From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 4226015803E for ; Mon, 1 Jan 2024 13:45:54 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 733922BC015; Mon, 1 Jan 2024 13:45:53 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1C3EA2BC015 for ; Mon, 1 Jan 2024 13:45:53 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A1D3533D3C2 for ; Mon, 1 Jan 2024 13:45:51 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 3D58E1300 for ; Mon, 1 Jan 2024 13:45:50 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1704116726.7fddc239b535a89d6c279c88a6c6d3d17680b924.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:6.6 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1008_linux-6.6.9.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 7fddc239b535a89d6c279c88a6c6d3d17680b924 X-VCS-Branch: 6.6 Date: Mon, 1 Jan 2024 13:45:50 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: c9ea71ba-6a1b-4df0-988b-dd9f2b203177 X-Archives-Hash: 02cdc66332ce62e95d77dc6d250f3294 commit: 7fddc239b535a89d6c279c88a6c6d3d17680b924 Author: Mike Pagano gentoo org> AuthorDate: Mon Jan 1 13:45:26 2024 +0000 Commit: Mike Pagano gentoo org> CommitDate: Mon Jan 1 13:45:26 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7fddc239 Linux patch 6.6.9 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1008_linux-6.6.9.patch | 6420 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 6424 insertions(+) diff --git a/0000_README b/0000_README index f6b072ea..f89b37ae 100644 --- a/0000_README +++ b/0000_README @@ -75,6 +75,10 @@ Patch: 1007_linux-6.6.8.patch From: https://www.kernel.org Desc: Linux 6.6.8 +Patch: 1008_linux-6.6.9.patch +From: https://www.kernel.org +Desc: Linux 6.6.9 + Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/ Desc: Enable link security restrictions by default. diff --git a/1008_linux-6.6.9.patch b/1008_linux-6.6.9.patch new file mode 100644 index 00000000..a4f511a0 --- /dev/null +++ b/1008_linux-6.6.9.patch @@ -0,0 +1,6420 @@ +diff --git a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml +index a9b822aeaa7ed..e436650f0faf7 100644 +--- a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml ++++ b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml +@@ -14,9 +14,11 @@ allOf: + + properties: + compatible: +- enum: +- - fsl,imx23-ocotp +- - fsl,imx28-ocotp ++ items: ++ - enum: ++ - fsl,imx23-ocotp ++ - fsl,imx28-ocotp ++ - const: fsl,ocotp + + reg: + maxItems: 1 +@@ -34,7 +36,7 @@ unevaluatedProperties: false + examples: + - | + ocotp: efuse@8002c000 { +- compatible = "fsl,imx28-ocotp"; ++ compatible = "fsl,imx28-ocotp", "fsl,ocotp"; + #address-cells = <1>; + #size-cells = <1>; + reg = <0x8002c000 0x2000>; +diff --git a/Makefile b/Makefile +index 891ef640396c7..4d1d5e925bb28 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +diff --git a/arch/arm/boot/dts/ti/omap/am33xx.dtsi b/arch/arm/boot/dts/ti/omap/am33xx.dtsi +index 1a2cd5baf4021..5b9e01a8aa5d5 100644 +--- a/arch/arm/boot/dts/ti/omap/am33xx.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am33xx.dtsi +@@ -359,6 +359,7 @@ + , + , + ; ++ ti,sysc-delay-us = <2>; + clocks = <&l3s_clkctrl AM3_L3S_USB_OTG_HS_CLKCTRL 0>; + clock-names = "fck"; + #address-cells = <1>; +diff --git a/arch/arm/boot/dts/ti/omap/dra7.dtsi b/arch/arm/boot/dts/ti/omap/dra7.dtsi +index 3f3e52e3b3752..6509c742fb58c 100644 +--- a/arch/arm/boot/dts/ti/omap/dra7.dtsi ++++ b/arch/arm/boot/dts/ti/omap/dra7.dtsi +@@ -147,7 +147,7 @@ + + l3-noc@44000000 { + compatible = "ti,dra7-l3-noc"; +- reg = <0x44000000 0x1000>, ++ reg = <0x44000000 0x1000000>, + <0x45000000 0x1000>; + interrupts-extended = <&crossbar_mpu GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, + <&wakeupgen GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>; +diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c +index 98999aa8cc0c0..7f387706368a6 100644 +--- a/arch/arm/mach-omap2/id.c ++++ b/arch/arm/mach-omap2/id.c +@@ -793,11 +793,16 @@ void __init omap_soc_device_init(void) + + soc_dev_attr->machine = soc_name; + soc_dev_attr->family = omap_get_family(); ++ if (!soc_dev_attr->family) { ++ kfree(soc_dev_attr); ++ return; ++ } + soc_dev_attr->revision = soc_rev; + soc_dev_attr->custom_attr_group = omap_soc_groups[0]; + + soc_dev = soc_device_register(soc_dev_attr); + if (IS_ERR(soc_dev)) { ++ kfree(soc_dev_attr->family); + kfree(soc_dev_attr); + return; + } +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi +index 15290e6892fca..fc7315b944065 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi +@@ -68,10 +68,7 @@ + &emac0 { + pinctrl-names = "default"; + pinctrl-0 = <&ext_rgmii_pins>; +- phy-mode = "rgmii"; + phy-handle = <&ext_rgmii_phy>; +- allwinner,rx-delay-ps = <3100>; +- allwinner,tx-delay-ps = <700>; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts +index d83852e72f063..b5d713926a341 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts +@@ -13,6 +13,9 @@ + }; + + &emac0 { ++ allwinner,rx-delay-ps = <3100>; ++ allwinner,tx-delay-ps = <700>; ++ phy-mode = "rgmii"; + phy-supply = <®_dcdce>; + }; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts b/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts +index 00fe28caac939..b3b1b8692125f 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts +@@ -13,6 +13,8 @@ + }; + + &emac0 { ++ allwinner,tx-delay-ps = <700>; ++ phy-mode = "rgmii-rxid"; + phy-supply = <®_dldo1>; + }; + +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index 4866b3f7b4ea3..685cc436146a5 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -407,7 +407,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) + kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache); + kvm_timer_vcpu_terminate(vcpu); + kvm_pmu_vcpu_destroy(vcpu); +- ++ kvm_vgic_vcpu_destroy(vcpu); + kvm_arm_vcpu_destroy(vcpu); + } + +diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c +index c8c3cb8127832..e949e1d0fd9f7 100644 +--- a/arch/arm64/kvm/vgic/vgic-init.c ++++ b/arch/arm64/kvm/vgic/vgic-init.c +@@ -368,7 +368,7 @@ static void kvm_vgic_dist_destroy(struct kvm *kvm) + vgic_v4_teardown(kvm); + } + +-void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) ++static void __kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) + { + struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; + +@@ -379,29 +379,39 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) + vgic_flush_pending_lpis(vcpu); + + INIT_LIST_HEAD(&vgic_cpu->ap_list_head); +- vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF; ++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) { ++ vgic_unregister_redist_iodev(vcpu); ++ vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF; ++ } + } + +-static void __kvm_vgic_destroy(struct kvm *kvm) ++void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) ++{ ++ struct kvm *kvm = vcpu->kvm; ++ ++ mutex_lock(&kvm->slots_lock); ++ __kvm_vgic_vcpu_destroy(vcpu); ++ mutex_unlock(&kvm->slots_lock); ++} ++ ++void kvm_vgic_destroy(struct kvm *kvm) + { + struct kvm_vcpu *vcpu; + unsigned long i; + +- lockdep_assert_held(&kvm->arch.config_lock); ++ mutex_lock(&kvm->slots_lock); + + vgic_debug_destroy(kvm); + + kvm_for_each_vcpu(i, vcpu, kvm) +- kvm_vgic_vcpu_destroy(vcpu); ++ __kvm_vgic_vcpu_destroy(vcpu); ++ ++ mutex_lock(&kvm->arch.config_lock); + + kvm_vgic_dist_destroy(kvm); +-} + +-void kvm_vgic_destroy(struct kvm *kvm) +-{ +- mutex_lock(&kvm->arch.config_lock); +- __kvm_vgic_destroy(kvm); + mutex_unlock(&kvm->arch.config_lock); ++ mutex_unlock(&kvm->slots_lock); + } + + /** +@@ -469,25 +479,26 @@ int kvm_vgic_map_resources(struct kvm *kvm) + type = VGIC_V3; + } + +- if (ret) { +- __kvm_vgic_destroy(kvm); ++ if (ret) + goto out; +- } ++ + dist->ready = true; + dist_base = dist->vgic_dist_base; + mutex_unlock(&kvm->arch.config_lock); + + ret = vgic_register_dist_iodev(kvm, dist_base, type); +- if (ret) { ++ if (ret) + kvm_err("Unable to register VGIC dist MMIO regions\n"); +- kvm_vgic_destroy(kvm); +- } +- mutex_unlock(&kvm->slots_lock); +- return ret; + ++ goto out_slots; + out: + mutex_unlock(&kvm->arch.config_lock); ++out_slots: + mutex_unlock(&kvm->slots_lock); ++ ++ if (ret) ++ kvm_vgic_destroy(kvm); ++ + return ret; + } + +diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c +index 188d2187eede9..871a45d4fc84c 100644 +--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c ++++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c +@@ -820,7 +820,7 @@ out_unlock: + return ret; + } + +-static void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu) ++void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu) + { + struct vgic_io_device *rd_dev = &vcpu->arch.vgic_cpu.rd_iodev; + +diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h +index 0ab09b0d44404..8d134569d0a1f 100644 +--- a/arch/arm64/kvm/vgic/vgic.h ++++ b/arch/arm64/kvm/vgic/vgic.h +@@ -241,6 +241,7 @@ int vgic_v3_lpi_sync_pending_status(struct kvm *kvm, struct vgic_irq *irq); + int vgic_v3_save_pending_tables(struct kvm *kvm); + int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count); + int vgic_register_redist_iodev(struct kvm_vcpu *vcpu); ++void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu); + bool vgic_v3_check_base(struct kvm *kvm); + + void vgic_v3_load(struct kvm_vcpu *vcpu); +diff --git a/arch/s390/include/asm/fpu/api.h b/arch/s390/include/asm/fpu/api.h +index b714ed0ef6885..9acf48e53a87f 100644 +--- a/arch/s390/include/asm/fpu/api.h ++++ b/arch/s390/include/asm/fpu/api.h +@@ -79,7 +79,7 @@ static inline int test_fp_ctl(u32 fpc) + #define KERNEL_VXR_HIGH (KERNEL_VXR_V16V23|KERNEL_VXR_V24V31) + + #define KERNEL_VXR (KERNEL_VXR_LOW|KERNEL_VXR_HIGH) +-#define KERNEL_FPR (KERNEL_FPC|KERNEL_VXR_V0V7) ++#define KERNEL_FPR (KERNEL_FPC|KERNEL_VXR_LOW) + + struct kernel_fpu; + +diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c +index 73be3931e4f06..aae7456ece070 100644 +--- a/arch/x86/kernel/alternative.c ++++ b/arch/x86/kernel/alternative.c +@@ -255,6 +255,16 @@ static void __init_or_module noinline optimize_nops(u8 *instr, size_t len) + } + } + ++static void __init_or_module noinline optimize_nops_inplace(u8 *instr, size_t len) ++{ ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ optimize_nops(instr, len); ++ sync_core(); ++ local_irq_restore(flags); ++} ++ + /* + * In this context, "source" is where the instructions are placed in the + * section .altinstr_replacement, for example during kernel build by the +@@ -438,7 +448,7 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start, + * patch if feature is *NOT* present. + */ + if (!boot_cpu_has(a->cpuid) == !(a->flags & ALT_FLAG_NOT)) { +- optimize_nops(instr, a->instrlen); ++ optimize_nops_inplace(instr, a->instrlen); + continue; + } + +@@ -1685,8 +1695,8 @@ void __init_or_module text_poke_early(void *addr, const void *opcode, + } else { + local_irq_save(flags); + memcpy(addr, opcode, len); +- local_irq_restore(flags); + sync_core(); ++ local_irq_restore(flags); + + /* + * Could also do a CLFLUSH here to speed up CPU recovery; but +diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S +index ea6995920b7aa..e6eaee8509cee 100644 +--- a/arch/x86/kernel/head_64.S ++++ b/arch/x86/kernel/head_64.S +@@ -256,6 +256,22 @@ SYM_INNER_LABEL(secondary_startup_64_no_verify, SYM_L_GLOBAL) + testl $X2APIC_ENABLE, %eax + jnz .Lread_apicid_msr + ++#ifdef CONFIG_X86_X2APIC ++ /* ++ * If system is in X2APIC mode then MMIO base might not be ++ * mapped causing the MMIO read below to fault. Faults can't ++ * be handled at that point. ++ */ ++ cmpl $0, x2apic_mode(%rip) ++ jz .Lread_apicid_mmio ++ ++ /* Force the AP into X2APIC mode. */ ++ orl $X2APIC_ENABLE, %eax ++ wrmsr ++ jmp .Lread_apicid_msr ++#endif ++ ++.Lread_apicid_mmio: + /* Read the APIC ID from the fix-mapped MMIO space. */ + movq apic_mmio_base(%rip), %rcx + addq $APIC_ID, %rcx +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 52f36c48c1b9e..955133077c105 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -2929,3 +2929,49 @@ void bpf_jit_free(struct bpf_prog *prog) + + bpf_prog_unlock_free(prog); + } ++ ++void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, ++ struct bpf_prog *new, struct bpf_prog *old) ++{ ++ u8 *old_addr, *new_addr, *old_bypass_addr; ++ int ret; ++ ++ old_bypass_addr = old ? NULL : poke->bypass_addr; ++ old_addr = old ? (u8 *)old->bpf_func + poke->adj_off : NULL; ++ new_addr = new ? (u8 *)new->bpf_func + poke->adj_off : NULL; ++ ++ /* ++ * On program loading or teardown, the program's kallsym entry ++ * might not be in place, so we use __bpf_arch_text_poke to skip ++ * the kallsyms check. ++ */ ++ if (new) { ++ ret = __bpf_arch_text_poke(poke->tailcall_target, ++ BPF_MOD_JUMP, ++ old_addr, new_addr); ++ BUG_ON(ret < 0); ++ if (!old) { ++ ret = __bpf_arch_text_poke(poke->tailcall_bypass, ++ BPF_MOD_JUMP, ++ poke->bypass_addr, ++ NULL); ++ BUG_ON(ret < 0); ++ } ++ } else { ++ ret = __bpf_arch_text_poke(poke->tailcall_bypass, ++ BPF_MOD_JUMP, ++ old_bypass_addr, ++ poke->bypass_addr); ++ BUG_ON(ret < 0); ++ /* let other CPUs finish the execution of program ++ * so that it will not possible to expose them ++ * to invalid nop, stack unwind, nop state ++ */ ++ if (!ret) ++ synchronize_rcu(); ++ ret = __bpf_arch_text_poke(poke->tailcall_target, ++ BPF_MOD_JUMP, ++ old_addr, NULL); ++ BUG_ON(ret < 0); ++ } ++} +diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig +index 9b1ec5d8c99c8..a65fc2ae15b49 100644 +--- a/arch/x86/xen/Kconfig ++++ b/arch/x86/xen/Kconfig +@@ -9,6 +9,7 @@ config XEN + select PARAVIRT_CLOCK + select X86_HV_CALLBACK_VECTOR + depends on X86_64 || (X86_32 && X86_PAE) ++ depends on X86_64 || (X86_GENERIC || MPENTIUM4 || MCORE2 || MATOM || MK8) + depends on X86_LOCAL_APIC && X86_TSC + help + This is the Linux Xen port. Enabling this will allow the +diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c +index f3892e9ce800f..572d68d52965f 100644 +--- a/drivers/bluetooth/hci_vhci.c ++++ b/drivers/bluetooth/hci_vhci.c +@@ -11,6 +11,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -44,6 +45,7 @@ struct vhci_data { + bool wakeup; + __u16 msft_opcode; + bool aosp_capable; ++ atomic_t initialized; + }; + + static int vhci_open_dev(struct hci_dev *hdev) +@@ -75,11 +77,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) + + memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); + +- mutex_lock(&data->open_mutex); + skb_queue_tail(&data->readq, skb); +- mutex_unlock(&data->open_mutex); + +- wake_up_interruptible(&data->read_wait); ++ if (atomic_read(&data->initialized)) ++ wake_up_interruptible(&data->read_wait); + return 0; + } + +@@ -464,7 +465,8 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode) + skb_put_u8(skb, 0xff); + skb_put_u8(skb, opcode); + put_unaligned_le16(hdev->id, skb_put(skb, 2)); +- skb_queue_tail(&data->readq, skb); ++ skb_queue_head(&data->readq, skb); ++ atomic_inc(&data->initialized); + + wake_up_interruptible(&data->read_wait); + return 0; +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index d57bc066dce6b..9ed9239b1228f 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -2158,13 +2158,23 @@ static int sysc_reset(struct sysc *ddata) + sysc_val = sysc_read_sysconfig(ddata); + sysc_val |= sysc_mask; + sysc_write(ddata, sysc_offset, sysc_val); +- /* Flush posted write */ ++ ++ /* ++ * Some devices need a delay before reading registers ++ * after reset. Presumably a srst_udelay is not needed ++ * for devices that use a rstctrl register reset. ++ */ ++ if (ddata->cfg.srst_udelay) ++ fsleep(ddata->cfg.srst_udelay); ++ ++ /* ++ * Flush posted write. For devices needing srst_udelay ++ * this should trigger an interconnect error if the ++ * srst_udelay value is needed but not configured. ++ */ + sysc_val = sysc_read_sysconfig(ddata); + } + +- if (ddata->cfg.srst_udelay) +- fsleep(ddata->cfg.srst_udelay); +- + if (ddata->post_reset_quirk) + ddata->post_reset_quirk(ddata); + +diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c +index c22fcaa44a614..6b7d47a52b10a 100644 +--- a/drivers/gpio/gpio-dwapb.c ++++ b/drivers/gpio/gpio-dwapb.c +@@ -283,13 +283,15 @@ static void dwapb_irq_enable(struct irq_data *d) + { + struct gpio_chip *gc = irq_data_get_irq_chip_data(d); + struct dwapb_gpio *gpio = to_dwapb_gpio(gc); ++ irq_hw_number_t hwirq = irqd_to_hwirq(d); + unsigned long flags; + u32 val; + + raw_spin_lock_irqsave(&gc->bgpio_lock, flags); +- val = dwapb_read(gpio, GPIO_INTEN); +- val |= BIT(irqd_to_hwirq(d)); ++ val = dwapb_read(gpio, GPIO_INTEN) | BIT(hwirq); + dwapb_write(gpio, GPIO_INTEN, val); ++ val = dwapb_read(gpio, GPIO_INTMASK) & ~BIT(hwirq); ++ dwapb_write(gpio, GPIO_INTMASK, val); + raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags); + } + +@@ -297,12 +299,14 @@ static void dwapb_irq_disable(struct irq_data *d) + { + struct gpio_chip *gc = irq_data_get_irq_chip_data(d); + struct dwapb_gpio *gpio = to_dwapb_gpio(gc); ++ irq_hw_number_t hwirq = irqd_to_hwirq(d); + unsigned long flags; + u32 val; + + raw_spin_lock_irqsave(&gc->bgpio_lock, flags); +- val = dwapb_read(gpio, GPIO_INTEN); +- val &= ~BIT(irqd_to_hwirq(d)); ++ val = dwapb_read(gpio, GPIO_INTMASK) | BIT(hwirq); ++ dwapb_write(gpio, GPIO_INTMASK, val); ++ val = dwapb_read(gpio, GPIO_INTEN) & ~BIT(hwirq); + dwapb_write(gpio, GPIO_INTEN, val); + raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags); + } +diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c +index e39d344feb289..4f3e66ece7f78 100644 +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -2482,10 +2482,7 @@ static int lineinfo_unwatch(struct gpio_chardev_data *cdev, void __user *ip) + return 0; + } + +-/* +- * gpio_ioctl() - ioctl handler for the GPIO chardev +- */ +-static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++static long gpio_ioctl_unlocked(struct file *file, unsigned int cmd, unsigned long arg) + { + struct gpio_chardev_data *cdev = file->private_data; + struct gpio_device *gdev = cdev->gdev; +@@ -2522,6 +2519,17 @@ static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + } + } + ++/* ++ * gpio_ioctl() - ioctl handler for the GPIO chardev ++ */ ++static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ struct gpio_chardev_data *cdev = file->private_data; ++ ++ return call_ioctl_locked(file, cmd, arg, cdev->gdev, ++ gpio_ioctl_unlocked); ++} ++ + #ifdef CONFIG_COMPAT + static long gpio_ioctl_compat(struct file *file, unsigned int cmd, + unsigned long arg) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +index ca4d2d430e28c..a1b15d0d6c489 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +@@ -962,6 +962,7 @@ static int amdgpu_debugfs_gem_info_show(struct seq_file *m, void *unused) + list_for_each_entry(file, &dev->filelist, lhead) { + struct task_struct *task; + struct drm_gem_object *gobj; ++ struct pid *pid; + int id; + + /* +@@ -971,8 +972,9 @@ static int amdgpu_debugfs_gem_info_show(struct seq_file *m, void *unused) + * Therefore, we need to protect this ->comm access using RCU. + */ + rcu_read_lock(); +- task = pid_task(file->pid, PIDTYPE_TGID); +- seq_printf(m, "pid %8d command %s:\n", pid_nr(file->pid), ++ pid = rcu_dereference(file->pid); ++ task = pid_task(pid, PIDTYPE_TGID); ++ seq_printf(m, "pid %8d command %s:\n", pid_nr(pid), + task ? task->comm : ""); + rcu_read_unlock(); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 89c8e51cd3323..9fe1278fd5861 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -285,6 +285,7 @@ static void amdgpu_vm_bo_reset_state_machine(struct amdgpu_vm *vm) + list_for_each_entry_safe(vm_bo, tmp, &vm->idle, vm_status) { + struct amdgpu_bo *bo = vm_bo->bo; + ++ vm_bo->moved = true; + if (!bo || bo->tbo.type != ttm_bo_type_kernel) + list_move(&vm_bo->vm_status, &vm_bo->vm->moved); + else if (bo->parent) +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index f5fdb61c821d0..d63360127834b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5170,6 +5170,9 @@ static void fill_dc_dirty_rects(struct drm_plane *plane, + if (plane->type == DRM_PLANE_TYPE_CURSOR) + return; + ++ if (new_plane_state->rotation != DRM_MODE_ROTATE_0) ++ goto ffu; ++ + num_clips = drm_plane_get_damage_clips_count(new_plane_state); + clips = drm_plane_get_damage_clips(new_plane_state); + +diff --git a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h +index 100d62162b717..99880b08cda0c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h +@@ -465,6 +465,7 @@ struct dc_cursor_mi_param { + struct fixed31_32 v_scale_ratio; + enum dc_rotation_angle rotation; + bool mirror; ++ struct dc_stream_state *stream; + }; + + /* IPP related types */ +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index 79befa17bb037..13ccb57379c7a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -3407,7 +3407,8 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx) + .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz, + .v_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.vert, + .rotation = pipe_ctx->plane_state->rotation, +- .mirror = pipe_ctx->plane_state->horizontal_mirror ++ .mirror = pipe_ctx->plane_state->horizontal_mirror, ++ .stream = pipe_ctx->stream, + }; + bool pipe_split_on = false; + bool odm_combine_on = (pipe_ctx->next_odm_pipe != NULL) || +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +index 4566bc7abf17e..aa252dc263267 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +@@ -1075,8 +1075,16 @@ void hubp2_cursor_set_position( + if (src_y_offset < 0) + src_y_offset = 0; + /* Save necessary cursor info x, y position. w, h is saved in attribute func. */ +- hubp->cur_rect.x = src_x_offset + param->viewport.x; +- hubp->cur_rect.y = src_y_offset + param->viewport.y; ++ if (param->stream->link->psr_settings.psr_version >= DC_PSR_VERSION_SU_1 && ++ param->rotation != ROTATION_ANGLE_0) { ++ hubp->cur_rect.x = 0; ++ hubp->cur_rect.y = 0; ++ hubp->cur_rect.w = param->stream->timing.h_addressable; ++ hubp->cur_rect.h = param->stream->timing.v_addressable; ++ } else { ++ hubp->cur_rect.x = src_x_offset + param->viewport.x; ++ hubp->cur_rect.y = src_y_offset + param->viewport.y; ++ } + } + + void hubp2_clk_cntl(struct hubp *hubp, bool enable) +diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c +index cf92a9ae8034c..6899b3dc1f12a 100644 +--- a/drivers/gpu/drm/drm_auth.c ++++ b/drivers/gpu/drm/drm_auth.c +@@ -235,7 +235,8 @@ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv) + static int + drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv) + { +- if (file_priv->pid == task_pid(current) && file_priv->was_master) ++ if (file_priv->was_master && ++ rcu_access_pointer(file_priv->pid) == task_tgid(current)) + return 0; + + if (!capable(CAP_SYS_ADMIN)) +diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c +index 2de43ff3ce0a4..41b0682c638ef 100644 +--- a/drivers/gpu/drm/drm_debugfs.c ++++ b/drivers/gpu/drm/drm_debugfs.c +@@ -92,15 +92,17 @@ static int drm_clients_info(struct seq_file *m, void *data) + */ + mutex_lock(&dev->filelist_mutex); + list_for_each_entry_reverse(priv, &dev->filelist, lhead) { +- struct task_struct *task; + bool is_current_master = drm_is_current_master(priv); ++ struct task_struct *task; ++ struct pid *pid; + +- rcu_read_lock(); /* locks pid_task()->comm */ +- task = pid_task(priv->pid, PIDTYPE_TGID); ++ rcu_read_lock(); /* Locks priv->pid and pid_task()->comm! */ ++ pid = rcu_dereference(priv->pid); ++ task = pid_task(pid, PIDTYPE_TGID); + uid = task ? __task_cred(task)->euid : GLOBAL_ROOT_UID; + seq_printf(m, "%20s %5d %3d %c %c %5d %10u\n", + task ? task->comm : "", +- pid_vnr(priv->pid), ++ pid_vnr(pid), + priv->minor->index, + is_current_master ? 'y' : 'n', + priv->authenticated ? 'y' : 'n', +diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c +index 883d83bc0e3d5..e692770ef6d3c 100644 +--- a/drivers/gpu/drm/drm_file.c ++++ b/drivers/gpu/drm/drm_file.c +@@ -160,7 +160,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor) + + /* Get a unique identifier for fdinfo: */ + file->client_id = atomic64_inc_return(&ident); +- file->pid = get_pid(task_tgid(current)); ++ rcu_assign_pointer(file->pid, get_pid(task_tgid(current))); + file->minor = minor; + + /* for compatibility root is always authenticated */ +@@ -200,7 +200,7 @@ out_prime_destroy: + drm_syncobj_release(file); + if (drm_core_check_feature(dev, DRIVER_GEM)) + drm_gem_release(dev, file); +- put_pid(file->pid); ++ put_pid(rcu_access_pointer(file->pid)); + kfree(file); + + return ERR_PTR(ret); +@@ -291,7 +291,7 @@ void drm_file_free(struct drm_file *file) + + WARN_ON(!list_empty(&file->event_list)); + +- put_pid(file->pid); ++ put_pid(rcu_access_pointer(file->pid)); + kfree(file); + } + +@@ -505,6 +505,40 @@ int drm_release(struct inode *inode, struct file *filp) + } + EXPORT_SYMBOL(drm_release); + ++void drm_file_update_pid(struct drm_file *filp) ++{ ++ struct drm_device *dev; ++ struct pid *pid, *old; ++ ++ /* ++ * Master nodes need to keep the original ownership in order for ++ * drm_master_check_perm to keep working correctly. (See comment in ++ * drm_auth.c.) ++ */ ++ if (filp->was_master) ++ return; ++ ++ pid = task_tgid(current); ++ ++ /* ++ * Quick unlocked check since the model is a single handover followed by ++ * exclusive repeated use. ++ */ ++ if (pid == rcu_access_pointer(filp->pid)) ++ return; ++ ++ dev = filp->minor->dev; ++ mutex_lock(&dev->filelist_mutex); ++ old = rcu_replace_pointer(filp->pid, pid, 1); ++ mutex_unlock(&dev->filelist_mutex); ++ ++ if (pid != old) { ++ get_pid(pid); ++ synchronize_rcu(); ++ put_pid(old); ++ } ++} ++ + /** + * drm_release_noglobal - release method for DRM file + * @inode: device inode +diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c +index f03ffbacfe9b4..77590b0f38fa3 100644 +--- a/drivers/gpu/drm/drm_ioctl.c ++++ b/drivers/gpu/drm/drm_ioctl.c +@@ -776,6 +776,9 @@ long drm_ioctl_kernel(struct file *file, drm_ioctl_t *func, void *kdata, + struct drm_device *dev = file_priv->minor->dev; + int retcode; + ++ /* Update drm_file owner if fd was passed along. */ ++ drm_file_update_pid(file_priv); ++ + if (drm_dev_is_unplugged(dev)) + return -ENODEV; + +diff --git a/drivers/gpu/drm/i915/display/g4x_dp.c b/drivers/gpu/drm/i915/display/g4x_dp.c +index 4c7187f7913ea..e8ee0a08947e8 100644 +--- a/drivers/gpu/drm/i915/display/g4x_dp.c ++++ b/drivers/gpu/drm/i915/display/g4x_dp.c +@@ -141,7 +141,7 @@ static void intel_dp_prepare(struct intel_encoder *encoder, + + intel_de_rmw(dev_priv, TRANS_DP_CTL(crtc->pipe), + TRANS_DP_ENH_FRAMING, +- drm_dp_enhanced_frame_cap(intel_dp->dpcd) ? ++ pipe_config->enhanced_framing ? + TRANS_DP_ENH_FRAMING : 0); + } else { + if (IS_G4X(dev_priv) && pipe_config->limited_color_range) +@@ -153,7 +153,7 @@ static void intel_dp_prepare(struct intel_encoder *encoder, + intel_dp->DP |= DP_SYNC_VS_HIGH; + intel_dp->DP |= DP_LINK_TRAIN_OFF; + +- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd)) ++ if (pipe_config->enhanced_framing) + intel_dp->DP |= DP_ENHANCED_FRAMING; + + if (IS_CHERRYVIEW(dev_priv)) +@@ -351,6 +351,9 @@ static void intel_dp_get_config(struct intel_encoder *encoder, + u32 trans_dp = intel_de_read(dev_priv, + TRANS_DP_CTL(crtc->pipe)); + ++ if (trans_dp & TRANS_DP_ENH_FRAMING) ++ pipe_config->enhanced_framing = true; ++ + if (trans_dp & TRANS_DP_HSYNC_ACTIVE_HIGH) + flags |= DRM_MODE_FLAG_PHSYNC; + else +@@ -361,6 +364,9 @@ static void intel_dp_get_config(struct intel_encoder *encoder, + else + flags |= DRM_MODE_FLAG_NVSYNC; + } else { ++ if (tmp & DP_ENHANCED_FRAMING) ++ pipe_config->enhanced_framing = true; ++ + if (tmp & DP_SYNC_HS_HIGH) + flags |= DRM_MODE_FLAG_PHSYNC; + else +diff --git a/drivers/gpu/drm/i915/display/intel_crt.c b/drivers/gpu/drm/i915/display/intel_crt.c +index d23020eb87f46..4352f90177615 100644 +--- a/drivers/gpu/drm/i915/display/intel_crt.c ++++ b/drivers/gpu/drm/i915/display/intel_crt.c +@@ -456,6 +456,8 @@ static int hsw_crt_compute_config(struct intel_encoder *encoder, + /* FDI must always be 2.7 GHz */ + pipe_config->port_clock = 135000 * 2; + ++ pipe_config->enhanced_framing = true; ++ + adjusted_mode->crtc_clock = lpt_iclkip(pipe_config); + + return 0; +diff --git a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c +index 8d4640d0fd346..66fe880af8f3f 100644 +--- a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c ++++ b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c +@@ -258,6 +258,9 @@ void intel_crtc_state_dump(const struct intel_crtc_state *pipe_config, + intel_dump_m_n_config(pipe_config, "dp m2_n2", + pipe_config->lane_count, + &pipe_config->dp_m2_n2); ++ drm_dbg_kms(&i915->drm, "fec: %s, enhanced framing: %s\n", ++ str_enabled_disabled(pipe_config->fec_enable), ++ str_enabled_disabled(pipe_config->enhanced_framing)); + } + + drm_dbg_kms(&i915->drm, "framestart delay: %d, MSA timing delay: %d\n", +diff --git a/drivers/gpu/drm/i915/display/intel_cx0_phy.c b/drivers/gpu/drm/i915/display/intel_cx0_phy.c +index 80e4ec6ee4031..048e581fda16c 100644 +--- a/drivers/gpu/drm/i915/display/intel_cx0_phy.c ++++ b/drivers/gpu/drm/i915/display/intel_cx0_phy.c +@@ -2420,7 +2420,8 @@ static void intel_program_port_clock_ctl(struct intel_encoder *encoder, + + val |= XELPDP_FORWARD_CLOCK_UNGATE; + +- if (is_hdmi_frl(crtc_state->port_clock)) ++ if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI) && ++ is_hdmi_frl(crtc_state->port_clock)) + val |= XELPDP_DDI_CLOCK_SELECT(XELPDP_DDI_CLOCK_SELECT_DIV18CLK); + else + val |= XELPDP_DDI_CLOCK_SELECT(XELPDP_DDI_CLOCK_SELECT_MAXPCLK); +diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c +index 84bbf854337aa..c7e00f57cb7ab 100644 +--- a/drivers/gpu/drm/i915/display/intel_ddi.c ++++ b/drivers/gpu/drm/i915/display/intel_ddi.c +@@ -3432,7 +3432,7 @@ static void mtl_ddi_prepare_link_retrain(struct intel_dp *intel_dp, + dp_tp_ctl |= DP_TP_CTL_MODE_MST; + } else { + dp_tp_ctl |= DP_TP_CTL_MODE_SST; +- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd)) ++ if (crtc_state->enhanced_framing) + dp_tp_ctl |= DP_TP_CTL_ENHANCED_FRAME_ENABLE; + } + intel_de_write(dev_priv, dp_tp_ctl_reg(encoder, crtc_state), dp_tp_ctl); +@@ -3489,7 +3489,7 @@ static void intel_ddi_prepare_link_retrain(struct intel_dp *intel_dp, + dp_tp_ctl |= DP_TP_CTL_MODE_MST; + } else { + dp_tp_ctl |= DP_TP_CTL_MODE_SST; +- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd)) ++ if (crtc_state->enhanced_framing) + dp_tp_ctl |= DP_TP_CTL_ENHANCED_FRAME_ENABLE; + } + intel_de_write(dev_priv, dp_tp_ctl_reg(encoder, crtc_state), dp_tp_ctl); +@@ -3724,17 +3724,14 @@ static void intel_ddi_read_func_ctl(struct intel_encoder *encoder, + intel_cpu_transcoder_get_m2_n2(crtc, cpu_transcoder, + &pipe_config->dp_m2_n2); + +- if (DISPLAY_VER(dev_priv) >= 11) { +- i915_reg_t dp_tp_ctl = dp_tp_ctl_reg(encoder, pipe_config); ++ pipe_config->enhanced_framing = ++ intel_de_read(dev_priv, dp_tp_ctl_reg(encoder, pipe_config)) & ++ DP_TP_CTL_ENHANCED_FRAME_ENABLE; + ++ if (DISPLAY_VER(dev_priv) >= 11) + pipe_config->fec_enable = +- intel_de_read(dev_priv, dp_tp_ctl) & DP_TP_CTL_FEC_ENABLE; +- +- drm_dbg_kms(&dev_priv->drm, +- "[ENCODER:%d:%s] Fec status: %u\n", +- encoder->base.base.id, encoder->base.name, +- pipe_config->fec_enable); +- } ++ intel_de_read(dev_priv, ++ dp_tp_ctl_reg(encoder, pipe_config)) & DP_TP_CTL_FEC_ENABLE; + + if (dig_port->lspcon.active && intel_dp_has_hdmi_sink(&dig_port->dp)) + pipe_config->infoframes.enable |= +@@ -3747,6 +3744,9 @@ static void intel_ddi_read_func_ctl(struct intel_encoder *encoder, + if (!HAS_DP20(dev_priv)) { + /* FDI */ + pipe_config->output_types |= BIT(INTEL_OUTPUT_ANALOG); ++ pipe_config->enhanced_framing = ++ intel_de_read(dev_priv, dp_tp_ctl_reg(encoder, pipe_config)) & ++ DP_TP_CTL_ENHANCED_FRAME_ENABLE; + break; + } + fallthrough; /* 128b/132b */ +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 1e2b09ae09b9c..2e0daad23aa61 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -5255,6 +5255,7 @@ intel_pipe_config_compare(const struct intel_crtc_state *current_config, + PIPE_CONF_CHECK_BOOL(hdmi_scrambling); + PIPE_CONF_CHECK_BOOL(hdmi_high_tmds_clock_ratio); + PIPE_CONF_CHECK_BOOL(has_infoframe); ++ PIPE_CONF_CHECK_BOOL(enhanced_framing); + PIPE_CONF_CHECK_BOOL(fec_enable); + + PIPE_CONF_CHECK_BOOL_INCOMPLETE(has_audio); +@@ -5976,6 +5977,17 @@ static int intel_async_flip_check_hw(struct intel_atomic_state *state, struct in + return -EINVAL; + } + ++ /* ++ * FIXME: Bigjoiner+async flip is busted currently. ++ * Remove this check once the issues are fixed. ++ */ ++ if (new_crtc_state->bigjoiner_pipes) { ++ drm_dbg_kms(&i915->drm, ++ "[CRTC:%d:%s] async flip disallowed with bigjoiner\n", ++ crtc->base.base.id, crtc->base.name); ++ return -EINVAL; ++ } ++ + for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state, + new_plane_state, i) { + if (plane->pipe != crtc->pipe) +diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h +index 731f2ec04d5cd..7fc92b1474cc4 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_types.h ++++ b/drivers/gpu/drm/i915/display/intel_display_types.h +@@ -1362,6 +1362,8 @@ struct intel_crtc_state { + u16 linetime; + u16 ips_linetime; + ++ bool enhanced_framing; ++ + /* Forward Error correction State */ + bool fec_enable; + +diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c +index 5f479f3828bbe..8751973b5730f 100644 +--- a/drivers/gpu/drm/i915/display/intel_dmc.c ++++ b/drivers/gpu/drm/i915/display/intel_dmc.c +@@ -389,7 +389,7 @@ disable_all_flip_queue_events(struct drm_i915_private *i915) + enum intel_dmc_id dmc_id; + + /* TODO: check if the following applies to all D13+ platforms. */ +- if (!IS_DG2(i915) && !IS_TIGERLAKE(i915)) ++ if (!IS_TIGERLAKE(i915)) + return; + + for_each_dmc_id(dmc_id) { +@@ -493,6 +493,45 @@ void intel_dmc_disable_pipe(struct drm_i915_private *i915, enum pipe pipe) + intel_de_rmw(i915, PIPEDMC_CONTROL(pipe), PIPEDMC_ENABLE, 0); + } + ++static bool is_dmc_evt_ctl_reg(struct drm_i915_private *i915, ++ enum intel_dmc_id dmc_id, i915_reg_t reg) ++{ ++ u32 offset = i915_mmio_reg_offset(reg); ++ u32 start = i915_mmio_reg_offset(DMC_EVT_CTL(i915, dmc_id, 0)); ++ u32 end = i915_mmio_reg_offset(DMC_EVT_CTL(i915, dmc_id, DMC_EVENT_HANDLER_COUNT_GEN12)); ++ ++ return offset >= start && offset < end; ++} ++ ++static bool disable_dmc_evt(struct drm_i915_private *i915, ++ enum intel_dmc_id dmc_id, ++ i915_reg_t reg, u32 data) ++{ ++ if (!is_dmc_evt_ctl_reg(i915, dmc_id, reg)) ++ return false; ++ ++ /* keep all pipe DMC events disabled by default */ ++ if (dmc_id != DMC_FW_MAIN) ++ return true; ++ ++ return false; ++} ++ ++static u32 dmc_mmiodata(struct drm_i915_private *i915, ++ struct intel_dmc *dmc, ++ enum intel_dmc_id dmc_id, int i) ++{ ++ if (disable_dmc_evt(i915, dmc_id, ++ dmc->dmc_info[dmc_id].mmioaddr[i], ++ dmc->dmc_info[dmc_id].mmiodata[i])) ++ return REG_FIELD_PREP(DMC_EVT_CTL_TYPE_MASK, ++ DMC_EVT_CTL_TYPE_EDGE_0_1) | ++ REG_FIELD_PREP(DMC_EVT_CTL_EVENT_ID_MASK, ++ DMC_EVT_CTL_EVENT_ID_FALSE); ++ else ++ return dmc->dmc_info[dmc_id].mmiodata[i]; ++} ++ + /** + * intel_dmc_load_program() - write the firmware from memory to register. + * @i915: i915 drm device. +@@ -532,7 +571,7 @@ void intel_dmc_load_program(struct drm_i915_private *i915) + for_each_dmc_id(dmc_id) { + for (i = 0; i < dmc->dmc_info[dmc_id].mmio_count; i++) { + intel_de_write(i915, dmc->dmc_info[dmc_id].mmioaddr[i], +- dmc->dmc_info[dmc_id].mmiodata[i]); ++ dmc_mmiodata(i915, dmc, dmc_id, i)); + } + } + +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index 66e35f8443e1a..b4fb7ce39d06f 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -2312,6 +2312,9 @@ intel_dp_compute_config(struct intel_encoder *encoder, + pipe_config->limited_color_range = + intel_dp_limited_color_range(pipe_config, conn_state); + ++ pipe_config->enhanced_framing = ++ drm_dp_enhanced_frame_cap(intel_dp->dpcd); ++ + if (pipe_config->dsc.compression_enable) + output_bpp = pipe_config->dsc.compressed_bpp; + else +diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_training.c b/drivers/gpu/drm/i915/display/intel_dp_link_training.c +index a263773f4d68a..a62bca622b0a1 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c +@@ -650,19 +650,30 @@ intel_dp_update_link_bw_set(struct intel_dp *intel_dp, + const struct intel_crtc_state *crtc_state, + u8 link_bw, u8 rate_select) + { +- u8 link_config[2]; ++ u8 lane_count = crtc_state->lane_count; ++ ++ if (crtc_state->enhanced_framing) ++ lane_count |= DP_LANE_COUNT_ENHANCED_FRAME_EN; + +- /* Write the link configuration data */ +- link_config[0] = link_bw; +- link_config[1] = crtc_state->lane_count; +- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd)) +- link_config[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN; +- drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config, 2); +- +- /* eDP 1.4 rate select method. */ +- if (!link_bw) +- drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_RATE_SET, +- &rate_select, 1); ++ if (link_bw) { ++ /* DP and eDP v1.3 and earlier link bw set method. */ ++ u8 link_config[] = { link_bw, lane_count }; ++ ++ drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config, ++ ARRAY_SIZE(link_config)); ++ } else { ++ /* ++ * eDP v1.4 and later link rate set method. ++ * ++ * eDP v1.4x sinks shall ignore DP_LINK_RATE_SET if ++ * DP_LINK_BW_SET is set. Avoid writing DP_LINK_BW_SET. ++ * ++ * eDP v1.5 sinks allow choosing either, and the last choice ++ * shall be active. ++ */ ++ drm_dp_dpcd_writeb(&intel_dp->aux, DP_LANE_COUNT_SET, lane_count); ++ drm_dp_dpcd_writeb(&intel_dp->aux, DP_LINK_RATE_SET, rate_select); ++ } + } + + /* +diff --git a/drivers/gpu/drm/i915/i915_hwmon.c b/drivers/gpu/drm/i915/i915_hwmon.c +index 975da8e7f2a9f..8c3f443c8347e 100644 +--- a/drivers/gpu/drm/i915/i915_hwmon.c ++++ b/drivers/gpu/drm/i915/i915_hwmon.c +@@ -175,7 +175,7 @@ hwm_power1_max_interval_show(struct device *dev, struct device_attribute *attr, + * tau4 = (4 | x) << y + * but add 2 when doing the final right shift to account for units + */ +- tau4 = ((1 << x_w) | x) << y; ++ tau4 = (u64)((1 << x_w) | x) << y; + /* val in hwmon interface units (millisec) */ + out = mul_u64_u32_shr(tau4, SF_TIME, hwmon->scl_shift_time + x_w); + +@@ -211,7 +211,7 @@ hwm_power1_max_interval_store(struct device *dev, + r = FIELD_PREP(PKG_MAX_WIN, PKG_MAX_WIN_DEFAULT); + x = REG_FIELD_GET(PKG_MAX_WIN_X, r); + y = REG_FIELD_GET(PKG_MAX_WIN_Y, r); +- tau4 = ((1 << x_w) | x) << y; ++ tau4 = (u64)((1 << x_w) | x) << y; + max_win = mul_u64_u32_shr(tau4, SF_TIME, hwmon->scl_shift_time + x_w); + + if (val > max_win) +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index 4396f501b16a3..50589f982d1a4 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -1133,7 +1133,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) + } + + get_task_comm(tmpname, current); +- snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid)); ++ rcu_read_lock(); ++ snprintf(name, sizeof(name), "%s[%d]", ++ tmpname, pid_nr(rcu_dereference(fpriv->pid))); ++ rcu_read_unlock(); + + if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL))) { + ret = -ENOMEM; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c +index 8b1eb0061610c..12787bb9c111d 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c +@@ -244,6 +244,7 @@ static int vmw_debugfs_gem_info_show(struct seq_file *m, void *unused) + list_for_each_entry(file, &dev->filelist, lhead) { + struct task_struct *task; + struct drm_gem_object *gobj; ++ struct pid *pid; + int id; + + /* +@@ -253,8 +254,9 @@ static int vmw_debugfs_gem_info_show(struct seq_file *m, void *unused) + * Therefore, we need to protect this ->comm access using RCU. + */ + rcu_read_lock(); +- task = pid_task(file->pid, PIDTYPE_TGID); +- seq_printf(m, "pid %8d command %s:\n", pid_nr(file->pid), ++ pid = rcu_dereference(file->pid); ++ task = pid_task(pid, PIDTYPE_TGID); ++ seq_printf(m, "pid %8d command %s:\n", pid_nr(pid), + task ? task->comm : ""); + rcu_read_unlock(); + +diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c +index 28e2a5fc45282..5511fd46a65ea 100644 +--- a/drivers/i2c/busses/i2c-aspeed.c ++++ b/drivers/i2c/busses/i2c-aspeed.c +@@ -249,18 +249,46 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status) + if (!slave) + return 0; + +- command = readl(bus->base + ASPEED_I2C_CMD_REG); ++ /* ++ * Handle stop conditions early, prior to SLAVE_MATCH. Some masters may drive ++ * transfers with low enough latency between the nak/stop phase of the current ++ * command and the start/address phase of the following command that the ++ * interrupts are coalesced by the time we process them. ++ */ ++ if (irq_status & ASPEED_I2CD_INTR_NORMAL_STOP) { ++ irq_handled |= ASPEED_I2CD_INTR_NORMAL_STOP; ++ bus->slave_state = ASPEED_I2C_SLAVE_STOP; ++ } ++ ++ if (irq_status & ASPEED_I2CD_INTR_TX_NAK && ++ bus->slave_state == ASPEED_I2C_SLAVE_READ_PROCESSED) { ++ irq_handled |= ASPEED_I2CD_INTR_TX_NAK; ++ bus->slave_state = ASPEED_I2C_SLAVE_STOP; ++ } ++ ++ /* Propagate any stop conditions to the slave implementation. */ ++ if (bus->slave_state == ASPEED_I2C_SLAVE_STOP) { ++ i2c_slave_event(slave, I2C_SLAVE_STOP, &value); ++ bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE; ++ } + +- /* Slave was requested, restart state machine. */ ++ /* ++ * Now that we've dealt with any potentially coalesced stop conditions, ++ * address any start conditions. ++ */ + if (irq_status & ASPEED_I2CD_INTR_SLAVE_MATCH) { + irq_handled |= ASPEED_I2CD_INTR_SLAVE_MATCH; + bus->slave_state = ASPEED_I2C_SLAVE_START; + } + +- /* Slave is not currently active, irq was for someone else. */ ++ /* ++ * If the slave has been stopped and not started then slave interrupt ++ * handling is complete. ++ */ + if (bus->slave_state == ASPEED_I2C_SLAVE_INACTIVE) + return irq_handled; + ++ command = readl(bus->base + ASPEED_I2C_CMD_REG); + dev_dbg(bus->dev, "slave irq status 0x%08x, cmd 0x%08x\n", + irq_status, command); + +@@ -279,17 +307,6 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status) + irq_handled |= ASPEED_I2CD_INTR_RX_DONE; + } + +- /* Slave was asked to stop. */ +- if (irq_status & ASPEED_I2CD_INTR_NORMAL_STOP) { +- irq_handled |= ASPEED_I2CD_INTR_NORMAL_STOP; +- bus->slave_state = ASPEED_I2C_SLAVE_STOP; +- } +- if (irq_status & ASPEED_I2CD_INTR_TX_NAK && +- bus->slave_state == ASPEED_I2C_SLAVE_READ_PROCESSED) { +- irq_handled |= ASPEED_I2CD_INTR_TX_NAK; +- bus->slave_state = ASPEED_I2C_SLAVE_STOP; +- } +- + switch (bus->slave_state) { + case ASPEED_I2C_SLAVE_READ_REQUESTED: + if (unlikely(irq_status & ASPEED_I2CD_INTR_TX_ACK)) +@@ -324,8 +341,7 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status) + i2c_slave_event(slave, I2C_SLAVE_WRITE_RECEIVED, &value); + break; + case ASPEED_I2C_SLAVE_STOP: +- i2c_slave_event(slave, I2C_SLAVE_STOP, &value); +- bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE; ++ /* Stop event handling is done early. Unreachable. */ + break; + case ASPEED_I2C_SLAVE_START: + /* Slave was just started. Waiting for the next event. */; +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index 229353e96e095..0a9d389df301b 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -857,6 +857,7 @@ static int geni_i2c_probe(struct platform_device *pdev) + ret = geni_se_resources_on(&gi2c->se); + if (ret) { + dev_err(dev, "Error turning on resources %d\n", ret); ++ clk_disable_unprepare(gi2c->core_clk); + return ret; + } + proto = geni_se_read_proto(&gi2c->se); +@@ -876,8 +877,11 @@ static int geni_i2c_probe(struct platform_device *pdev) + /* FIFO is disabled, so we can only use GPI DMA */ + gi2c->gpi_mode = true; + ret = setup_gpi_dma(gi2c); +- if (ret) ++ if (ret) { ++ geni_se_resources_off(&gi2c->se); ++ clk_disable_unprepare(gi2c->core_clk); + return dev_err_probe(dev, ret, "Failed to setup GPI DMA mode\n"); ++ } + + dev_dbg(dev, "Using GPI DMA mode for I2C\n"); + } else { +@@ -890,6 +894,8 @@ static int geni_i2c_probe(struct platform_device *pdev) + + if (!tx_depth) { + dev_err(dev, "Invalid TX FIFO depth\n"); ++ geni_se_resources_off(&gi2c->se); ++ clk_disable_unprepare(gi2c->core_clk); + return -EINVAL; + } + +diff --git a/drivers/iio/accel/kionix-kx022a.c b/drivers/iio/accel/kionix-kx022a.c +index 4ea3c6718ed49..971fc60efef01 100644 +--- a/drivers/iio/accel/kionix-kx022a.c ++++ b/drivers/iio/accel/kionix-kx022a.c +@@ -273,17 +273,17 @@ static const unsigned int kx022a_odrs[] = { + * (range / 2^bits) * g = (range / 2^bits) * 9.80665 m/s^2 + * => KX022A uses 16 bit (HiRes mode - assume the low 8 bits are zeroed + * in low-power mode(?) ) +- * => +/-2G => 4 / 2^16 * 9,80665 * 10^6 (to scale to micro) +- * => +/-2G - 598.550415 +- * +/-4G - 1197.10083 +- * +/-8G - 2394.20166 +- * +/-16G - 4788.40332 ++ * => +/-2G => 4 / 2^16 * 9,80665 ++ * => +/-2G - 0.000598550415 ++ * +/-4G - 0.00119710083 ++ * +/-8G - 0.00239420166 ++ * +/-16G - 0.00478840332 + */ + static const int kx022a_scale_table[][2] = { +- { 598, 550415 }, +- { 1197, 100830 }, +- { 2394, 201660 }, +- { 4788, 403320 }, ++ { 0, 598550 }, ++ { 0, 1197101 }, ++ { 0, 2394202 }, ++ { 0, 4788403 }, + }; + + static int kx022a_read_avail(struct iio_dev *indio_dev, +@@ -302,7 +302,7 @@ static int kx022a_read_avail(struct iio_dev *indio_dev, + *vals = (const int *)kx022a_scale_table; + *length = ARRAY_SIZE(kx022a_scale_table) * + ARRAY_SIZE(kx022a_scale_table[0]); +- *type = IIO_VAL_INT_PLUS_MICRO; ++ *type = IIO_VAL_INT_PLUS_NANO; + return IIO_AVAIL_LIST; + default: + return -EINVAL; +@@ -366,6 +366,20 @@ static int kx022a_turn_on_unlock(struct kx022a_data *data) + return ret; + } + ++static int kx022a_write_raw_get_fmt(struct iio_dev *idev, ++ struct iio_chan_spec const *chan, ++ long mask) ++{ ++ switch (mask) { ++ case IIO_CHAN_INFO_SCALE: ++ return IIO_VAL_INT_PLUS_NANO; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ return IIO_VAL_INT_PLUS_MICRO; ++ default: ++ return -EINVAL; ++ } ++} ++ + static int kx022a_write_raw(struct iio_dev *idev, + struct iio_chan_spec const *chan, + int val, int val2, long mask) +@@ -510,7 +524,7 @@ static int kx022a_read_raw(struct iio_dev *idev, + + kx022a_reg2scale(regval, val, val2); + +- return IIO_VAL_INT_PLUS_MICRO; ++ return IIO_VAL_INT_PLUS_NANO; + } + + return -EINVAL; +@@ -712,6 +726,7 @@ static int kx022a_fifo_flush(struct iio_dev *idev, unsigned int samples) + static const struct iio_info kx022a_info = { + .read_raw = &kx022a_read_raw, + .write_raw = &kx022a_write_raw, ++ .write_raw_get_fmt = &kx022a_write_raw_get_fmt, + .read_avail = &kx022a_read_avail, + + .validate_trigger = iio_validate_own_trigger, +diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c +index dce9ec91e4a77..512d7b95b08e6 100644 +--- a/drivers/iio/adc/imx93_adc.c ++++ b/drivers/iio/adc/imx93_adc.c +@@ -93,6 +93,10 @@ static const struct iio_chan_spec imx93_adc_iio_channels[] = { + IMX93_ADC_CHAN(1), + IMX93_ADC_CHAN(2), + IMX93_ADC_CHAN(3), ++ IMX93_ADC_CHAN(4), ++ IMX93_ADC_CHAN(5), ++ IMX93_ADC_CHAN(6), ++ IMX93_ADC_CHAN(7), + }; + + static void imx93_adc_power_down(struct imx93_adc *adc) +diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c +index 320e3e7e3d4d4..57cfabe80c826 100644 +--- a/drivers/iio/adc/meson_saradc.c ++++ b/drivers/iio/adc/meson_saradc.c +@@ -1239,6 +1239,20 @@ static const struct meson_sar_adc_param meson_sar_adc_gxl_param = { + .cmv_select = 1, + }; + ++static const struct meson_sar_adc_param meson_sar_adc_axg_param = { ++ .has_bl30_integration = true, ++ .clock_rate = 1200000, ++ .bandgap_reg = MESON_SAR_ADC_REG11, ++ .regmap_config = &meson_sar_adc_regmap_config_gxbb, ++ .resolution = 12, ++ .disable_ring_counter = 1, ++ .has_reg11 = true, ++ .vref_volatge = 1, ++ .has_vref_select = true, ++ .vref_select = VREF_VDDA, ++ .cmv_select = 1, ++}; ++ + static const struct meson_sar_adc_param meson_sar_adc_g12a_param = { + .has_bl30_integration = false, + .clock_rate = 1200000, +@@ -1283,7 +1297,7 @@ static const struct meson_sar_adc_data meson_sar_adc_gxm_data = { + }; + + static const struct meson_sar_adc_data meson_sar_adc_axg_data = { +- .param = &meson_sar_adc_gxl_param, ++ .param = &meson_sar_adc_axg_param, + .name = "meson-axg-saradc", + }; + +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index 8db7a01cb5fbf..5f87959869954 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -670,8 +670,10 @@ static int tiadc_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, indio_dev); + + err = tiadc_request_dma(pdev, adc_dev); +- if (err && err == -EPROBE_DEFER) ++ if (err && err != -ENODEV) { ++ dev_err_probe(&pdev->dev, err, "DMA request failed\n"); + goto err_dma; ++ } + + return 0; + +diff --git a/drivers/iio/buffer/industrialio-triggered-buffer.c b/drivers/iio/buffer/industrialio-triggered-buffer.c +index c7671b1f5eada..c06515987e7a7 100644 +--- a/drivers/iio/buffer/industrialio-triggered-buffer.c ++++ b/drivers/iio/buffer/industrialio-triggered-buffer.c +@@ -46,6 +46,16 @@ int iio_triggered_buffer_setup_ext(struct iio_dev *indio_dev, + struct iio_buffer *buffer; + int ret; + ++ /* ++ * iio_triggered_buffer_cleanup() assumes that the buffer allocated here ++ * is assigned to indio_dev->buffer but this is only the case if this ++ * function is the first caller to iio_device_attach_buffer(). If ++ * indio_dev->buffer is already set then we can't proceed otherwise the ++ * cleanup function will try to free a buffer that was not allocated here. ++ */ ++ if (indio_dev->buffer) ++ return -EADDRINUSE; ++ + buffer = iio_kfifo_allocate(); + if (!buffer) { + ret = -ENOMEM; +diff --git a/drivers/iio/common/ms_sensors/ms_sensors_i2c.c b/drivers/iio/common/ms_sensors/ms_sensors_i2c.c +index 6633b35a94e69..9c9bc77003c7f 100644 +--- a/drivers/iio/common/ms_sensors/ms_sensors_i2c.c ++++ b/drivers/iio/common/ms_sensors/ms_sensors_i2c.c +@@ -15,8 +15,8 @@ + /* Conversion times in us */ + static const u16 ms_sensors_ht_t_conversion_time[] = { 50000, 25000, + 13000, 7000 }; +-static const u16 ms_sensors_ht_h_conversion_time[] = { 16000, 3000, +- 5000, 8000 }; ++static const u16 ms_sensors_ht_h_conversion_time[] = { 16000, 5000, ++ 3000, 8000 }; + static const u16 ms_sensors_tp_conversion_time[] = { 500, 1100, 2100, + 4100, 8220, 16440 }; + +diff --git a/drivers/iio/imu/adis16475.c b/drivers/iio/imu/adis16475.c +index 17275a53ca2cd..0a9951a502101 100644 +--- a/drivers/iio/imu/adis16475.c ++++ b/drivers/iio/imu/adis16475.c +@@ -1244,50 +1244,6 @@ static int adis16475_config_irq_pin(struct adis16475 *st) + return 0; + } + +-static const struct of_device_id adis16475_of_match[] = { +- { .compatible = "adi,adis16470", +- .data = &adis16475_chip_info[ADIS16470] }, +- { .compatible = "adi,adis16475-1", +- .data = &adis16475_chip_info[ADIS16475_1] }, +- { .compatible = "adi,adis16475-2", +- .data = &adis16475_chip_info[ADIS16475_2] }, +- { .compatible = "adi,adis16475-3", +- .data = &adis16475_chip_info[ADIS16475_3] }, +- { .compatible = "adi,adis16477-1", +- .data = &adis16475_chip_info[ADIS16477_1] }, +- { .compatible = "adi,adis16477-2", +- .data = &adis16475_chip_info[ADIS16477_2] }, +- { .compatible = "adi,adis16477-3", +- .data = &adis16475_chip_info[ADIS16477_3] }, +- { .compatible = "adi,adis16465-1", +- .data = &adis16475_chip_info[ADIS16465_1] }, +- { .compatible = "adi,adis16465-2", +- .data = &adis16475_chip_info[ADIS16465_2] }, +- { .compatible = "adi,adis16465-3", +- .data = &adis16475_chip_info[ADIS16465_3] }, +- { .compatible = "adi,adis16467-1", +- .data = &adis16475_chip_info[ADIS16467_1] }, +- { .compatible = "adi,adis16467-2", +- .data = &adis16475_chip_info[ADIS16467_2] }, +- { .compatible = "adi,adis16467-3", +- .data = &adis16475_chip_info[ADIS16467_3] }, +- { .compatible = "adi,adis16500", +- .data = &adis16475_chip_info[ADIS16500] }, +- { .compatible = "adi,adis16505-1", +- .data = &adis16475_chip_info[ADIS16505_1] }, +- { .compatible = "adi,adis16505-2", +- .data = &adis16475_chip_info[ADIS16505_2] }, +- { .compatible = "adi,adis16505-3", +- .data = &adis16475_chip_info[ADIS16505_3] }, +- { .compatible = "adi,adis16507-1", +- .data = &adis16475_chip_info[ADIS16507_1] }, +- { .compatible = "adi,adis16507-2", +- .data = &adis16475_chip_info[ADIS16507_2] }, +- { .compatible = "adi,adis16507-3", +- .data = &adis16475_chip_info[ADIS16507_3] }, +- { }, +-}; +-MODULE_DEVICE_TABLE(of, adis16475_of_match); + + static int adis16475_probe(struct spi_device *spi) + { +@@ -1301,7 +1257,7 @@ static int adis16475_probe(struct spi_device *spi) + + st = iio_priv(indio_dev); + +- st->info = device_get_match_data(&spi->dev); ++ st->info = spi_get_device_match_data(spi); + if (!st->info) + return -EINVAL; + +@@ -1341,12 +1297,83 @@ static int adis16475_probe(struct spi_device *spi) + return 0; + } + ++static const struct of_device_id adis16475_of_match[] = { ++ { .compatible = "adi,adis16470", ++ .data = &adis16475_chip_info[ADIS16470] }, ++ { .compatible = "adi,adis16475-1", ++ .data = &adis16475_chip_info[ADIS16475_1] }, ++ { .compatible = "adi,adis16475-2", ++ .data = &adis16475_chip_info[ADIS16475_2] }, ++ { .compatible = "adi,adis16475-3", ++ .data = &adis16475_chip_info[ADIS16475_3] }, ++ { .compatible = "adi,adis16477-1", ++ .data = &adis16475_chip_info[ADIS16477_1] }, ++ { .compatible = "adi,adis16477-2", ++ .data = &adis16475_chip_info[ADIS16477_2] }, ++ { .compatible = "adi,adis16477-3", ++ .data = &adis16475_chip_info[ADIS16477_3] }, ++ { .compatible = "adi,adis16465-1", ++ .data = &adis16475_chip_info[ADIS16465_1] }, ++ { .compatible = "adi,adis16465-2", ++ .data = &adis16475_chip_info[ADIS16465_2] }, ++ { .compatible = "adi,adis16465-3", ++ .data = &adis16475_chip_info[ADIS16465_3] }, ++ { .compatible = "adi,adis16467-1", ++ .data = &adis16475_chip_info[ADIS16467_1] }, ++ { .compatible = "adi,adis16467-2", ++ .data = &adis16475_chip_info[ADIS16467_2] }, ++ { .compatible = "adi,adis16467-3", ++ .data = &adis16475_chip_info[ADIS16467_3] }, ++ { .compatible = "adi,adis16500", ++ .data = &adis16475_chip_info[ADIS16500] }, ++ { .compatible = "adi,adis16505-1", ++ .data = &adis16475_chip_info[ADIS16505_1] }, ++ { .compatible = "adi,adis16505-2", ++ .data = &adis16475_chip_info[ADIS16505_2] }, ++ { .compatible = "adi,adis16505-3", ++ .data = &adis16475_chip_info[ADIS16505_3] }, ++ { .compatible = "adi,adis16507-1", ++ .data = &adis16475_chip_info[ADIS16507_1] }, ++ { .compatible = "adi,adis16507-2", ++ .data = &adis16475_chip_info[ADIS16507_2] }, ++ { .compatible = "adi,adis16507-3", ++ .data = &adis16475_chip_info[ADIS16507_3] }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, adis16475_of_match); ++ ++static const struct spi_device_id adis16475_ids[] = { ++ { "adis16470", (kernel_ulong_t)&adis16475_chip_info[ADIS16470] }, ++ { "adis16475-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_1] }, ++ { "adis16475-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_2] }, ++ { "adis16475-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_3] }, ++ { "adis16477-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_1] }, ++ { "adis16477-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_2] }, ++ { "adis16477-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_3] }, ++ { "adis16465-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_1] }, ++ { "adis16465-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_2] }, ++ { "adis16465-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_3] }, ++ { "adis16467-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_1] }, ++ { "adis16467-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_2] }, ++ { "adis16467-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_3] }, ++ { "adis16500", (kernel_ulong_t)&adis16475_chip_info[ADIS16500] }, ++ { "adis16505-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_1] }, ++ { "adis16505-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_2] }, ++ { "adis16505-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_3] }, ++ { "adis16507-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_1] }, ++ { "adis16507-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_2] }, ++ { "adis16507-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_3] }, ++ { } ++}; ++MODULE_DEVICE_TABLE(spi, adis16475_ids); ++ + static struct spi_driver adis16475_driver = { + .driver = { + .name = "adis16475", + .of_match_table = adis16475_of_match, + }, + .probe = adis16475_probe, ++ .id_table = adis16475_ids, + }; + module_spi_driver(adis16475_driver); + +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +index 29f906c884bd8..a9a5fb266ef13 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -749,13 +749,13 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev, + ret = inv_mpu6050_sensor_show(st, st->reg->gyro_offset, + chan->channel2, val); + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + case IIO_ACCEL: + mutex_lock(&st->lock); + ret = inv_mpu6050_sensor_show(st, st->reg->accl_offset, + chan->channel2, val); + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + + default: + return -EINVAL; +diff --git a/drivers/iio/magnetometer/tmag5273.c b/drivers/iio/magnetometer/tmag5273.c +index c5e5c4ad681e6..e8c4ca142d21d 100644 +--- a/drivers/iio/magnetometer/tmag5273.c ++++ b/drivers/iio/magnetometer/tmag5273.c +@@ -356,7 +356,7 @@ static int tmag5273_read_raw(struct iio_dev *indio_dev, + case IIO_CHAN_INFO_OFFSET: + switch (chan->type) { + case IIO_TEMP: +- *val = -266314; ++ *val = -16005; + return IIO_VAL_INT; + default: + return -EINVAL; +diff --git a/drivers/input/keyboard/ipaq-micro-keys.c b/drivers/input/keyboard/ipaq-micro-keys.c +index 7b509bce2b332..1d71dd79ffd28 100644 +--- a/drivers/input/keyboard/ipaq-micro-keys.c ++++ b/drivers/input/keyboard/ipaq-micro-keys.c +@@ -105,6 +105,9 @@ static int micro_key_probe(struct platform_device *pdev) + keys->codes = devm_kmemdup(&pdev->dev, micro_keycodes, + keys->input->keycodesize * keys->input->keycodemax, + GFP_KERNEL); ++ if (!keys->codes) ++ return -ENOMEM; ++ + keys->input->keycode = keys->codes; + + __set_bit(EV_KEY, keys->input->evbit); +diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c +index e79f5497948b8..9116f4248fd09 100644 +--- a/drivers/input/misc/soc_button_array.c ++++ b/drivers/input/misc/soc_button_array.c +@@ -299,6 +299,11 @@ static int soc_button_parse_btn_desc(struct device *dev, + info->name = "power"; + info->event_code = KEY_POWER; + info->wakeup = true; ++ } else if (upage == 0x01 && usage == 0xc6) { ++ info->name = "airplane mode switch"; ++ info->event_type = EV_SW; ++ info->event_code = SW_RFKILL_ALL; ++ info->active_low = false; + } else if (upage == 0x01 && usage == 0xca) { + info->name = "rotation lock switch"; + info->event_type = EV_SW; +diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c +index dfab160ca5293..50bac2d79d9b5 100644 +--- a/drivers/interconnect/core.c ++++ b/drivers/interconnect/core.c +@@ -395,6 +395,9 @@ struct icc_node_data *of_icc_get_from_provider(struct of_phandle_args *spec) + } + mutex_unlock(&icc_lock); + ++ if (!node) ++ return ERR_PTR(-EINVAL); ++ + if (IS_ERR(node)) + return ERR_CAST(node); + +diff --git a/drivers/interconnect/qcom/sm8250.c b/drivers/interconnect/qcom/sm8250.c +index 661dc18d99dba..2a2f56b993733 100644 +--- a/drivers/interconnect/qcom/sm8250.c ++++ b/drivers/interconnect/qcom/sm8250.c +@@ -1995,6 +1995,7 @@ static struct platform_driver qnoc_driver = { + .driver = { + .name = "qnoc-sm8250", + .of_match_table = qnoc_of_match, ++ .sync_state = icc_sync_state, + }, + }; + module_platform_driver(qnoc_driver); +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 97a8d5fc9ebb6..9261bbebd662a 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -1765,11 +1765,12 @@ static void integrity_metadata(struct work_struct *w) + sectors_to_process = dio->range.n_sectors; + + __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) { ++ struct bio_vec bv_copy = bv; + unsigned int pos; + char *mem, *checksums_ptr; + + again: +- mem = bvec_kmap_local(&bv); ++ mem = bvec_kmap_local(&bv_copy); + pos = 0; + checksums_ptr = checksums; + do { +@@ -1778,7 +1779,7 @@ again: + sectors_to_process -= ic->sectors_per_block; + pos += ic->sectors_per_block << SECTOR_SHIFT; + sector += ic->sectors_per_block; +- } while (pos < bv.bv_len && sectors_to_process && checksums != checksums_onstack); ++ } while (pos < bv_copy.bv_len && sectors_to_process && checksums != checksums_onstack); + kunmap_local(mem); + + r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset, +@@ -1803,9 +1804,9 @@ again: + if (!sectors_to_process) + break; + +- if (unlikely(pos < bv.bv_len)) { +- bv.bv_offset += pos; +- bv.bv_len -= pos; ++ if (unlikely(pos < bv_copy.bv_len)) { ++ bv_copy.bv_offset += pos; ++ bv_copy.bv_len -= pos; + goto again; + } + } +diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +index 5935be190b9e2..5f2a6fcba9670 100644 +--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c ++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +@@ -866,10 +866,13 @@ static int atl1e_setup_ring_resources(struct atl1e_adapter *adapter) + netdev_err(adapter->netdev, "offset(%d) > ring size(%d) !!\n", + offset, adapter->ring_size); + err = -1; +- goto failed; ++ goto free_buffer; + } + + return 0; ++free_buffer: ++ kfree(tx_ring->tx_buffer); ++ tx_ring->tx_buffer = NULL; + failed: + if (adapter->ring_vir_addr != NULL) { + dma_free_coherent(&pdev->dev, adapter->ring_size, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index 96f5ca778c67d..8cb9a99154aad 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -59,7 +59,6 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp, + for (i = 0; i < num_frags ; i++) { + skb_frag_t *frag = &sinfo->frags[i]; + struct bnxt_sw_tx_bd *frag_tx_buf; +- struct pci_dev *pdev = bp->pdev; + dma_addr_t frag_mapping; + int frag_len; + +@@ -73,16 +72,10 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp, + txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)]; + + frag_len = skb_frag_size(frag); +- frag_mapping = skb_frag_dma_map(&pdev->dev, frag, 0, +- frag_len, DMA_TO_DEVICE); +- +- if (unlikely(dma_mapping_error(&pdev->dev, frag_mapping))) +- return NULL; +- +- dma_unmap_addr_set(frag_tx_buf, mapping, frag_mapping); +- + flags = frag_len << TX_BD_LEN_SHIFT; + txbd->tx_bd_len_flags_type = cpu_to_le32(flags); ++ frag_mapping = page_pool_get_dma_addr(skb_frag_page(frag)) + ++ skb_frag_off(frag); + txbd->tx_bd_haddr = cpu_to_le64(frag_mapping); + + len = frag_len; +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index ad4d4702129f0..9be13e9840917 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -1757,14 +1757,14 @@ ice_phy_type_to_ethtool(struct net_device *netdev, + linkmode_zero(ks->link_modes.supported); + linkmode_zero(ks->link_modes.advertising); + +- for (i = 0; i < BITS_PER_TYPE(u64); i++) { ++ for (i = 0; i < ARRAY_SIZE(phy_type_low_lkup); i++) { + if (phy_types_low & BIT_ULL(i)) + ice_linkmode_set_bit(&phy_type_low_lkup[i], ks, + req_speeds, advert_phy_type_lo, + i); + } + +- for (i = 0; i < BITS_PER_TYPE(u64); i++) { ++ for (i = 0; i < ARRAY_SIZE(phy_type_high_lkup); i++) { + if (phy_types_high & BIT_ULL(i)) + ice_linkmode_set_bit(&phy_type_high_lkup[i], ks, + req_speeds, advert_phy_type_hi, +diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c +index d86e2460b5a4d..23e197c3d02a7 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lag.c ++++ b/drivers/net/ethernet/intel/ice/ice_lag.c +@@ -1963,6 +1963,8 @@ int ice_init_lag(struct ice_pf *pf) + int n, err; + + ice_lag_init_feature_support_flag(pf); ++ if (!ice_is_feature_supported(pf, ICE_F_SRIOV_LAG)) ++ return 0; + + pf->lag = kzalloc(sizeof(*lag), GFP_KERNEL); + if (!pf->lag) +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index 73bbf06a76db9..a66c3b6ccec1e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -2384,6 +2384,9 @@ static int ice_vsi_cfg_tc_lan(struct ice_pf *pf, struct ice_vsi *vsi) + } else { + max_txqs[i] = vsi->alloc_txq; + } ++ ++ if (vsi->type == ICE_VSI_PF) ++ max_txqs[i] += vsi->num_xdp_txq; + } + + dev_dbg(dev, "vsi->tc_cfg.ena_tc = %d\n", vsi->tc_cfg.ena_tc); +@@ -2633,10 +2636,6 @@ void ice_vsi_decfg(struct ice_vsi *vsi) + if (vsi->type == ICE_VSI_VF && + vsi->agg_node && vsi->agg_node->valid) + vsi->agg_node->num_vsis--; +- if (vsi->agg_node) { +- vsi->agg_node->valid = false; +- vsi->agg_node->agg_id = 0; +- } + } + + /** +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +index bfddbff7bcdfb..28fb643d2917f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +@@ -399,9 +399,10 @@ static int otx2_dcbnl_ieee_getpfc(struct net_device *dev, struct ieee_pfc *pfc) + static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc) + { + struct otx2_nic *pfvf = netdev_priv(dev); ++ u8 old_pfc_en; + int err; + +- /* Save PFC configuration to interface */ ++ old_pfc_en = pfvf->pfc_en; + pfvf->pfc_en = pfc->pfc_en; + + if (pfvf->hw.tx_queues >= NIX_PF_PFC_PRIO_MAX) +@@ -411,13 +412,17 @@ static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc) + * supported by the tx queue configuration + */ + err = otx2_check_pfc_config(pfvf); +- if (err) ++ if (err) { ++ pfvf->pfc_en = old_pfc_en; + return err; ++ } + + process_pfc: + err = otx2_config_priority_flow_ctrl(pfvf); +- if (err) ++ if (err) { ++ pfvf->pfc_en = old_pfc_en; + return err; ++ } + + /* Request Per channel Bpids */ + if (pfc->pfc_en) +@@ -425,6 +430,12 @@ process_pfc: + + err = otx2_pfc_txschq_update(pfvf); + if (err) { ++ if (pfc->pfc_en) ++ otx2_nix_config_bp(pfvf, false); ++ ++ otx2_pfc_txschq_stop(pfvf); ++ pfvf->pfc_en = old_pfc_en; ++ otx2_config_priority_flow_ctrl(pfvf); + dev_err(pfvf->dev, "%s failed to update TX schedulers\n", __func__); + return err; + } +diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.c b/drivers/net/ethernet/mediatek/mtk_wed_wo.c +index 3bd51a3d66500..ae44ad5f8ce8a 100644 +--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c ++++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c +@@ -291,6 +291,9 @@ mtk_wed_wo_queue_tx_clean(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q) + for (i = 0; i < q->n_desc; i++) { + struct mtk_wed_wo_queue_entry *entry = &q->entry[i]; + ++ if (!entry->buf) ++ continue; ++ + dma_unmap_single(wo->hw->dev, entry->addr, entry->len, + DMA_TO_DEVICE); + skb_free_frag(entry->buf); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index c22b0ad0c8701..7013e1c8741a3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -156,15 +156,18 @@ static u8 alloc_token(struct mlx5_cmd *cmd) + return token; + } + +-static int cmd_alloc_index(struct mlx5_cmd *cmd) ++static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent) + { + unsigned long flags; + int ret; + + spin_lock_irqsave(&cmd->alloc_lock, flags); + ret = find_first_bit(&cmd->vars.bitmask, cmd->vars.max_reg_cmds); +- if (ret < cmd->vars.max_reg_cmds) ++ if (ret < cmd->vars.max_reg_cmds) { + clear_bit(ret, &cmd->vars.bitmask); ++ ent->idx = ret; ++ cmd->ent_arr[ent->idx] = ent; ++ } + spin_unlock_irqrestore(&cmd->alloc_lock, flags); + + return ret < cmd->vars.max_reg_cmds ? ret : -ENOMEM; +@@ -977,7 +980,7 @@ static void cmd_work_handler(struct work_struct *work) + sem = ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem; + down(sem); + if (!ent->page_queue) { +- alloc_ret = cmd_alloc_index(cmd); ++ alloc_ret = cmd_alloc_index(cmd, ent); + if (alloc_ret < 0) { + mlx5_core_err_rl(dev, "failed to allocate command entry\n"); + if (ent->callback) { +@@ -992,15 +995,14 @@ static void cmd_work_handler(struct work_struct *work) + up(sem); + return; + } +- ent->idx = alloc_ret; + } else { + ent->idx = cmd->vars.max_reg_cmds; + spin_lock_irqsave(&cmd->alloc_lock, flags); + clear_bit(ent->idx, &cmd->vars.bitmask); ++ cmd->ent_arr[ent->idx] = ent; + spin_unlock_irqrestore(&cmd->alloc_lock, flags); + } + +- cmd->ent_arr[ent->idx] = ent; + lay = get_inst(cmd, ent->idx); + ent->lay = lay; + memset(lay, 0, sizeof(*lay)); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +index ad789349c06e6..85d3bfa0780c6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -718,7 +718,7 @@ static void mlx5_fw_tracer_handle_traces(struct work_struct *work) + + while (block_timestamp > tracer->last_timestamp) { + /* Check block override if it's not the first block */ +- if (!tracer->last_timestamp) { ++ if (tracer->last_timestamp) { + u64 *ts_event; + /* To avoid block override be the HW in case of buffer + * wraparound, the time stamp of the previous block +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c +index be83ad9db82a4..e1283531e0b81 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c +@@ -154,6 +154,7 @@ static int fs_udp_create_groups(struct mlx5e_flow_table *ft, enum fs_udp_type ty + in = kvzalloc(inlen, GFP_KERNEL); + if (!in || !ft->g) { + kfree(ft->g); ++ ft->g = NULL; + kvfree(in); + return -ENOMEM; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c +index f63402c480280..1b418095b79a3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c +@@ -197,7 +197,7 @@ parse_mirred_encap(struct mlx5e_tc_act_parse_state *parse_state, + } + esw_attr->dests[esw_attr->out_count].flags |= MLX5_ESW_DEST_ENCAP; + esw_attr->out_count++; +- /* attr->dests[].rep is resolved when we handle encap */ ++ /* attr->dests[].vport is resolved when we handle encap */ + + return 0; + } +@@ -270,7 +270,8 @@ parse_mirred(struct mlx5e_tc_act_parse_state *parse_state, + + out_priv = netdev_priv(out_dev); + rpriv = out_priv->ppriv; +- esw_attr->dests[esw_attr->out_count].rep = rpriv->rep; ++ esw_attr->dests[esw_attr->out_count].vport_valid = true; ++ esw_attr->dests[esw_attr->out_count].vport = rpriv->rep->vport; + esw_attr->dests[esw_attr->out_count].mdev = out_priv->mdev; + + esw_attr->out_count++; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +index 668da5c70e63d..00a04fdd756f5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +@@ -300,6 +300,9 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, + if (err) + goto destroy_neigh_entry; + ++ e->encap_size = ipv4_encap_size; ++ e->encap_header = encap_header; ++ + if (!(nud_state & NUD_VALID)) { + neigh_event_send(attr.n, NULL); + /* the encap entry will be made valid on neigh update event +@@ -319,8 +322,6 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, + goto destroy_neigh_entry; + } + +- e->encap_size = ipv4_encap_size; +- e->encap_header = encap_header; + e->flags |= MLX5_ENCAP_ENTRY_VALID; + mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); + mlx5e_route_lookup_ipv4_put(&attr); +@@ -403,12 +404,16 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv, + if (err) + goto free_encap; + ++ e->encap_size = ipv4_encap_size; ++ kfree(e->encap_header); ++ e->encap_header = encap_header; ++ + if (!(nud_state & NUD_VALID)) { + neigh_event_send(attr.n, NULL); + /* the encap entry will be made valid on neigh update event + * and not used before that. + */ +- goto free_encap; ++ goto release_neigh; + } + + memset(&reformat_params, 0, sizeof(reformat_params)); +@@ -422,10 +427,6 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv, + goto free_encap; + } + +- e->encap_size = ipv4_encap_size; +- kfree(e->encap_header); +- e->encap_header = encap_header; +- + e->flags |= MLX5_ENCAP_ENTRY_VALID; + mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); + mlx5e_route_lookup_ipv4_put(&attr); +@@ -567,6 +568,9 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, + if (err) + goto destroy_neigh_entry; + ++ e->encap_size = ipv6_encap_size; ++ e->encap_header = encap_header; ++ + if (!(nud_state & NUD_VALID)) { + neigh_event_send(attr.n, NULL); + /* the encap entry will be made valid on neigh update event +@@ -586,8 +590,6 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, + goto destroy_neigh_entry; + } + +- e->encap_size = ipv6_encap_size; +- e->encap_header = encap_header; + e->flags |= MLX5_ENCAP_ENTRY_VALID; + mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); + mlx5e_route_lookup_ipv6_put(&attr); +@@ -669,12 +671,16 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv, + if (err) + goto free_encap; + ++ e->encap_size = ipv6_encap_size; ++ kfree(e->encap_header); ++ e->encap_header = encap_header; ++ + if (!(nud_state & NUD_VALID)) { + neigh_event_send(attr.n, NULL); + /* the encap entry will be made valid on neigh update event + * and not used before that. + */ +- goto free_encap; ++ goto release_neigh; + } + + memset(&reformat_params, 0, sizeof(reformat_params)); +@@ -688,10 +694,6 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv, + goto free_encap; + } + +- e->encap_size = ipv6_encap_size; +- kfree(e->encap_header); +- e->encap_header = encap_header; +- + e->flags |= MLX5_ENCAP_ENTRY_VALID; + mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); + mlx5e_route_lookup_ipv6_put(&attr); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +index b10e40e1a9c14..f1d1e1542e81b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +@@ -1064,7 +1064,8 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv, + + out_priv = netdev_priv(encap_dev); + rpriv = out_priv->ppriv; +- esw_attr->dests[out_index].rep = rpriv->rep; ++ esw_attr->dests[out_index].vport_valid = true; ++ esw_attr->dests[out_index].vport = rpriv->rep->vport; + esw_attr->dests[out_index].mdev = out_priv->mdev; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c +index 8bed17d8fe564..b723ff5e5249c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c +@@ -493,6 +493,7 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd, + dma_addr_t dma_addr = xdptxd->dma_addr; + u32 dma_len = xdptxd->len; + u16 ds_cnt, inline_hdr_sz; ++ unsigned int frags_size; + u8 num_wqebbs = 1; + int num_frags = 0; + bool inline_ok; +@@ -503,8 +504,9 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd, + + inline_ok = sq->min_inline_mode == MLX5_INLINE_MODE_NONE || + dma_len >= MLX5E_XDP_MIN_INLINE; ++ frags_size = xdptxd->has_frags ? xdptxdf->sinfo->xdp_frags_size : 0; + +- if (unlikely(!inline_ok || sq->hw_mtu < dma_len)) { ++ if (unlikely(!inline_ok || sq->hw_mtu < dma_len + frags_size)) { + stats->err++; + return false; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +index 03f69c485a006..81e6aa6434cf2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +@@ -1866,7 +1866,7 @@ static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev) + + static void mlx5e_ipsec_unblock_tc_offload(struct mlx5_core_dev *mdev) + { +- mdev->num_block_tc++; ++ mdev->num_block_tc--; + } + + int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index 7c66bd73ddfa2..38263d5c98b34 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -49,7 +49,7 @@ void mlx5e_ethtool_get_drvinfo(struct mlx5e_priv *priv, + count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), + "%d.%d.%04d (%.16s)", fw_rev_maj(mdev), + fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id); +- if (count == sizeof(drvinfo->fw_version)) ++ if (count >= sizeof(drvinfo->fw_version)) + snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), + "%d.%d.%04d", fw_rev_maj(mdev), + fw_rev_min(mdev), fw_rev_sub(mdev)); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 007cb167cabc9..751d3ffcd2f6c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -78,7 +78,7 @@ static void mlx5e_rep_get_drvinfo(struct net_device *dev, + count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), + "%d.%d.%04d (%.16s)", fw_rev_maj(mdev), + fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id); +- if (count == sizeof(drvinfo->fw_version)) ++ if (count >= sizeof(drvinfo->fw_version)) + snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), + "%d.%d.%04d", fw_rev_maj(mdev), + fw_rev_min(mdev), fw_rev_sub(mdev)); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 1bead98f73bf5..25e44ee5121a9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3776,7 +3776,8 @@ alloc_branch_attr(struct mlx5e_tc_flow *flow, + break; + case FLOW_ACTION_ACCEPT: + case FLOW_ACTION_PIPE: +- if (set_branch_dest_ft(flow->priv, attr)) ++ err = set_branch_dest_ft(flow->priv, attr); ++ if (err) + goto out_err; + break; + case FLOW_ACTION_JUMP: +@@ -3786,7 +3787,8 @@ alloc_branch_attr(struct mlx5e_tc_flow *flow, + goto out_err; + } + *jump_count = cond->extval; +- if (set_branch_dest_ft(flow->priv, attr)) ++ err = set_branch_dest_ft(flow->priv, attr); ++ if (err) + goto out_err; + break; + default: +@@ -5734,8 +5736,10 @@ int mlx5e_tc_action_miss_mapping_get(struct mlx5e_priv *priv, struct mlx5_flow_a + + esw = priv->mdev->priv.eswitch; + attr->act_id_restore_rule = esw_add_restore_rule(esw, *act_miss_mapping); +- if (IS_ERR(attr->act_id_restore_rule)) ++ if (IS_ERR(attr->act_id_restore_rule)) { ++ err = PTR_ERR(attr->act_id_restore_rule); + goto err_rule; ++ } + + return 0; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index b674b57d05aad..b4eb17141edf3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -526,7 +526,8 @@ struct mlx5_esw_flow_attr { + u8 total_vlan; + struct { + u32 flags; +- struct mlx5_eswitch_rep *rep; ++ bool vport_valid; ++ u16 vport; + struct mlx5_pkt_reformat *pkt_reformat; + struct mlx5_core_dev *mdev; + struct mlx5_termtbl_handle *termtbl; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index bb8bcb448ae90..b0455134c98ef 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -287,10 +287,9 @@ static void esw_put_dest_tables_loop(struct mlx5_eswitch *esw, struct mlx5_flow_ + for (i = from; i < to; i++) + if (esw_attr->dests[i].flags & MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE) + mlx5_chains_put_table(chains, 0, 1, 0); +- else if (mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].rep->vport, ++ else if (mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].vport, + esw_attr->dests[i].mdev)) +- mlx5_esw_indir_table_put(esw, esw_attr->dests[i].rep->vport, +- false); ++ mlx5_esw_indir_table_put(esw, esw_attr->dests[i].vport, false); + } + + static bool +@@ -358,8 +357,8 @@ esw_is_indir_table(struct mlx5_eswitch *esw, struct mlx5_flow_attr *attr) + * this criteria. + */ + for (i = esw_attr->split_count; i < esw_attr->out_count; i++) { +- if (esw_attr->dests[i].rep && +- mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].rep->vport, ++ if (esw_attr->dests[i].vport_valid && ++ mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].vport, + esw_attr->dests[i].mdev)) { + result = true; + } else { +@@ -388,7 +387,7 @@ esw_setup_indir_table(struct mlx5_flow_destination *dest, + dest[*i].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + + dest[*i].ft = mlx5_esw_indir_table_get(esw, attr, +- esw_attr->dests[j].rep->vport, false); ++ esw_attr->dests[j].vport, false); + if (IS_ERR(dest[*i].ft)) { + err = PTR_ERR(dest[*i].ft); + goto err_indir_tbl_get; +@@ -432,11 +431,11 @@ static bool esw_setup_uplink_fwd_ipsec_needed(struct mlx5_eswitch *esw, + int attr_idx) + { + if (esw->offloads.ft_ipsec_tx_pol && +- esw_attr->dests[attr_idx].rep && +- esw_attr->dests[attr_idx].rep->vport == MLX5_VPORT_UPLINK && ++ esw_attr->dests[attr_idx].vport_valid && ++ esw_attr->dests[attr_idx].vport == MLX5_VPORT_UPLINK && + /* To be aligned with software, encryption is needed only for tunnel device */ + (esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP_VALID) && +- esw_attr->dests[attr_idx].rep != esw_attr->in_rep && ++ esw_attr->dests[attr_idx].vport != esw_attr->in_rep->vport && + esw_same_vhca_id(esw_attr->dests[attr_idx].mdev, esw->dev)) + return true; + +@@ -469,7 +468,7 @@ esw_setup_dest_fwd_vport(struct mlx5_flow_destination *dest, struct mlx5_flow_ac + int attr_idx, int dest_idx, bool pkt_reformat) + { + dest[dest_idx].type = MLX5_FLOW_DESTINATION_TYPE_VPORT; +- dest[dest_idx].vport.num = esw_attr->dests[attr_idx].rep->vport; ++ dest[dest_idx].vport.num = esw_attr->dests[attr_idx].vport; + if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) { + dest[dest_idx].vport.vhca_id = + MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id); +@@ -1177,9 +1176,9 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, + struct mlx5_flow_handle *flow; + struct mlx5_flow_spec *spec; + struct mlx5_vport *vport; ++ int err, pfindex; + unsigned long i; + void *misc; +- int err; + + if (!MLX5_VPORT_MANAGER(esw->dev) && !mlx5_core_is_ecpf_esw_manager(esw->dev)) + return 0; +@@ -1255,7 +1254,15 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, + flows[vport->index] = flow; + } + } +- esw->fdb_table.offloads.peer_miss_rules[mlx5_get_dev_index(peer_dev)] = flows; ++ ++ pfindex = mlx5_get_dev_index(peer_dev); ++ if (pfindex >= MLX5_MAX_PORTS) { ++ esw_warn(esw->dev, "Peer dev index(%d) is over the max num defined(%d)\n", ++ pfindex, MLX5_MAX_PORTS); ++ err = -EINVAL; ++ goto add_ec_vf_flow_err; ++ } ++ esw->fdb_table.offloads.peer_miss_rules[pfindex] = flows; + + kvfree(spec); + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +index edd9102583144..40bdc677f051d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +@@ -233,8 +233,8 @@ mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw, + + /* hairpin */ + for (i = esw_attr->split_count; i < esw_attr->out_count; i++) +- if (!esw_attr->dest_int_port && esw_attr->dests[i].rep && +- esw_attr->dests[i].rep->vport == MLX5_VPORT_UPLINK) ++ if (!esw_attr->dest_int_port && esw_attr->dests[i].vport_valid && ++ esw_attr->dests[i].vport == MLX5_VPORT_UPLINK) + return true; + + return false; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +index 5a31fb47ffa58..21753f3278685 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +@@ -277,7 +277,7 @@ int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev, + req_list_size = max_list_size; + } + +- out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_in) + ++ out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_out) + + req_list_size * MLX5_ST_SZ_BYTES(mac_address_layout); + + out = kvzalloc(out_sz, GFP_KERNEL); +diff --git a/drivers/net/ethernet/micrel/ks8851.h b/drivers/net/ethernet/micrel/ks8851.h +index fecd43754cead..e5ec0a363aff8 100644 +--- a/drivers/net/ethernet/micrel/ks8851.h ++++ b/drivers/net/ethernet/micrel/ks8851.h +@@ -350,6 +350,8 @@ union ks8851_tx_hdr { + * @rxd: Space for receiving SPI data, in DMA-able space. + * @txd: Space for transmitting SPI data, in DMA-able space. + * @msg_enable: The message flags controlling driver output (see ethtool). ++ * @tx_space: Free space in the hardware TX buffer (cached copy of KS_TXMIR). ++ * @queued_len: Space required in hardware TX buffer for queued packets in txq. + * @fid: Incrementing frame id tag. + * @rc_ier: Cached copy of KS_IER. + * @rc_ccr: Cached copy of KS_CCR. +@@ -399,6 +401,7 @@ struct ks8851_net { + struct work_struct rxctrl_work; + + struct sk_buff_head txq; ++ unsigned int queued_len; + + struct eeprom_93cx6 eeprom; + struct regulator *vdd_reg; +diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c +index cfbc900d4aeb9..0bf13b38b8f5b 100644 +--- a/drivers/net/ethernet/micrel/ks8851_common.c ++++ b/drivers/net/ethernet/micrel/ks8851_common.c +@@ -362,16 +362,18 @@ static irqreturn_t ks8851_irq(int irq, void *_ks) + handled |= IRQ_RXPSI; + + if (status & IRQ_TXI) { +- handled |= IRQ_TXI; ++ unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR); + +- /* no lock here, tx queue should have been stopped */ ++ netif_dbg(ks, intr, ks->netdev, ++ "%s: txspace %d\n", __func__, tx_space); + +- /* update our idea of how much tx space is available to the +- * system */ +- ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR); ++ spin_lock(&ks->statelock); ++ ks->tx_space = tx_space; ++ if (netif_queue_stopped(ks->netdev)) ++ netif_wake_queue(ks->netdev); ++ spin_unlock(&ks->statelock); + +- netif_dbg(ks, intr, ks->netdev, +- "%s: txspace %d\n", __func__, ks->tx_space); ++ handled |= IRQ_TXI; + } + + if (status & IRQ_RXI) +@@ -414,9 +416,6 @@ static irqreturn_t ks8851_irq(int irq, void *_ks) + if (status & IRQ_LCI) + mii_check_link(&ks->mii); + +- if (status & IRQ_TXI) +- netif_wake_queue(ks->netdev); +- + return IRQ_HANDLED; + } + +@@ -500,6 +499,7 @@ static int ks8851_net_open(struct net_device *dev) + ks8851_wrreg16(ks, KS_ISR, ks->rc_ier); + ks8851_wrreg16(ks, KS_IER, ks->rc_ier); + ++ ks->queued_len = 0; + netif_start_queue(ks->netdev); + + netif_dbg(ks, ifup, ks->netdev, "network device up\n"); +diff --git a/drivers/net/ethernet/micrel/ks8851_spi.c b/drivers/net/ethernet/micrel/ks8851_spi.c +index 70bc7253454f6..88e26c120b483 100644 +--- a/drivers/net/ethernet/micrel/ks8851_spi.c ++++ b/drivers/net/ethernet/micrel/ks8851_spi.c +@@ -286,6 +286,18 @@ static void ks8851_wrfifo_spi(struct ks8851_net *ks, struct sk_buff *txp, + netdev_err(ks->netdev, "%s: spi_sync() failed\n", __func__); + } + ++/** ++ * calc_txlen - calculate size of message to send packet ++ * @len: Length of data ++ * ++ * Returns the size of the TXFIFO message needed to send ++ * this packet. ++ */ ++static unsigned int calc_txlen(unsigned int len) ++{ ++ return ALIGN(len + 4, 4); ++} ++ + /** + * ks8851_rx_skb_spi - receive skbuff + * @ks: The device state +@@ -305,7 +317,9 @@ static void ks8851_rx_skb_spi(struct ks8851_net *ks, struct sk_buff *skb) + */ + static void ks8851_tx_work(struct work_struct *work) + { ++ unsigned int dequeued_len = 0; + struct ks8851_net_spi *kss; ++ unsigned short tx_space; + struct ks8851_net *ks; + unsigned long flags; + struct sk_buff *txb; +@@ -322,6 +336,8 @@ static void ks8851_tx_work(struct work_struct *work) + last = skb_queue_empty(&ks->txq); + + if (txb) { ++ dequeued_len += calc_txlen(txb->len); ++ + ks8851_wrreg16_spi(ks, KS_RXQCR, + ks->rc_rxqcr | RXQCR_SDA); + ks8851_wrfifo_spi(ks, txb, last); +@@ -332,6 +348,13 @@ static void ks8851_tx_work(struct work_struct *work) + } + } + ++ tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR); ++ ++ spin_lock(&ks->statelock); ++ ks->queued_len -= dequeued_len; ++ ks->tx_space = tx_space; ++ spin_unlock(&ks->statelock); ++ + ks8851_unlock_spi(ks, &flags); + } + +@@ -346,18 +369,6 @@ static void ks8851_flush_tx_work_spi(struct ks8851_net *ks) + flush_work(&kss->tx_work); + } + +-/** +- * calc_txlen - calculate size of message to send packet +- * @len: Length of data +- * +- * Returns the size of the TXFIFO message needed to send +- * this packet. +- */ +-static unsigned int calc_txlen(unsigned int len) +-{ +- return ALIGN(len + 4, 4); +-} +- + /** + * ks8851_start_xmit_spi - transmit packet using SPI + * @skb: The buffer to transmit +@@ -386,16 +397,17 @@ static netdev_tx_t ks8851_start_xmit_spi(struct sk_buff *skb, + + spin_lock(&ks->statelock); + +- if (needed > ks->tx_space) { ++ if (ks->queued_len + needed > ks->tx_space) { + netif_stop_queue(dev); + ret = NETDEV_TX_BUSY; + } else { +- ks->tx_space -= needed; ++ ks->queued_len += needed; + skb_queue_tail(&ks->txq, skb); + } + + spin_unlock(&ks->statelock); +- schedule_work(&kss->tx_work); ++ if (ret == NETDEV_TX_OK) ++ schedule_work(&kss->tx_work); + + return ret; + } +diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig +index 090e6b9832431..01eb7445ead95 100644 +--- a/drivers/net/ethernet/microsoft/Kconfig ++++ b/drivers/net/ethernet/microsoft/Kconfig +@@ -20,6 +20,7 @@ config MICROSOFT_MANA + depends on PCI_MSI && X86_64 + depends on PCI_HYPERV + select AUXILIARY_BUS ++ select PAGE_POOL + help + This driver supports Microsoft Azure Network Adapter (MANA). + So far, the driver is only supported on X86_64. +diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c +index 5c55197c7327d..c018783757fb2 100644 +--- a/drivers/net/ethernet/mscc/ocelot_stats.c ++++ b/drivers/net/ethernet/mscc/ocelot_stats.c +@@ -582,10 +582,10 @@ static void ocelot_port_rmon_stats_cb(struct ocelot *ocelot, int port, void *pri + rmon_stats->hist_tx[0] = s[OCELOT_STAT_TX_64]; + rmon_stats->hist_tx[1] = s[OCELOT_STAT_TX_65_127]; + rmon_stats->hist_tx[2] = s[OCELOT_STAT_TX_128_255]; +- rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_128_255]; +- rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_256_511]; +- rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_512_1023]; +- rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_1024_1526]; ++ rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_256_511]; ++ rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_512_1023]; ++ rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_1024_1526]; ++ rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_1527_MAX]; + } + + static void ocelot_port_pmac_rmon_stats_cb(struct ocelot *ocelot, int port, +@@ -610,10 +610,10 @@ static void ocelot_port_pmac_rmon_stats_cb(struct ocelot *ocelot, int port, + rmon_stats->hist_tx[0] = s[OCELOT_STAT_TX_PMAC_64]; + rmon_stats->hist_tx[1] = s[OCELOT_STAT_TX_PMAC_65_127]; + rmon_stats->hist_tx[2] = s[OCELOT_STAT_TX_PMAC_128_255]; +- rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_PMAC_128_255]; +- rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_PMAC_256_511]; +- rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_PMAC_512_1023]; +- rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_PMAC_1024_1526]; ++ rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_PMAC_256_511]; ++ rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_PMAC_512_1023]; ++ rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_PMAC_1024_1526]; ++ rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_PMAC_1527_MAX]; + } + + void ocelot_port_get_rmon_stats(struct ocelot *ocelot, int port, +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +index 540f6a4ec0b81..f05bd757dfe52 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -237,7 +237,7 @@ static void timestamp_interrupt(struct stmmac_priv *priv) + */ + ts_status = readl(priv->ioaddr + GMAC_TIMESTAMP_STATUS); + +- if (priv->plat->flags & STMMAC_FLAG_EXT_SNAPSHOT_EN) ++ if (!(priv->plat->flags & STMMAC_FLAG_EXT_SNAPSHOT_EN)) + return; + + num_snapshot = (ts_status & GMAC_TIMESTAMP_ATSNS_MASK) >> +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 2ce74593d6e4a..a42df2c1bd043 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1548,7 +1548,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, + goto error; + + phy_resume(phydev); +- phy_led_triggers_register(phydev); ++ if (!phydev->is_on_sfp_module) ++ phy_led_triggers_register(phydev); + + /** + * If the external phy used by current mac interface is managed by +@@ -1817,7 +1818,8 @@ void phy_detach(struct phy_device *phydev) + } + phydev->phylink = NULL; + +- phy_led_triggers_unregister(phydev); ++ if (!phydev->is_on_sfp_module) ++ phy_led_triggers_unregister(phydev); + + if (phydev->mdio.dev.driver) + module_put(phydev->mdio.dev.driver->owner); +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 4ea0e155bb0d5..5a1bf42ce1566 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -173,6 +173,7 @@ struct ax88179_data { + u8 in_pm; + u32 wol_supported; + u32 wolopts; ++ u8 disconnecting; + }; + + struct ax88179_int_data { +@@ -208,6 +209,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + { + int ret; + int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16); ++ struct ax88179_data *ax179_data = dev->driver_priv; + + BUG_ON(!dev); + +@@ -219,7 +221,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + value, index, data, size); + +- if (unlikely(ret < 0)) ++ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting))) + netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n", + index, ret); + +@@ -231,6 +233,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + { + int ret; + int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16); ++ struct ax88179_data *ax179_data = dev->driver_priv; + + BUG_ON(!dev); + +@@ -242,7 +245,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + value, index, data, size); + +- if (unlikely(ret < 0)) ++ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting))) + netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n", + index, ret); + +@@ -492,6 +495,20 @@ static int ax88179_resume(struct usb_interface *intf) + return usbnet_resume(intf); + } + ++static void ax88179_disconnect(struct usb_interface *intf) ++{ ++ struct usbnet *dev = usb_get_intfdata(intf); ++ struct ax88179_data *ax179_data; ++ ++ if (!dev) ++ return; ++ ++ ax179_data = dev->driver_priv; ++ ax179_data->disconnecting = 1; ++ ++ usbnet_disconnect(intf); ++} ++ + static void + ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + { +@@ -1906,7 +1923,7 @@ static struct usb_driver ax88179_178a_driver = { + .suspend = ax88179_suspend, + .resume = ax88179_resume, + .reset_resume = ax88179_resume, +- .disconnect = usbnet_disconnect, ++ .disconnect = ax88179_disconnect, + .supports_autosuspend = 1, + .disable_hub_initiated_lpm = 1, + }; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 583d1011963ec..2e23ccd7d7938 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -3088,7 +3088,7 @@ static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans, + struct iwl_rxq *rxq = &trans_pcie->rxq[0]; + u32 i, r, j, rb_len = 0; + +- spin_lock(&rxq->lock); ++ spin_lock_bh(&rxq->lock); + + r = le16_to_cpu(iwl_get_closed_rb_stts(trans, rxq)) & 0x0FFF; + +@@ -3112,7 +3112,7 @@ static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans, + *data = iwl_fw_error_next_data(*data); + } + +- spin_unlock(&rxq->lock); ++ spin_unlock_bh(&rxq->lock); + + return rb_len; + } +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 6ca7b494c2c26..cd04865970643 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -776,7 +776,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid) + + static void + mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, +- int len, bool more, u32 info) ++ int len, bool more, u32 info, bool allow_direct) + { + struct sk_buff *skb = q->rx_head; + struct skb_shared_info *shinfo = skb_shinfo(skb); +@@ -788,7 +788,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, + + skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size); + } else { +- mt76_put_page_pool_buf(data, true); ++ mt76_put_page_pool_buf(data, allow_direct); + } + + if (more) +@@ -808,6 +808,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget) + struct sk_buff *skb; + unsigned char *data; + bool check_ddone = false; ++ bool allow_direct = !mt76_queue_is_wed_rx(q); + bool more; + + if (IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED) && +@@ -848,7 +849,8 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget) + } + + if (q->rx_head) { +- mt76_add_fragment(dev, q, data, len, more, info); ++ mt76_add_fragment(dev, q, data, len, more, info, ++ allow_direct); + continue; + } + +@@ -877,7 +879,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget) + continue; + + free_frag: +- mt76_put_page_pool_buf(data, true); ++ mt76_put_page_pool_buf(data, allow_direct); + } + + mt76_dma_rx_fill(dev, q, true); +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index d5c8b0a08d494..b32e3cff37b14 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4100,6 +4100,8 @@ static void nvme_fw_act_work(struct work_struct *work) + struct nvme_ctrl, fw_act_work); + unsigned long fw_act_timeout; + ++ nvme_auth_stop(ctrl); ++ + if (ctrl->mtfa) + fw_act_timeout = jiffies + + msecs_to_jiffies(ctrl->mtfa * 100); +@@ -4155,7 +4157,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + * firmware activation. + */ + if (nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING)) { +- nvme_auth_stop(ctrl); + requeue = false; + queue_work(nvme_wq, &ctrl->fw_act_work); + } +diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c +index 9737104f3b76b..5cdf339cfbec0 100644 +--- a/drivers/nvmem/brcm_nvram.c ++++ b/drivers/nvmem/brcm_nvram.c +@@ -17,9 +17,23 @@ + + #define NVRAM_MAGIC "FLSH" + ++/** ++ * struct brcm_nvram - driver state internal struct ++ * ++ * @dev: NVMEM device pointer ++ * @nvmem_size: Size of the whole space available for NVRAM ++ * @data: NVRAM data copy stored to avoid poking underlaying flash controller ++ * @data_len: NVRAM data size ++ * @padding_byte: Padding value used to fill remaining space ++ * @cells: Array of discovered NVMEM cells ++ * @ncells: Number of elements in cells ++ */ + struct brcm_nvram { + struct device *dev; +- void __iomem *base; ++ size_t nvmem_size; ++ uint8_t *data; ++ size_t data_len; ++ uint8_t padding_byte; + struct nvmem_cell_info *cells; + int ncells; + }; +@@ -36,10 +50,47 @@ static int brcm_nvram_read(void *context, unsigned int offset, void *val, + size_t bytes) + { + struct brcm_nvram *priv = context; +- u8 *dst = val; ++ size_t to_copy; ++ ++ if (offset + bytes > priv->data_len) ++ to_copy = max_t(ssize_t, (ssize_t)priv->data_len - offset, 0); ++ else ++ to_copy = bytes; ++ ++ memcpy(val, priv->data + offset, to_copy); ++ ++ memset((uint8_t *)val + to_copy, priv->padding_byte, bytes - to_copy); ++ ++ return 0; ++} ++ ++static int brcm_nvram_copy_data(struct brcm_nvram *priv, struct platform_device *pdev) ++{ ++ struct resource *res; ++ void __iomem *base; ++ ++ base = devm_platform_get_and_ioremap_resource(pdev, 0, &res); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); ++ ++ priv->nvmem_size = resource_size(res); ++ ++ priv->padding_byte = readb(base + priv->nvmem_size - 1); ++ for (priv->data_len = priv->nvmem_size; ++ priv->data_len; ++ priv->data_len--) { ++ if (readb(base + priv->data_len - 1) != priv->padding_byte) ++ break; ++ } ++ WARN(priv->data_len > SZ_128K, "Unexpected (big) NVRAM size: %zu B\n", priv->data_len); ++ ++ priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL); ++ if (!priv->data) ++ return -ENOMEM; ++ ++ memcpy_fromio(priv->data, base, priv->data_len); + +- while (bytes--) +- *dst++ = readb(priv->base + offset++); ++ bcm47xx_nvram_init_from_iomem(base, priv->data_len); + + return 0; + } +@@ -67,8 +118,13 @@ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data, + size_t len) + { + struct device *dev = priv->dev; +- char *var, *value, *eq; ++ char *var, *value; ++ uint8_t tmp; + int idx; ++ int err = 0; ++ ++ tmp = priv->data[len - 1]; ++ priv->data[len - 1] = '\0'; + + priv->ncells = 0; + for (var = data + sizeof(struct brcm_nvram_header); +@@ -78,67 +134,68 @@ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data, + } + + priv->cells = devm_kcalloc(dev, priv->ncells, sizeof(*priv->cells), GFP_KERNEL); +- if (!priv->cells) +- return -ENOMEM; ++ if (!priv->cells) { ++ err = -ENOMEM; ++ goto out; ++ } + + for (var = data + sizeof(struct brcm_nvram_header), idx = 0; + var < (char *)data + len && *var; + var = value + strlen(value) + 1, idx++) { ++ char *eq, *name; ++ + eq = strchr(var, '='); + if (!eq) + break; + *eq = '\0'; ++ name = devm_kstrdup(dev, var, GFP_KERNEL); ++ *eq = '='; ++ if (!name) { ++ err = -ENOMEM; ++ goto out; ++ } + value = eq + 1; + +- priv->cells[idx].name = devm_kstrdup(dev, var, GFP_KERNEL); +- if (!priv->cells[idx].name) +- return -ENOMEM; ++ priv->cells[idx].name = name; + priv->cells[idx].offset = value - (char *)data; + priv->cells[idx].bytes = strlen(value); + priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name); +- if (!strcmp(var, "et0macaddr") || +- !strcmp(var, "et1macaddr") || +- !strcmp(var, "et2macaddr")) { ++ if (!strcmp(name, "et0macaddr") || ++ !strcmp(name, "et1macaddr") || ++ !strcmp(name, "et2macaddr")) { + priv->cells[idx].raw_len = strlen(value); + priv->cells[idx].bytes = ETH_ALEN; + priv->cells[idx].read_post_process = brcm_nvram_read_post_process_macaddr; + } + } + +- return 0; ++out: ++ priv->data[len - 1] = tmp; ++ return err; + } + + static int brcm_nvram_parse(struct brcm_nvram *priv) + { ++ struct brcm_nvram_header *header = (struct brcm_nvram_header *)priv->data; + struct device *dev = priv->dev; +- struct brcm_nvram_header header; +- uint8_t *data; + size_t len; + int err; + +- memcpy_fromio(&header, priv->base, sizeof(header)); +- +- if (memcmp(header.magic, NVRAM_MAGIC, 4)) { ++ if (memcmp(header->magic, NVRAM_MAGIC, 4)) { + dev_err(dev, "Invalid NVRAM magic\n"); + return -EINVAL; + } + +- len = le32_to_cpu(header.len); +- +- data = kzalloc(len, GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- +- memcpy_fromio(data, priv->base, len); +- data[len - 1] = '\0'; +- +- err = brcm_nvram_add_cells(priv, data, len); +- if (err) { +- dev_err(dev, "Failed to add cells: %d\n", err); +- return err; ++ len = le32_to_cpu(header->len); ++ if (len > priv->nvmem_size) { ++ dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len, ++ priv->nvmem_size); ++ return -EINVAL; + } + +- kfree(data); ++ err = brcm_nvram_add_cells(priv, priv->data, len); ++ if (err) ++ dev_err(dev, "Failed to add cells: %d\n", err); + + return 0; + } +@@ -150,7 +207,6 @@ static int brcm_nvram_probe(struct platform_device *pdev) + .reg_read = brcm_nvram_read, + }; + struct device *dev = &pdev->dev; +- struct resource *res; + struct brcm_nvram *priv; + int err; + +@@ -159,21 +215,19 @@ static int brcm_nvram_probe(struct platform_device *pdev) + return -ENOMEM; + priv->dev = dev; + +- priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res); +- if (IS_ERR(priv->base)) +- return PTR_ERR(priv->base); ++ err = brcm_nvram_copy_data(priv, pdev); ++ if (err) ++ return err; + + err = brcm_nvram_parse(priv); + if (err) + return err; + +- bcm47xx_nvram_init_from_iomem(priv->base, resource_size(res)); +- + config.dev = dev; + config.cells = priv->cells; + config.ncells = priv->ncells; + config.priv = priv; +- config.size = resource_size(res); ++ config.size = priv->nvmem_size; + + return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &config)); + } +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 383309e533c3d..a27c01fcbb47e 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1068,6 +1068,13 @@ static const struct of_device_id atmel_pctrl_of_match[] = { + } + }; + ++/* ++ * This lock class allows to tell lockdep that parent IRQ and children IRQ do ++ * not share the same class so it does not raise false positive ++ */ ++static struct lock_class_key atmel_lock_key; ++static struct lock_class_key atmel_request_key; ++ + static int atmel_pinctrl_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1214,6 +1221,7 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) + irq_set_chip_and_handler(irq, &atmel_gpio_irq_chip, + handle_simple_irq); + irq_set_chip_data(irq, atmel_pioctrl); ++ irq_set_lockdep_class(irq, &atmel_lock_key, &atmel_request_key); + dev_dbg(dev, + "atmel gpio irq domain: hwirq: %d, linux irq: %d\n", + i, irq); +diff --git a/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c b/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c +index 530fe340a9a15..561fd0c6b9b0a 100644 +--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c ++++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c +@@ -492,7 +492,7 @@ static int starfive_dt_node_to_map(struct pinctrl_dev *pctldev, + + nmaps = 0; + ngroups = 0; +- for_each_child_of_node(np, child) { ++ for_each_available_child_of_node(np, child) { + int npinmux = of_property_count_u32_elems(child, "pinmux"); + int npins = of_property_count_u32_elems(child, "pins"); + +@@ -527,7 +527,7 @@ static int starfive_dt_node_to_map(struct pinctrl_dev *pctldev, + nmaps = 0; + ngroups = 0; + mutex_lock(&sfp->mutex); +- for_each_child_of_node(np, child) { ++ for_each_available_child_of_node(np, child) { + int npins; + int i; + +diff --git a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c +index 640f827a9b2ca..b4f7995726894 100644 +--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c ++++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c +@@ -135,7 +135,7 @@ static int jh7110_dt_node_to_map(struct pinctrl_dev *pctldev, + int ret; + + ngroups = 0; +- for_each_child_of_node(np, child) ++ for_each_available_child_of_node(np, child) + ngroups += 1; + nmaps = 2 * ngroups; + +@@ -150,7 +150,7 @@ static int jh7110_dt_node_to_map(struct pinctrl_dev *pctldev, + nmaps = 0; + ngroups = 0; + mutex_lock(&sfp->mutex); +- for_each_child_of_node(np, child) { ++ for_each_available_child_of_node(np, child) { + int npins = of_property_count_u32_elems(child, "pinmux"); + int *pins; + u32 *pinmux; +diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c +index 84c175b9721a0..e95d3011b9997 100644 +--- a/drivers/platform/x86/intel/pmc/core.c ++++ b/drivers/platform/x86/intel/pmc/core.c +@@ -472,7 +472,7 @@ int pmc_core_send_ltr_ignore(struct pmc_dev *pmcdev, u32 value) + * is based on the contiguous indexes from ltr_show output. + * pmc index and ltr index needs to be calculated from it. + */ +- for (pmc_index = 0; pmc_index < ARRAY_SIZE(pmcdev->pmcs) && ltr_index > 0; pmc_index++) { ++ for (pmc_index = 0; pmc_index < ARRAY_SIZE(pmcdev->pmcs) && ltr_index >= 0; pmc_index++) { + pmc = pmcdev->pmcs[pmc_index]; + + if (!pmc) +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index f0a076e94118f..92cc13ef3e566 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -807,6 +807,9 @@ static void __reset_control_put_internal(struct reset_control *rstc) + { + lockdep_assert_held(&reset_list_mutex); + ++ if (IS_ERR_OR_NULL(rstc)) ++ return; ++ + kref_put(&rstc->refcnt, __reset_control_release); + } + +@@ -1017,11 +1020,8 @@ EXPORT_SYMBOL_GPL(reset_control_put); + void reset_control_bulk_put(int num_rstcs, struct reset_control_bulk_data *rstcs) + { + mutex_lock(&reset_list_mutex); +- while (num_rstcs--) { +- if (IS_ERR_OR_NULL(rstcs[num_rstcs].rstc)) +- continue; ++ while (num_rstcs--) + __reset_control_put_internal(rstcs[num_rstcs].rstc); +- } + mutex_unlock(&reset_list_mutex); + } + EXPORT_SYMBOL_GPL(reset_control_bulk_put); +diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h +index 73b6ac0c01f54..7d5a155073c62 100644 +--- a/drivers/scsi/aacraid/aacraid.h ++++ b/drivers/scsi/aacraid/aacraid.h +@@ -1678,7 +1678,6 @@ struct aac_dev + u32 handle_pci_error; + bool init_reset; + u8 soft_reset_support; +- u8 use_map_queue; + }; + + #define aac_adapter_interrupt(dev) \ +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index 013a9a334972e..25cee03d7f973 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -223,12 +223,8 @@ int aac_fib_setup(struct aac_dev * dev) + struct fib *aac_fib_alloc_tag(struct aac_dev *dev, struct scsi_cmnd *scmd) + { + struct fib *fibptr; +- u32 blk_tag; +- int i; + +- blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd)); +- i = blk_mq_unique_tag_to_tag(blk_tag); +- fibptr = &dev->fibs[i]; ++ fibptr = &dev->fibs[scsi_cmd_to_rq(scmd)->tag]; + /* + * Null out fields that depend on being zero at the start of + * each I/O +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index c4a36c0be527c..68f4dbcfff492 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -19,7 +19,6 @@ + + #include + #include +-#include + #include + #include + #include +@@ -505,15 +504,6 @@ common_config: + return 0; + } + +-static void aac_map_queues(struct Scsi_Host *shost) +-{ +- struct aac_dev *aac = (struct aac_dev *)shost->hostdata; +- +- blk_mq_pci_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT], +- aac->pdev, 0); +- aac->use_map_queue = true; +-} +- + /** + * aac_change_queue_depth - alter queue depths + * @sdev: SCSI device we are considering +@@ -1498,7 +1488,6 @@ static const struct scsi_host_template aac_driver_template = { + .bios_param = aac_biosparm, + .shost_groups = aac_host_groups, + .slave_configure = aac_slave_configure, +- .map_queues = aac_map_queues, + .change_queue_depth = aac_change_queue_depth, + .sdev_groups = aac_dev_groups, + .eh_abort_handler = aac_eh_abort, +@@ -1786,8 +1775,6 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + shost->max_lun = AAC_MAX_LUN; + + pci_set_drvdata(pdev, shost); +- shost->nr_hw_queues = aac->max_msix; +- shost->host_tagset = 1; + + error = scsi_add_host(shost, &pdev->dev); + if (error) +@@ -1919,7 +1906,6 @@ static void aac_remove_one(struct pci_dev *pdev) + struct aac_dev *aac = (struct aac_dev *)shost->hostdata; + + aac_cancel_rescan_worker(aac); +- aac->use_map_queue = false; + scsi_remove_host(shost); + + __aac_shutdown(aac); +diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c +index 61949f3741886..11ef58204e96f 100644 +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -493,10 +493,6 @@ static int aac_src_deliver_message(struct fib *fib) + #endif + + u16 vector_no; +- struct scsi_cmnd *scmd; +- u32 blk_tag; +- struct Scsi_Host *shost = dev->scsi_host_ptr; +- struct blk_mq_queue_map *qmap; + + atomic_inc(&q->numpending); + +@@ -509,25 +505,8 @@ static int aac_src_deliver_message(struct fib *fib) + if ((dev->comm_interface == AAC_COMM_MESSAGE_TYPE3) + && dev->sa_firmware) + vector_no = aac_get_vector(dev); +- else { +- if (!fib->vector_no || !fib->callback_data) { +- if (shost && dev->use_map_queue) { +- qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT]; +- vector_no = qmap->mq_map[raw_smp_processor_id()]; +- } +- /* +- * We hardcode the vector_no for +- * reserved commands as a valid shost is +- * absent during the init +- */ +- else +- vector_no = 0; +- } else { +- scmd = (struct scsi_cmnd *)fib->callback_data; +- blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd)); +- vector_no = blk_mq_unique_tag_to_hwq(blk_tag); +- } +- } ++ else ++ vector_no = fib->vector_no; + + if (native_hba) { + if (fib->flags & FIB_CONTEXT_FLAG_NATIVE_HBA_TMF) { +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 05ddbb9bb7d8a..451a58e0fd969 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -429,7 +429,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + struct fcoe_ctlr *ctlr; + struct fcoe_rcv_info *fr; + struct fcoe_percpu_s *bg; +- struct sk_buff *tmp_skb; + + interface = container_of(ptype, struct bnx2fc_interface, + fcoe_packet_type); +@@ -441,11 +440,9 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + goto err; + } + +- tmp_skb = skb_share_check(skb, GFP_ATOMIC); +- if (!tmp_skb) +- goto err; +- +- skb = tmp_skb; ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!skb) ++ return -1; + + if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) { + printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n"); +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index c67cdcdc3ba86..1223d34c04da3 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -1152,6 +1152,7 @@ retry: + + scsi_log_send(scmd); + scmd->submitter = SUBMITTED_BY_SCSI_ERROR_HANDLER; ++ scmd->flags |= SCMD_LAST; + + /* + * Lock sdev->state_mutex to avoid that scsi_device_quiesce() can +@@ -2459,6 +2460,7 @@ scsi_ioctl_reset(struct scsi_device *dev, int __user *arg) + scsi_init_command(dev, scmd); + + scmd->submitter = SUBMITTED_BY_SCSI_RESET_IOCTL; ++ scmd->flags |= SCMD_LAST; + memset(&scmd->sdb, 0, sizeof(scmd->sdb)); + + scmd->cmd_len = 0; +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 6aa8adbe4170c..e073d54873b1f 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + + /* SPI register offsets */ +@@ -279,6 +280,7 @@ struct atmel_spi { + bool keep_cs; + + u32 fifo_size; ++ bool last_polarity; + u8 native_cs_free; + u8 native_cs_for_gpio; + }; +@@ -291,6 +293,22 @@ struct atmel_spi_device { + #define SPI_MAX_DMA_XFER 65535 /* true for both PDC and DMA */ + #define INVALID_DMA_ADDRESS 0xffffffff + ++/* ++ * This frequency can be anything supported by the controller, but to avoid ++ * unnecessary delay, the highest possible frequency is chosen. ++ * ++ * This frequency is the highest possible which is not interfering with other ++ * chip select registers (see Note for Serial Clock Bit Rate configuration in ++ * Atmel-11121F-ATARM-SAMA5D3-Series-Datasheet_02-Feb-16, page 1283) ++ */ ++#define DUMMY_MSG_FREQUENCY 0x02 ++/* ++ * 8 bits is the minimum data the controller is capable of sending. ++ * ++ * This message can be anything as it should not be treated by any SPI device. ++ */ ++#define DUMMY_MSG 0xAA ++ + /* + * Version 2 of the SPI controller has + * - CR.LASTXFER +@@ -304,6 +322,43 @@ static bool atmel_spi_is_v2(struct atmel_spi *as) + return as->caps.is_spi2; + } + ++/* ++ * Send a dummy message. ++ * ++ * This is sometimes needed when using a CS GPIO to force clock transition when ++ * switching between devices with different polarities. ++ */ ++static void atmel_spi_send_dummy(struct atmel_spi *as, struct spi_device *spi, int chip_select) ++{ ++ u32 status; ++ u32 csr; ++ ++ /* ++ * Set a clock frequency to allow sending message on SPI bus. ++ * The frequency here can be anything, but is needed for ++ * the controller to send the data. ++ */ ++ csr = spi_readl(as, CSR0 + 4 * chip_select); ++ csr = SPI_BFINS(SCBR, DUMMY_MSG_FREQUENCY, csr); ++ spi_writel(as, CSR0 + 4 * chip_select, csr); ++ ++ /* ++ * Read all data coming from SPI bus, needed to be able to send ++ * the message. ++ */ ++ spi_readl(as, RDR); ++ while (spi_readl(as, SR) & SPI_BIT(RDRF)) { ++ spi_readl(as, RDR); ++ cpu_relax(); ++ } ++ ++ spi_writel(as, TDR, DUMMY_MSG); ++ ++ readl_poll_timeout_atomic(as->regs + SPI_SR, status, ++ (status & SPI_BIT(TXEMPTY)), 1, 1000); ++} ++ ++ + /* + * Earlier SPI controllers (e.g. on at91rm9200) have a design bug whereby + * they assume that spi slave device state will not change on deselect, so +@@ -320,11 +375,17 @@ static bool atmel_spi_is_v2(struct atmel_spi *as) + * Master on Chip Select 0.") No workaround exists for that ... so for + * nCS0 on that chip, we (a) don't use the GPIO, (b) can't support CS_HIGH, + * and (c) will trigger that first erratum in some cases. ++ * ++ * When changing the clock polarity, the SPI controller waits for the next ++ * transmission to enforce the default clock state. This may be an issue when ++ * using a GPIO as Chip Select: the clock level is applied only when the first ++ * packet is sent, once the CS has already been asserted. The workaround is to ++ * avoid this by sending a first (dummy) message before toggling the CS state. + */ +- + static void cs_activate(struct atmel_spi *as, struct spi_device *spi) + { + struct atmel_spi_device *asd = spi->controller_state; ++ bool new_polarity; + int chip_select; + u32 mr; + +@@ -353,6 +414,25 @@ static void cs_activate(struct atmel_spi *as, struct spi_device *spi) + } + + mr = spi_readl(as, MR); ++ ++ /* ++ * Ensures the clock polarity is valid before we actually ++ * assert the CS to avoid spurious clock edges to be ++ * processed by the spi devices. ++ */ ++ if (spi_get_csgpiod(spi, 0)) { ++ new_polarity = (asd->csr & SPI_BIT(CPOL)) != 0; ++ if (new_polarity != as->last_polarity) { ++ /* ++ * Need to disable the GPIO before sending the dummy ++ * message because it is already set by the spi core. ++ */ ++ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), 0); ++ atmel_spi_send_dummy(as, spi, chip_select); ++ as->last_polarity = new_polarity; ++ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), 1); ++ } ++ } + } else { + u32 cpol = (spi->mode & SPI_CPOL) ? SPI_BIT(CPOL) : 0; + int i; +@@ -1336,12 +1416,10 @@ static int atmel_spi_one_transfer(struct spi_controller *host, + } + + dma_timeout = msecs_to_jiffies(spi_controller_xfer_timeout(host, xfer)); +- ret_timeout = wait_for_completion_interruptible_timeout(&as->xfer_completion, +- dma_timeout); +- if (ret_timeout <= 0) { +- dev_err(&spi->dev, "spi transfer %s\n", +- !ret_timeout ? "timeout" : "canceled"); +- as->done_status = ret_timeout < 0 ? ret_timeout : -EIO; ++ ret_timeout = wait_for_completion_timeout(&as->xfer_completion, dma_timeout); ++ if (!ret_timeout) { ++ dev_err(&spi->dev, "spi transfer timeout\n"); ++ as->done_status = -EIO; + } + + if (as->done_status) +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index 12c940ba074ab..bd96d8b546cdb 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -451,7 +451,6 @@ static int cdns_transfer_one(struct spi_controller *ctlr, + udelay(10); + + cdns_spi_process_fifo(xspi, xspi->tx_fifo_depth, 0); +- spi_transfer_delay_exec(transfer); + + cdns_spi_write(xspi, CDNS_SPI_IER, CDNS_SPI_IXR_DEFAULT); + return transfer->len; +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 498e35c8db2c1..272bc871a848b 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -659,11 +659,18 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, + ctrl |= (spi_imx->target_burst * 8 - 1) + << MX51_ECSPI_CTRL_BL_OFFSET; + else { +- if (spi_imx->count >= 512) +- ctrl |= 0xFFF << MX51_ECSPI_CTRL_BL_OFFSET; +- else +- ctrl |= (spi_imx->count * spi_imx->bits_per_word - 1) ++ if (spi_imx->usedma) { ++ ctrl |= (spi_imx->bits_per_word * ++ spi_imx_bytes_per_word(spi_imx->bits_per_word) - 1) + << MX51_ECSPI_CTRL_BL_OFFSET; ++ } else { ++ if (spi_imx->count >= MX51_ECSPI_CTRL_MAX_BURST) ++ ctrl |= (MX51_ECSPI_CTRL_MAX_BURST - 1) ++ << MX51_ECSPI_CTRL_BL_OFFSET; ++ else ++ ctrl |= (spi_imx->count * spi_imx->bits_per_word - 1) ++ << MX51_ECSPI_CTRL_BL_OFFSET; ++ } + } + + /* set clock speed */ +diff --git a/drivers/thunderbolt/debugfs.c b/drivers/thunderbolt/debugfs.c +index c9ddd49138d82..e324cd8997193 100644 +--- a/drivers/thunderbolt/debugfs.c ++++ b/drivers/thunderbolt/debugfs.c +@@ -959,7 +959,7 @@ static void margining_port_remove(struct tb_port *port) + snprintf(dir_name, sizeof(dir_name), "port%d", port->port); + parent = debugfs_lookup(dir_name, port->sw->debugfs_dir); + if (parent) +- debugfs_remove_recursive(debugfs_lookup("margining", parent)); ++ debugfs_lookup_and_remove("margining", parent); + + kfree(port->usb4->margining); + port->usb4->margining = NULL; +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 170fbd5715b21..a885cc177cff7 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -2172,9 +2172,10 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag, + if (is_mcq_enabled(hba)) { + int utrd_size = sizeof(struct utp_transfer_req_desc); + struct utp_transfer_req_desc *src = lrbp->utr_descriptor_ptr; +- struct utp_transfer_req_desc *dest = hwq->sqe_base_addr + hwq->sq_tail_slot; ++ struct utp_transfer_req_desc *dest; + + spin_lock(&hwq->sq_lock); ++ dest = hwq->sqe_base_addr + hwq->sq_tail_slot; + memcpy(dest, src, utrd_size); + ufshcd_inc_sq_tail(hwq); + spin_unlock(&hwq->sq_lock); +diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c +index b1d720031251e..fc40726e13c26 100644 +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -1399,9 +1399,11 @@ static int ufs_qcom_clk_scale_notify(struct ufs_hba *hba, + err = ufs_qcom_clk_scale_up_pre_change(hba); + else + err = ufs_qcom_clk_scale_down_pre_change(hba); +- if (err) +- ufshcd_uic_hibern8_exit(hba); + ++ if (err) { ++ ufshcd_uic_hibern8_exit(hba); ++ return err; ++ } + } else { + if (scale_up) + err = ufs_qcom_clk_scale_up_post_change(hba); +diff --git a/drivers/usb/fotg210/fotg210-hcd.c b/drivers/usb/fotg210/fotg210-hcd.c +index 929106c16b29b..7bf810a0c98a9 100644 +--- a/drivers/usb/fotg210/fotg210-hcd.c ++++ b/drivers/usb/fotg210/fotg210-hcd.c +@@ -428,8 +428,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh, + temp = size; + size -= temp; + next += temp; +- if (temp == size) +- goto done; + } + + temp = snprintf(next, size, "\n"); +@@ -439,7 +437,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh, + size -= temp; + next += temp; + +-done: + *sizep = size; + *nextp = next; + } +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 1bf23611be122..13a56783830df 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1033,9 +1033,9 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, + { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, + { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, +- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, +- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, +- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_UID_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_USA_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGX_PID) }, + { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, + { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, + { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index e2099445db708..21a2b5a25fc09 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1568,9 +1568,9 @@ + #define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ + #define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ + #define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ +-#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ +-#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ +-#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ ++#define ACTISENSE_UID_PID 0xD9AC /* USB Isolating Device */ ++#define ACTISENSE_USA_PID 0xD9AD /* USB to Serial Adapter */ ++#define ACTISENSE_NGX_PID 0xD9AE /* NGX NMEA2000 Gateway */ + #define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ + #define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ + #define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 4dffcfefd62da..72390dbf07692 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -272,6 +272,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 + #define QUECTEL_PRODUCT_EC200U 0x0901 ++#define QUECTEL_PRODUCT_EG912Y 0x6001 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 + #define QUECTEL_PRODUCT_EC200A 0x6005 + #define QUECTEL_PRODUCT_EM061K_LWW 0x6008 +@@ -1232,6 +1233,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */ + .driver_info = RSVD(3) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, +@@ -1244,6 +1246,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, +@@ -2242,6 +2245,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0da, 0xff), /* Foxconn T99W265 MBIM variant */ ++ .driver_info = RSVD(3) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */ +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 20dcbccb290b3..fd68204374f2c 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1305,6 +1305,17 @@ UNUSUAL_DEV( 0x090c, 0x6000, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_INITIAL_READ10 ), + ++/* ++ * Patch by Tasos Sahanidis ++ * This flash drive always shows up with write protect enabled ++ * during the first mode sense. ++ */ ++UNUSUAL_DEV(0x0951, 0x1697, 0x0100, 0x0100, ++ "Kingston", ++ "DT Ultimate G3", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT), ++ + /* + * This Pentax still camera is not conformant + * to the USB storage specification: - +diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c +index db6e248f82083..4853141cd10c8 100644 +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -228,7 +228,7 @@ static void pmic_glink_ucsi_notify(struct work_struct *work) + + con_num = UCSI_CCI_CONNECTOR(cci); + if (con_num) { +- if (con_num < PMIC_GLINK_MAX_PORTS && ++ if (con_num <= PMIC_GLINK_MAX_PORTS && + ucsi->port_orientation[con_num - 1]) { + int orientation = gpiod_get_value(ucsi->port_orientation[con_num - 1]); + +diff --git a/fs/afs/cell.c b/fs/afs/cell.c +index 988c2ac7cecec..926cb1188eba6 100644 +--- a/fs/afs/cell.c ++++ b/fs/afs/cell.c +@@ -409,10 +409,12 @@ static int afs_update_cell(struct afs_cell *cell) + if (ret == -ENOMEM) + goto out_wake; + +- ret = -ENOMEM; + vllist = afs_alloc_vlserver_list(0); +- if (!vllist) ++ if (!vllist) { ++ if (ret >= 0) ++ ret = -ENOMEM; + goto out_wake; ++ } + + switch (ret) { + case -ENODATA: +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 8081d68004d05..10905a53d5b27 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -114,6 +114,7 @@ static int afs_probe_cell_name(struct dentry *dentry) + struct afs_net *net = afs_d2net(dentry); + const char *name = dentry->d_name.name; + size_t len = dentry->d_name.len; ++ char *result = NULL; + int ret; + + /* Names prefixed with a dot are R/W mounts. */ +@@ -131,9 +132,22 @@ static int afs_probe_cell_name(struct dentry *dentry) + } + + ret = dns_query(net->net, "afsdb", name, len, "srv=1", +- NULL, NULL, false); +- if (ret == -ENODATA || ret == -ENOKEY) ++ &result, NULL, false); ++ if (ret == -ENODATA || ret == -ENOKEY || ret == 0) + ret = -ENOENT; ++ if (ret > 0 && ret >= sizeof(struct dns_server_list_v1_header)) { ++ struct dns_server_list_v1_header *v1 = (void *)result; ++ ++ if (v1->hdr.zero == 0 && ++ v1->hdr.content == DNS_PAYLOAD_IS_SERVER_LIST && ++ v1->hdr.version == 1 && ++ (v1->status != DNS_LOOKUP_GOOD && ++ v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) ++ return -ENOENT; ++ ++ } ++ ++ kfree(result); + return ret; + } + +@@ -252,20 +266,9 @@ static int afs_dynroot_d_revalidate(struct dentry *dentry, unsigned int flags) + return 1; + } + +-/* +- * Allow the VFS to enquire as to whether a dentry should be unhashed (mustn't +- * sleep) +- * - called from dput() when d_count is going to 0. +- * - return 1 to request dentry be unhashed, 0 otherwise +- */ +-static int afs_dynroot_d_delete(const struct dentry *dentry) +-{ +- return d_really_is_positive(dentry); +-} +- + const struct dentry_operations afs_dynroot_dentry_operations = { + .d_revalidate = afs_dynroot_d_revalidate, +- .d_delete = afs_dynroot_d_delete, ++ .d_delete = always_delete_dentry, + .d_release = afs_d_release, + .d_automount = afs_d_automount, + }; +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 5041eae64423a..c4bf8439bc9c9 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -586,6 +586,7 @@ struct afs_volume { + #define AFS_VOLUME_OFFLINE 4 /* - T if volume offline notice given */ + #define AFS_VOLUME_BUSY 5 /* - T if volume busy notice given */ + #define AFS_VOLUME_MAYBE_NO_IBULK 6 /* - T if some servers don't have InlineBulkStatus */ ++#define AFS_VOLUME_RM_TREE 7 /* - Set if volume removed from cell->volumes */ + #ifdef CONFIG_AFS_FSCACHE + struct fscache_volume *cache; /* Caching cookie */ + #endif +@@ -1513,6 +1514,7 @@ extern struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *, + extern struct afs_volume *afs_create_volume(struct afs_fs_context *); + extern int afs_activate_volume(struct afs_volume *); + extern void afs_deactivate_volume(struct afs_volume *); ++bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason); + extern struct afs_volume *afs_get_volume(struct afs_volume *, enum afs_volume_trace); + extern void afs_put_volume(struct afs_net *, struct afs_volume *, enum afs_volume_trace); + extern int afs_check_volume_status(struct afs_volume *, struct afs_operation *); +diff --git a/fs/afs/volume.c b/fs/afs/volume.c +index 29d483c802813..115c081a8e2ce 100644 +--- a/fs/afs/volume.c ++++ b/fs/afs/volume.c +@@ -32,8 +32,13 @@ static struct afs_volume *afs_insert_volume_into_cell(struct afs_cell *cell, + } else if (p->vid > volume->vid) { + pp = &(*pp)->rb_right; + } else { +- volume = afs_get_volume(p, afs_volume_trace_get_cell_insert); +- goto found; ++ if (afs_try_get_volume(p, afs_volume_trace_get_cell_insert)) { ++ volume = p; ++ goto found; ++ } ++ ++ set_bit(AFS_VOLUME_RM_TREE, &volume->flags); ++ rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes); + } + } + +@@ -56,7 +61,8 @@ static void afs_remove_volume_from_cell(struct afs_volume *volume) + afs_volume_trace_remove); + write_seqlock(&cell->volume_lock); + hlist_del_rcu(&volume->proc_link); +- rb_erase(&volume->cell_node, &cell->volumes); ++ if (!test_and_set_bit(AFS_VOLUME_RM_TREE, &volume->flags)) ++ rb_erase(&volume->cell_node, &cell->volumes); + write_sequnlock(&cell->volume_lock); + } + } +@@ -231,6 +237,20 @@ static void afs_destroy_volume(struct afs_net *net, struct afs_volume *volume) + _leave(" [destroyed]"); + } + ++/* ++ * Try to get a reference on a volume record. ++ */ ++bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason) ++{ ++ int r; ++ ++ if (__refcount_inc_not_zero(&volume->ref, &r)) { ++ trace_afs_volume(volume->vid, r + 1, reason); ++ return true; ++ } ++ return false; ++} ++ + /* + * Get a reference on a volume record. + */ +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 71efb6883f307..b79781df70714 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4836,6 +4836,32 @@ void btrfs_cleanup_dirty_bgs(struct btrfs_transaction *cur_trans, + } + } + ++static void btrfs_free_all_qgroup_pertrans(struct btrfs_fs_info *fs_info) ++{ ++ struct btrfs_root *gang[8]; ++ int i; ++ int ret; ++ ++ spin_lock(&fs_info->fs_roots_radix_lock); ++ while (1) { ++ ret = radix_tree_gang_lookup_tag(&fs_info->fs_roots_radix, ++ (void **)gang, 0, ++ ARRAY_SIZE(gang), ++ BTRFS_ROOT_TRANS_TAG); ++ if (ret == 0) ++ break; ++ for (i = 0; i < ret; i++) { ++ struct btrfs_root *root = gang[i]; ++ ++ btrfs_qgroup_free_meta_all_pertrans(root); ++ radix_tree_tag_clear(&fs_info->fs_roots_radix, ++ (unsigned long)root->root_key.objectid, ++ BTRFS_ROOT_TRANS_TAG); ++ } ++ } ++ spin_unlock(&fs_info->fs_roots_radix_lock); ++} ++ + void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans, + struct btrfs_fs_info *fs_info) + { +@@ -4864,6 +4890,8 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans, + EXTENT_DIRTY); + btrfs_destroy_pinned_extent(fs_info, &cur_trans->pinned_extents); + ++ btrfs_free_all_qgroup_pertrans(fs_info); ++ + cur_trans->state =TRANS_STATE_COMPLETED; + wake_up(&cur_trans->commit_wait); + } +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 7c92494381549..a006f5160e6b4 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -208,6 +208,7 @@ static struct btrfs_qgroup *add_qgroup_rb(struct btrfs_fs_info *fs_info, + INIT_LIST_HEAD(&qgroup->groups); + INIT_LIST_HEAD(&qgroup->members); + INIT_LIST_HEAD(&qgroup->dirty); ++ INIT_LIST_HEAD(&qgroup->iterator); + + rb_link_node(&qgroup->node, parent, p); + rb_insert_color(&qgroup->node, &fs_info->qgroup_tree); +@@ -1342,6 +1343,24 @@ static void qgroup_dirty(struct btrfs_fs_info *fs_info, + list_add(&qgroup->dirty, &fs_info->dirty_qgroups); + } + ++static void qgroup_iterator_add(struct list_head *head, struct btrfs_qgroup *qgroup) ++{ ++ if (!list_empty(&qgroup->iterator)) ++ return; ++ ++ list_add_tail(&qgroup->iterator, head); ++} ++ ++static void qgroup_iterator_clean(struct list_head *head) ++{ ++ while (!list_empty(head)) { ++ struct btrfs_qgroup *qgroup; ++ ++ qgroup = list_first_entry(head, struct btrfs_qgroup, iterator); ++ list_del_init(&qgroup->iterator); ++ } ++} ++ + /* + * The easy accounting, we're updating qgroup relationship whose child qgroup + * only has exclusive extents. +@@ -3125,8 +3144,7 @@ static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce, + struct btrfs_fs_info *fs_info = root->fs_info; + u64 ref_root = root->root_key.objectid; + int ret = 0; +- struct ulist_node *unode; +- struct ulist_iterator uiter; ++ LIST_HEAD(qgroup_list); + + if (!is_fstree(ref_root)) + return 0; +@@ -3146,49 +3164,28 @@ static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce, + if (!qgroup) + goto out; + +- /* +- * in a first step, we check all affected qgroups if any limits would +- * be exceeded +- */ +- ulist_reinit(fs_info->qgroup_ulist); +- ret = ulist_add(fs_info->qgroup_ulist, qgroup->qgroupid, +- qgroup_to_aux(qgroup), GFP_ATOMIC); +- if (ret < 0) +- goto out; +- ULIST_ITER_INIT(&uiter); +- while ((unode = ulist_next(fs_info->qgroup_ulist, &uiter))) { +- struct btrfs_qgroup *qg; ++ qgroup_iterator_add(&qgroup_list, qgroup); ++ list_for_each_entry(qgroup, &qgroup_list, iterator) { + struct btrfs_qgroup_list *glist; + +- qg = unode_aux_to_qgroup(unode); +- +- if (enforce && !qgroup_check_limits(qg, num_bytes)) { ++ if (enforce && !qgroup_check_limits(qgroup, num_bytes)) { + ret = -EDQUOT; + goto out; + } + +- list_for_each_entry(glist, &qg->groups, next_group) { +- ret = ulist_add(fs_info->qgroup_ulist, +- glist->group->qgroupid, +- qgroup_to_aux(glist->group), GFP_ATOMIC); +- if (ret < 0) +- goto out; +- } ++ list_for_each_entry(glist, &qgroup->groups, next_group) ++ qgroup_iterator_add(&qgroup_list, glist->group); + } ++ + ret = 0; + /* + * no limits exceeded, now record the reservation into all qgroups + */ +- ULIST_ITER_INIT(&uiter); +- while ((unode = ulist_next(fs_info->qgroup_ulist, &uiter))) { +- struct btrfs_qgroup *qg; +- +- qg = unode_aux_to_qgroup(unode); +- +- qgroup_rsv_add(fs_info, qg, num_bytes, type); +- } ++ list_for_each_entry(qgroup, &qgroup_list, iterator) ++ qgroup_rsv_add(fs_info, qgroup, num_bytes, type); + + out: ++ qgroup_iterator_clean(&qgroup_list); + spin_unlock(&fs_info->qgroup_lock); + return ret; + } +@@ -4109,9 +4106,7 @@ static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root, + int num_bytes) + { + struct btrfs_qgroup *qgroup; +- struct ulist_node *unode; +- struct ulist_iterator uiter; +- int ret = 0; ++ LIST_HEAD(qgroup_list); + + if (num_bytes == 0) + return; +@@ -4122,31 +4117,22 @@ static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root, + qgroup = find_qgroup_rb(fs_info, ref_root); + if (!qgroup) + goto out; +- ulist_reinit(fs_info->qgroup_ulist); +- ret = ulist_add(fs_info->qgroup_ulist, qgroup->qgroupid, +- qgroup_to_aux(qgroup), GFP_ATOMIC); +- if (ret < 0) +- goto out; +- ULIST_ITER_INIT(&uiter); +- while ((unode = ulist_next(fs_info->qgroup_ulist, &uiter))) { +- struct btrfs_qgroup *qg; +- struct btrfs_qgroup_list *glist; + +- qg = unode_aux_to_qgroup(unode); ++ qgroup_iterator_add(&qgroup_list, qgroup); ++ list_for_each_entry(qgroup, &qgroup_list, iterator) { ++ struct btrfs_qgroup_list *glist; + +- qgroup_rsv_release(fs_info, qg, num_bytes, ++ qgroup_rsv_release(fs_info, qgroup, num_bytes, + BTRFS_QGROUP_RSV_META_PREALLOC); +- qgroup_rsv_add(fs_info, qg, num_bytes, +- BTRFS_QGROUP_RSV_META_PERTRANS); +- list_for_each_entry(glist, &qg->groups, next_group) { +- ret = ulist_add(fs_info->qgroup_ulist, +- glist->group->qgroupid, +- qgroup_to_aux(glist->group), GFP_ATOMIC); +- if (ret < 0) +- goto out; +- } ++ if (!sb_rdonly(fs_info->sb)) ++ qgroup_rsv_add(fs_info, qgroup, num_bytes, ++ BTRFS_QGROUP_RSV_META_PERTRANS); ++ ++ list_for_each_entry(glist, &qgroup->groups, next_group) ++ qgroup_iterator_add(&qgroup_list, glist->group); + } + out: ++ qgroup_iterator_clean(&qgroup_list); + spin_unlock(&fs_info->qgroup_lock); + } + +diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h +index 104c9bd3c3379..1203f06320991 100644 +--- a/fs/btrfs/qgroup.h ++++ b/fs/btrfs/qgroup.h +@@ -220,6 +220,15 @@ struct btrfs_qgroup { + struct list_head groups; /* groups this group is member of */ + struct list_head members; /* groups that are members of this group */ + struct list_head dirty; /* dirty groups */ ++ ++ /* ++ * For qgroup iteration usage. ++ * ++ * The iteration list should always be empty until qgroup_iterator_add() ++ * is called. And should be reset to empty after the iteration is ++ * finished. ++ */ ++ struct list_head iterator; + struct rb_node node; /* tree of qgroups */ + + /* +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index c780d37294636..0ac2d191cd34f 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -37,8 +37,6 @@ + + static struct kmem_cache *btrfs_trans_handle_cachep; + +-#define BTRFS_ROOT_TRANS_TAG 0 +- + /* + * Transaction states and transitions + * +diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h +index 93869cda6af99..238a0ab85df9b 100644 +--- a/fs/btrfs/transaction.h ++++ b/fs/btrfs/transaction.h +@@ -12,6 +12,9 @@ + #include "ctree.h" + #include "misc.h" + ++/* Radix-tree tag for roots that are part of the trasaction. */ ++#define BTRFS_ROOT_TRANS_TAG 0 ++ + enum btrfs_trans_state { + TRANS_STATE_RUNNING, + TRANS_STATE_COMMIT_PREP, +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 7ed02fb88a362..98854dd3c1502 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -704,8 +704,10 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred + + err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); + +- if (err >= 0 && +- !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) ++ if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) ++ nfsd_last_thread(net); ++ else if (err >= 0 && ++ !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) + svc_get(nn->nfsd_serv); + + nfsd_put(net); +@@ -756,6 +758,9 @@ out_close: + svc_xprt_put(xprt); + } + out_err: ++ if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) ++ nfsd_last_thread(net); ++ + nfsd_put(net); + return err; + } +diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h +index 11c14faa6c67b..63deed27a9059 100644 +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -138,6 +138,7 @@ int nfsd_vers(struct nfsd_net *nn, int vers, enum vers_op change); + int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op change); + void nfsd_reset_versions(struct nfsd_net *nn); + int nfsd_create_serv(struct net *net); ++void nfsd_last_thread(struct net *net); + + extern int nfsd_max_blksize; + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 211458203d147..7ef6af908faac 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -542,7 +542,7 @@ static struct notifier_block nfsd_inet6addr_notifier = { + /* Only used under nfsd_mutex, so this atomic may be overkill: */ + static atomic_t nfsd_notifier_refcount = ATOMIC_INIT(0); + +-static void nfsd_last_thread(struct net *net) ++void nfsd_last_thread(struct net *net) + { + struct nfsd_net *nn = net_generic(net, nfsd_net_id); + struct svc_serv *serv = nn->nfsd_serv; +diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c +index 16282ecfe17a7..a2584ad8808a9 100644 +--- a/fs/smb/client/cifs_debug.c ++++ b/fs/smb/client/cifs_debug.c +@@ -40,11 +40,13 @@ void cifs_dump_detail(void *buf, struct TCP_Server_Info *server) + #ifdef CONFIG_CIFS_DEBUG2 + struct smb_hdr *smb = buf; + +- cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Flgs2: 0x%x Mid: %d Pid: %d\n", +- smb->Command, smb->Status.CifsError, +- smb->Flags, smb->Flags2, smb->Mid, smb->Pid); +- cifs_dbg(VFS, "smb buf %p len %u\n", smb, +- server->ops->calc_smb_size(smb)); ++ cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Flgs2: 0x%x Mid: %d Pid: %d Wct: %d\n", ++ smb->Command, smb->Status.CifsError, smb->Flags, ++ smb->Flags2, smb->Mid, smb->Pid, smb->WordCount); ++ if (!server->ops->check_message(buf, server->total_read, server)) { ++ cifs_dbg(VFS, "smb buf %p len %u\n", smb, ++ server->ops->calc_smb_size(smb)); ++ } + #endif /* CONFIG_CIFS_DEBUG2 */ + } + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index bd7fc20c49de4..4eac7dcb82f94 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -532,7 +532,8 @@ struct smb_version_operations { + struct mid_q_entry **, char **, int *); + enum securityEnum (*select_sectype)(struct TCP_Server_Info *, + enum securityEnum); +- int (*next_header)(char *); ++ int (*next_header)(struct TCP_Server_Info *server, char *buf, ++ unsigned int *noff); + /* ioctl passthrough for query_info */ + int (*ioctl_query_info)(const unsigned int xid, + struct cifs_tcon *tcon, +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index d517651d7bcea..76ccbdba58558 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1180,7 +1180,12 @@ next_pdu: + server->total_read += length; + + if (server->ops->next_header) { +- next_offset = server->ops->next_header(buf); ++ if (server->ops->next_header(server, buf, &next_offset)) { ++ cifs_dbg(VFS, "%s: malformed response (next_offset=%u)\n", ++ __func__, next_offset); ++ cifs_reconnect(server, true); ++ continue; ++ } + if (next_offset) + server->pdu_size = next_offset; + } +diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c +index 35b176457bbed..c2137ea3c2538 100644 +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -363,6 +363,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) + cifs_dbg(VFS, "Length less than smb header size\n"); + } + return -EIO; ++ } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { ++ cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", ++ __func__, smb->WordCount); ++ return -EIO; + } + + /* otherwise, there is enough to get to the BCC */ +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index dbcfdf7bc2704..2187921580ac6 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -5072,17 +5072,22 @@ smb3_handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid) + NULL, 0, false); + } + +-static int +-smb2_next_header(char *buf) ++static int smb2_next_header(struct TCP_Server_Info *server, char *buf, ++ unsigned int *noff) + { + struct smb2_hdr *hdr = (struct smb2_hdr *)buf; + struct smb2_transform_hdr *t_hdr = (struct smb2_transform_hdr *)buf; + +- if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) +- return sizeof(struct smb2_transform_hdr) + +- le32_to_cpu(t_hdr->OriginalMessageSize); +- +- return le32_to_cpu(hdr->NextCommand); ++ if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) { ++ *noff = le32_to_cpu(t_hdr->OriginalMessageSize); ++ if (unlikely(check_add_overflow(*noff, sizeof(*t_hdr), noff))) ++ return -EINVAL; ++ } else { ++ *noff = le32_to_cpu(hdr->NextCommand); ++ } ++ if (unlikely(*noff && *noff < MID_HEADER_SIZE(server))) ++ return -EINVAL; ++ return 0; + } + + static int +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 2df118540e895..76a0b9dbcf755 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -376,10 +376,15 @@ static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, + void **request_buf, unsigned int *total_len) + { + /* BB eventually switch this to SMB2 specific small buf size */ +- if (smb2_command == SMB2_SET_INFO) ++ switch (smb2_command) { ++ case SMB2_SET_INFO: ++ case SMB2_QUERY_INFO: + *request_buf = cifs_buf_get(); +- else ++ break; ++ default: + *request_buf = cifs_small_buf_get(); ++ break; ++ } + if (*request_buf == NULL) { + /* BB should we add a retry in here if not a writepage? */ + return -ENOMEM; +@@ -3494,8 +3499,13 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, + struct smb2_query_info_req *req; + struct kvec *iov = rqst->rq_iov; + unsigned int total_len; ++ size_t len; + int rc; + ++ if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || ++ len > CIFSMaxBufSize)) ++ return -EINVAL; ++ + rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, + (void **) &req, &total_len); + if (rc) +@@ -3517,7 +3527,7 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, + + iov[0].iov_base = (char *)req; + /* 1 for Buffer */ +- iov[0].iov_len = total_len - 1 + input_len; ++ iov[0].iov_len = len; + return 0; + } + +@@ -3525,7 +3535,7 @@ void + SMB2_query_info_free(struct smb_rqst *rqst) + { + if (rqst && rqst->rq_iov) +- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ ++ cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ + } + + static int +@@ -5392,6 +5402,11 @@ build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, + return 0; + } + ++static inline void free_qfs_info_req(struct kvec *iov) ++{ ++ cifs_buf_release(iov->iov_base); ++} ++ + int + SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) +@@ -5423,7 +5438,7 @@ SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, + + rc = cifs_send_recv(xid, ses, server, + &rqst, &resp_buftype, flags, &rsp_iov); +- cifs_small_buf_release(iov.iov_base); ++ free_qfs_info_req(&iov); + if (rc) { + cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); + goto posix_qfsinf_exit; +@@ -5474,7 +5489,7 @@ SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, + + rc = cifs_send_recv(xid, ses, server, + &rqst, &resp_buftype, flags, &rsp_iov); +- cifs_small_buf_release(iov.iov_base); ++ free_qfs_info_req(&iov); + if (rc) { + cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); + goto qfsinf_exit; +@@ -5541,7 +5556,7 @@ SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, + + rc = cifs_send_recv(xid, ses, server, + &rqst, &resp_buftype, flags, &rsp_iov); +- cifs_small_buf_release(iov.iov_base); ++ free_qfs_info_req(&iov); + if (rc) { + cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); + goto qfsattr_exit; +diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h +index 010239392adfb..9c47a43f42a62 100644 +--- a/include/drm/drm_file.h ++++ b/include/drm/drm_file.h +@@ -256,8 +256,15 @@ struct drm_file { + /** @master_lookup_lock: Serializes @master. */ + spinlock_t master_lookup_lock; + +- /** @pid: Process that opened this file. */ +- struct pid *pid; ++ /** ++ * @pid: Process that is using this file. ++ * ++ * Must only be dereferenced under a rcu_read_lock or equivalent. ++ * ++ * Updates are guarded with dev->filelist_mutex and reference must be ++ * dropped after a RCU grace period to accommodate lockless readers. ++ */ ++ struct pid __rcu *pid; + + /** @client_id: A unique id for fdinfo */ + u64 client_id; +@@ -420,6 +427,8 @@ static inline bool drm_is_accel_client(const struct drm_file *file_priv) + return file_priv->minor->type == DRM_MINOR_ACCEL; + } + ++void drm_file_update_pid(struct drm_file *); ++ + int drm_open(struct inode *inode, struct file *filp); + int drm_open_helper(struct file *filp, struct drm_minor *minor); + ssize_t drm_read(struct file *filp, char __user *buffer, +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 392f581af2cee..75e039081f929 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -3143,6 +3143,9 @@ enum bpf_text_poke_type { + int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t, + void *addr1, void *addr2); + ++void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, ++ struct bpf_prog *new, struct bpf_prog *old); ++ + void *bpf_arch_text_copy(void *dst, void *src, size_t len); + int bpf_arch_text_invalidate(void *dst, size_t len); + +diff --git a/include/linux/damon.h b/include/linux/damon.h +index c70cca8a839f7..a953d7083cd59 100644 +--- a/include/linux/damon.h ++++ b/include/linux/damon.h +@@ -522,8 +522,20 @@ struct damon_ctx { + struct damon_attrs attrs; + + /* private: internal use only */ +- struct timespec64 last_aggregation; +- struct timespec64 last_ops_update; ++ /* number of sample intervals that passed since this context started */ ++ unsigned long passed_sample_intervals; ++ /* ++ * number of sample intervals that should be passed before next ++ * aggregation ++ */ ++ unsigned long next_aggregation_sis; ++ /* ++ * number of sample intervals that should be passed before next ops ++ * update ++ */ ++ unsigned long next_ops_update_sis; ++ /* for waiting until the execution of the kdamond_fn is started */ ++ struct completion kdamond_started; + + /* public: */ + struct task_struct *kdamond; +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index b24fb80782c5a..2b0a73cb7cbb0 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -4381,7 +4381,8 @@ ieee80211_is_protected_dual_of_public_action(struct sk_buff *skb) + action != WLAN_PUB_ACTION_LOC_TRACK_NOTI && + action != WLAN_PUB_ACTION_FTM_REQUEST && + action != WLAN_PUB_ACTION_FTM_RESPONSE && +- action != WLAN_PUB_ACTION_FILS_DISCOVERY; ++ action != WLAN_PUB_ACTION_FILS_DISCOVERY && ++ action != WLAN_PUB_ACTION_VENDOR_SPECIFIC; + } + + /** +diff --git a/include/linux/key-type.h b/include/linux/key-type.h +index 7d985a1dfe4af..5caf3ce823733 100644 +--- a/include/linux/key-type.h ++++ b/include/linux/key-type.h +@@ -73,6 +73,7 @@ struct key_type { + + unsigned int flags; + #define KEY_TYPE_NET_DOMAIN 0x00000001 /* Keys of this type have a net namespace domain */ ++#define KEY_TYPE_INSTANT_REAP 0x00000002 /* Keys of this type don't have a delay after expiring */ + + /* vet a description */ + int (*vet_description)(const char *description); +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 7fa95b72e5c85..7a4be33bd07aa 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -189,6 +189,7 @@ struct blocked_key { + struct smp_csrk { + bdaddr_t bdaddr; + u8 bdaddr_type; ++ u8 link_type; + u8 type; + u8 val[16]; + }; +@@ -198,6 +199,7 @@ struct smp_ltk { + struct rcu_head rcu; + bdaddr_t bdaddr; + u8 bdaddr_type; ++ u8 link_type; + u8 authenticated; + u8 type; + u8 enc_size; +@@ -212,6 +214,7 @@ struct smp_irk { + bdaddr_t rpa; + bdaddr_t bdaddr; + u8 addr_type; ++ u8 link_type; + u8 val[16]; + }; + +@@ -219,6 +222,8 @@ struct link_key { + struct list_head list; + struct rcu_head rcu; + bdaddr_t bdaddr; ++ u8 bdaddr_type; ++ u8 link_type; + u8 type; + u8 val[HCI_LINK_KEY_SIZE]; + u8 pin_len; +@@ -1227,11 +1232,11 @@ static inline struct hci_conn *hci_conn_hash_lookup_cis(struct hci_dev *hdev, + continue; + + /* Match CIG ID if set */ +- if (cig != BT_ISO_QOS_CIG_UNSET && cig != c->iso_qos.ucast.cig) ++ if (cig != c->iso_qos.ucast.cig) + continue; + + /* Match CIS ID if set */ +- if (id != BT_ISO_QOS_CIS_UNSET && id != c->iso_qos.ucast.cis) ++ if (id != c->iso_qos.ucast.cis) + continue; + + /* Match destination address if set */ +diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h +index 1ba9f4ddf2f6d..9ba6413fd2e3e 100644 +--- a/include/net/ip6_fib.h ++++ b/include/net/ip6_fib.h +@@ -179,9 +179,6 @@ struct fib6_info { + + refcount_t fib6_ref; + unsigned long expires; +- +- struct hlist_node gc_link; +- + struct dst_metrics *fib6_metrics; + #define fib6_pmtu fib6_metrics->metrics[RTAX_MTU-1] + +@@ -250,6 +247,19 @@ static inline bool fib6_requires_src(const struct fib6_info *rt) + return rt->fib6_src.plen > 0; + } + ++static inline void fib6_clean_expires(struct fib6_info *f6i) ++{ ++ f6i->fib6_flags &= ~RTF_EXPIRES; ++ f6i->expires = 0; ++} ++ ++static inline void fib6_set_expires(struct fib6_info *f6i, ++ unsigned long expires) ++{ ++ f6i->expires = expires; ++ f6i->fib6_flags |= RTF_EXPIRES; ++} ++ + static inline bool fib6_check_expired(const struct fib6_info *f6i) + { + if (f6i->fib6_flags & RTF_EXPIRES) +@@ -257,11 +267,6 @@ static inline bool fib6_check_expired(const struct fib6_info *f6i) + return false; + } + +-static inline bool fib6_has_expires(const struct fib6_info *f6i) +-{ +- return f6i->fib6_flags & RTF_EXPIRES; +-} +- + /* Function to safely get fn->fn_sernum for passed in rt + * and store result in passed in cookie. + * Return true if we can get cookie safely +@@ -383,7 +388,6 @@ struct fib6_table { + struct inet_peer_base tb6_peers; + unsigned int flags; + unsigned int fib_seq; +- struct hlist_head tb6_gc_hlist; /* GC candidates */ + #define RT6_TABLE_HAS_DFLT_ROUTER BIT(0) + }; + +@@ -500,48 +504,6 @@ void fib6_gc_cleanup(void); + + int fib6_init(void); + +-/* fib6_info must be locked by the caller, and fib6_info->fib6_table can be +- * NULL. +- */ +-static inline void fib6_set_expires_locked(struct fib6_info *f6i, +- unsigned long expires) +-{ +- struct fib6_table *tb6; +- +- tb6 = f6i->fib6_table; +- f6i->expires = expires; +- if (tb6 && !fib6_has_expires(f6i)) +- hlist_add_head(&f6i->gc_link, &tb6->tb6_gc_hlist); +- f6i->fib6_flags |= RTF_EXPIRES; +-} +- +-/* fib6_info must be locked by the caller, and fib6_info->fib6_table can be +- * NULL. If fib6_table is NULL, the fib6_info will no be inserted into the +- * list of GC candidates until it is inserted into a table. +- */ +-static inline void fib6_set_expires(struct fib6_info *f6i, +- unsigned long expires) +-{ +- spin_lock_bh(&f6i->fib6_table->tb6_lock); +- fib6_set_expires_locked(f6i, expires); +- spin_unlock_bh(&f6i->fib6_table->tb6_lock); +-} +- +-static inline void fib6_clean_expires_locked(struct fib6_info *f6i) +-{ +- if (fib6_has_expires(f6i)) +- hlist_del_init(&f6i->gc_link); +- f6i->fib6_flags &= ~RTF_EXPIRES; +- f6i->expires = 0; +-} +- +-static inline void fib6_clean_expires(struct fib6_info *f6i) +-{ +- spin_lock_bh(&f6i->fib6_table->tb6_lock); +- fib6_clean_expires_locked(f6i); +- spin_unlock_bh(&f6i->fib6_table->tb6_lock); +-} +- + struct ipv6_route_iter { + struct seq_net_private p; + struct fib6_walker w; +diff --git a/include/net/sock.h b/include/net/sock.h +index 7753354d59c0b..1b7ca8f35dd60 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2798,6 +2798,11 @@ static inline bool sk_is_tcp(const struct sock *sk) + return sk->sk_type == SOCK_STREAM && sk->sk_protocol == IPPROTO_TCP; + } + ++static inline bool sk_is_stream_unix(const struct sock *sk) ++{ ++ return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM; ++} ++ + /** + * sk_eat_skb - Release a skb if it is no longer needed + * @sk: socket to eat this skb from +diff --git a/include/trace/events/9p.h b/include/trace/events/9p.h +index 4dfa6d7f83baa..cd104a1343e2d 100644 +--- a/include/trace/events/9p.h ++++ b/include/trace/events/9p.h +@@ -178,18 +178,21 @@ TRACE_EVENT(9p_protocol_dump, + __field( void *, clnt ) + __field( __u8, type ) + __field( __u16, tag ) +- __array( unsigned char, line, P9_PROTO_DUMP_SZ ) ++ __dynamic_array(unsigned char, line, ++ min_t(size_t, pdu->capacity, P9_PROTO_DUMP_SZ)) + ), + + TP_fast_assign( + __entry->clnt = clnt; + __entry->type = pdu->id; + __entry->tag = pdu->tag; +- memcpy(__entry->line, pdu->sdata, P9_PROTO_DUMP_SZ); ++ memcpy(__get_dynamic_array(line), pdu->sdata, ++ __get_dynamic_array_len(line)); + ), +- TP_printk("clnt %lu %s(tag = %d)\n%.3x: %16ph\n%.3x: %16ph\n", ++ TP_printk("clnt %lu %s(tag = %d)\n%*ph\n", + (unsigned long)__entry->clnt, show_9p_op(__entry->type), +- __entry->tag, 0, __entry->line, 16, __entry->line + 16) ++ __entry->tag, __get_dynamic_array_len(line), ++ __get_dynamic_array(line)) + ); + + +diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c +index 2058e89b5ddd0..c85ff9162a5cd 100644 +--- a/kernel/bpf/arraymap.c ++++ b/kernel/bpf/arraymap.c +@@ -1012,11 +1012,16 @@ static void prog_array_map_poke_untrack(struct bpf_map *map, + mutex_unlock(&aux->poke_mutex); + } + ++void __weak bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, ++ struct bpf_prog *new, struct bpf_prog *old) ++{ ++ WARN_ON_ONCE(1); ++} ++ + static void prog_array_map_poke_run(struct bpf_map *map, u32 key, + struct bpf_prog *old, + struct bpf_prog *new) + { +- u8 *old_addr, *new_addr, *old_bypass_addr; + struct prog_poke_elem *elem; + struct bpf_array_aux *aux; + +@@ -1025,7 +1030,7 @@ static void prog_array_map_poke_run(struct bpf_map *map, u32 key, + + list_for_each_entry(elem, &aux->poke_progs, list) { + struct bpf_jit_poke_descriptor *poke; +- int i, ret; ++ int i; + + for (i = 0; i < elem->aux->size_poke_tab; i++) { + poke = &elem->aux->poke_tab[i]; +@@ -1044,21 +1049,10 @@ static void prog_array_map_poke_run(struct bpf_map *map, u32 key, + * activated, so tail call updates can arrive from here + * while JIT is still finishing its final fixup for + * non-activated poke entries. +- * 3) On program teardown, the program's kallsym entry gets +- * removed out of RCU callback, but we can only untrack +- * from sleepable context, therefore bpf_arch_text_poke() +- * might not see that this is in BPF text section and +- * bails out with -EINVAL. As these are unreachable since +- * RCU grace period already passed, we simply skip them. +- * 4) Also programs reaching refcount of zero while patching ++ * 3) Also programs reaching refcount of zero while patching + * is in progress is okay since we're protected under + * poke_mutex and untrack the programs before the JIT +- * buffer is freed. When we're still in the middle of +- * patching and suddenly kallsyms entry of the program +- * gets evicted, we just skip the rest which is fine due +- * to point 3). +- * 5) Any other error happening below from bpf_arch_text_poke() +- * is a unexpected bug. ++ * buffer is freed. + */ + if (!READ_ONCE(poke->tailcall_target_stable)) + continue; +@@ -1068,39 +1062,7 @@ static void prog_array_map_poke_run(struct bpf_map *map, u32 key, + poke->tail_call.key != key) + continue; + +- old_bypass_addr = old ? NULL : poke->bypass_addr; +- old_addr = old ? (u8 *)old->bpf_func + poke->adj_off : NULL; +- new_addr = new ? (u8 *)new->bpf_func + poke->adj_off : NULL; +- +- if (new) { +- ret = bpf_arch_text_poke(poke->tailcall_target, +- BPF_MOD_JUMP, +- old_addr, new_addr); +- BUG_ON(ret < 0 && ret != -EINVAL); +- if (!old) { +- ret = bpf_arch_text_poke(poke->tailcall_bypass, +- BPF_MOD_JUMP, +- poke->bypass_addr, +- NULL); +- BUG_ON(ret < 0 && ret != -EINVAL); +- } +- } else { +- ret = bpf_arch_text_poke(poke->tailcall_bypass, +- BPF_MOD_JUMP, +- old_bypass_addr, +- poke->bypass_addr); +- BUG_ON(ret < 0 && ret != -EINVAL); +- /* let other CPUs finish the execution of program +- * so that it will not possible to expose them +- * to invalid nop, stack unwind, nop state +- */ +- if (!ret) +- synchronize_rcu(); +- ret = bpf_arch_text_poke(poke->tailcall_target, +- BPF_MOD_JUMP, +- old_addr, NULL); +- BUG_ON(ret < 0 && ret != -EINVAL); +- } ++ bpf_arch_poke_desc_update(poke, new, old); + } + } + } +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index af08a1a411e3d..783a500e89c58 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -644,8 +644,8 @@ static inline bool __rb_time_read(rb_time_t *t, u64 *ret, unsigned long *cnt) + + *cnt = rb_time_cnt(top); + +- /* If top and msb counts don't match, this interrupted a write */ +- if (*cnt != rb_time_cnt(msb)) ++ /* If top, msb or bottom counts don't match, this interrupted a write */ ++ if (*cnt != rb_time_cnt(msb) || *cnt != rb_time_cnt(bottom)) + return false; + + /* The shift to msb will lose its cnt bits */ +@@ -700,48 +700,6 @@ rb_time_read_cmpxchg(local_t *l, unsigned long expect, unsigned long set) + return local_try_cmpxchg(l, &expect, set); + } + +-static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) +-{ +- unsigned long cnt, top, bottom, msb; +- unsigned long cnt2, top2, bottom2, msb2; +- u64 val; +- +- /* Any interruptions in this function should cause a failure */ +- cnt = local_read(&t->cnt); +- +- /* The cmpxchg always fails if it interrupted an update */ +- if (!__rb_time_read(t, &val, &cnt2)) +- return false; +- +- if (val != expect) +- return false; +- +- if ((cnt & 3) != cnt2) +- return false; +- +- cnt2 = cnt + 1; +- +- rb_time_split(val, &top, &bottom, &msb); +- msb = rb_time_val_cnt(msb, cnt); +- top = rb_time_val_cnt(top, cnt); +- bottom = rb_time_val_cnt(bottom, cnt); +- +- rb_time_split(set, &top2, &bottom2, &msb2); +- msb2 = rb_time_val_cnt(msb2, cnt); +- top2 = rb_time_val_cnt(top2, cnt2); +- bottom2 = rb_time_val_cnt(bottom2, cnt2); +- +- if (!rb_time_read_cmpxchg(&t->cnt, cnt, cnt2)) +- return false; +- if (!rb_time_read_cmpxchg(&t->msb, msb, msb2)) +- return false; +- if (!rb_time_read_cmpxchg(&t->top, top, top2)) +- return false; +- if (!rb_time_read_cmpxchg(&t->bottom, bottom, bottom2)) +- return false; +- return true; +-} +- + #else /* 64 bits */ + + /* local64_t always succeeds */ +@@ -755,11 +713,6 @@ static void rb_time_set(rb_time_t *t, u64 val) + { + local64_set(&t->time, val); + } +- +-static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) +-{ +- return local64_try_cmpxchg(&t->time, &expect, set); +-} + #endif + + /* +@@ -2987,25 +2940,6 @@ static unsigned rb_calculate_event_length(unsigned length) + return length; + } + +-static u64 rb_time_delta(struct ring_buffer_event *event) +-{ +- switch (event->type_len) { +- case RINGBUF_TYPE_PADDING: +- return 0; +- +- case RINGBUF_TYPE_TIME_EXTEND: +- return rb_event_time_stamp(event); +- +- case RINGBUF_TYPE_TIME_STAMP: +- return 0; +- +- case RINGBUF_TYPE_DATA: +- return event->time_delta; +- default: +- return 0; +- } +-} +- + static inline bool + rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + struct ring_buffer_event *event) +@@ -3013,8 +2947,6 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + unsigned long new_index, old_index; + struct buffer_page *bpage; + unsigned long addr; +- u64 write_stamp; +- u64 delta; + + new_index = rb_event_index(event); + old_index = new_index + rb_event_ts_length(event); +@@ -3023,14 +2955,10 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + + bpage = READ_ONCE(cpu_buffer->tail_page); + +- delta = rb_time_delta(event); +- +- if (!rb_time_read(&cpu_buffer->write_stamp, &write_stamp)) +- return false; +- +- /* Make sure the write stamp is read before testing the location */ +- barrier(); +- ++ /* ++ * Make sure the tail_page is still the same and ++ * the next write location is the end of this event ++ */ + if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) { + unsigned long write_mask = + local_read(&bpage->write) & ~RB_WRITE_MASK; +@@ -3041,20 +2969,20 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + * to make sure that the next event adds an absolute + * value and does not rely on the saved write stamp, which + * is now going to be bogus. ++ * ++ * By setting the before_stamp to zero, the next event ++ * is not going to use the write_stamp and will instead ++ * create an absolute timestamp. This means there's no ++ * reason to update the wirte_stamp! + */ + rb_time_set(&cpu_buffer->before_stamp, 0); + +- /* Something came in, can't discard */ +- if (!rb_time_cmpxchg(&cpu_buffer->write_stamp, +- write_stamp, write_stamp - delta)) +- return false; +- + /* + * If an event were to come in now, it would see that the + * write_stamp and the before_stamp are different, and assume + * that this event just added itself before updating + * the write stamp. The interrupting event will fix the +- * write stamp for us, and use the before stamp as its delta. ++ * write stamp for us, and use an absolute timestamp. + */ + + /* +@@ -3491,7 +3419,7 @@ static void check_buffer(struct ring_buffer_per_cpu *cpu_buffer, + return; + + /* +- * If this interrupted another event, ++ * If this interrupted another event, + */ + if (atomic_inc_return(this_cpu_ptr(&checking)) != 1) + goto out; +@@ -3635,20 +3563,36 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, + } else { + u64 ts; + /* SLOW PATH - Interrupted between A and C */ +- a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after); +- /* Was interrupted before here, write_stamp must be valid */ ++ ++ /* Save the old before_stamp */ ++ a_ok = rb_time_read(&cpu_buffer->before_stamp, &info->before); + RB_WARN_ON(cpu_buffer, !a_ok); ++ ++ /* ++ * Read a new timestamp and update the before_stamp to make ++ * the next event after this one force using an absolute ++ * timestamp. This is in case an interrupt were to come in ++ * between E and F. ++ */ + ts = rb_time_stamp(cpu_buffer->buffer); ++ rb_time_set(&cpu_buffer->before_stamp, ts); ++ + barrier(); +- /*E*/ if (write == (local_read(&tail_page->write) & RB_WRITE_MASK) && +- info->after < ts && +- rb_time_cmpxchg(&cpu_buffer->write_stamp, +- info->after, ts)) { +- /* Nothing came after this event between C and E */ ++ /*E*/ a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after); ++ /* Was interrupted before here, write_stamp must be valid */ ++ RB_WARN_ON(cpu_buffer, !a_ok); ++ barrier(); ++ /*F*/ if (write == (local_read(&tail_page->write) & RB_WRITE_MASK) && ++ info->after == info->before && info->after < ts) { ++ /* ++ * Nothing came after this event between C and F, it is ++ * safe to use info->after for the delta as it ++ * matched info->before and is still valid. ++ */ + info->delta = ts - info->after; + } else { + /* +- * Interrupted between C and E: ++ * Interrupted between C and F: + * Lost the previous events time stamp. Just set the + * delta to zero, and this will be the same time as + * the event this event interrupted. And the events that +diff --git a/kernel/trace/synth_event_gen_test.c b/kernel/trace/synth_event_gen_test.c +index 8dfe85499d4a2..354c2117be43f 100644 +--- a/kernel/trace/synth_event_gen_test.c ++++ b/kernel/trace/synth_event_gen_test.c +@@ -477,6 +477,17 @@ static int __init synth_event_gen_test_init(void) + + ret = test_trace_synth_event(); + WARN_ON(ret); ++ ++ /* Disable when done */ ++ trace_array_set_clr_event(gen_synth_test->tr, ++ "synthetic", ++ "gen_synth_test", false); ++ trace_array_set_clr_event(empty_synth_test->tr, ++ "synthetic", ++ "empty_synth_test", false); ++ trace_array_set_clr_event(create_synth_test->tr, ++ "synthetic", ++ "create_synth_test", false); + out: + return ret; + } +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index afb88b24fa748..2aa408441cd3e 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -2110,15 +2110,20 @@ char *fwnode_full_name_string(struct fwnode_handle *fwnode, char *buf, + + /* Loop starting from the root node to the current node. */ + for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) { +- struct fwnode_handle *__fwnode = +- fwnode_get_nth_parent(fwnode, depth); ++ /* ++ * Only get a reference for other nodes (i.e. parent nodes). ++ * fwnode refcount may be 0 here. ++ */ ++ struct fwnode_handle *__fwnode = depth ? ++ fwnode_get_nth_parent(fwnode, depth) : fwnode; + + buf = string(buf, end, fwnode_get_name_prefix(__fwnode), + default_str_spec); + buf = string(buf, end, fwnode_get_name(__fwnode), + default_str_spec); + +- fwnode_handle_put(__fwnode); ++ if (depth) ++ fwnode_handle_put(__fwnode); + } + + return buf; +diff --git a/mm/damon/core.c b/mm/damon/core.c +index fd5be73f699f4..aff611b6eafe1 100644 +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -423,12 +423,16 @@ struct damon_ctx *damon_new_ctx(void) + if (!ctx) + return NULL; + ++ init_completion(&ctx->kdamond_started); ++ + ctx->attrs.sample_interval = 5 * 1000; + ctx->attrs.aggr_interval = 100 * 1000; + ctx->attrs.ops_update_interval = 60 * 1000 * 1000; + +- ktime_get_coarse_ts64(&ctx->last_aggregation); +- ctx->last_ops_update = ctx->last_aggregation; ++ ctx->passed_sample_intervals = 0; ++ /* These will be set from kdamond_init_intervals_sis() */ ++ ctx->next_aggregation_sis = 0; ++ ctx->next_ops_update_sis = 0; + + mutex_init(&ctx->kdamond_lock); + +@@ -542,6 +546,9 @@ static void damon_update_monitoring_results(struct damon_ctx *ctx, + */ + int damon_set_attrs(struct damon_ctx *ctx, struct damon_attrs *attrs) + { ++ unsigned long sample_interval = attrs->sample_interval ? ++ attrs->sample_interval : 1; ++ + if (attrs->min_nr_regions < 3) + return -EINVAL; + if (attrs->min_nr_regions > attrs->max_nr_regions) +@@ -549,6 +556,11 @@ int damon_set_attrs(struct damon_ctx *ctx, struct damon_attrs *attrs) + if (attrs->sample_interval > attrs->aggr_interval) + return -EINVAL; + ++ ctx->next_aggregation_sis = ctx->passed_sample_intervals + ++ attrs->aggr_interval / sample_interval; ++ ctx->next_ops_update_sis = ctx->passed_sample_intervals + ++ attrs->ops_update_interval / sample_interval; ++ + damon_update_monitoring_results(ctx, attrs); + ctx->attrs = *attrs; + return 0; +@@ -626,11 +638,14 @@ static int __damon_start(struct damon_ctx *ctx) + mutex_lock(&ctx->kdamond_lock); + if (!ctx->kdamond) { + err = 0; ++ reinit_completion(&ctx->kdamond_started); + ctx->kdamond = kthread_run(kdamond_fn, ctx, "kdamond.%d", + nr_running_ctxs); + if (IS_ERR(ctx->kdamond)) { + err = PTR_ERR(ctx->kdamond); + ctx->kdamond = NULL; ++ } else { ++ wait_for_completion(&ctx->kdamond_started); + } + } + mutex_unlock(&ctx->kdamond_lock); +@@ -722,38 +737,6 @@ int damon_stop(struct damon_ctx **ctxs, int nr_ctxs) + return err; + } + +-/* +- * damon_check_reset_time_interval() - Check if a time interval is elapsed. +- * @baseline: the time to check whether the interval has elapsed since +- * @interval: the time interval (microseconds) +- * +- * See whether the given time interval has passed since the given baseline +- * time. If so, it also updates the baseline to current time for next check. +- * +- * Return: true if the time interval has passed, or false otherwise. +- */ +-static bool damon_check_reset_time_interval(struct timespec64 *baseline, +- unsigned long interval) +-{ +- struct timespec64 now; +- +- ktime_get_coarse_ts64(&now); +- if ((timespec64_to_ns(&now) - timespec64_to_ns(baseline)) < +- interval * 1000) +- return false; +- *baseline = now; +- return true; +-} +- +-/* +- * Check whether it is time to flush the aggregated information +- */ +-static bool kdamond_aggregate_interval_passed(struct damon_ctx *ctx) +-{ +- return damon_check_reset_time_interval(&ctx->last_aggregation, +- ctx->attrs.aggr_interval); +-} +- + /* + * Reset the aggregated monitoring results ('nr_accesses' of each region). + */ +@@ -1234,18 +1217,6 @@ static void kdamond_split_regions(struct damon_ctx *ctx) + last_nr_regions = nr_regions; + } + +-/* +- * Check whether it is time to check and apply the operations-related data +- * structures. +- * +- * Returns true if it is. +- */ +-static bool kdamond_need_update_operations(struct damon_ctx *ctx) +-{ +- return damon_check_reset_time_interval(&ctx->last_ops_update, +- ctx->attrs.ops_update_interval); +-} +- + /* + * Check whether current monitoring should be stopped + * +@@ -1357,6 +1328,17 @@ static int kdamond_wait_activation(struct damon_ctx *ctx) + return -EBUSY; + } + ++static void kdamond_init_intervals_sis(struct damon_ctx *ctx) ++{ ++ unsigned long sample_interval = ctx->attrs.sample_interval ? ++ ctx->attrs.sample_interval : 1; ++ ++ ctx->passed_sample_intervals = 0; ++ ctx->next_aggregation_sis = ctx->attrs.aggr_interval / sample_interval; ++ ctx->next_ops_update_sis = ctx->attrs.ops_update_interval / ++ sample_interval; ++} ++ + /* + * The monitoring daemon that runs as a kernel thread + */ +@@ -1370,6 +1352,9 @@ static int kdamond_fn(void *data) + + pr_debug("kdamond (%d) starts\n", current->pid); + ++ complete(&ctx->kdamond_started); ++ kdamond_init_intervals_sis(ctx); ++ + if (ctx->ops.init) + ctx->ops.init(ctx); + if (ctx->callback.before_start && ctx->callback.before_start(ctx)) +@@ -1378,6 +1363,17 @@ static int kdamond_fn(void *data) + sz_limit = damon_region_sz_limit(ctx); + + while (!kdamond_need_stop(ctx)) { ++ /* ++ * ctx->attrs and ctx->next_{aggregation,ops_update}_sis could ++ * be changed from after_wmarks_check() or after_aggregation() ++ * callbacks. Read the values here, and use those for this ++ * iteration. That is, damon_set_attrs() updated new values ++ * are respected from next iteration. ++ */ ++ unsigned long next_aggregation_sis = ctx->next_aggregation_sis; ++ unsigned long next_ops_update_sis = ctx->next_ops_update_sis; ++ unsigned long sample_interval = ctx->attrs.sample_interval; ++ + if (kdamond_wait_activation(ctx)) + break; + +@@ -1387,12 +1383,17 @@ static int kdamond_fn(void *data) + ctx->callback.after_sampling(ctx)) + break; + +- kdamond_usleep(ctx->attrs.sample_interval); ++ kdamond_usleep(sample_interval); ++ ctx->passed_sample_intervals++; + + if (ctx->ops.check_accesses) + max_nr_accesses = ctx->ops.check_accesses(ctx); + +- if (kdamond_aggregate_interval_passed(ctx)) { ++ sample_interval = ctx->attrs.sample_interval ? ++ ctx->attrs.sample_interval : 1; ++ if (ctx->passed_sample_intervals == next_aggregation_sis) { ++ ctx->next_aggregation_sis = next_aggregation_sis + ++ ctx->attrs.aggr_interval / sample_interval; + kdamond_merge_regions(ctx, + max_nr_accesses / 10, + sz_limit); +@@ -1407,7 +1408,10 @@ static int kdamond_fn(void *data) + ctx->ops.reset_aggregated(ctx); + } + +- if (kdamond_need_update_operations(ctx)) { ++ if (ctx->passed_sample_intervals == next_ops_update_sis) { ++ ctx->next_ops_update_sis = next_ops_update_sis + ++ ctx->attrs.ops_update_interval / ++ sample_interval; + if (ctx->ops.update) + ctx->ops.update(ctx); + sz_limit = damon_region_sz_limit(ctx); +diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c +index 0beb44f2fe1f0..f001582345052 100644 +--- a/net/8021q/vlan_core.c ++++ b/net/8021q/vlan_core.c +@@ -407,6 +407,8 @@ int vlan_vids_add_by_dev(struct net_device *dev, + return 0; + + list_for_each_entry(vid_info, &vlan_info->vid_list, list) { ++ if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) ++ continue; + err = vlan_vid_add(dev, vid_info->proto, vid_info->vid); + if (err) + goto unwind; +@@ -417,6 +419,8 @@ unwind: + list_for_each_entry_continue_reverse(vid_info, + &vlan_info->vid_list, + list) { ++ if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) ++ continue; + vlan_vid_del(dev, vid_info->proto, vid_info->vid); + } + +@@ -436,8 +440,11 @@ void vlan_vids_del_by_dev(struct net_device *dev, + if (!vlan_info) + return; + +- list_for_each_entry(vid_info, &vlan_info->vid_list, list) ++ list_for_each_entry(vid_info, &vlan_info->vid_list, list) { ++ if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) ++ continue; + vlan_vid_del(dev, vid_info->proto, vid_info->vid); ++ } + } + EXPORT_SYMBOL(vlan_vids_del_by_dev); + +diff --git a/net/9p/protocol.c b/net/9p/protocol.c +index 4e3a2a1ffcb3f..0e6603b1ec906 100644 +--- a/net/9p/protocol.c ++++ b/net/9p/protocol.c +@@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, + uint16_t *nwname = va_arg(ap, uint16_t *); + char ***wnames = va_arg(ap, char ***); + ++ *wnames = NULL; ++ + errcode = p9pdu_readf(pdu, proto_version, + "w", nwname); + if (!errcode) { +@@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, + GFP_NOFS); + if (!*wnames) + errcode = -ENOMEM; ++ else ++ (*wnames)[0] = NULL; + } + + if (!errcode) { +@@ -414,8 +418,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, + proto_version, + "s", + &(*wnames)[i]); +- if (errcode) ++ if (errcode) { ++ (*wnames)[i] = NULL; + break; ++ } + } + } + +@@ -423,11 +429,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, + if (*wnames) { + int i; + +- for (i = 0; i < *nwname; i++) ++ for (i = 0; i < *nwname; i++) { ++ if (!(*wnames)[i]) ++ break; + kfree((*wnames)[i]); ++ } ++ kfree(*wnames); ++ *wnames = NULL; + } +- kfree(*wnames); +- *wnames = NULL; + } + } + break; +diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c +index 336a761654546..b93464ac3517f 100644 +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + if (flags & MSG_OOB) + return -EOPNOTSUPP; + ++ lock_sock(sk); ++ + skb = skb_recv_datagram(sk, flags, &err); + if (!skb) { + if (sk->sk_shutdown & RCV_SHUTDOWN) +- return 0; ++ err = 0; + ++ release_sock(sk); + return err; + } + +@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + + skb_free_datagram(sk, skb); + ++ release_sock(sk); ++ + if (flags & MSG_TRUNC) + copied = skblen; + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index f6d3150bcbb03..f7ebbbd302182 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -516,6 +516,9 @@ static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data, + { + struct hci_rp_read_class_of_dev *rp = data; + ++ if (WARN_ON(!hdev)) ++ return HCI_ERROR_UNSPECIFIED; ++ + bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); + + if (rp->status) +@@ -747,9 +750,23 @@ static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data, + } else { + conn->enc_key_size = rp->key_size; + status = 0; ++ ++ if (conn->enc_key_size < hdev->min_enc_key_size) { ++ /* As slave role, the conn->state has been set to ++ * BT_CONNECTED and l2cap conn req might not be received ++ * yet, at this moment the l2cap layer almost does ++ * nothing with the non-zero status. ++ * So we also clear encrypt related bits, and then the ++ * handler of l2cap conn req will get the right secure ++ * state at a later time. ++ */ ++ status = HCI_ERROR_AUTH_FAILURE; ++ clear_bit(HCI_CONN_ENCRYPT, &conn->flags); ++ clear_bit(HCI_CONN_AES_CCM, &conn->flags); ++ } + } + +- hci_encrypt_cfm(conn, 0); ++ hci_encrypt_cfm(conn, status); + + done: + hci_dev_unlock(hdev); +@@ -820,8 +837,6 @@ static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data, + if (!rp->status) + conn->auth_payload_timeout = get_unaligned_le16(sent + 2); + +- hci_encrypt_cfm(conn, 0); +- + unlock: + hci_dev_unlock(hdev); + +@@ -2304,7 +2319,8 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status) + return; + } + +- set_bit(HCI_INQUIRY, &hdev->flags); ++ if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY)) ++ set_bit(HCI_INQUIRY, &hdev->flags); + } + + static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status) +@@ -3683,12 +3699,8 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data, + cp.handle = cpu_to_le16(conn->handle); + cp.timeout = cpu_to_le16(hdev->auth_payload_timeout); + if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO, +- sizeof(cp), &cp)) { ++ sizeof(cp), &cp)) + bt_dev_err(hdev, "write auth payload timeout failed"); +- goto notify; +- } +- +- goto unlock; + } + + notify: +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 17ca13e8c044c..baeebee41cd9e 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6492,6 +6492,14 @@ drop: + kfree_skb(skb); + } + ++static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident) ++{ ++ struct l2cap_cmd_rej_unk rej; ++ ++ rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); ++ l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); ++} ++ + static inline void l2cap_sig_channel(struct l2cap_conn *conn, + struct sk_buff *skb) + { +@@ -6517,23 +6525,24 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, + + if (len > skb->len || !cmd->ident) { + BT_DBG("corrupted command"); ++ l2cap_sig_send_rej(conn, cmd->ident); + break; + } + + err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); + if (err) { +- struct l2cap_cmd_rej_unk rej; +- + BT_ERR("Wrong link type (%d)", err); +- +- rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); +- l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, +- sizeof(rej), &rej); ++ l2cap_sig_send_rej(conn, cmd->ident); + } + + skb_pull(skb, len); + } + ++ if (skb->len > 0) { ++ BT_DBG("corrupted command"); ++ l2cap_sig_send_rej(conn, 0); ++ } ++ + drop: + kfree_skb(skb); + } +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index ba2e00646e8e8..9dd815b6603fe 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2897,7 +2897,8 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, + for (i = 0; i < key_count; i++) { + struct mgmt_link_key_info *key = &cp->keys[i]; + +- if (key->addr.type != BDADDR_BREDR || key->type > 0x08) ++ /* Considering SMP over BREDR/LE, there is no need to check addr_type */ ++ if (key->type > 0x08) + return mgmt_cmd_status(sk, hdev->id, + MGMT_OP_LOAD_LINK_KEYS, + MGMT_STATUS_INVALID_PARAMS); +@@ -7130,6 +7131,7 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, + + for (i = 0; i < irk_count; i++) { + struct mgmt_irk_info *irk = &cp->irks[i]; ++ u8 addr_type = le_addr_type(irk->addr.type); + + if (hci_is_blocked_key(hdev, + HCI_BLOCKED_KEY_TYPE_IRK, +@@ -7139,8 +7141,12 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, + continue; + } + ++ /* When using SMP over BR/EDR, the addr type should be set to BREDR */ ++ if (irk->addr.type == BDADDR_BREDR) ++ addr_type = BDADDR_BREDR; ++ + hci_add_irk(hdev, &irk->addr.bdaddr, +- le_addr_type(irk->addr.type), irk->val, ++ addr_type, irk->val, + BDADDR_ANY); + } + +@@ -7221,6 +7227,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, + for (i = 0; i < key_count; i++) { + struct mgmt_ltk_info *key = &cp->keys[i]; + u8 type, authenticated; ++ u8 addr_type = le_addr_type(key->addr.type); + + if (hci_is_blocked_key(hdev, + HCI_BLOCKED_KEY_TYPE_LTK, +@@ -7255,8 +7262,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, + continue; + } + ++ /* When using SMP over BR/EDR, the addr type should be set to BREDR */ ++ if (key->addr.type == BDADDR_BREDR) ++ addr_type = BDADDR_BREDR; ++ + hci_add_ltk(hdev, &key->addr.bdaddr, +- le_addr_type(key->addr.type), type, authenticated, ++ addr_type, type, authenticated, + key->val, key->enc_size, key->ediv, key->rand); + } + +@@ -9523,7 +9534,7 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, + + ev.store_hint = persistent; + bacpy(&ev.key.addr.bdaddr, &key->bdaddr); +- ev.key.addr.type = BDADDR_BREDR; ++ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); + ev.key.type = key->type; + memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); + ev.key.pin_len = key->pin_len; +@@ -9574,7 +9585,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) + ev.store_hint = persistent; + + bacpy(&ev.key.addr.bdaddr, &key->bdaddr); +- ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); ++ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); + ev.key.type = mgmt_ltk_type(key); + ev.key.enc_size = key->enc_size; + ev.key.ediv = key->ediv; +@@ -9603,7 +9614,7 @@ void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) + + bacpy(&ev.rpa, &irk->rpa); + bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); +- ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); ++ ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); + memcpy(ev.irk.val, irk->val, sizeof(irk->val)); + + mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); +@@ -9632,7 +9643,7 @@ void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, + ev.store_hint = persistent; + + bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); +- ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); ++ ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); + ev.key.type = csrk->type; + memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); + +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index f1a9fc0012f09..37f95ea8c7db5 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -1060,6 +1060,7 @@ static void smp_notify_keys(struct l2cap_conn *conn) + } + + if (smp->remote_irk) { ++ smp->remote_irk->link_type = hcon->type; + mgmt_new_irk(hdev, smp->remote_irk, persistent); + + /* Now that user space can be considered to know the +@@ -1079,24 +1080,28 @@ static void smp_notify_keys(struct l2cap_conn *conn) + } + + if (smp->csrk) { ++ smp->csrk->link_type = hcon->type; + smp->csrk->bdaddr_type = hcon->dst_type; + bacpy(&smp->csrk->bdaddr, &hcon->dst); + mgmt_new_csrk(hdev, smp->csrk, persistent); + } + + if (smp->responder_csrk) { ++ smp->responder_csrk->link_type = hcon->type; + smp->responder_csrk->bdaddr_type = hcon->dst_type; + bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); + mgmt_new_csrk(hdev, smp->responder_csrk, persistent); + } + + if (smp->ltk) { ++ smp->ltk->link_type = hcon->type; + smp->ltk->bdaddr_type = hcon->dst_type; + bacpy(&smp->ltk->bdaddr, &hcon->dst); + mgmt_new_ltk(hdev, smp->ltk, persistent); + } + + if (smp->responder_ltk) { ++ smp->responder_ltk->link_type = hcon->type; + smp->responder_ltk->bdaddr_type = hcon->dst_type; + bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); + mgmt_new_ltk(hdev, smp->responder_ltk, persistent); +@@ -1116,6 +1121,8 @@ static void smp_notify_keys(struct l2cap_conn *conn) + key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, + smp->link_key, type, 0, &persistent); + if (key) { ++ key->link_type = hcon->type; ++ key->bdaddr_type = hcon->dst_type; + mgmt_new_link_key(hdev, key, persistent); + + /* Don't keep debug keys around if the relevant +diff --git a/net/core/dev.c b/net/core/dev.c +index 9bf90b2a75b6a..e480afb50d4c1 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3500,6 +3500,9 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, + if (gso_segs > READ_ONCE(dev->gso_max_segs)) + return features & ~NETIF_F_GSO_MASK; + ++ if (unlikely(skb->len >= READ_ONCE(dev->gso_max_size))) ++ return features & ~NETIF_F_GSO_MASK; ++ + if (!skb_shinfo(skb)->gso_type) { + skb_warn_bad_offload(skb); + return features & ~NETIF_F_GSO_MASK; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 97b4a42e6e347..6d204cf54c574 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4810,7 +4810,9 @@ static __always_inline unsigned int skb_ext_total_length(void) + static void skb_extensions_init(void) + { + BUILD_BUG_ON(SKB_EXT_NUM >= 8); ++#if !IS_ENABLED(CONFIG_KCOV_INSTRUMENT_ALL) + BUILD_BUG_ON(skb_ext_total_length() > 255); ++#endif + + skbuff_ext_cache = kmem_cache_create("skbuff_ext_cache", + SKB_EXT_ALIGN_VALUE * skb_ext_total_length(), +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 4292c2ed18286..27d733c0f65e1 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -536,6 +536,8 @@ static bool sock_map_sk_state_allowed(const struct sock *sk) + { + if (sk_is_tcp(sk)) + return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN); ++ if (sk_is_stream_unix(sk)) ++ return (1 << sk->sk_state) & TCPF_ESTABLISHED; + return true; + } + +diff --git a/net/core/stream.c b/net/core/stream.c +index 96fbcb9bbb30a..b16dfa568a2d5 100644 +--- a/net/core/stream.c ++++ b/net/core/stream.c +@@ -79,7 +79,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) + remove_wait_queue(sk_sleep(sk), &wait); + sk->sk_write_pending--; + } while (!done); +- return 0; ++ return done < 0 ? done : 0; + } + EXPORT_SYMBOL(sk_stream_wait_connect); + +diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c +index 01e54b46ae0b9..2a6d363763a2b 100644 +--- a/net/dns_resolver/dns_key.c ++++ b/net/dns_resolver/dns_key.c +@@ -91,6 +91,7 @@ const struct cred *dns_resolver_cache; + static int + dns_resolver_preparse(struct key_preparsed_payload *prep) + { ++ const struct dns_server_list_v1_header *v1; + const struct dns_payload_header *bin; + struct user_key_payload *upayload; + unsigned long derrno; +@@ -122,6 +123,13 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) + return -EINVAL; + } + ++ v1 = (const struct dns_server_list_v1_header *)bin; ++ if ((v1->status != DNS_LOOKUP_GOOD && ++ v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) { ++ if (prep->expiry == TIME64_MAX) ++ prep->expiry = ktime_get_real_seconds() + 1; ++ } ++ + result_len = datalen; + goto store_result; + } +@@ -314,7 +322,7 @@ static long dns_resolver_read(const struct key *key, + + struct key_type key_type_dns_resolver = { + .name = "dns_resolver", +- .flags = KEY_TYPE_NET_DOMAIN, ++ .flags = KEY_TYPE_NET_DOMAIN | KEY_TYPE_INSTANT_REAP, + .preparse = dns_resolver_preparse, + .free_preparse = dns_resolver_free_preparse, + .instantiate = generic_key_instantiate, +diff --git a/net/ife/ife.c b/net/ife/ife.c +index 13bbf8cb6a396..be05b690b9ef2 100644 +--- a/net/ife/ife.c ++++ b/net/ife/ife.c +@@ -82,6 +82,7 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen) + if (unlikely(!pskb_may_pull(skb, total_pull))) + return NULL; + ++ ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len); + skb_set_mac_header(skb, total_pull); + __skb_pull(skb, total_pull); + *metalen = ifehdrln - IFE_METAHDRLEN; +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 7772f42ff2b94..4fc2cae0d116c 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -160,8 +160,6 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags, bool with_fib6_nh) + INIT_LIST_HEAD(&f6i->fib6_siblings); + refcount_set(&f6i->fib6_ref, 1); + +- INIT_HLIST_NODE(&f6i->gc_link); +- + return f6i; + } + +@@ -248,7 +246,6 @@ static struct fib6_table *fib6_alloc_table(struct net *net, u32 id) + net->ipv6.fib6_null_entry); + table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO; + inet_peer_base_init(&table->tb6_peers); +- INIT_HLIST_HEAD(&table->tb6_gc_hlist); + } + + return table; +@@ -1060,8 +1057,6 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn, + lockdep_is_held(&table->tb6_lock)); + } + } +- +- fib6_clean_expires_locked(rt); + } + + /* +@@ -1123,10 +1118,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, + if (!(iter->fib6_flags & RTF_EXPIRES)) + return -EEXIST; + if (!(rt->fib6_flags & RTF_EXPIRES)) +- fib6_clean_expires_locked(iter); ++ fib6_clean_expires(iter); + else +- fib6_set_expires_locked(iter, +- rt->expires); ++ fib6_set_expires(iter, rt->expires); + + if (rt->fib6_pmtu) + fib6_metric_set(iter, RTAX_MTU, +@@ -1485,10 +1479,6 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, + if (rt->nh) + list_add(&rt->nh_list, &rt->nh->f6i_list); + __fib6_update_sernum_upto_root(rt, fib6_new_sernum(info->nl_net)); +- +- if (fib6_has_expires(rt)) +- hlist_add_head(&rt->gc_link, &table->tb6_gc_hlist); +- + fib6_start_gc(info->nl_net, rt); + } + +@@ -2291,8 +2281,9 @@ static void fib6_flush_trees(struct net *net) + * Garbage collection + */ + +-static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args) ++static int fib6_age(struct fib6_info *rt, void *arg) + { ++ struct fib6_gc_args *gc_args = arg; + unsigned long now = jiffies; + + /* +@@ -2300,7 +2291,7 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args) + * Routes are expired even if they are in use. + */ + +- if (fib6_has_expires(rt) && rt->expires) { ++ if (rt->fib6_flags & RTF_EXPIRES && rt->expires) { + if (time_after(now, rt->expires)) { + RT6_TRACE("expiring %p\n", rt); + return -1; +@@ -2317,40 +2308,6 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args) + return 0; + } + +-static void fib6_gc_table(struct net *net, +- struct fib6_table *tb6, +- struct fib6_gc_args *gc_args) +-{ +- struct fib6_info *rt; +- struct hlist_node *n; +- struct nl_info info = { +- .nl_net = net, +- .skip_notify = false, +- }; +- +- hlist_for_each_entry_safe(rt, n, &tb6->tb6_gc_hlist, gc_link) +- if (fib6_age(rt, gc_args) == -1) +- fib6_del(rt, &info); +-} +- +-static void fib6_gc_all(struct net *net, struct fib6_gc_args *gc_args) +-{ +- struct fib6_table *table; +- struct hlist_head *head; +- unsigned int h; +- +- rcu_read_lock(); +- for (h = 0; h < FIB6_TABLE_HASHSZ; h++) { +- head = &net->ipv6.fib_table_hash[h]; +- hlist_for_each_entry_rcu(table, head, tb6_hlist) { +- spin_lock_bh(&table->tb6_lock); +- fib6_gc_table(net, table, gc_args); +- spin_unlock_bh(&table->tb6_lock); +- } +- } +- rcu_read_unlock(); +-} +- + void fib6_run_gc(unsigned long expires, struct net *net, bool force) + { + struct fib6_gc_args gc_args; +@@ -2366,7 +2323,7 @@ void fib6_run_gc(unsigned long expires, struct net *net, bool force) + net->ipv6.sysctl.ip6_rt_gc_interval; + gc_args.more = 0; + +- fib6_gc_all(net, &gc_args); ++ fib6_clean_all(net, fib6_age, &gc_args); + now = jiffies; + net->ipv6.ip6_rt_last_gc = now; + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 9c687b357e6a4..56525b5b95a2b 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3763,10 +3763,10 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, + rt->dst_nocount = true; + + if (cfg->fc_flags & RTF_EXPIRES) +- fib6_set_expires_locked(rt, jiffies + +- clock_t_to_jiffies(cfg->fc_expires)); ++ fib6_set_expires(rt, jiffies + ++ clock_t_to_jiffies(cfg->fc_expires)); + else +- fib6_clean_expires_locked(rt); ++ fib6_clean_expires(rt); + + if (cfg->fc_protocol == RTPROT_UNSPEC) + cfg->fc_protocol = RTPROT_BOOT; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 715da615f0359..f7cb50b0dd4ed 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1806,10 +1806,10 @@ static int sta_link_apply_parameters(struct ieee80211_local *local, + lockdep_is_held(&local->sta_mtx)); + + /* +- * If there are no changes, then accept a link that doesn't exist, ++ * If there are no changes, then accept a link that exist, + * unless it's a new link. + */ +- if (params->link_id < 0 && !new_link && ++ if (params->link_id >= 0 && !new_link && + !params->link_mac && !params->txpwr_set && + !params->supported_rates_len && + !params->ht_capa && !params->vht_capa && +diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c +index aa37a1410f377..f8af0c3d405ae 100644 +--- a/net/mac80211/driver-ops.c ++++ b/net/mac80211/driver-ops.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* + * Copyright 2015 Intel Deutschland GmbH +- * Copyright (C) 2022 Intel Corporation ++ * Copyright (C) 2022-2023 Intel Corporation + */ + #include + #include "ieee80211_i.h" +@@ -564,6 +564,10 @@ int drv_change_sta_links(struct ieee80211_local *local, + if (ret) + return ret; + ++ /* during reconfig don't add it to debugfs again */ ++ if (local->in_reconfig) ++ return 0; ++ + for_each_set_bit(link_id, &links_to_add, IEEE80211_MLD_MAX_NUM_LINKS) { + link_sta = rcu_dereference_protected(info->link[link_id], + lockdep_is_held(&local->sta_mtx)); +diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c +index a1e526419e9d2..cc62c2a01f54f 100644 +--- a/net/mac80211/mesh_plink.c ++++ b/net/mac80211/mesh_plink.c +@@ -1064,8 +1064,8 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata, + case WLAN_SP_MESH_PEERING_OPEN: + if (!matches_local) + event = OPN_RJCT; +- if (!mesh_plink_free_count(sdata) || +- (sta->mesh->plid && sta->mesh->plid != plid)) ++ else if (!mesh_plink_free_count(sdata) || ++ (sta->mesh->plid && sta->mesh->plid != plid)) + event = OPN_IGNR; + else + event = OPN_ACPT; +@@ -1073,9 +1073,9 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata, + case WLAN_SP_MESH_PEERING_CONFIRM: + if (!matches_local) + event = CNF_RJCT; +- if (!mesh_plink_free_count(sdata) || +- sta->mesh->llid != llid || +- (sta->mesh->plid && sta->mesh->plid != plid)) ++ else if (!mesh_plink_free_count(sdata) || ++ sta->mesh->llid != llid || ++ (sta->mesh->plid && sta->mesh->plid != plid)) + event = CNF_IGNR; + else + event = CNF_ACPT; +@@ -1243,6 +1243,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, + return; + } + elems = ieee802_11_parse_elems(baseaddr, len - baselen, true, NULL); +- mesh_process_plink_frame(sdata, mgmt, elems, rx_status); +- kfree(elems); ++ if (elems) { ++ mesh_process_plink_frame(sdata, mgmt, elems, rx_status); ++ kfree(elems); ++ } + } +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 0c9198997482b..73f8df03d159c 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5805,7 +5805,7 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, + { + const struct ieee80211_multi_link_elem *ml; + const struct element *sub; +- size_t ml_len; ++ ssize_t ml_len; + unsigned long removed_links = 0; + u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {}; + u8 link_id; +@@ -5821,6 +5821,8 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, + elems->scratch + elems->scratch_len - + elems->scratch_pos, + WLAN_EID_FRAGMENT); ++ if (ml_len < 0) ++ return; + + elems->ml_reconf = (const void *)elems->scratch_pos; + elems->ml_reconf_len = ml_len; +diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c +index 5a81505fba9ac..4e32d659524e0 100644 +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -126,6 +126,14 @@ static int rfkill_gpio_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ ret = gpiod_direction_output(rfkill->reset_gpio, true); ++ if (ret) ++ return ret; ++ ++ ret = gpiod_direction_output(rfkill->shutdown_gpio, true); ++ if (ret) ++ return ret; ++ + rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev, + rfkill->type, &rfkill_gpio_ops, + rfkill); +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 4a5c2dc8dd7a9..42e8b9e37516b 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -182,21 +182,47 @@ void rose_kill_by_neigh(struct rose_neigh *neigh) + */ + static void rose_kill_by_device(struct net_device *dev) + { +- struct sock *s; ++ struct sock *sk, *array[16]; ++ struct rose_sock *rose; ++ bool rescan; ++ int i, cnt; + ++start: ++ rescan = false; ++ cnt = 0; + spin_lock_bh(&rose_list_lock); +- sk_for_each(s, &rose_list) { +- struct rose_sock *rose = rose_sk(s); ++ sk_for_each(sk, &rose_list) { ++ rose = rose_sk(sk); ++ if (rose->device == dev) { ++ if (cnt == ARRAY_SIZE(array)) { ++ rescan = true; ++ break; ++ } ++ sock_hold(sk); ++ array[cnt++] = sk; ++ } ++ } ++ spin_unlock_bh(&rose_list_lock); + ++ for (i = 0; i < cnt; i++) { ++ sk = array[cnt]; ++ rose = rose_sk(sk); ++ lock_sock(sk); ++ spin_lock_bh(&rose_list_lock); + if (rose->device == dev) { +- rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); ++ rose_disconnect(sk, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); + if (rose->neighbour) + rose->neighbour->use--; + netdev_put(rose->device, &rose->dev_tracker); + rose->device = NULL; + } ++ spin_unlock_bh(&rose_list_lock); ++ release_sock(sk); ++ sock_put(sk); ++ cond_resched(); + } +- spin_unlock_bh(&rose_list_lock); ++ if (rescan) ++ goto start; + } + + /* +@@ -656,7 +682,10 @@ static int rose_release(struct socket *sock) + break; + } + ++ spin_lock_bh(&rose_list_lock); + netdev_put(rose->device, &rose->dev_tracker); ++ rose->device = NULL; ++ spin_unlock_bh(&rose_list_lock); + sock->sk = NULL; + release_sock(sk); + sock_put(sk); +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 4cfe9640df481..5cfe5c7408b74 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -666,9 +666,8 @@ static bool svc_alloc_arg(struct svc_rqst *rqstp) + } + + for (filled = 0; filled < pages; filled = ret) { +- ret = alloc_pages_bulk_array_node(GFP_KERNEL, +- rqstp->rq_pool->sp_id, +- pages, rqstp->rq_pages); ++ ret = alloc_pages_bulk_array(GFP_KERNEL, pages, ++ rqstp->rq_pages); + if (ret > filled) + /* Made progress, don't sleep yet */ + continue; +diff --git a/net/wireless/certs/wens.hex b/net/wireless/certs/wens.hex +new file mode 100644 +index 0000000000000..0d50369bede98 +--- /dev/null ++++ b/net/wireless/certs/wens.hex +@@ -0,0 +1,87 @@ ++/* Chen-Yu Tsai's regdb certificate */ ++0x30, 0x82, 0x02, 0xa7, 0x30, 0x82, 0x01, 0x8f, ++0x02, 0x14, 0x61, 0xc0, 0x38, 0x65, 0x1a, 0xab, ++0xdc, 0xf9, 0x4b, 0xd0, 0xac, 0x7f, 0xf0, 0x6c, ++0x72, 0x48, 0xdb, 0x18, 0xc6, 0x00, 0x30, 0x0d, ++0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, ++0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x0f, 0x31, ++0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, ++0x0c, 0x04, 0x77, 0x65, 0x6e, 0x73, 0x30, 0x20, ++0x17, 0x0d, 0x32, 0x33, 0x31, 0x32, 0x30, 0x31, ++0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, 0x18, ++0x0f, 0x32, 0x31, 0x32, 0x33, 0x31, 0x31, 0x30, ++0x37, 0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, ++0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, ++0x55, 0x04, 0x03, 0x0c, 0x04, 0x77, 0x65, 0x6e, ++0x73, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, ++0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, ++0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, ++0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, ++0x01, 0x00, 0xa9, 0x7a, 0x2c, 0x78, 0x4d, 0xa7, ++0x19, 0x2d, 0x32, 0x52, 0xa0, 0x2e, 0x6c, 0xef, ++0x88, 0x7f, 0x15, 0xc5, 0xb6, 0x69, 0x54, 0x16, ++0x43, 0x14, 0x79, 0x53, 0xb7, 0xae, 0x88, 0xfe, ++0xc0, 0xb7, 0x5d, 0x47, 0x8e, 0x1a, 0xe1, 0xef, ++0xb3, 0x90, 0x86, 0xda, 0xd3, 0x64, 0x81, 0x1f, ++0xce, 0x5d, 0x9e, 0x4b, 0x6e, 0x58, 0x02, 0x3e, ++0xb2, 0x6f, 0x5e, 0x42, 0x47, 0x41, 0xf4, 0x2c, ++0xb8, 0xa8, 0xd4, 0xaa, 0xc0, 0x0e, 0xe6, 0x48, ++0xf0, 0xa8, 0xce, 0xcb, 0x08, 0xae, 0x37, 0xaf, ++0xf6, 0x40, 0x39, 0xcb, 0x55, 0x6f, 0x5b, 0x4f, ++0x85, 0x34, 0xe6, 0x69, 0x10, 0x50, 0x72, 0x5e, ++0x4e, 0x9d, 0x4c, 0xba, 0x38, 0x36, 0x0d, 0xce, ++0x73, 0x38, 0xd7, 0x27, 0x02, 0x2a, 0x79, 0x03, ++0xe1, 0xac, 0xcf, 0xb0, 0x27, 0x85, 0x86, 0x93, ++0x17, 0xab, 0xec, 0x42, 0x77, 0x37, 0x65, 0x8a, ++0x44, 0xcb, 0xd6, 0x42, 0x93, 0x92, 0x13, 0xe3, ++0x39, 0x45, 0xc5, 0x6e, 0x00, 0x4a, 0x7f, 0xcb, ++0x42, 0x17, 0x2b, 0x25, 0x8c, 0xb8, 0x17, 0x3b, ++0x15, 0x36, 0x59, 0xde, 0x42, 0xce, 0x21, 0xe6, ++0xb6, 0xc7, 0x6e, 0x5e, 0x26, 0x1f, 0xf7, 0x8a, ++0x57, 0x9e, 0xa5, 0x96, 0x72, 0xb7, 0x02, 0x32, ++0xeb, 0x07, 0x2b, 0x73, 0xe2, 0x4f, 0x66, 0x58, ++0x9a, 0xeb, 0x0f, 0x07, 0xb6, 0xab, 0x50, 0x8b, ++0xc3, 0x8f, 0x17, 0xfa, 0x0a, 0x99, 0xc2, 0x16, ++0x25, 0xbf, 0x2d, 0x6b, 0x1a, 0xaa, 0xe6, 0x3e, ++0x5f, 0xeb, 0x6d, 0x9b, 0x5d, 0x4d, 0x42, 0x83, ++0x2d, 0x39, 0xb8, 0xc9, 0xac, 0xdb, 0x3a, 0x91, ++0x50, 0xdf, 0xbb, 0xb1, 0x76, 0x6d, 0x15, 0x73, ++0xfd, 0xc6, 0xe6, 0x6b, 0x71, 0x9e, 0x67, 0x36, ++0x22, 0x83, 0x79, 0xb1, 0xd6, 0xb8, 0x84, 0x52, ++0xaf, 0x96, 0x5b, 0xc3, 0x63, 0x02, 0x4e, 0x78, ++0x70, 0x57, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, ++0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, ++0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, ++0x01, 0x01, 0x00, 0x24, 0x28, 0xee, 0x22, 0x74, ++0x7f, 0x7c, 0xfa, 0x6c, 0x1f, 0xb3, 0x18, 0xd1, ++0xc2, 0x3d, 0x7d, 0x29, 0x42, 0x88, 0xad, 0x82, ++0xa5, 0xb1, 0x8a, 0x05, 0xd0, 0xec, 0x5c, 0x91, ++0x20, 0xf6, 0x82, 0xfd, 0xd5, 0x67, 0x60, 0x5f, ++0x31, 0xf5, 0xbd, 0x88, 0x91, 0x70, 0xbd, 0xb8, ++0xb9, 0x8c, 0x88, 0xfe, 0x53, 0xc9, 0x54, 0x9b, ++0x43, 0xc4, 0x7a, 0x43, 0x74, 0x6b, 0xdd, 0xb0, ++0xb1, 0x3b, 0x33, 0x45, 0x46, 0x78, 0xa3, 0x1c, ++0xef, 0x54, 0x68, 0xf7, 0x85, 0x9c, 0xe4, 0x51, ++0x6f, 0x06, 0xaf, 0x81, 0xdb, 0x2a, 0x7b, 0x7b, ++0x6f, 0xa8, 0x9c, 0x67, 0xd8, 0xcb, 0xc9, 0x91, ++0x40, 0x00, 0xae, 0xd9, 0xa1, 0x9f, 0xdd, 0xa6, ++0x43, 0x0e, 0x28, 0x7b, 0xaa, 0x1b, 0xe9, 0x84, ++0xdb, 0x76, 0x64, 0x42, 0x70, 0xc9, 0xc0, 0xeb, ++0xae, 0x84, 0x11, 0x16, 0x68, 0x4e, 0x84, 0x9e, ++0x7e, 0x92, 0x36, 0xee, 0x1c, 0x3b, 0x08, 0x63, ++0xeb, 0x79, 0x84, 0x15, 0x08, 0x9d, 0xaf, 0xc8, ++0x9a, 0xc7, 0x34, 0xd3, 0x94, 0x4b, 0xd1, 0x28, ++0x97, 0xbe, 0xd1, 0x45, 0x75, 0xdc, 0x35, 0x62, ++0xac, 0x1d, 0x1f, 0xb7, 0xb7, 0x15, 0x87, 0xc8, ++0x98, 0xc0, 0x24, 0x31, 0x56, 0x8d, 0xed, 0xdb, ++0x06, 0xc6, 0x46, 0xbf, 0x4b, 0x6d, 0xa6, 0xd5, ++0xab, 0xcc, 0x60, 0xfc, 0xe5, 0x37, 0xb6, 0x53, ++0x7d, 0x58, 0x95, 0xa9, 0x56, 0xc7, 0xf7, 0xee, ++0xc3, 0xa0, 0x76, 0xf7, 0x65, 0x4d, 0x53, 0xfa, ++0xff, 0x5f, 0x76, 0x33, 0x5a, 0x08, 0xfa, 0x86, ++0x92, 0x5a, 0x13, 0xfa, 0x1a, 0xfc, 0xf2, 0x1b, ++0x8c, 0x7f, 0x42, 0x6d, 0xb7, 0x7e, 0xb7, 0xb4, ++0xf0, 0xc7, 0x83, 0xbb, 0xa2, 0x81, 0x03, 0x2d, ++0xd4, 0x2a, 0x63, 0x3f, 0xf7, 0x31, 0x2e, 0x40, ++0x33, 0x5c, 0x46, 0xbc, 0x9b, 0xc1, 0x05, 0xa5, ++0x45, 0x4e, 0xc3, +diff --git a/security/keys/gc.c b/security/keys/gc.c +index 3c90807476eb0..eaddaceda14ea 100644 +--- a/security/keys/gc.c ++++ b/security/keys/gc.c +@@ -66,6 +66,19 @@ void key_schedule_gc(time64_t gc_at) + } + } + ++/* ++ * Set the expiration time on a key. ++ */ ++void key_set_expiry(struct key *key, time64_t expiry) ++{ ++ key->expiry = expiry; ++ if (expiry != TIME64_MAX) { ++ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) ++ expiry += key_gc_delay; ++ key_schedule_gc(expiry); ++ } ++} ++ + /* + * Schedule a dead links collection run. + */ +@@ -176,7 +189,6 @@ static void key_garbage_collector(struct work_struct *work) + static u8 gc_state; /* Internal persistent state */ + #define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */ + #define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */ +-#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */ + #define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */ + #define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */ + #define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */ +@@ -184,21 +196,17 @@ static void key_garbage_collector(struct work_struct *work) + + struct rb_node *cursor; + struct key *key; +- time64_t new_timer, limit; ++ time64_t new_timer, limit, expiry; + + kenter("[%lx,%x]", key_gc_flags, gc_state); + + limit = ktime_get_real_seconds(); +- if (limit > key_gc_delay) +- limit -= key_gc_delay; +- else +- limit = key_gc_delay; + + /* Work out what we're going to be doing in this pass */ + gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2; + gc_state <<= 1; + if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags)) +- gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER; ++ gc_state |= KEY_GC_REAPING_LINKS; + + if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) + gc_state |= KEY_GC_REAPING_DEAD_1; +@@ -233,8 +241,11 @@ continue_scanning: + } + } + +- if (gc_state & KEY_GC_SET_TIMER) { +- if (key->expiry > limit && key->expiry < new_timer) { ++ expiry = key->expiry; ++ if (expiry != TIME64_MAX) { ++ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) ++ expiry += key_gc_delay; ++ if (expiry > limit && expiry < new_timer) { + kdebug("will expire %x in %lld", + key_serial(key), key->expiry - limit); + new_timer = key->expiry; +@@ -276,7 +287,7 @@ maybe_resched: + */ + kdebug("pass complete"); + +- if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) { ++ if (new_timer != TIME64_MAX) { + new_timer += key_gc_delay; + key_schedule_gc(new_timer); + } +diff --git a/security/keys/internal.h b/security/keys/internal.h +index 3c1e7122076b9..ec2ec335b6133 100644 +--- a/security/keys/internal.h ++++ b/security/keys/internal.h +@@ -174,6 +174,7 @@ extern unsigned key_gc_delay; + extern void keyring_gc(struct key *keyring, time64_t limit); + extern void keyring_restriction_gc(struct key *keyring, + struct key_type *dead_type); ++void key_set_expiry(struct key *key, time64_t expiry); + extern void key_schedule_gc(time64_t gc_at); + extern void key_schedule_gc_links(void); + extern void key_gc_keytype(struct key_type *ktype); +@@ -222,10 +223,18 @@ extern struct key *key_get_instantiation_authkey(key_serial_t target_id); + */ + static inline bool key_is_dead(const struct key *key, time64_t limit) + { ++ time64_t expiry = key->expiry; ++ ++ if (expiry != TIME64_MAX) { ++ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) ++ expiry += key_gc_delay; ++ if (expiry <= limit) ++ return true; ++ } ++ + return + key->flags & ((1 << KEY_FLAG_DEAD) | + (1 << KEY_FLAG_INVALIDATED)) || +- (key->expiry > 0 && key->expiry <= limit) || + key->domain_tag->removed; + } + +diff --git a/security/keys/key.c b/security/keys/key.c +index 5c0c7df833f8a..5f103b2713c64 100644 +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -294,6 +294,7 @@ struct key *key_alloc(struct key_type *type, const char *desc, + key->uid = uid; + key->gid = gid; + key->perm = perm; ++ key->expiry = TIME64_MAX; + key->restrict_link = restrict_link; + key->last_used_at = ktime_get_real_seconds(); + +@@ -463,10 +464,7 @@ static int __key_instantiate_and_link(struct key *key, + if (authkey) + key_invalidate(authkey); + +- if (prep->expiry != TIME64_MAX) { +- key->expiry = prep->expiry; +- key_schedule_gc(prep->expiry + key_gc_delay); +- } ++ key_set_expiry(key, prep->expiry); + } + } + +@@ -606,8 +604,7 @@ int key_reject_and_link(struct key *key, + atomic_inc(&key->user->nikeys); + mark_key_instantiated(key, -error); + notify_key(key, NOTIFY_KEY_INSTANTIATED, -error); +- key->expiry = ktime_get_real_seconds() + timeout; +- key_schedule_gc(key->expiry + key_gc_delay); ++ key_set_expiry(key, ktime_get_real_seconds() + timeout); + + if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) + awaken = 1; +@@ -722,16 +719,14 @@ found_kernel_type: + + void key_set_timeout(struct key *key, unsigned timeout) + { +- time64_t expiry = 0; ++ time64_t expiry = TIME64_MAX; + + /* make the changes with the locks held to prevent races */ + down_write(&key->sem); + + if (timeout > 0) + expiry = ktime_get_real_seconds() + timeout; +- +- key->expiry = expiry; +- key_schedule_gc(key->expiry + key_gc_delay); ++ key_set_expiry(key, expiry); + + up_write(&key->sem); + } +diff --git a/security/keys/proc.c b/security/keys/proc.c +index d0cde6685627f..4f4e2c1824f18 100644 +--- a/security/keys/proc.c ++++ b/security/keys/proc.c +@@ -198,7 +198,7 @@ static int proc_keys_show(struct seq_file *m, void *v) + + /* come up with a suitable timeout value */ + expiry = READ_ONCE(key->expiry); +- if (expiry == 0) { ++ if (expiry == TIME64_MAX) { + memcpy(xbuf, "perm", 5); + } else if (now >= expiry) { + memcpy(xbuf, "expd", 5); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2590879f0a84b..343732c062c70 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9864,6 +9864,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), ++ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 63a90c7e89768..2fb1a7037c82c 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -543,6 +543,10 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + + tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; + tasdevice_prmg_load(tas_priv, 0); ++ if (tas_priv->fmw->nr_programs > 0) ++ tas_priv->cur_prog = 0; ++ if (tas_priv->fmw->nr_configurations > 0) ++ tas_priv->cur_conf = 0; + + /* If calibrated data occurs error, dsp will still works with default + * calibrated data inside algo. +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index 20da1eaa4f1c7..0938671700c62 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -850,8 +850,9 @@ static int hdmi_dai_probe(struct snd_soc_dai *dai) + static void hdmi_codec_jack_report(struct hdmi_codec_priv *hcp, + unsigned int jack_status) + { +- if (hcp->jack && jack_status != hcp->jack_status) { +- snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_LINEOUT); ++ if (jack_status != hcp->jack_status) { ++ if (hcp->jack) ++ snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_LINEOUT); + hcp->jack_status = jack_status; + } + } +@@ -880,6 +881,13 @@ static int hdmi_codec_set_jack(struct snd_soc_component *component, + + if (hcp->hcd.ops->hook_plugged_cb) { + hcp->jack = jack; ++ ++ /* ++ * Report the initial jack status which may have been provided ++ * by the parent hdmi driver while the hpd hook was registered. ++ */ ++ snd_soc_jack_report(jack, hcp->jack_status, SND_JACK_LINEOUT); ++ + return 0; + } + +diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c +index eb55abae0d7bb..1dfac9b2fca25 100644 +--- a/sound/soc/codecs/tas2781-fmwlib.c ++++ b/sound/soc/codecs/tas2781-fmwlib.c +@@ -2219,11 +2219,11 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no, + goto out; + } + +- conf = &(tas_fmw->configs[cfg_no]); + for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { + if (cfg_info[rca_conf_no]->active_dev & (1 << i)) { +- if (tas_priv->tasdevice[i].cur_prog != prm_no +- || tas_priv->force_fwload_status) { ++ if (prm_no >= 0 ++ && (tas_priv->tasdevice[i].cur_prog != prm_no ++ || tas_priv->force_fwload_status)) { + tas_priv->tasdevice[i].cur_conf = -1; + tas_priv->tasdevice[i].is_loading = true; + prog_status++; +@@ -2258,7 +2258,8 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no, + } + + for (i = 0, status = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].cur_conf != cfg_no ++ if (cfg_no >= 0 ++ && tas_priv->tasdevice[i].cur_conf != cfg_no + && (cfg_info[rca_conf_no]->active_dev & (1 << i)) + && (tas_priv->tasdevice[i].is_loaderr == false)) { + status++; +@@ -2268,6 +2269,7 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no, + } + + if (status) { ++ conf = &(tas_fmw->configs[cfg_no]); + status = 0; + tasdevice_load_data(tas_priv, &(conf->dev_data)); + for (i = 0; i < tas_priv->ndev; i++) { +@@ -2311,7 +2313,7 @@ int tasdevice_prmg_load(void *context, int prm_no) + } + + for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].cur_prog != prm_no) { ++ if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) { + tas_priv->tasdevice[i].cur_conf = -1; + tas_priv->tasdevice[i].is_loading = true; + prog_status++; +@@ -2356,7 +2358,7 @@ int tasdevice_prmg_calibdata_load(void *context, int prm_no) + } + + for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].cur_prog != prm_no) { ++ if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) { + tas_priv->tasdevice[i].cur_conf = -1; + tas_priv->tasdevice[i].is_loading = true; + prog_status++; +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 3252eefc4bc0e..3d202398c5411 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -715,6 +715,9 @@ static int fsl_sai_hw_free(struct snd_pcm_substream *substream, + bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; + unsigned int ofs = sai->soc_data->reg_offset; + ++ /* Clear xMR to avoid channel swap with mclk_with_tere enabled case */ ++ regmap_write(sai->regmap, FSL_SAI_xMR(tx), 0); ++ + regmap_update_bits(sai->regmap, FSL_SAI_xCR3(tx, ofs), + FSL_SAI_CR3_TRCE_MASK, 0); + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index ab2b938502ebe..07cc6a201579a 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1387,7 +1387,7 @@ free_buf: + + static int snd_usb_motu_m_series_boot_quirk(struct usb_device *dev) + { +- msleep(2000); ++ msleep(4000); + + return 0; + } +@@ -1630,7 +1630,7 @@ int snd_usb_apply_boot_quirk_once(struct usb_device *dev, + unsigned int id) + { + switch (id) { +- case USB_ID(0x07fd, 0x0008): /* MOTU M Series */ ++ case USB_ID(0x07fd, 0x0008): /* MOTU M Series, 1st hardware version */ + return snd_usb_motu_m_series_boot_quirk(dev); + } + +diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh +index 8eec7d2c1fc69..4632a954c73e6 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -2773,7 +2773,7 @@ backup_tests() + fi + + if reset "mpc backup" && +- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then ++ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then + pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup + speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 +@@ -2782,7 +2782,7 @@ backup_tests() + fi + + if reset "mpc backup both sides" && +- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then ++ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then + pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow,backup + pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup + speed=slow \ +@@ -2792,7 +2792,7 @@ backup_tests() + fi + + if reset "mpc switch to backup" && +- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then ++ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then + pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow + sflags=backup speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 +@@ -2801,7 +2801,7 @@ backup_tests() + fi + + if reset "mpc switch to backup both sides" && +- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then ++ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then + pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow + pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow + sflags=backup speed=slow \