;
+
+- if (subsys && ctrl->instance != subsys->instance)
++ if (!subsys || ctrl->instance != subsys->instance)
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+
+ kfree(ctrl->effects);
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 6e2f623e472e9..58b035cc67a01 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -396,6 +396,9 @@ static void nvmet_keep_alive_timer(struct work_struct *work)
+
+ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl)
+ {
++ if (unlikely(ctrl->kato == 0))
++ return;
++
+ pr_debug("ctrl %d start keep-alive timer for %d secs\n",
+ ctrl->cntlid, ctrl->kato);
+
+@@ -405,6 +408,9 @@ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl)
+
+ static void nvmet_stop_keep_alive_timer(struct nvmet_ctrl *ctrl)
+ {
++ if (unlikely(ctrl->kato == 0))
++ return;
++
+ pr_debug("ctrl %d stop keep-alive\n", ctrl->cntlid);
+
+ cancel_delayed_work_sync(&ctrl->ka_work);
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 27fd3b5aa621c..f98a1ba4dc47c 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -2362,9 +2362,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)
+ return;
+ if (fcpreq->fcp_error ||
+ fcpreq->transferred_length != fcpreq->transfer_length) {
+- spin_lock(&fod->flock);
++ spin_lock_irqsave(&fod->flock, flags);
+ fod->abort = true;
+- spin_unlock(&fod->flock);
++ spin_unlock_irqrestore(&fod->flock, flags);
+
+ nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
+ return;
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 8c90f78717723..91dcad982d362 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -1265,13 +1265,19 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq)
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_remove);
+
+-void _opp_remove_all_static(struct opp_table *opp_table)
++bool _opp_remove_all_static(struct opp_table *opp_table)
+ {
+ struct dev_pm_opp *opp, *tmp;
++ bool ret = true;
+
+ mutex_lock(&opp_table->lock);
+
+- if (!opp_table->parsed_static_opps || --opp_table->parsed_static_opps)
++ if (!opp_table->parsed_static_opps) {
++ ret = false;
++ goto unlock;
++ }
++
++ if (--opp_table->parsed_static_opps)
+ goto unlock;
+
+ list_for_each_entry_safe(opp, tmp, &opp_table->opp_list, node) {
+@@ -1281,6 +1287,8 @@ void _opp_remove_all_static(struct opp_table *opp_table)
+
+ unlock:
+ mutex_unlock(&opp_table->lock);
++
++ return ret;
+ }
+
+ /**
+@@ -2382,13 +2390,15 @@ void _dev_pm_opp_find_and_remove_table(struct device *dev)
+ return;
+ }
+
+- _opp_remove_all_static(opp_table);
++ /*
++ * Drop the extra reference only if the OPP table was successfully added
++ * with dev_pm_opp_of_add_table() earlier.
++ **/
++ if (_opp_remove_all_static(opp_table))
++ dev_pm_opp_put_opp_table(opp_table);
+
+ /* Drop reference taken by _find_opp_table() */
+ dev_pm_opp_put_opp_table(opp_table);
+-
+- /* Drop reference taken while the OPP table was added */
+- dev_pm_opp_put_opp_table(opp_table);
+ }
+
+ /**
+diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
+index e51646ff279eb..c3fcd571e446d 100644
+--- a/drivers/opp/opp.h
++++ b/drivers/opp/opp.h
+@@ -212,7 +212,7 @@ struct opp_table {
+
+ /* Routines internal to opp core */
+ void dev_pm_opp_get(struct dev_pm_opp *opp);
+-void _opp_remove_all_static(struct opp_table *opp_table);
++bool _opp_remove_all_static(struct opp_table *opp_table);
+ void _get_opp_table_kref(struct opp_table *opp_table);
+ int _get_opp_count(struct opp_table *opp_table);
+ struct opp_table *_find_opp_table(struct device *dev);
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
+index bc27f9430eeb1..7c6b91f0e780a 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -199,6 +199,7 @@ static int cedrus_request_validate(struct media_request *req)
+ struct v4l2_ctrl *ctrl_test;
+ unsigned int count;
+ unsigned int i;
++ int ret = 0;
+
+ list_for_each_entry(obj, &req->objects, list) {
+ struct vb2_buffer *vb;
+@@ -243,12 +244,16 @@ static int cedrus_request_validate(struct media_request *req)
+ if (!ctrl_test) {
+ v4l2_info(&ctx->dev->v4l2_dev,
+ "Missing required codec control\n");
+- return -ENOENT;
++ ret = -ENOENT;
++ break;
+ }
+ }
+
+ v4l2_ctrl_request_hdl_put(hdl);
+
++ if (ret)
++ return ret;
++
+ return vb2_request_validate(req);
+ }
+
+diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c
+index bf7bae42c141c..6dc879fea9c8a 100644
+--- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c
++++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved.
+ */
+
+ #include <linux/bitops.h>
+@@ -191,7 +191,7 @@ static int qpnp_tm_get_temp(void *data, int *temp)
+ chip->temp = mili_celsius;
+ }
+
+- *temp = chip->temp < 0 ? 0 : chip->temp;
++ *temp = chip->temp;
+
+ return 0;
+ }
+diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+index 63b02bfb2adf6..fdb8a495ab69a 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+@@ -37,20 +37,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = {
+
+ /*
+ * Temperature values in milli degree celsius
+- * ADC code values from 530 to 923
++ * ADC code values from 13 to 107, see TRM
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
+ */
+ static const int
+ omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = {
+- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000,
+- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000,
+- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000,
+- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000,
+- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000,
+- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000,
+- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000,
+- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000,
+- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000,
+- 117000, 118000, 120000, 122000, 123000,
++ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000,
++ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000,
++ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000,
++ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500,
++ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000,
++ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000,
++ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000,
++ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000,
++ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000,
++ 115000, 117000, 118500, 120000, 122000, 123500, 125000,
+ };
+
+ /* OMAP4430 data */
+diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+index a453ff8eb313e..9a3955c3853ba 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+@@ -53,9 +53,13 @@
+ * and thresholds for OMAP4430.
+ */
+
+-/* ADC conversion table limits */
+-#define OMAP4430_ADC_START_VALUE 0
+-#define OMAP4430_ADC_END_VALUE 127
++/*
++ * ADC conversion table limits. Ignore values outside the TRM listed
++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
++ */
++#define OMAP4430_ADC_START_VALUE 13
++#define OMAP4430_ADC_END_VALUE 107
+ /* bandgap clock limits (no control on 4430) */
+ #define OMAP4430_MAX_FREQ 32768
+ #define OMAP4430_MIN_FREQ 32768
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 457c0bf8cbf83..ffdf6da016c21 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1047,7 +1047,7 @@ static unsigned int qcom_geni_serial_tx_empty(struct uart_port *uport)
+ }
+
+ #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
+-static int __init qcom_geni_console_setup(struct console *co, char *options)
++static int qcom_geni_console_setup(struct console *co, char *options)
+ {
+ struct uart_port *uport;
+ struct qcom_geni_serial_port *port;
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index 786fbb7d8be06..907bcbb93afbf 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -379,8 +379,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr,
+ int i, j;
+
+ for (i = 0; i < nr_pages; i++) {
+- err = gnttab_grant_foreign_access(dev->otherend_id,
+- virt_to_gfn(vaddr), 0);
++ unsigned long gfn;
++
++ if (is_vmalloc_addr(vaddr))
++ gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr));
++ else
++ gfn = virt_to_gfn(vaddr);
++
++ err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0);
+ if (err < 0) {
+ xenbus_dev_fatal(dev, err,
+ "granting access to ring page");
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index f708c45d5f664..29f11e10a7c7d 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -420,24 +420,51 @@ affs_mode_to_prot(struct inode *inode)
+ u32 prot = AFFS_I(inode)->i_protect;
+ umode_t mode = inode->i_mode;
+
++ /*
++ * First, clear all RWED bits for owner, group, other.
++ * Then, recalculate them afresh.
++ *
++ * We'll always clear the delete-inhibit bit for the owner, as that is
++ * the classic single-user mode AmigaOS protection bit and we need to
++ * stay compatible with all scenarios.
++ *
++ * Since multi-user AmigaOS is an extension, we'll only set the
++ * delete-allow bit if any of the other bits in the same user class
++ * (group/other) are used.
++ */
++ prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD
++ | FIBF_NOWRITE | FIBF_NODELETE
++ | FIBF_GRP_EXECUTE | FIBF_GRP_READ
++ | FIBF_GRP_WRITE | FIBF_GRP_DELETE
++ | FIBF_OTR_EXECUTE | FIBF_OTR_READ
++ | FIBF_OTR_WRITE | FIBF_OTR_DELETE);
++
++ /* Classic single-user AmigaOS flags. These are inverted. */
+ if (!(mode & 0100))
+ prot |= FIBF_NOEXECUTE;
+ if (!(mode & 0400))
+ prot |= FIBF_NOREAD;
+ if (!(mode & 0200))
+ prot |= FIBF_NOWRITE;
++
++ /* Multi-user extended flags. Not inverted. */
+ if (mode & 0010)
+ prot |= FIBF_GRP_EXECUTE;
+ if (mode & 0040)
+ prot |= FIBF_GRP_READ;
+ if (mode & 0020)
+ prot |= FIBF_GRP_WRITE;
++ if (mode & 0070)
++ prot |= FIBF_GRP_DELETE;
++
+ if (mode & 0001)
+ prot |= FIBF_OTR_EXECUTE;
+ if (mode & 0004)
+ prot |= FIBF_OTR_READ;
+ if (mode & 0002)
+ prot |= FIBF_OTR_WRITE;
++ if (mode & 0007)
++ prot |= FIBF_OTR_DELETE;
+
+ AFFS_I(inode)->i_protect = prot;
+ }
+diff --git a/fs/affs/file.c b/fs/affs/file.c
+index a85817f54483f..ba084b0b214b9 100644
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -428,6 +428,24 @@ static int affs_write_begin(struct file *file, struct address_space *mapping,
+ return ret;
+ }
+
++static int affs_write_end(struct file *file, struct address_space *mapping,
++ loff_t pos, unsigned int len, unsigned int copied,
++ struct page *page, void *fsdata)
++{
++ struct inode *inode = mapping->host;
++ int ret;
++
++ ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata);
++
++ /* Clear Archived bit on file writes, as AmigaOS would do */
++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
++ mark_inode_dirty(inode);
++ }
++
++ return ret;
++}
++
+ static sector_t _affs_bmap(struct address_space *mapping, sector_t block)
+ {
+ return generic_block_bmap(mapping,block,affs_get_block);
+@@ -437,7 +455,7 @@ const struct address_space_operations affs_aops = {
+ .readpage = affs_readpage,
+ .writepage = affs_writepage,
+ .write_begin = affs_write_begin,
+- .write_end = generic_write_end,
++ .write_end = affs_write_end,
+ .direct_IO = affs_direct_IO,
+ .bmap = _affs_bmap
+ };
+@@ -794,6 +812,12 @@ done:
+ if (tmp > inode->i_size)
+ inode->i_size = AFFS_I(inode)->mmu_private = tmp;
+
++ /* Clear Archived bit on file writes, as AmigaOS would do */
++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
++ mark_inode_dirty(inode);
++ }
++
+ err_first_bh:
+ unlock_page(page);
+ put_page(page);
+diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c
+index 5d9ef517cf816..e7e98ad63a91a 100644
+--- a/fs/afs/fs_probe.c
++++ b/fs/afs/fs_probe.c
+@@ -161,8 +161,8 @@ responded:
+ }
+ }
+
+- rtt_us = rxrpc_kernel_get_srtt(call->net->socket, call->rxcall);
+- if (rtt_us < server->probe.rtt) {
++ if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) &&
++ rtt_us < server->probe.rtt) {
+ server->probe.rtt = rtt_us;
+ server->rtt = rtt_us;
+ alist->preferred = index;
+diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c
+index e3aa013c21779..081b7e5b13f58 100644
+--- a/fs/afs/vl_probe.c
++++ b/fs/afs/vl_probe.c
+@@ -92,8 +92,8 @@ responded:
+ }
+ }
+
+- rtt_us = rxrpc_kernel_get_srtt(call->net->socket, call->rxcall);
+- if (rtt_us < server->probe.rtt) {
++ if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) &&
++ rtt_us < server->probe.rtt) {
+ server->probe.rtt = rtt_us;
+ alist->preferred = index;
+ have_result = true;
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index c037ef514b64a..8702e8a4d20db 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1814,7 +1814,6 @@ static struct btrfs_block_group *btrfs_create_block_group_cache(
+
+ cache->fs_info = fs_info;
+ cache->full_stripe_len = btrfs_full_stripe_len(fs_info, start);
+- set_free_space_tree_thresholds(cache);
+
+ cache->discard_index = BTRFS_DISCARD_INDEX_UNUSED;
+
+@@ -1928,6 +1927,8 @@ static int read_one_block_group(struct btrfs_fs_info *info,
+ if (ret < 0)
+ goto error;
+
++ set_free_space_tree_thresholds(cache);
++
+ if (need_clear) {
+ /*
+ * When we mount with old space cache, we need to
+@@ -2148,6 +2149,7 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans, u64 bytes_used,
+ return -ENOMEM;
+
+ cache->length = size;
++ set_free_space_tree_thresholds(cache);
+ cache->used = bytes_used;
+ cache->flags = type;
+ cache->last_byte_to_unpin = (u64)-1;
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 82ab6e5a386da..367e3044b620b 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1297,6 +1297,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
+ btrfs_tree_read_unlock_blocking(eb);
+ free_extent_buffer(eb);
+
++ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin),
++ eb_rewin, btrfs_header_level(eb_rewin));
+ btrfs_tree_read_lock(eb_rewin);
+ __tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
+ WARN_ON(btrfs_header_nritems(eb_rewin) >
+@@ -1370,7 +1372,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+
+ if (!eb)
+ return NULL;
+- btrfs_tree_read_lock(eb);
+ if (old_root) {
+ btrfs_set_header_bytenr(eb, eb->start);
+ btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
+@@ -1378,6 +1379,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ btrfs_set_header_level(eb, old_root->level);
+ btrfs_set_header_generation(eb, old_generation);
+ }
++ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb,
++ btrfs_header_level(eb));
++ btrfs_tree_read_lock(eb);
+ if (tm)
+ __tree_mod_log_rewind(fs_info, eb, time_seq, tm);
+ else
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 5871ef78edbac..e9eedc053fc52 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -4527,7 +4527,7 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ return ERR_PTR(-EUCLEAN);
+ }
+
+- btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level);
++ btrfs_set_buffer_lockdep_class(owner, buf, level);
+ btrfs_tree_lock(buf);
+ btrfs_clean_tree_block(buf);
+ clear_bit(EXTENT_BUFFER_STALE, &buf->bflags);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 8ba8788461ae5..df68736bdad1b 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -5640,9 +5640,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
+ }
+ }
+
+-int read_extent_buffer_to_user(const struct extent_buffer *eb,
+- void __user *dstv,
+- unsigned long start, unsigned long len)
++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
++ void __user *dstv,
++ unsigned long start, unsigned long len)
+ {
+ size_t cur;
+ size_t offset;
+@@ -5662,7 +5662,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb,
+
+ cur = min(len, (PAGE_SIZE - offset));
+ kaddr = page_address(page);
+- if (copy_to_user(dst, kaddr + offset, cur)) {
++ if (copy_to_user_nofault(dst, kaddr + offset, cur)) {
+ ret = -EFAULT;
+ break;
+ }
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index 87f60a48f7500..0ab8a20d282b8 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -241,9 +241,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
+ void read_extent_buffer(const struct extent_buffer *eb, void *dst,
+ unsigned long start,
+ unsigned long len);
+-int read_extent_buffer_to_user(const struct extent_buffer *eb,
+- void __user *dst, unsigned long start,
+- unsigned long len);
++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
++ void __user *dst, unsigned long start,
++ unsigned long len);
+ void write_extent_buffer_fsid(const struct extent_buffer *eb, const void *src);
+ void write_extent_buffer_chunk_tree_uuid(const struct extent_buffer *eb,
+ const void *src);
+diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
+index 8b1f5c8897b75..6b9faf3b0e967 100644
+--- a/fs/btrfs/free-space-tree.c
++++ b/fs/btrfs/free-space-tree.c
+@@ -22,6 +22,10 @@ void set_free_space_tree_thresholds(struct btrfs_block_group *cache)
+ size_t bitmap_size;
+ u64 num_bitmaps, total_bitmap_size;
+
++ if (WARN_ON(cache->length == 0))
++ btrfs_warn(cache->fs_info, "block group %llu length is zero",
++ cache->start);
++
+ /*
+ * We convert to bitmaps when the disk space required for using extents
+ * exceeds that required for using bitmaps.
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 1448bc43561c2..5cbebf32082ab 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2086,9 +2086,14 @@ static noinline int copy_to_sk(struct btrfs_path *path,
+ sh.len = item_len;
+ sh.transid = found_transid;
+
+- /* copy search result header */
+- if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) {
+- ret = -EFAULT;
++ /*
++ * Copy search result header. If we fault then loop again so we
++ * can fault in the pages and -EFAULT there if there's a
++ * problem. Otherwise we'll fault and then copy the buffer in
++ * properly this next time through
++ */
++ if (copy_to_user_nofault(ubuf + *sk_offset, &sh, sizeof(sh))) {
++ ret = 0;
+ goto out;
+ }
+
+@@ -2096,10 +2101,14 @@ static noinline int copy_to_sk(struct btrfs_path *path,
+
+ if (item_len) {
+ char __user *up = ubuf + *sk_offset;
+- /* copy the item */
+- if (read_extent_buffer_to_user(leaf, up,
+- item_off, item_len)) {
+- ret = -EFAULT;
++ /*
++ * Copy the item, same behavior as above, but reset the
++ * * sk_offset so we copy the full thing again.
++ */
++ if (read_extent_buffer_to_user_nofault(leaf, up,
++ item_off, item_len)) {
++ ret = 0;
++ *sk_offset -= sizeof(sh);
+ goto out;
+ }
+
+@@ -2184,6 +2193,10 @@ static noinline int search_ioctl(struct inode *inode,
+ key.offset = sk->min_offset;
+
+ while (1) {
++ ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset);
++ if (ret)
++ break;
++
+ ret = btrfs_search_forward(root, &key, path, sk->min_transid);
+ if (ret != 0) {
+ if (ret > 0)
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 5f5b21e389dbc..4e857e91c76e5 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -3783,50 +3783,84 @@ static noinline_for_stack int scrub_supers(struct scrub_ctx *sctx,
+ return 0;
+ }
+
++static void scrub_workers_put(struct btrfs_fs_info *fs_info)
++{
++ if (refcount_dec_and_mutex_lock(&fs_info->scrub_workers_refcnt,
++ &fs_info->scrub_lock)) {
++ struct btrfs_workqueue *scrub_workers = NULL;
++ struct btrfs_workqueue *scrub_wr_comp = NULL;
++ struct btrfs_workqueue *scrub_parity = NULL;
++
++ scrub_workers = fs_info->scrub_workers;
++ scrub_wr_comp = fs_info->scrub_wr_completion_workers;
++ scrub_parity = fs_info->scrub_parity_workers;
++
++ fs_info->scrub_workers = NULL;
++ fs_info->scrub_wr_completion_workers = NULL;
++ fs_info->scrub_parity_workers = NULL;
++ mutex_unlock(&fs_info->scrub_lock);
++
++ btrfs_destroy_workqueue(scrub_workers);
++ btrfs_destroy_workqueue(scrub_wr_comp);
++ btrfs_destroy_workqueue(scrub_parity);
++ }
++}
++
+ /*
+ * get a reference count on fs_info->scrub_workers. start worker if necessary
+ */
+ static noinline_for_stack int scrub_workers_get(struct btrfs_fs_info *fs_info,
+ int is_dev_replace)
+ {
++ struct btrfs_workqueue *scrub_workers = NULL;
++ struct btrfs_workqueue *scrub_wr_comp = NULL;
++ struct btrfs_workqueue *scrub_parity = NULL;
+ unsigned int flags = WQ_FREEZABLE | WQ_UNBOUND;
+ int max_active = fs_info->thread_pool_size;
++ int ret = -ENOMEM;
+
+- lockdep_assert_held(&fs_info->scrub_lock);
++ if (refcount_inc_not_zero(&fs_info->scrub_workers_refcnt))
++ return 0;
+
+- if (refcount_read(&fs_info->scrub_workers_refcnt) == 0) {
+- ASSERT(fs_info->scrub_workers == NULL);
+- fs_info->scrub_workers = btrfs_alloc_workqueue(fs_info, "scrub",
+- flags, is_dev_replace ? 1 : max_active, 4);
+- if (!fs_info->scrub_workers)
+- goto fail_scrub_workers;
+-
+- ASSERT(fs_info->scrub_wr_completion_workers == NULL);
+- fs_info->scrub_wr_completion_workers =
+- btrfs_alloc_workqueue(fs_info, "scrubwrc", flags,
+- max_active, 2);
+- if (!fs_info->scrub_wr_completion_workers)
+- goto fail_scrub_wr_completion_workers;
++ scrub_workers = btrfs_alloc_workqueue(fs_info, "scrub", flags,
++ is_dev_replace ? 1 : max_active, 4);
++ if (!scrub_workers)
++ goto fail_scrub_workers;
+
+- ASSERT(fs_info->scrub_parity_workers == NULL);
+- fs_info->scrub_parity_workers =
+- btrfs_alloc_workqueue(fs_info, "scrubparity", flags,
++ scrub_wr_comp = btrfs_alloc_workqueue(fs_info, "scrubwrc", flags,
+ max_active, 2);
+- if (!fs_info->scrub_parity_workers)
+- goto fail_scrub_parity_workers;
++ if (!scrub_wr_comp)
++ goto fail_scrub_wr_completion_workers;
+
++ scrub_parity = btrfs_alloc_workqueue(fs_info, "scrubparity", flags,
++ max_active, 2);
++ if (!scrub_parity)
++ goto fail_scrub_parity_workers;
++
++ mutex_lock(&fs_info->scrub_lock);
++ if (refcount_read(&fs_info->scrub_workers_refcnt) == 0) {
++ ASSERT(fs_info->scrub_workers == NULL &&
++ fs_info->scrub_wr_completion_workers == NULL &&
++ fs_info->scrub_parity_workers == NULL);
++ fs_info->scrub_workers = scrub_workers;
++ fs_info->scrub_wr_completion_workers = scrub_wr_comp;
++ fs_info->scrub_parity_workers = scrub_parity;
+ refcount_set(&fs_info->scrub_workers_refcnt, 1);
+- } else {
+- refcount_inc(&fs_info->scrub_workers_refcnt);
++ mutex_unlock(&fs_info->scrub_lock);
++ return 0;
+ }
+- return 0;
++ /* Other thread raced in and created the workers for us */
++ refcount_inc(&fs_info->scrub_workers_refcnt);
++ mutex_unlock(&fs_info->scrub_lock);
+
++ ret = 0;
++ btrfs_destroy_workqueue(scrub_parity);
+ fail_scrub_parity_workers:
+- btrfs_destroy_workqueue(fs_info->scrub_wr_completion_workers);
++ btrfs_destroy_workqueue(scrub_wr_comp);
+ fail_scrub_wr_completion_workers:
+- btrfs_destroy_workqueue(fs_info->scrub_workers);
++ btrfs_destroy_workqueue(scrub_workers);
+ fail_scrub_workers:
+- return -ENOMEM;
++ return ret;
+ }
+
+ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+@@ -3837,9 +3871,6 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ int ret;
+ struct btrfs_device *dev;
+ unsigned int nofs_flag;
+- struct btrfs_workqueue *scrub_workers = NULL;
+- struct btrfs_workqueue *scrub_wr_comp = NULL;
+- struct btrfs_workqueue *scrub_parity = NULL;
+
+ if (btrfs_fs_closing(fs_info))
+ return -EAGAIN;
+@@ -3886,13 +3917,17 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ if (IS_ERR(sctx))
+ return PTR_ERR(sctx);
+
++ ret = scrub_workers_get(fs_info, is_dev_replace);
++ if (ret)
++ goto out_free_ctx;
++
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true);
+ if (!dev || (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) &&
+ !is_dev_replace)) {
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+ ret = -ENODEV;
+- goto out_free_ctx;
++ goto out;
+ }
+
+ if (!is_dev_replace && !readonly &&
+@@ -3901,7 +3936,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ btrfs_err_in_rcu(fs_info, "scrub: device %s is not writable",
+ rcu_str_deref(dev->name));
+ ret = -EROFS;
+- goto out_free_ctx;
++ goto out;
+ }
+
+ mutex_lock(&fs_info->scrub_lock);
+@@ -3910,7 +3945,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+ ret = -EIO;
+- goto out_free_ctx;
++ goto out;
+ }
+
+ down_read(&fs_info->dev_replace.rwsem);
+@@ -3921,17 +3956,10 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+ ret = -EINPROGRESS;
+- goto out_free_ctx;
++ goto out;
+ }
+ up_read(&fs_info->dev_replace.rwsem);
+
+- ret = scrub_workers_get(fs_info, is_dev_replace);
+- if (ret) {
+- mutex_unlock(&fs_info->scrub_lock);
+- mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- goto out_free_ctx;
+- }
+-
+ sctx->readonly = readonly;
+ dev->scrub_ctx = sctx;
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+@@ -3984,24 +4012,14 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+
+ mutex_lock(&fs_info->scrub_lock);
+ dev->scrub_ctx = NULL;
+- if (refcount_dec_and_test(&fs_info->scrub_workers_refcnt)) {
+- scrub_workers = fs_info->scrub_workers;
+- scrub_wr_comp = fs_info->scrub_wr_completion_workers;
+- scrub_parity = fs_info->scrub_parity_workers;
+-
+- fs_info->scrub_workers = NULL;
+- fs_info->scrub_wr_completion_workers = NULL;
+- fs_info->scrub_parity_workers = NULL;
+- }
+ mutex_unlock(&fs_info->scrub_lock);
+
+- btrfs_destroy_workqueue(scrub_workers);
+- btrfs_destroy_workqueue(scrub_wr_comp);
+- btrfs_destroy_workqueue(scrub_parity);
++ scrub_workers_put(fs_info);
+ scrub_put_ctx(sctx);
+
+ return ret;
+-
++out:
++ scrub_workers_put(fs_info);
+ out_free_ctx:
+ scrub_free_ctx(sctx);
+
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index 517b44300a05c..7b1fee630f978 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -984,7 +984,7 @@ static int check_inode_item(struct extent_buffer *leaf,
+ /* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */
+ if (btrfs_inode_transid(leaf, iitem) > super_gen + 1) {
+ inode_item_err(leaf, slot,
+- "invalid inode generation: has %llu expect [0, %llu]",
++ "invalid inode transid: has %llu expect [0, %llu]",
+ btrfs_inode_transid(leaf, iitem), super_gen + 1);
+ return -EUCLEAN;
+ }
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 0fecf1e4d8f66..0e50b885d3fd6 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4462,6 +4462,7 @@ int btrfs_uuid_scan_kthread(void *data)
+ goto skip;
+ }
+ update_tree:
++ btrfs_release_path(path);
+ if (!btrfs_is_empty_uuid(root_item.uuid)) {
+ ret = btrfs_uuid_tree_add(trans, root_item.uuid,
+ BTRFS_UUID_KEY_SUBVOL,
+@@ -4486,6 +4487,7 @@ update_tree:
+ }
+
+ skip:
++ btrfs_release_path(path);
+ if (trans) {
+ ret = btrfs_end_transaction(trans);
+ trans = NULL;
+@@ -4493,7 +4495,6 @@ skip:
+ break;
+ }
+
+- btrfs_release_path(path);
+ if (key.offset < (u64)-1) {
+ key.offset++;
+ } else if (key.type < BTRFS_ROOT_ITEM_KEY) {
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index d51c3f2fdca02..327649883ec7c 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -2507,6 +2507,7 @@ const struct file_operations ceph_file_fops = {
+ .mmap = ceph_mmap,
+ .fsync = ceph_fsync,
+ .lock = ceph_lock,
++ .setlease = simple_nosetlease,
+ .flock = ceph_flock,
+ .splice_read = generic_file_splice_read,
+ .splice_write = iter_file_splice_write,
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index e0decff22ae27..8107e06d7f6f5 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1995,9 +1995,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ * during ep_insert().
+ */
+ if (list_empty(&epi->ffd.file->f_tfile_llink)) {
+- get_file(epi->ffd.file);
+- list_add(&epi->ffd.file->f_tfile_llink,
+- &tfile_check_list);
++ if (get_file_rcu(epi->ffd.file))
++ list_add(&epi->ffd.file->f_tfile_llink,
++ &tfile_check_list);
+ }
+ }
+ }
+diff --git a/fs/ext2/file.c b/fs/ext2/file.c
+index 60378ddf1424b..96044f5dbc0e0 100644
+--- a/fs/ext2/file.c
++++ b/fs/ext2/file.c
+@@ -93,8 +93,10 @@ static vm_fault_t ext2_dax_fault(struct vm_fault *vmf)
+ struct inode *inode = file_inode(vmf->vma->vm_file);
+ struct ext2_inode_info *ei = EXT2_I(inode);
+ vm_fault_t ret;
++ bool write = (vmf->flags & FAULT_FLAG_WRITE) &&
++ (vmf->vma->vm_flags & VM_SHARED);
+
+- if (vmf->flags & FAULT_FLAG_WRITE) {
++ if (write) {
+ sb_start_pagefault(inode->i_sb);
+ file_update_time(vmf->vma->vm_file);
+ }
+@@ -103,7 +105,7 @@ static vm_fault_t ext2_dax_fault(struct vm_fault *vmf)
+ ret = dax_iomap_fault(vmf, PE_SIZE_PTE, NULL, NULL, &ext2_iomap_ops);
+
+ up_read(&ei->dax_sem);
+- if (vmf->flags & FAULT_FLAG_WRITE)
++ if (write)
+ sb_end_pagefault(inode->i_sb);
+ return ret;
+ }
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index a76e55bc28ebf..27f467a0f008e 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -901,6 +901,36 @@ static void empty_ail1_list(struct gfs2_sbd *sdp)
+ }
+ }
+
++/**
++ * drain_bd - drain the buf and databuf queue for a failed transaction
++ * @tr: the transaction to drain
++ *
++ * When this is called, we're taking an error exit for a log write that failed
++ * but since we bypassed the after_commit functions, we need to remove the
++ * items from the buf and databuf queue.
++ */
++static void trans_drain(struct gfs2_trans *tr)
++{
++ struct gfs2_bufdata *bd;
++ struct list_head *head;
++
++ if (!tr)
++ return;
++
++ head = &tr->tr_buf;
++ while (!list_empty(head)) {
++ bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
++ list_del_init(&bd->bd_list);
++ kmem_cache_free(gfs2_bufdata_cachep, bd);
++ }
++ head = &tr->tr_databuf;
++ while (!list_empty(head)) {
++ bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
++ list_del_init(&bd->bd_list);
++ kmem_cache_free(gfs2_bufdata_cachep, bd);
++ }
++}
++
+ /**
+ * gfs2_log_flush - flush incore transaction(s)
+ * @sdp: the filesystem
+@@ -1005,6 +1035,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
+
+ out:
+ if (gfs2_withdrawn(sdp)) {
++ trans_drain(tr);
+ /**
+ * If the tr_list is empty, we're withdrawing during a log
+ * flush that targets a transaction, but the transaction was
+diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
+index a3dfa3aa87ad9..d897dd73c5999 100644
+--- a/fs/gfs2/trans.c
++++ b/fs/gfs2/trans.c
+@@ -52,6 +52,7 @@ int gfs2_trans_begin(struct gfs2_sbd *sdp, unsigned int blocks,
+ tr->tr_reserved += gfs2_struct2blk(sdp, revokes);
+ INIT_LIST_HEAD(&tr->tr_databuf);
+ INIT_LIST_HEAD(&tr->tr_buf);
++ INIT_LIST_HEAD(&tr->tr_list);
+ INIT_LIST_HEAD(&tr->tr_ail1_list);
+ INIT_LIST_HEAD(&tr->tr_ail2_list);
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 4115bfedf15dc..38f3ec15ba3b1 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -2697,8 +2697,15 @@ static int io_read(struct io_kiocb *req, bool force_nonblock)
+ else
+ ret2 = -EINVAL;
+
++ /* no retry on NONBLOCK marked file */
++ if (ret2 == -EAGAIN && (req->file->f_flags & O_NONBLOCK)) {
++ ret = 0;
++ goto done;
++ }
++
+ /* Catch -EAGAIN return for forced non-blocking submission */
+ if (!force_nonblock || ret2 != -EAGAIN) {
++ done:
+ kiocb_done(kiocb, ret2);
+ } else {
+ copy_iov:
+@@ -2823,7 +2830,13 @@ static int io_write(struct io_kiocb *req, bool force_nonblock)
+ */
+ if (ret2 == -EOPNOTSUPP && (kiocb->ki_flags & IOCB_NOWAIT))
+ ret2 = -EAGAIN;
++ /* no retry on NONBLOCK marked file */
++ if (ret2 == -EAGAIN && (req->file->f_flags & O_NONBLOCK)) {
++ ret = 0;
++ goto done;
++ }
+ if (!force_nonblock || ret2 != -EAGAIN) {
++done:
+ kiocb_done(kiocb, ret2);
+ } else {
+ copy_iov:
+@@ -6928,7 +6941,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
+ table = &ctx->file_data->table[i >> IORING_FILE_TABLE_SHIFT];
+ index = i & IORING_FILE_TABLE_MASK;
+ if (table->files[index]) {
+- file = io_file_from_index(ctx, index);
++ file = table->files[index];
+ err = io_queue_file_removal(data, file);
+ if (err)
+ break;
+@@ -6957,6 +6970,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
+ table->files[index] = file;
+ err = io_sqe_file_register(ctx, file, i);
+ if (err) {
++ table->files[index] = NULL;
+ fput(file);
+ break;
+ }
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 2f7e89e4be3e3..4eb2ecd31b0d2 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -996,8 +996,10 @@ xfs_attr_shortform_verify(
+ * struct xfs_attr_sf_entry has a variable length.
+ * Check the fixed-offset parts of the structure are
+ * within the data buffer.
++ * xfs_attr_sf_entry is defined with a 1-byte variable
++ * array at the end, so we must subtract that off.
+ */
+- if (((char *)sfep + sizeof(*sfep)) >= endp)
++ if (((char *)sfep + sizeof(*sfep) - 1) >= endp)
+ return __this_address;
+
+ /* Don't allow names with known bad length. */
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 667cdd0dfdf4a..aa784404964a0 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -6222,7 +6222,7 @@ xfs_bmap_validate_extent(
+
+ isrt = XFS_IS_REALTIME_INODE(ip);
+ endfsb = irec->br_startblock + irec->br_blockcount - 1;
+- if (isrt) {
++ if (isrt && whichfork == XFS_DATA_FORK) {
+ if (!xfs_verify_rtbno(mp, irec->br_startblock))
+ return __this_address;
+ if (!xfs_verify_rtbno(mp, endfsb))
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index afdc7f8e0e701..feb277874a1fb 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1165,7 +1165,7 @@ xfs_insert_file_space(
+ goto out_trans_cancel;
+
+ do {
+- error = xfs_trans_roll_inode(&tp, ip);
++ error = xfs_defer_finish(&tp);
+ if (error)
+ goto out_trans_cancel;
+
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index 00db81eac80d6..4d7385426149c 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -1220,6 +1220,14 @@ __xfs_filemap_fault(
+ return ret;
+ }
+
++static inline bool
++xfs_is_write_fault(
++ struct vm_fault *vmf)
++{
++ return (vmf->flags & FAULT_FLAG_WRITE) &&
++ (vmf->vma->vm_flags & VM_SHARED);
++}
++
+ static vm_fault_t
+ xfs_filemap_fault(
+ struct vm_fault *vmf)
+@@ -1227,7 +1235,7 @@ xfs_filemap_fault(
+ /* DAX can shortcut the normal fault path on write faults! */
+ return __xfs_filemap_fault(vmf, PE_SIZE_PTE,
+ IS_DAX(file_inode(vmf->vma->vm_file)) &&
+- (vmf->flags & FAULT_FLAG_WRITE));
++ xfs_is_write_fault(vmf));
+ }
+
+ static vm_fault_t
+@@ -1240,7 +1248,7 @@ xfs_filemap_huge_fault(
+
+ /* DAX can shortcut the normal fault path on write faults! */
+ return __xfs_filemap_fault(vmf, pe_size,
+- (vmf->flags & FAULT_FLAG_WRITE));
++ xfs_is_write_fault(vmf));
+ }
+
+ static vm_fault_t
+diff --git a/include/drm/drm_hdcp.h b/include/drm/drm_hdcp.h
+index c6bab4986a658..fe58dbb46962a 100644
+--- a/include/drm/drm_hdcp.h
++++ b/include/drm/drm_hdcp.h
+@@ -29,6 +29,9 @@
+ /* Slave address for the HDCP registers in the receiver */
+ #define DRM_HDCP_DDC_ADDR 0x3A
+
++/* Value to use at the end of the SHA-1 bytestream used for repeaters */
++#define DRM_HDCP_SHA1_TERMINATOR 0x80
++
+ /* HDCP register offsets for HDMI/DVI devices */
+ #define DRM_HDCP_DDC_BKSV 0x00
+ #define DRM_HDCP_DDC_RI_PRIME 0x08
+diff --git a/include/linux/bvec.h b/include/linux/bvec.h
+index ac0c7299d5b8a..dd74503f7e5ea 100644
+--- a/include/linux/bvec.h
++++ b/include/linux/bvec.h
+@@ -117,11 +117,18 @@ static inline bool bvec_iter_advance(const struct bio_vec *bv,
+ return true;
+ }
+
++static inline void bvec_iter_skip_zero_bvec(struct bvec_iter *iter)
++{
++ iter->bi_bvec_done = 0;
++ iter->bi_idx++;
++}
++
+ #define for_each_bvec(bvl, bio_vec, iter, start) \
+ for (iter = (start); \
+ (iter).bi_size && \
+ ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \
+- bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len))
++ (bvl).bv_len ? (void)bvec_iter_advance((bio_vec), &(iter), \
++ (bvl).bv_len) : bvec_iter_skip_zero_bvec(&(iter)))
+
+ /* for iterating one bio from start to end */
+ #define BVEC_ITER_ALL_INIT (struct bvec_iter) \
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 77ccf040a128b..5f550eb27f811 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -421,6 +421,7 @@ enum {
+ ATA_HORKAGE_NO_DMA_LOG = (1 << 23), /* don't use DMA for log read */
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */
++ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/linux/log2.h b/include/linux/log2.h
+index 83a4a3ca3e8a7..c619ec6eff4ae 100644
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -173,7 +173,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
+ #define roundup_pow_of_two(n) \
+ ( \
+ __builtin_constant_p(n) ? ( \
+- (n == 1) ? 1 : \
++ ((n) == 1) ? 1 : \
+ (1UL << (ilog2((n) - 1) + 1)) \
+ ) : \
+ __roundup_pow_of_two(n) \
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 851425c3178f1..89016d08f6a27 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group);
+ int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
+ unsigned int group, int echo, gfp_t flags);
+ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error);
+-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
+- int flags);
++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid);
+
+ static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
+ {
+diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
+index 91eacbdcf33d2..f6abcc0bbd6e7 100644
+--- a/include/net/af_rxrpc.h
++++ b/include/net/af_rxrpc.h
+@@ -59,7 +59,7 @@ bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *,
+ void rxrpc_kernel_end_call(struct socket *, struct rxrpc_call *);
+ void rxrpc_kernel_get_peer(struct socket *, struct rxrpc_call *,
+ struct sockaddr_rxrpc *);
+-u32 rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *);
++bool rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *, u32 *);
+ int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t,
+ rxrpc_user_attach_call_t, unsigned long, gfp_t,
+ unsigned int);
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 6f0f6fca9ac3e..ec2cbfab71f35 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -143,6 +143,8 @@ static inline u64 nft_reg_load64(const u32 *sreg)
+ static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
+ unsigned int len)
+ {
++ if (len % NFT_REG32_SIZE)
++ dst[len / NFT_REG32_SIZE] = 0;
+ memcpy(dst, src, len);
+ }
+
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 059b6e45a0283..c33079b986e86 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -138,11 +138,16 @@ enum rxrpc_recvmsg_trace {
+ };
+
+ enum rxrpc_rtt_tx_trace {
++ rxrpc_rtt_tx_cancel,
+ rxrpc_rtt_tx_data,
++ rxrpc_rtt_tx_no_slot,
+ rxrpc_rtt_tx_ping,
+ };
+
+ enum rxrpc_rtt_rx_trace {
++ rxrpc_rtt_rx_cancel,
++ rxrpc_rtt_rx_lost,
++ rxrpc_rtt_rx_obsolete,
+ rxrpc_rtt_rx_ping_response,
+ rxrpc_rtt_rx_requested_ack,
+ };
+@@ -339,10 +344,15 @@ enum rxrpc_tx_point {
+ E_(rxrpc_recvmsg_wait, "WAIT")
+
+ #define rxrpc_rtt_tx_traces \
++ EM(rxrpc_rtt_tx_cancel, "CNCE") \
+ EM(rxrpc_rtt_tx_data, "DATA") \
++ EM(rxrpc_rtt_tx_no_slot, "FULL") \
+ E_(rxrpc_rtt_tx_ping, "PING")
+
+ #define rxrpc_rtt_rx_traces \
++ EM(rxrpc_rtt_rx_cancel, "CNCL") \
++ EM(rxrpc_rtt_rx_obsolete, "OBSL") \
++ EM(rxrpc_rtt_rx_lost, "LOST") \
+ EM(rxrpc_rtt_rx_ping_response, "PONG") \
+ E_(rxrpc_rtt_rx_requested_ack, "RACK")
+
+@@ -1087,38 +1097,43 @@ TRACE_EVENT(rxrpc_recvmsg,
+
+ TRACE_EVENT(rxrpc_rtt_tx,
+ TP_PROTO(struct rxrpc_call *call, enum rxrpc_rtt_tx_trace why,
+- rxrpc_serial_t send_serial),
++ int slot, rxrpc_serial_t send_serial),
+
+- TP_ARGS(call, why, send_serial),
++ TP_ARGS(call, why, slot, send_serial),
+
+ TP_STRUCT__entry(
+ __field(unsigned int, call )
+ __field(enum rxrpc_rtt_tx_trace, why )
++ __field(int, slot )
+ __field(rxrpc_serial_t, send_serial )
+ ),
+
+ TP_fast_assign(
+ __entry->call = call->debug_id;
+ __entry->why = why;
++ __entry->slot = slot;
+ __entry->send_serial = send_serial;
+ ),
+
+- TP_printk("c=%08x %s sr=%08x",
++ TP_printk("c=%08x [%d] %s sr=%08x",
+ __entry->call,
++ __entry->slot,
+ __print_symbolic(__entry->why, rxrpc_rtt_tx_traces),
+ __entry->send_serial)
+ );
+
+ TRACE_EVENT(rxrpc_rtt_rx,
+ TP_PROTO(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why,
++ int slot,
+ rxrpc_serial_t send_serial, rxrpc_serial_t resp_serial,
+ u32 rtt, u32 rto),
+
+- TP_ARGS(call, why, send_serial, resp_serial, rtt, rto),
++ TP_ARGS(call, why, slot, send_serial, resp_serial, rtt, rto),
+
+ TP_STRUCT__entry(
+ __field(unsigned int, call )
+ __field(enum rxrpc_rtt_rx_trace, why )
++ __field(int, slot )
+ __field(rxrpc_serial_t, send_serial )
+ __field(rxrpc_serial_t, resp_serial )
+ __field(u32, rtt )
+@@ -1128,14 +1143,16 @@ TRACE_EVENT(rxrpc_rtt_rx,
+ TP_fast_assign(
+ __entry->call = call->debug_id;
+ __entry->why = why;
++ __entry->slot = slot;
+ __entry->send_serial = send_serial;
+ __entry->resp_serial = resp_serial;
+ __entry->rtt = rtt;
+ __entry->rto = rto;
+ ),
+
+- TP_printk("c=%08x %s sr=%08x rr=%08x rtt=%u rto=%u",
++ TP_printk("c=%08x [%d] %s sr=%08x rr=%08x rtt=%u rto=%u",
+ __entry->call,
++ __entry->slot,
+ __print_symbolic(__entry->why, rxrpc_rtt_rx_traces),
+ __entry->send_serial,
+ __entry->resp_serial,
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index 4565456c0ef44..0b27da1d771ba 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -133,7 +133,7 @@ enum nf_tables_msg_types {
+ * @NFTA_LIST_ELEM: list element (NLA_NESTED)
+ */
+ enum nft_list_attributes {
+- NFTA_LIST_UNPEC,
++ NFTA_LIST_UNSPEC,
+ NFTA_LIST_ELEM,
+ __NFTA_LIST_MAX
+ };
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 0fd80ac81f705..72e943b3bd656 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -2629,7 +2629,7 @@ static int bpf_raw_tp_link_fill_link_info(const struct bpf_link *link,
+ u32 ulen = info->raw_tracepoint.tp_name_len;
+ size_t tp_len = strlen(tp_name);
+
+- if (ulen && !ubuf)
++ if (!ulen ^ !ubuf)
+ return -EINVAL;
+
+ info->raw_tracepoint.tp_name_len = tp_len + 1;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 7952c6cb6f08c..e153509820958 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1251,21 +1251,32 @@ static struct page *alloc_gigantic_page(struct hstate *h, gfp_t gfp_mask,
+ int nid, nodemask_t *nodemask)
+ {
+ unsigned long nr_pages = 1UL << huge_page_order(h);
++ if (nid == NUMA_NO_NODE)
++ nid = numa_mem_id();
+
+ #ifdef CONFIG_CMA
+ {
+ struct page *page;
+ int node;
+
+- for_each_node_mask(node, *nodemask) {
+- if (!hugetlb_cma[node])
+- continue;
+-
+- page = cma_alloc(hugetlb_cma[node], nr_pages,
+- huge_page_order(h), true);
++ if (hugetlb_cma[nid]) {
++ page = cma_alloc(hugetlb_cma[nid], nr_pages,
++ huge_page_order(h), true);
+ if (page)
+ return page;
+ }
++
++ if (!(gfp_mask & __GFP_THISNODE)) {
++ for_each_node_mask(node, *nodemask) {
++ if (node == nid || !hugetlb_cma[node])
++ continue;
++
++ page = cma_alloc(hugetlb_cma[node], nr_pages,
++ huge_page_order(h), true);
++ if (page)
++ return page;
++ }
++ }
+ }
+ #endif
+
+@@ -3469,6 +3480,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array)
+ }
+
+ #ifdef CONFIG_SYSCTL
++static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write,
++ void *buffer, size_t *length,
++ loff_t *ppos, unsigned long *out)
++{
++ struct ctl_table dup_table;
++
++ /*
++ * In order to avoid races with __do_proc_doulongvec_minmax(), we
++ * can duplicate the @table and alter the duplicate of it.
++ */
++ dup_table = *table;
++ dup_table.data = out;
++
++ return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos);
++}
++
+ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+ struct ctl_table *table, int write,
+ void *buffer, size_t *length, loff_t *ppos)
+@@ -3480,9 +3507,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+ if (!hugepages_supported())
+ return -EOPNOTSUPP;
+
+- table->data = &tmp;
+- table->maxlen = sizeof(unsigned long);
+- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
++ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
++ &tmp);
+ if (ret)
+ goto out;
+
+@@ -3525,9 +3551,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
+ if (write && hstate_is_gigantic(h))
+ return -EINVAL;
+
+- table->data = &tmp;
+- table->maxlen = sizeof(unsigned long);
+- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
++ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
++ &tmp);
+ if (ret)
+ goto out;
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index dd592ea9a4a06..e6fc7c3e7dc98 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1709,7 +1709,7 @@ static void collapse_file(struct mm_struct *mm,
+ xas_unlock_irq(&xas);
+ page_cache_sync_readahead(mapping, &file->f_ra,
+ file, index,
+- PAGE_SIZE);
++ end - index);
+ /* drain pagevecs to help isolate_lru_page() */
+ lru_add_drain();
+ page = find_lock_page(mapping, index);
+diff --git a/mm/madvise.c b/mm/madvise.c
+index dd1d43cf026de..d4aa5f7765435 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -289,9 +289,9 @@ static long madvise_willneed(struct vm_area_struct *vma,
+ */
+ *prev = NULL; /* tell sys_madvise we drop mmap_lock */
+ get_file(file);
+- mmap_read_unlock(current->mm);
+ offset = (loff_t)(start - vma->vm_start)
+ + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
++ mmap_read_unlock(current->mm);
+ vfs_fadvise(file, offset, end - start, POSIX_FADV_WILLNEED);
+ fput(file);
+ mmap_read_lock(current->mm);
+diff --git a/mm/memory.c b/mm/memory.c
+index a279c1a26af7e..03c693ea59bda 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -71,6 +71,7 @@
+ #include <linux/dax.h>
+ #include <linux/oom.h>
+ #include <linux/numa.h>
++#include <linux/vmalloc.h>
+
+ #include <trace/events/kmem.h>
+
+@@ -2201,7 +2202,8 @@ EXPORT_SYMBOL(vm_iomap_memory);
+
+ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ unsigned long addr, unsigned long end,
+- pte_fn_t fn, void *data, bool create)
++ pte_fn_t fn, void *data, bool create,
++ pgtbl_mod_mask *mask)
+ {
+ pte_t *pte;
+ int err = 0;
+@@ -2209,7 +2211,7 @@ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
+
+ if (create) {
+ pte = (mm == &init_mm) ?
+- pte_alloc_kernel(pmd, addr) :
++ pte_alloc_kernel_track(pmd, addr, mask) :
+ pte_alloc_map_lock(mm, pmd, addr, &ptl);
+ if (!pte)
+ return -ENOMEM;
+@@ -2230,6 +2232,7 @@ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ break;
+ }
+ } while (addr += PAGE_SIZE, addr != end);
++ *mask |= PGTBL_PTE_MODIFIED;
+
+ arch_leave_lazy_mmu_mode();
+
+@@ -2240,7 +2243,8 @@ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
+
+ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+ unsigned long addr, unsigned long end,
+- pte_fn_t fn, void *data, bool create)
++ pte_fn_t fn, void *data, bool create,
++ pgtbl_mod_mask *mask)
+ {
+ pmd_t *pmd;
+ unsigned long next;
+@@ -2249,7 +2253,7 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+ BUG_ON(pud_huge(*pud));
+
+ if (create) {
+- pmd = pmd_alloc(mm, pud, addr);
++ pmd = pmd_alloc_track(mm, pud, addr, mask);
+ if (!pmd)
+ return -ENOMEM;
+ } else {
+@@ -2259,7 +2263,7 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+ next = pmd_addr_end(addr, end);
+ if (create || !pmd_none_or_clear_bad(pmd)) {
+ err = apply_to_pte_range(mm, pmd, addr, next, fn, data,
+- create);
++ create, mask);
+ if (err)
+ break;
+ }
+@@ -2269,14 +2273,15 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+
+ static int apply_to_pud_range(struct mm_struct *mm, p4d_t *p4d,
+ unsigned long addr, unsigned long end,
+- pte_fn_t fn, void *data, bool create)
++ pte_fn_t fn, void *data, bool create,
++ pgtbl_mod_mask *mask)
+ {
+ pud_t *pud;
+ unsigned long next;
+ int err = 0;
+
+ if (create) {
+- pud = pud_alloc(mm, p4d, addr);
++ pud = pud_alloc_track(mm, p4d, addr, mask);
+ if (!pud)
+ return -ENOMEM;
+ } else {
+@@ -2286,7 +2291,7 @@ static int apply_to_pud_range(struct mm_struct *mm, p4d_t *p4d,
+ next = pud_addr_end(addr, end);
+ if (create || !pud_none_or_clear_bad(pud)) {
+ err = apply_to_pmd_range(mm, pud, addr, next, fn, data,
+- create);
++ create, mask);
+ if (err)
+ break;
+ }
+@@ -2296,14 +2301,15 @@ static int apply_to_pud_range(struct mm_struct *mm, p4d_t *p4d,
+
+ static int apply_to_p4d_range(struct mm_struct *mm, pgd_t *pgd,
+ unsigned long addr, unsigned long end,
+- pte_fn_t fn, void *data, bool create)
++ pte_fn_t fn, void *data, bool create,
++ pgtbl_mod_mask *mask)
+ {
+ p4d_t *p4d;
+ unsigned long next;
+ int err = 0;
+
+ if (create) {
+- p4d = p4d_alloc(mm, pgd, addr);
++ p4d = p4d_alloc_track(mm, pgd, addr, mask);
+ if (!p4d)
+ return -ENOMEM;
+ } else {
+@@ -2313,7 +2319,7 @@ static int apply_to_p4d_range(struct mm_struct *mm, pgd_t *pgd,
+ next = p4d_addr_end(addr, end);
+ if (create || !p4d_none_or_clear_bad(p4d)) {
+ err = apply_to_pud_range(mm, p4d, addr, next, fn, data,
+- create);
++ create, mask);
+ if (err)
+ break;
+ }
+@@ -2326,8 +2332,9 @@ static int __apply_to_page_range(struct mm_struct *mm, unsigned long addr,
+ void *data, bool create)
+ {
+ pgd_t *pgd;
+- unsigned long next;
++ unsigned long start = addr, next;
+ unsigned long end = addr + size;
++ pgtbl_mod_mask mask = 0;
+ int err = 0;
+
+ if (WARN_ON(addr >= end))
+@@ -2338,11 +2345,14 @@ static int __apply_to_page_range(struct mm_struct *mm, unsigned long addr,
+ next = pgd_addr_end(addr, end);
+ if (!create && pgd_none_or_clear_bad(pgd))
+ continue;
+- err = apply_to_p4d_range(mm, pgd, addr, next, fn, data, create);
++ err = apply_to_p4d_range(mm, pgd, addr, next, fn, data, create, &mask);
+ if (err)
+ break;
+ } while (pgd++, addr = next, addr != end);
+
++ if (mask & ARCH_PAGE_TABLE_SYNC_MASK)
++ arch_sync_kernel_mappings(start, start + size);
++
+ return err;
+ }
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 40cd7016ae6fc..3511f9529ea60 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -251,7 +251,7 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
+ entry = make_device_private_entry(new, pte_write(pte));
+ pte = swp_entry_to_pte(entry);
+ if (pte_swp_uffd_wp(*pvmw.pte))
+- pte = pte_mkuffd_wp(pte);
++ pte = pte_swp_mkuffd_wp(pte);
+ }
+ }
+
+@@ -2330,10 +2330,17 @@ again:
+ entry = make_migration_entry(page, mpfn &
+ MIGRATE_PFN_WRITE);
+ swp_pte = swp_entry_to_pte(entry);
+- if (pte_soft_dirty(pte))
+- swp_pte = pte_swp_mksoft_dirty(swp_pte);
+- if (pte_uffd_wp(pte))
+- swp_pte = pte_swp_mkuffd_wp(swp_pte);
++ if (pte_present(pte)) {
++ if (pte_soft_dirty(pte))
++ swp_pte = pte_swp_mksoft_dirty(swp_pte);
++ if (pte_uffd_wp(pte))
++ swp_pte = pte_swp_mkuffd_wp(swp_pte);
++ } else {
++ if (pte_swp_soft_dirty(pte))
++ swp_pte = pte_swp_mksoft_dirty(swp_pte);
++ if (pte_swp_uffd_wp(pte))
++ swp_pte = pte_swp_mkuffd_wp(swp_pte);
++ }
+ set_pte_at(mm, addr, ptep, swp_pte);
+
+ /*
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 6cce9ef06753b..536f2706a6c8d 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1511,9 +1511,14 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+ */
+ entry = make_migration_entry(page, 0);
+ swp_pte = swp_entry_to_pte(entry);
+- if (pte_soft_dirty(pteval))
++
++ /*
++ * pteval maps a zone device page and is therefore
++ * a swap pte.
++ */
++ if (pte_swp_soft_dirty(pteval))
+ swp_pte = pte_swp_mksoft_dirty(swp_pte);
+- if (pte_uffd_wp(pteval))
++ if (pte_swp_uffd_wp(pteval))
+ swp_pte = pte_swp_mkuffd_wp(swp_pte);
+ set_pte_at(mm, pvmw.address, pvmw.pte, swp_pte);
+ /*
+diff --git a/mm/slub.c b/mm/slub.c
+index ef303070d175a..76d005862c4d9 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -680,12 +680,12 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...)
+ }
+
+ static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
+- void *freelist, void *nextfree)
++ void **freelist, void *nextfree)
+ {
+ if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
+- !check_valid_pointer(s, page, nextfree)) {
+- object_err(s, page, freelist, "Freechain corrupt");
+- freelist = NULL;
++ !check_valid_pointer(s, page, nextfree) && freelist) {
++ object_err(s, page, *freelist, "Freechain corrupt");
++ *freelist = NULL;
+ slab_fix(s, "Isolate corrupted freechain");
+ return true;
+ }
+@@ -1425,7 +1425,7 @@ static inline void dec_slabs_node(struct kmem_cache *s, int node,
+ int objects) {}
+
+ static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
+- void *freelist, void *nextfree)
++ void **freelist, void *nextfree)
+ {
+ return false;
+ }
+@@ -2117,7 +2117,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page,
+ * 'freelist' is already corrupted. So isolate all objects
+ * starting at 'freelist'.
+ */
+- if (freelist_corrupted(s, page, freelist, nextfree))
++ if (freelist_corrupted(s, page, &freelist, nextfree))
+ break;
+
+ do {
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index 18028b9f95f01..65b1280cf2fc1 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -874,6 +874,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset,
+ ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl,
+ ogm_packet->version, ntohs(ogm_packet->tvlv_len));
+
++ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) {
++ batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
++ "Drop packet: originator packet from ourself\n");
++ return;
++ }
++
+ /* If the throughput metric is 0, immediately drop the packet. No need
+ * to create orig_node / neigh_node for an unusable route.
+ */
+@@ -1001,11 +1007,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
+ if (batadv_is_my_mac(bat_priv, ethhdr->h_source))
+ goto free_skb;
+
+- ogm_packet = (struct batadv_ogm2_packet *)skb->data;
+-
+- if (batadv_is_my_mac(bat_priv, ogm_packet->orig))
+- goto free_skb;
+-
+ batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX);
+ batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES,
+ skb->len + ETH_HLEN);
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 41cc87f06b142..cfb9e16afe38a 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -437,7 +437,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac,
+ batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+ skb->len + ETH_HLEN);
+
+- netif_rx(skb);
++ if (in_interrupt())
++ netif_rx(skb);
++ else
++ netif_rx_ni(skb);
+ out:
+ if (primary_if)
+ batadv_hardif_put(primary_if);
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index a18dcc686dc31..ef3f85b576c4c 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -703,8 +703,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
+
+ chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
+ /* store the client address if the message is going to a client */
+- if (ret == BATADV_DHCP_TO_CLIENT &&
+- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) {
++ if (ret == BATADV_DHCP_TO_CLIENT) {
++ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN))
++ return BATADV_DHCP_NO;
++
+ /* check if the DHCP packet carries an Ethernet DHCP */
+ p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
+ if (*p != BATADV_DHCP_HTYPE_ETHERNET)
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 41fba93d857a6..fc28dc201b936 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3370,7 +3370,7 @@ done:
+ bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
+ action, ret);
+
+- return NOTIFY_STOP;
++ return NOTIFY_DONE;
+ }
+
+ /* Alloc HCI device */
+diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
+index 760ca24228165..af402f458ee02 100644
+--- a/net/netfilter/nf_conntrack_proto_udp.c
++++ b/net/netfilter/nf_conntrack_proto_udp.c
+@@ -81,18 +81,6 @@ static bool udp_error(struct sk_buff *skb,
+ return false;
+ }
+
+-static void nf_conntrack_udp_refresh_unreplied(struct nf_conn *ct,
+- struct sk_buff *skb,
+- enum ip_conntrack_info ctinfo,
+- u32 extra_jiffies)
+-{
+- if (unlikely(ctinfo == IP_CT_ESTABLISHED_REPLY &&
+- ct->status & IPS_NAT_CLASH))
+- nf_ct_kill(ct);
+- else
+- nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies);
+-}
+-
+ /* Returns verdict for packet, and may modify conntracktype */
+ int nf_conntrack_udp_packet(struct nf_conn *ct,
+ struct sk_buff *skb,
+@@ -124,12 +112,15 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
+
+ nf_ct_refresh_acct(ct, ctinfo, skb, extra);
+
++ /* never set ASSURED for IPS_NAT_CLASH, they time out soon */
++ if (unlikely((ct->status & IPS_NAT_CLASH)))
++ return NF_ACCEPT;
++
+ /* Also, more likely to be important, and not a probe */
+ if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
+ nf_conntrack_event_cache(IPCT_ASSURED, ct);
+ } else {
+- nf_conntrack_udp_refresh_unreplied(ct, skb, ctinfo,
+- timeouts[UDP_CT_UNREPLIED]);
++ nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
+ }
+ return NF_ACCEPT;
+ }
+@@ -206,12 +197,15 @@ int nf_conntrack_udplite_packet(struct nf_conn *ct,
+ if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+ nf_ct_refresh_acct(ct, ctinfo, skb,
+ timeouts[UDP_CT_REPLIED]);
++
++ if (unlikely((ct->status & IPS_NAT_CLASH)))
++ return NF_ACCEPT;
++
+ /* Also, more likely to be important, and not a probe */
+ if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
+ nf_conntrack_event_cache(IPCT_ASSURED, ct);
+ } else {
+- nf_conntrack_udp_refresh_unreplied(ct, skb, ctinfo,
+- timeouts[UDP_CT_UNREPLIED]);
++ nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
+ }
+ return NF_ACCEPT;
+ }
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index d31832d32e028..05059f620d41e 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -797,11 +797,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
+ family, table);
+ if (err < 0)
+- goto err;
++ goto err_fill_table_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_table_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -1527,11 +1527,11 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
+ family, table, chain);
+ if (err < 0)
+- goto err;
++ goto err_fill_chain_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_chain_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -2898,11 +2898,11 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
+ family, table, chain, rule, NULL);
+ if (err < 0)
+- goto err;
++ goto err_fill_rule_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_rule_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -3643,7 +3643,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
+ goto nla_put_failure;
+ }
+
+- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
++ if (set->udata &&
++ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
+ goto nla_put_failure;
+
+ nest = nla_nest_start_noflag(skb, NFTA_SET_DESC);
+@@ -3828,11 +3829,11 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
+
+ err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
+ if (err < 0)
+- goto err;
++ goto err_fill_set_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_set_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -4720,24 +4721,18 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ err = -ENOMEM;
+ skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+ if (skb == NULL)
+- goto err1;
++ return err;
+
+ err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
+ NFT_MSG_NEWSETELEM, 0, set, &elem);
+ if (err < 0)
+- goto err2;
++ goto err_fill_setelem;
+
+- err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
+- /* This avoids a loop in nfnetlink. */
+- if (err < 0)
+- goto err1;
++ return nfnetlink_unicast(skb, ctx->net, ctx->portid);
+
+- return 0;
+-err2:
++err_fill_setelem:
+ kfree_skb(skb);
+-err1:
+- /* this avoids a loop in nfnetlink. */
+- return err == -EAGAIN ? -ENOBUFS : err;
++ return err;
+ }
+
+ /* called with rcu_read_lock held */
+@@ -5991,10 +5986,11 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
+ family, table, obj, reset);
+ if (err < 0)
+- goto err;
++ goto err_fill_obj_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+-err:
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++
++err_fill_obj_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -6843,10 +6839,11 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
+ NFT_MSG_NEWFLOWTABLE, 0, family,
+ flowtable, &flowtable->hook_list);
+ if (err < 0)
+- goto err;
++ goto err_fill_flowtable_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+-err:
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++
++err_fill_flowtable_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -7017,10 +7014,11 @@ static int nf_tables_getgen(struct net *net, struct sock *nlsk,
+ err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
+ nlh->nlmsg_seq);
+ if (err < 0)
+- goto err;
++ goto err_fill_gen_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+-err:
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++
++err_fill_gen_info:
+ kfree_skb(skb2);
+ return err;
+ }
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 5f24edf958309..3a2e64e13b227 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -149,10 +149,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error)
+ }
+ EXPORT_SYMBOL_GPL(nfnetlink_set_err);
+
+-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
+- int flags)
++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid)
+ {
+- return netlink_unicast(net->nfnl, skb, portid, flags);
++ int err;
++
++ err = nlmsg_unicast(net->nfnl, skb, portid);
++ if (err == -EAGAIN)
++ err = -ENOBUFS;
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(nfnetlink_unicast);
+
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 0ba020ca38e68..7ca2ca4bba055 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -356,8 +356,7 @@ __nfulnl_send(struct nfulnl_instance *inst)
+ goto out;
+ }
+ }
+- nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
+- MSG_DONTWAIT);
++ nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid);
+ out:
+ inst->qlen = 0;
+ inst->skb = NULL;
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index 3243a31f6e829..70d086944bcc7 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -681,7 +681,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
+ *packet_id_ptr = htonl(entry->id);
+
+ /* nfnetlink_unicast will either free the nskb or add it to a socket */
+- err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT);
++ err = nfnetlink_unicast(nskb, net, queue->peer_portid);
+ if (err < 0) {
+ if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
+ failopen = 1;
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 3b9b97aa4b32e..3a6c84fb2c90d 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -102,7 +102,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ }
+
+ if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
+- ct->status & IPS_SEQ_ADJUST)
++ ct->status & (IPS_SEQ_ADJUST | IPS_NAT_CLASH))
+ goto out;
+
+ if (!nf_ct_is_confirmed(ct))
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index a7de3a58f553d..67ce866a446d9 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -87,7 +87,9 @@ void nft_payload_eval(const struct nft_expr *expr,
+ u32 *dest = ®s->data[priv->dreg];
+ int offset;
+
+- dest[priv->len / NFT_REG32_SIZE] = 0;
++ if (priv->len % NFT_REG32_SIZE)
++ dest[priv->len / NFT_REG32_SIZE] = 0;
++
+ switch (priv->base) {
+ case NFT_PAYLOAD_LL_HEADER:
+ if (!skb_mac_header_was_set(skb))
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 301f41d4929bd..82f7802983797 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2170,7 +2170,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ int skb_len = skb->len;
+ unsigned int snaplen, res;
+ unsigned long status = TP_STATUS_USER;
+- unsigned short macoff, netoff, hdrlen;
++ unsigned short macoff, hdrlen;
++ unsigned int netoff;
+ struct sk_buff *copy_skb = NULL;
+ struct timespec64 ts;
+ __u32 ts_status;
+@@ -2239,6 +2240,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ }
+ macoff = netoff - maclen;
+ }
++ if (netoff > USHRT_MAX) {
++ atomic_inc(&po->tp_drops);
++ goto drop_n_restore;
++ }
+ if (po->tp_version <= TPACKET_V2) {
+ if (macoff + snaplen > po->rx_ring.frame_size) {
+ if (po->copy_thresh &&
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 9a2139ebd67d7..ca1fea72c8d29 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -488,7 +488,6 @@ enum rxrpc_call_flag {
+ RXRPC_CALL_RX_LAST, /* Received the last packet (at rxtx_top) */
+ RXRPC_CALL_TX_LAST, /* Last packet in Tx buffer (at rxtx_top) */
+ RXRPC_CALL_SEND_PING, /* A ping will need to be sent */
+- RXRPC_CALL_PINGING, /* Ping in process */
+ RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */
+ RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */
+ RXRPC_CALL_RX_HEARD, /* The peer responded at least once to this call */
+@@ -673,9 +672,13 @@ struct rxrpc_call {
+ rxrpc_seq_t ackr_consumed; /* Highest packet shown consumed */
+ rxrpc_seq_t ackr_seen; /* Highest packet shown seen */
+
+- /* ping management */
+- rxrpc_serial_t ping_serial; /* Last ping sent */
+- ktime_t ping_time; /* Time last ping sent */
++ /* RTT management */
++ rxrpc_serial_t rtt_serial[4]; /* Serial number of DATA or PING sent */
++ ktime_t rtt_sent_at[4]; /* Time packet sent */
++ unsigned long rtt_avail; /* Mask of available slots in bits 0-3,
++ * Mask of pending samples in 8-11 */
++#define RXRPC_CALL_RTT_AVAIL_MASK 0xf
++#define RXRPC_CALL_RTT_PEND_SHIFT 8
+
+ /* transmission-phase ACK management */
+ ktime_t acks_latest_ts; /* Timestamp of latest ACK received */
+@@ -1037,7 +1040,7 @@ static inline bool __rxrpc_abort_eproto(struct rxrpc_call *call,
+ /*
+ * rtt.c
+ */
+-void rxrpc_peer_add_rtt(struct rxrpc_call *, enum rxrpc_rtt_rx_trace,
++void rxrpc_peer_add_rtt(struct rxrpc_call *, enum rxrpc_rtt_rx_trace, int,
+ rxrpc_serial_t, rxrpc_serial_t, ktime_t, ktime_t);
+ unsigned long rxrpc_get_rto_backoff(struct rxrpc_peer *, bool);
+ void rxrpc_peer_init_rtt(struct rxrpc_peer *);
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index 38a46167523fa..a40fae0139423 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -153,6 +153,7 @@ struct rxrpc_call *rxrpc_alloc_call(struct rxrpc_sock *rx, gfp_t gfp,
+ call->cong_ssthresh = RXRPC_RXTX_BUFF_SIZE - 1;
+
+ call->rxnet = rxnet;
++ call->rtt_avail = RXRPC_CALL_RTT_AVAIL_MASK;
+ atomic_inc(&rxnet->nr_calls);
+ return call;
+
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 767579328a069..19ddfc9807e89 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -608,36 +608,57 @@ unlock:
+ }
+
+ /*
+- * Process a requested ACK.
++ * See if there's a cached RTT probe to complete.
+ */
+-static void rxrpc_input_requested_ack(struct rxrpc_call *call,
+- ktime_t resp_time,
+- rxrpc_serial_t orig_serial,
+- rxrpc_serial_t ack_serial)
++static void rxrpc_complete_rtt_probe(struct rxrpc_call *call,
++ ktime_t resp_time,
++ rxrpc_serial_t acked_serial,
++ rxrpc_serial_t ack_serial,
++ enum rxrpc_rtt_rx_trace type)
+ {
+- struct rxrpc_skb_priv *sp;
+- struct sk_buff *skb;
++ rxrpc_serial_t orig_serial;
++ unsigned long avail;
+ ktime_t sent_at;
+- int ix;
++ bool matched = false;
++ int i;
+
+- for (ix = 0; ix < RXRPC_RXTX_BUFF_SIZE; ix++) {
+- skb = call->rxtx_buffer[ix];
+- if (!skb)
+- continue;
++ avail = READ_ONCE(call->rtt_avail);
++ smp_rmb(); /* Read avail bits before accessing data. */
+
+- sent_at = skb->tstamp;
+- smp_rmb(); /* Read timestamp before serial. */
+- sp = rxrpc_skb(skb);
+- if (sp->hdr.serial != orig_serial)
++ for (i = 0; i < ARRAY_SIZE(call->rtt_serial); i++) {
++ if (!test_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &avail))
+ continue;
+- goto found;
+- }
+
+- return;
++ sent_at = call->rtt_sent_at[i];
++ orig_serial = call->rtt_serial[i];
++
++ if (orig_serial == acked_serial) {
++ clear_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail);
++ smp_mb(); /* Read data before setting avail bit */
++ set_bit(i, &call->rtt_avail);
++ if (type != rxrpc_rtt_rx_cancel)
++ rxrpc_peer_add_rtt(call, type, i, acked_serial, ack_serial,
++ sent_at, resp_time);
++ else
++ trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_cancel, i,
++ orig_serial, acked_serial, 0, 0);
++ matched = true;
++ }
++
++ /* If a later serial is being acked, then mark this slot as
++ * being available.
++ */
++ if (after(acked_serial, orig_serial)) {
++ trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_obsolete, i,
++ orig_serial, acked_serial, 0, 0);
++ clear_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail);
++ smp_wmb();
++ set_bit(i, &call->rtt_avail);
++ }
++ }
+
+-found:
+- rxrpc_peer_add_rtt(call, rxrpc_rtt_rx_requested_ack,
+- orig_serial, ack_serial, sent_at, resp_time);
++ if (!matched)
++ trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_lost, 9, 0, acked_serial, 0, 0);
+ }
+
+ /*
+@@ -682,27 +703,11 @@ static void rxrpc_input_check_for_lost_ack(struct rxrpc_call *call)
+ */
+ static void rxrpc_input_ping_response(struct rxrpc_call *call,
+ ktime_t resp_time,
+- rxrpc_serial_t orig_serial,
++ rxrpc_serial_t acked_serial,
+ rxrpc_serial_t ack_serial)
+ {
+- rxrpc_serial_t ping_serial;
+- ktime_t ping_time;
+-
+- ping_time = call->ping_time;
+- smp_rmb();
+- ping_serial = READ_ONCE(call->ping_serial);
+-
+- if (orig_serial == call->acks_lost_ping)
++ if (acked_serial == call->acks_lost_ping)
+ rxrpc_input_check_for_lost_ack(call);
+-
+- if (before(orig_serial, ping_serial) ||
+- !test_and_clear_bit(RXRPC_CALL_PINGING, &call->flags))
+- return;
+- if (after(orig_serial, ping_serial))
+- return;
+-
+- rxrpc_peer_add_rtt(call, rxrpc_rtt_rx_ping_response,
+- orig_serial, ack_serial, ping_time, resp_time);
+ }
+
+ /*
+@@ -843,7 +848,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
+ struct rxrpc_ackinfo info;
+ u8 acks[RXRPC_MAXACKS];
+ } buf;
+- rxrpc_serial_t acked_serial;
++ rxrpc_serial_t ack_serial, acked_serial;
+ rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
+ int nr_acks, offset, ioffset;
+
+@@ -856,6 +861,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
+ }
+ offset += sizeof(buf.ack);
+
++ ack_serial = sp->hdr.serial;
+ acked_serial = ntohl(buf.ack.serial);
+ first_soft_ack = ntohl(buf.ack.firstPacket);
+ prev_pkt = ntohl(buf.ack.previousPacket);
+@@ -864,31 +870,42 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
+ summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
+ buf.ack.reason : RXRPC_ACK__INVALID);
+
+- trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
++ trace_rxrpc_rx_ack(call, ack_serial, acked_serial,
+ first_soft_ack, prev_pkt,
+ summary.ack_reason, nr_acks);
+
+- if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
++ switch (buf.ack.reason) {
++ case RXRPC_ACK_PING_RESPONSE:
+ rxrpc_input_ping_response(call, skb->tstamp, acked_serial,
+- sp->hdr.serial);
+- if (buf.ack.reason == RXRPC_ACK_REQUESTED)
+- rxrpc_input_requested_ack(call, skb->tstamp, acked_serial,
+- sp->hdr.serial);
++ ack_serial);
++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial,
++ rxrpc_rtt_rx_ping_response);
++ break;
++ case RXRPC_ACK_REQUESTED:
++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial,
++ rxrpc_rtt_rx_requested_ack);
++ break;
++ default:
++ if (acked_serial != 0)
++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial,
++ rxrpc_rtt_rx_cancel);
++ break;
++ }
+
+ if (buf.ack.reason == RXRPC_ACK_PING) {
+- _proto("Rx ACK %%%u PING Request", sp->hdr.serial);
++ _proto("Rx ACK %%%u PING Request", ack_serial);
+ rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
+- sp->hdr.serial, true, true,
++ ack_serial, true, true,
+ rxrpc_propose_ack_respond_to_ping);
+ } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
+ rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED,
+- sp->hdr.serial, true, true,
++ ack_serial, true, true,
+ rxrpc_propose_ack_respond_to_ack);
+ }
+
+ /* Discard any out-of-order or duplicate ACKs (outside lock). */
+ if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) {
+- trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial,
++ trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial,
+ first_soft_ack, call->ackr_first_seq,
+ prev_pkt, call->ackr_prev_seq);
+ return;
+@@ -904,7 +921,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
+
+ /* Discard any out-of-order or duplicate ACKs (inside lock). */
+ if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) {
+- trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial,
++ trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial,
+ first_soft_ack, call->ackr_first_seq,
+ prev_pkt, call->ackr_prev_seq);
+ goto out;
+@@ -964,7 +981,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
+ RXRPC_TX_ANNO_LAST &&
+ summary.nr_acks == call->tx_top - hard_ack &&
+ rxrpc_is_client_call(call))
+- rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
++ rxrpc_propose_ACK(call, RXRPC_ACK_PING, ack_serial,
+ false, true,
+ rxrpc_propose_ack_ping_for_lost_reply);
+
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index 1ba43c3df4adb..3cfff7922ba82 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -123,6 +123,49 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
+ return top - hard_ack + 3;
+ }
+
++/*
++ * Record the beginning of an RTT probe.
++ */
++static int rxrpc_begin_rtt_probe(struct rxrpc_call *call, rxrpc_serial_t serial,
++ enum rxrpc_rtt_tx_trace why)
++{
++ unsigned long avail = call->rtt_avail;
++ int rtt_slot = 9;
++
++ if (!(avail & RXRPC_CALL_RTT_AVAIL_MASK))
++ goto no_slot;
++
++ rtt_slot = __ffs(avail & RXRPC_CALL_RTT_AVAIL_MASK);
++ if (!test_and_clear_bit(rtt_slot, &call->rtt_avail))
++ goto no_slot;
++
++ call->rtt_serial[rtt_slot] = serial;
++ call->rtt_sent_at[rtt_slot] = ktime_get_real();
++ smp_wmb(); /* Write data before avail bit */
++ set_bit(rtt_slot + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail);
++
++ trace_rxrpc_rtt_tx(call, why, rtt_slot, serial);
++ return rtt_slot;
++
++no_slot:
++ trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_no_slot, rtt_slot, serial);
++ return -1;
++}
++
++/*
++ * Cancel an RTT probe.
++ */
++static void rxrpc_cancel_rtt_probe(struct rxrpc_call *call,
++ rxrpc_serial_t serial, int rtt_slot)
++{
++ if (rtt_slot != -1) {
++ clear_bit(rtt_slot + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail);
++ smp_wmb(); /* Clear pending bit before setting slot */
++ set_bit(rtt_slot, &call->rtt_avail);
++ trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_cancel, rtt_slot, serial);
++ }
++}
++
+ /*
+ * Send an ACK call packet.
+ */
+@@ -136,7 +179,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ rxrpc_serial_t serial;
+ rxrpc_seq_t hard_ack, top;
+ size_t len, n;
+- int ret;
++ int ret, rtt_slot = -1;
+ u8 reason;
+
+ if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
+@@ -196,18 +239,8 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ if (_serial)
+ *_serial = serial;
+
+- if (ping) {
+- call->ping_serial = serial;
+- smp_wmb();
+- /* We need to stick a time in before we send the packet in case
+- * the reply gets back before kernel_sendmsg() completes - but
+- * asking UDP to send the packet can take a relatively long
+- * time.
+- */
+- call->ping_time = ktime_get_real();
+- set_bit(RXRPC_CALL_PINGING, &call->flags);
+- trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_ping, serial);
+- }
++ if (ping)
++ rtt_slot = rxrpc_begin_rtt_probe(call, serial, rxrpc_rtt_tx_ping);
+
+ ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
+ conn->params.peer->last_tx_at = ktime_get_seconds();
+@@ -221,8 +254,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+
+ if (call->state < RXRPC_CALL_COMPLETE) {
+ if (ret < 0) {
+- if (ping)
+- clear_bit(RXRPC_CALL_PINGING, &call->flags);
++ rxrpc_cancel_rtt_probe(call, serial, rtt_slot);
+ rxrpc_propose_ACK(call, pkt->ack.reason,
+ ntohl(pkt->ack.serial),
+ false, true,
+@@ -321,7 +353,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
+ struct kvec iov[2];
+ rxrpc_serial_t serial;
+ size_t len;
+- int ret;
++ int ret, rtt_slot = -1;
+
+ _enter(",{%d}", skb->len);
+
+@@ -397,6 +429,8 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
+ sp->hdr.serial = serial;
+ smp_wmb(); /* Set serial before timestamp */
+ skb->tstamp = ktime_get_real();
++ if (whdr.flags & RXRPC_REQUEST_ACK)
++ rtt_slot = rxrpc_begin_rtt_probe(call, serial, rxrpc_rtt_tx_data);
+
+ /* send the packet by UDP
+ * - returns -EMSGSIZE if UDP would have to fragment the packet
+@@ -408,12 +442,15 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
+ conn->params.peer->last_tx_at = ktime_get_seconds();
+
+ up_read(&conn->params.local->defrag_sem);
+- if (ret < 0)
++ if (ret < 0) {
++ rxrpc_cancel_rtt_probe(call, serial, rtt_slot);
+ trace_rxrpc_tx_fail(call->debug_id, serial, ret,
+ rxrpc_tx_point_call_data_nofrag);
+- else
++ } else {
+ trace_rxrpc_tx_packet(call->debug_id, &whdr,
+ rxrpc_tx_point_call_data_nofrag);
++ }
++
+ rxrpc_tx_backoff(call, ret);
+ if (ret == -EMSGSIZE)
+ goto send_fragmentable;
+@@ -422,7 +459,6 @@ done:
+ if (ret >= 0) {
+ if (whdr.flags & RXRPC_REQUEST_ACK) {
+ call->peer->rtt_last_req = skb->tstamp;
+- trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_data, serial);
+ if (call->peer->rtt_count > 1) {
+ unsigned long nowj = jiffies, ack_lost_at;
+
+@@ -469,6 +505,8 @@ send_fragmentable:
+ sp->hdr.serial = serial;
+ smp_wmb(); /* Set serial before timestamp */
+ skb->tstamp = ktime_get_real();
++ if (whdr.flags & RXRPC_REQUEST_ACK)
++ rtt_slot = rxrpc_begin_rtt_probe(call, serial, rxrpc_rtt_tx_data);
+
+ switch (conn->params.local->srx.transport.family) {
+ case AF_INET6:
+@@ -487,12 +525,14 @@ send_fragmentable:
+ BUG();
+ }
+
+- if (ret < 0)
++ if (ret < 0) {
++ rxrpc_cancel_rtt_probe(call, serial, rtt_slot);
+ trace_rxrpc_tx_fail(call->debug_id, serial, ret,
+ rxrpc_tx_point_call_data_frag);
+- else
++ } else {
+ trace_rxrpc_tx_packet(call->debug_id, &whdr,
+ rxrpc_tx_point_call_data_frag);
++ }
+ rxrpc_tx_backoff(call, ret);
+
+ up_write(&conn->params.local->defrag_sem);
+diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
+index ca29976bb193e..68396d0520525 100644
+--- a/net/rxrpc/peer_object.c
++++ b/net/rxrpc/peer_object.c
+@@ -502,11 +502,21 @@ EXPORT_SYMBOL(rxrpc_kernel_get_peer);
+ * rxrpc_kernel_get_srtt - Get a call's peer smoothed RTT
+ * @sock: The socket on which the call is in progress.
+ * @call: The call to query
++ * @_srtt: Where to store the SRTT value.
+ *
+- * Get the call's peer smoothed RTT.
++ * Get the call's peer smoothed RTT in uS.
+ */
+-u32 rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call)
++bool rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call,
++ u32 *_srtt)
+ {
+- return call->peer->srtt_us >> 3;
++ struct rxrpc_peer *peer = call->peer;
++
++ if (peer->rtt_count == 0) {
++ *_srtt = 1000000; /* 1S */
++ return false;
++ }
++
++ *_srtt = call->peer->srtt_us >> 3;
++ return true;
+ }
+ EXPORT_SYMBOL(rxrpc_kernel_get_srtt);
+diff --git a/net/rxrpc/rtt.c b/net/rxrpc/rtt.c
+index 928d8b34a3eee..1221b0637a7ec 100644
+--- a/net/rxrpc/rtt.c
++++ b/net/rxrpc/rtt.c
+@@ -146,6 +146,7 @@ static void rxrpc_ack_update_rtt(struct rxrpc_peer *peer, long rtt_us)
+ * exclusive access to the peer RTT data.
+ */
+ void rxrpc_peer_add_rtt(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why,
++ int rtt_slot,
+ rxrpc_serial_t send_serial, rxrpc_serial_t resp_serial,
+ ktime_t send_time, ktime_t resp_time)
+ {
+@@ -162,7 +163,7 @@ void rxrpc_peer_add_rtt(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why,
+ peer->rtt_count++;
+ spin_unlock(&peer->rtt_input_lock);
+
+- trace_rxrpc_rtt_rx(call, why, send_serial, resp_serial,
++ trace_rxrpc_rtt_rx(call, why, rtt_slot, send_serial, resp_serial,
+ peer->srtt_us >> 3, peer->rto_j);
+ }
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 0d74a31ef0ab4..fc2af2c8b6d54 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2944,6 +2944,9 @@ int regulatory_hint_user(const char *alpha2,
+ if (WARN_ON(!alpha2))
+ return -EINVAL;
+
++ if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2))
++ return -EINVAL;
++
+ request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+ if (!request)
+ return -ENOMEM;
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 4c820607540bf..e73e998d582a1 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -2636,8 +2636,8 @@ sub process {
+
+ # Check if the commit log has what seems like a diff which can confuse patch
+ if ($in_commit_log && !$commit_log_has_diff &&
+- (($line =~ m@^\s+diff\b.*a/[\w/]+@ &&
+- $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) ||
++ (($line =~ m@^\s+diff\b.*a/([\w/]+)@ &&
++ $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) ||
+ $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ ||
+ $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) {
+ ERROR("DIFF_IN_COMMIT_MSG",
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index 19857d18d814d..1c78ba49ca992 100755
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -593,7 +593,10 @@ while ($repeat) {
+ }
+
+ my %setconfigs;
+-my @preserved_kconfigs = split(/:/,$ENV{LMC_KEEP});
++my @preserved_kconfigs;
++if (defined($ENV{'LMC_KEEP'})) {
++ @preserved_kconfigs = split(/:/,$ENV{LMC_KEEP});
++}
+
+ sub in_preserved_kconfigs {
+ my $kconfig = $config2kfile{$_[0]};
+diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c
+index 3788906421a73..fe27034f28460 100644
+--- a/sound/core/oss/mulaw.c
++++ b/sound/core/oss/mulaw.c
+@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug,
+ snd_BUG();
+ return -EINVAL;
+ }
+- if (snd_BUG_ON(!snd_pcm_format_linear(format->format)))
+- return -ENXIO;
++ if (!snd_pcm_format_linear(format->format))
++ return -EINVAL;
+
+ err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion",
+ src_format, dst_format,
+diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
+index c84b913a9fe01..ab8408966ec33 100644
+--- a/sound/firewire/digi00x/digi00x.c
++++ b/sound/firewire/digi00x/digi00x.c
+@@ -14,6 +14,7 @@ MODULE_LICENSE("GPL v2");
+ #define VENDOR_DIGIDESIGN 0x00a07e
+ #define MODEL_CONSOLE 0x000001
+ #define MODEL_RACK 0x000002
++#define SPEC_VERSION 0x000001
+
+ static int name_card(struct snd_dg00x *dg00x)
+ {
+@@ -175,14 +176,18 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = {
+ /* Both of 002/003 use the same ID. */
+ {
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_VERSION |
+ IEEE1394_MATCH_MODEL_ID,
+ .vendor_id = VENDOR_DIGIDESIGN,
++ .version = SPEC_VERSION,
+ .model_id = MODEL_CONSOLE,
+ },
+ {
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_VERSION |
+ IEEE1394_MATCH_MODEL_ID,
+ .vendor_id = VENDOR_DIGIDESIGN,
++ .version = SPEC_VERSION,
+ .model_id = MODEL_RACK,
+ },
+ {}
+diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
+index 5dac0d9fc58e5..75f2edd8e78fb 100644
+--- a/sound/firewire/tascam/tascam.c
++++ b/sound/firewire/tascam/tascam.c
+@@ -39,9 +39,6 @@ static const struct snd_tscm_spec model_specs[] = {
+ .midi_capture_ports = 2,
+ .midi_playback_ports = 4,
+ },
+- // This kernel module doesn't support FE-8 because the most of features
+- // can be implemented in userspace without any specific support of this
+- // module.
+ };
+
+ static int identify_model(struct snd_tscm *tscm)
+@@ -211,11 +208,39 @@ static void snd_tscm_remove(struct fw_unit *unit)
+ }
+
+ static const struct ieee1394_device_id snd_tscm_id_table[] = {
++ // Tascam, FW-1884.
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
++ .vendor_id = 0x00022e,
++ .specifier_id = 0x00022e,
++ .version = 0x800000,
++ },
++ // Tascam, FE-8 (.version = 0x800001)
++ // This kernel module doesn't support FE-8 because the most of features
++ // can be implemented in userspace without any specific support of this
++ // module.
++ //
++ // .version = 0x800002 is unknown.
++ //
++ // Tascam, FW-1082.
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
++ .vendor_id = 0x00022e,
++ .specifier_id = 0x00022e,
++ .version = 0x800003,
++ },
++ // Tascam, FW-1804.
+ {
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
+- IEEE1394_MATCH_SPECIFIER_ID,
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
+ .vendor_id = 0x00022e,
+ .specifier_id = 0x00022e,
++ .version = 0x800004,
+ },
+ {}
+ };
+diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
+index 70d775ff967eb..c189f70c82cb9 100644
+--- a/sound/pci/ca0106/ca0106_main.c
++++ b/sound/pci/ca0106/ca0106_main.c
+@@ -537,7 +537,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 *chip, int channel_id,
+ else
+ /* Power down */
+ chip->spi_dac_reg[reg] |= bit;
+- return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]);
++ if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0)
++ return -ENXIO;
+ }
+ return 0;
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1a26940a3fd7c..4c23b169ac67e 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2747,8 +2747,6 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_HDMI },
+ /* Zhaoxin */
+ { PCI_DEVICE(0x1d17, 0x3288), .driver_data = AZX_DRIVER_ZHAOXIN },
+- /* Loongson */
+- { PCI_DEVICE(0x0014, 0x7a07), .driver_data = AZX_DRIVER_GENERIC },
+ { 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, azx_ids);
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index f0c6d2907e396..fc22bdc30da3e 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2737,6 +2737,7 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec,
+ hda_nid_t cvt_nid)
+ {
+ if (per_pin) {
++ haswell_verify_D0(codec, per_pin->cvt_nid, per_pin->pin_nid);
+ snd_hda_set_dev_select(codec, per_pin->pin_nid,
+ per_pin->dev_id);
+ intel_verify_pin_cvt_connect(codec, per_pin);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index da23c2d4ca51e..0b9907c9cd84f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2467,6 +2467,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
++ SND_PCI_QUIRK(0x1462, 0x9c37, "MSI X570-A PRO", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+@@ -5879,6 +5880,39 @@ static void alc275_fixup_gpio4_off(struct hda_codec *codec,
+ }
+ }
+
++/* Quirk for Thinkpad X1 7th and 8th Gen
++ * The following fixed routing needed
++ * DAC1 (NID 0x02) -> Speaker (NID 0x14); some eq applied secretly
++ * DAC2 (NID 0x03) -> Bass (NID 0x17) & Headphone (NID 0x21); sharing a DAC
++ * DAC3 (NID 0x06) -> Unused, due to the lack of volume amp
++ */
++static void alc285_fixup_thinkpad_x1_gen7(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ static const hda_nid_t conn[] = { 0x02, 0x03 }; /* exclude 0x06 */
++ static const hda_nid_t preferred_pairs[] = {
++ 0x14, 0x02, 0x17, 0x03, 0x21, 0x03, 0
++ };
++ struct alc_spec *spec = codec->spec;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn);
++ spec->gen.preferred_dacs = preferred_pairs;
++ break;
++ case HDA_FIXUP_ACT_BUILD:
++ /* The generic parser creates somewhat unintuitive volume ctls
++ * with the fixed routing above, and the shared DAC2 may be
++ * confusing for PA.
++ * Rename those to unique names so that PA doesn't touch them
++ * and use only Master volume.
++ */
++ rename_ctl(codec, "Front Playback Volume", "DAC1 Playback Volume");
++ rename_ctl(codec, "Bass Speaker Playback Volume", "DAC2 Playback Volume");
++ break;
++ }
++}
++
+ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+@@ -6147,6 +6181,7 @@ enum {
+ ALC289_FIXUP_DUAL_SPK,
+ ALC294_FIXUP_SPK2_TO_DAC1,
+ ALC294_FIXUP_ASUS_DUAL_SPK,
++ ALC285_FIXUP_THINKPAD_X1_GEN7,
+ ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+ ALC294_FIXUP_ASUS_HPE,
+ ALC294_FIXUP_ASUS_COEF_1B,
+@@ -7292,11 +7327,17 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC294_FIXUP_SPK2_TO_DAC1
+ },
++ [ALC285_FIXUP_THINKPAD_X1_GEN7] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_thinkpad_x1_gen7,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_THINKPAD_ACPI
++ },
+ [ALC285_FIXUP_THINKPAD_HEADSET_JACK] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_jack,
+ .chained = true,
+- .chain_id = ALC285_FIXUP_SPEAKER2_TO_DAC1
++ .chain_id = ALC285_FIXUP_THINKPAD_X1_GEN7
+ },
+ [ALC294_FIXUP_ASUS_HPE] = {
+ .type = HDA_FIXUP_VERBS,
+@@ -7707,7 +7748,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+- SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
++ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
++ SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index eb3cececda794..28506415c7ad5 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -369,11 +369,13 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
+ case USB_ID(0x31e9, 0x0001): /* Solid State Logic SSL2 */
+ case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */
++ case USB_ID(0x0499, 0x172f): /* Steinberg UR22C */
+ case USB_ID(0x0d9a, 0x00df): /* RTX6001 */
+ ep = 0x81;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x2b73, 0x000a): /* Pioneer DJ DJM-900NXS2 */
++ case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */
+ ep = 0x82;
+ ifnum = 0;
+ goto add_sync_ep_from_ifnum;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 366faaa4ba82c..5410e5ac82f91 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3532,14 +3532,40 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ {
+ /*
+ * Pioneer DJ DJM-250MK2
+- * PCM is 8 channels out @ 48 fixed (endpoints 0x01).
+- * The output from computer to the mixer is usable.
++ * PCM is 8 channels out @ 48 fixed (endpoint 0x01)
++ * and 8 channels in @ 48 fixed (endpoint 0x82).
+ *
+- * The input (phono or line to computer) is not working.
+- * It should be at endpoint 0x82 and probably also 8 channels,
+- * but it seems that it works only with Pioneer proprietary software.
+- * Even on officially supported OS, the Audacity was unable to record
+- * and Mixxx to recognize the control vinyls.
++ * Both playback and recording is working, even simultaneously.
++ *
++ * Playback channels could be mapped to:
++ * - CH1
++ * - CH2
++ * - AUX
++ *
++ * Recording channels could be mapped to:
++ * - Post CH1 Fader
++ * - Post CH2 Fader
++ * - Cross Fader A
++ * - Cross Fader B
++ * - MIC
++ * - AUX
++ * - REC OUT
++ *
++ * There is remaining problem with recording directly from PHONO/LINE.
++ * If we map a channel to:
++ * - CH1 Control Tone PHONO
++ * - CH1 Control Tone LINE
++ * - CH2 Control Tone PHONO
++ * - CH2 Control Tone LINE
++ * it is silent.
++ * There is no signal even on other operating systems with official drivers.
++ * The signal appears only when a supported application is started.
++ * This needs to be investigated yet...
++ * (there is quite a lot communication on the USB in both directions)
++ *
++ * In current version this mixer could be used for playback
++ * and for recording from vinyls (through Post CH* Fader)
++ * but not for DVS (Digital Vinyl Systems) like in Mixxx.
+ */
+ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0017),
+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+@@ -3563,6 +3589,26 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .rate_max = 48000,
+ .nr_rates = 1,
+ .rate_table = (unsigned int[]) { 48000 }
++ }
++ },
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++ .data = &(const struct audioformat) {
++ .formats = SNDRV_PCM_FMTBIT_S24_3LE,
++ .channels = 8, // inputs
++ .iface = 0,
++ .altsetting = 1,
++ .altset_idx = 1,
++ .endpoint = 0x82,
++ .ep_attr = USB_ENDPOINT_XFER_ISOC|
++ USB_ENDPOINT_SYNC_ASYNC|
++ USB_ENDPOINT_USAGE_IMPLICIT_FB,
++ .rates = SNDRV_PCM_RATE_48000,
++ .rate_min = 48000,
++ .rate_max = 48000,
++ .nr_rates = 1,
++ .rate_table = (unsigned int[]) { 48000 }
+ }
+ },
+ {
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index ef1c1cf040b45..bf2d521b6768c 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1493,6 +1493,7 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ set_format_emu_quirk(subs, fmt);
+ break;
+ case USB_ID(0x2b73, 0x000a): /* Pioneer DJ DJM-900NXS2 */
++ case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */
+ pioneer_djm_set_format_quirk(subs);
+ break;
+ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */
+diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h
+index 7b2d6fc9e6ed7..bc8c4816ba386 100644
+--- a/tools/include/uapi/linux/perf_event.h
++++ b/tools/include/uapi/linux/perf_event.h
+@@ -1155,7 +1155,7 @@ union perf_mem_data_src {
+
+ #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */
+ /* 1 free */
+-#define PERF_MEM_SNOOPX_SHIFT 37
++#define PERF_MEM_SNOOPX_SHIFT 38
+
+ /* locked instruction */
+ #define PERF_MEM_LOCK_NA 0x01 /* not available */
+diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
+index c8209467076b1..d8299b77f5c89 100644
+--- a/tools/perf/Documentation/perf-stat.txt
++++ b/tools/perf/Documentation/perf-stat.txt
+@@ -380,6 +380,9 @@ counts for all hardware threads in a core but show the sum counts per
+ hardware thread. This is essentially a replacement for the any bit and
+ convenient for post processing.
+
++--summary::
++Print summary for interval mode (-I).
++
+ EXAMPLES
+ --------
+
+diff --git a/tools/perf/bench/synthesize.c b/tools/perf/bench/synthesize.c
+index 8d624aea1c5e5..b2924e3181dc3 100644
+--- a/tools/perf/bench/synthesize.c
++++ b/tools/perf/bench/synthesize.c
+@@ -162,8 +162,8 @@ static int do_run_multi_threaded(struct target *target,
+ init_stats(&event_stats);
+ for (i = 0; i < multi_iterations; i++) {
+ session = perf_session__new(NULL, false, NULL);
+- if (!session)
+- return -ENOMEM;
++ if (IS_ERR(session))
++ return PTR_ERR(session);
+
+ atomic_set(&event_count, 0);
+ gettimeofday(&start, NULL);
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index 23ea934f30b34..07313217db4cd 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -2417,7 +2417,7 @@ static struct option __record_options[] = {
+ OPT_BOOLEAN(0, "tail-synthesize", &record.opts.tail_synthesize,
+ "synthesize non-sample events at the end of output"),
+ OPT_BOOLEAN(0, "overwrite", &record.opts.overwrite, "use overwrite mode"),
+- OPT_BOOLEAN(0, "no-bpf-event", &record.opts.no_bpf_event, "record bpf events"),
++ OPT_BOOLEAN(0, "no-bpf-event", &record.opts.no_bpf_event, "do not record bpf events"),
+ OPT_BOOLEAN(0, "strict-freq", &record.opts.strict_freq,
+ "Fail if the specified frequency can't be used"),
+ OPT_CALLBACK('F', "freq", &record.opts, "freq or 'max'",
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index 459e4229945e4..7b9511e59b434 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -2575,7 +2575,8 @@ static int timehist_sched_change_event(struct perf_tool *tool,
+ }
+
+ if (!sched->idle_hist || thread->tid == 0) {
+- timehist_update_runtime_stats(tr, t, tprev);
++ if (!cpu_list || test_bit(sample->cpu, cpu_bitmap))
++ timehist_update_runtime_stats(tr, t, tprev);
+
+ if (sched->idle_hist) {
+ struct idle_thread_runtime *itr = (void *)tr;
+@@ -2848,6 +2849,9 @@ static void timehist_print_summary(struct perf_sched *sched,
+
+ printf("\nIdle stats:\n");
+ for (i = 0; i < idle_max_cpu; ++i) {
++ if (cpu_list && !test_bit(i, cpu_bitmap))
++ continue;
++
+ t = idle_threads[i];
+ if (!t)
+ continue;
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 9be020e0098ad..6e2502de755a8 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -402,7 +402,7 @@ static void read_counters(struct timespec *rs)
+ {
+ struct evsel *counter;
+
+- if (!stat_config.summary && (read_affinity_counters(rs) < 0))
++ if (!stat_config.stop_read_counter && (read_affinity_counters(rs) < 0))
+ return;
+
+ evlist__for_each_entry(evsel_list, counter) {
+@@ -826,9 +826,9 @@ try_again_reset:
+ if (stat_config.walltime_run_table)
+ stat_config.walltime_run[run_idx] = t1 - t0;
+
+- if (interval) {
++ if (interval && stat_config.summary) {
+ stat_config.interval = 0;
+- stat_config.summary = true;
++ stat_config.stop_read_counter = true;
+ init_stats(&walltime_nsecs_stats);
+ update_stats(&walltime_nsecs_stats, t1 - t0);
+
+@@ -1066,6 +1066,8 @@ static struct option stat_options[] = {
+ "Use with 'percore' event qualifier to show the event "
+ "counts of one hardware thread by sum up total hardware "
+ "threads of same physical core"),
++ OPT_BOOLEAN(0, "summary", &stat_config.summary,
++ "print summary for interval mode"),
+ #ifdef HAVE_LIBPFM
+ OPT_CALLBACK(0, "pfm-events", &evsel_list, "event",
+ "libpfm4 event selector. use 'perf list' to list available events",
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index 13889d73f8dd5..c665d69c0651d 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -1746,6 +1746,7 @@ int cmd_top(int argc, const char **argv)
+ goto out_delete_evlist;
+ }
+
++#ifdef HAVE_LIBBPF_SUPPORT
+ if (!top.record_opts.no_bpf_event) {
+ top.sb_evlist = evlist__new();
+
+@@ -1759,6 +1760,7 @@ int cmd_top(int argc, const char **argv)
+ goto out_delete_evlist;
+ }
+ }
++#endif
+
+ if (perf_evlist__start_sb_thread(top.sb_evlist, target)) {
+ pr_debug("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n");
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index fa86c5f997cc5..fc9c158bfa134 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -137,7 +137,7 @@ static char *fixregex(char *s)
+ return s;
+
+ /* allocate space for a new string */
+- fixed = (char *) malloc(len + 1);
++ fixed = (char *) malloc(len + esc_count + 1);
+ if (!fixed)
+ return NULL;
+
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index be9c4c0549bc8..a07626f072087 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -3629,8 +3629,8 @@ int perf_evlist__tui_browse_hists(struct evlist *evlist, const char *help,
+ {
+ int nr_entries = evlist->core.nr_entries;
+
+-single_entry:
+ if (perf_evlist__single_entry(evlist)) {
++single_entry: {
+ struct evsel *first = evlist__first(evlist);
+
+ return perf_evsel__hists_browse(first, nr_entries, help,
+@@ -3638,6 +3638,7 @@ single_entry:
+ env, warn_lost_event,
+ annotation_opts);
+ }
++ }
+
+ if (symbol_conf.event_group) {
+ struct evsel *pos;
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index c283223fb31f2..a2a369e2fbb67 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -1344,8 +1344,15 @@ static int cs_etm__synth_events(struct cs_etm_auxtrace *etm,
+ attr.sample_type &= ~(u64)PERF_SAMPLE_ADDR;
+ }
+
+- if (etm->synth_opts.last_branch)
++ if (etm->synth_opts.last_branch) {
+ attr.sample_type |= PERF_SAMPLE_BRANCH_STACK;
++ /*
++ * We don't use the hardware index, but the sample generation
++ * code uses the new format branch_stack with this field,
++ * so the event attributes must indicate that it's present.
++ */
++ attr.branch_sample_type |= PERF_SAMPLE_BRANCH_HW_INDEX;
++ }
+
+ if (etm->synth_opts.instructions) {
+ attr.config = PERF_COUNT_HW_INSTRUCTIONS;
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index cb3c1e569a2db..9357b5f62c273 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -2913,8 +2913,15 @@ static int intel_pt_synth_events(struct intel_pt *pt,
+
+ if (pt->synth_opts.callchain)
+ attr.sample_type |= PERF_SAMPLE_CALLCHAIN;
+- if (pt->synth_opts.last_branch)
++ if (pt->synth_opts.last_branch) {
+ attr.sample_type |= PERF_SAMPLE_BRANCH_STACK;
++ /*
++ * We don't use the hardware index, but the sample generation
++ * code uses the new format branch_stack with this field,
++ * so the event attributes must indicate that it's present.
++ */
++ attr.branch_sample_type |= PERF_SAMPLE_BRANCH_HW_INDEX;
++ }
+
+ if (pt->synth_opts.instructions) {
+ attr.config = PERF_COUNT_HW_INSTRUCTIONS;
+diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h
+index f75ae679eb281..d8a9dd786bf43 100644
+--- a/tools/perf/util/stat.h
++++ b/tools/perf/util/stat.h
+@@ -113,6 +113,7 @@ struct perf_stat_config {
+ bool summary;
+ bool metric_no_group;
+ bool metric_no_merge;
++ bool stop_read_counter;
+ FILE *output;
+ unsigned int interval;
+ unsigned int timeout;
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 754cf611723ee..0d92ebcb335d1 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -1274,6 +1274,8 @@ static void __run_parallel(unsigned int tasks,
+ pid_t pid[tasks];
+ int i;
+
++ fflush(stdout);
++
+ for (i = 0; i < tasks; i++) {
+ pid[i] = fork();
+ if (pid[i] == 0) {
next reply other threads:[~2020-09-09 18:02 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-09 18:02 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-11-01 20:32 [gentoo-commits] proj/linux-patches:5.8 commit in: / Mike Pagano
2020-10-29 11:20 Mike Pagano
2020-10-17 10:19 Mike Pagano
2020-10-14 20:38 Mike Pagano
2020-10-07 12:47 Mike Pagano
2020-10-01 19:00 Mike Pagano
2020-09-26 21:50 Mike Pagano
2020-09-24 15:37 Mike Pagano
2020-09-24 15:37 Mike Pagano
2020-09-24 15:37 Mike Pagano
2020-09-23 13:06 Mike Pagano
2020-09-23 12:14 Mike Pagano
2020-09-17 14:57 Mike Pagano
2020-09-14 17:36 Mike Pagano
2020-09-12 18:14 Mike Pagano
2020-09-05 10:48 Mike Pagano
2020-09-03 12:52 Mike Pagano
2020-09-03 12:37 Mike Pagano
2020-08-27 13:22 Mike Pagano
2020-08-26 11:18 Mike Pagano
2020-08-21 11:41 Alice Ferrazzi
2020-08-19 14:58 Mike Pagano
2020-08-19 9:16 Alice Ferrazzi
2020-08-13 11:55 Alice Ferrazzi
2020-08-03 14:42 Mike Pagano
2020-08-03 11:35 Mike Pagano
2020-06-29 17:33 Mike Pagano
2020-06-29 17:25 Mike Pagano
2020-06-16 18:22 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1599674532.9823217538d25d8a5408a78372823d3649ae9eed.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox