diff options
author | Mike Pagano <mpagano@gentoo.org> | 2022-10-24 07:04:43 -0400 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2022-10-24 07:04:43 -0400 |
commit | 890a9a856fcbbd48ed12143fd8c4fbac094f8fa9 (patch) | |
tree | 4bd230b5633f42f84391c4b8b0bef72d8a407377 | |
parent | Linuxpatch 5.19.16 (diff) | |
download | linux-patches-890a9a856fcbbd48ed12143fd8c4fbac094f8fa9.tar.gz linux-patches-890a9a856fcbbd48ed12143fd8c4fbac094f8fa9.tar.bz2 linux-patches-890a9a856fcbbd48ed12143fd8c4fbac094f8fa9.zip |
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1016_linux-5.19.17.patch | 27445 |
2 files changed, 27449 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 256c6e52..7b85fc87 100644 --- a/0000_README +++ b/0000_README @@ -107,6 +107,10 @@ Patch: 1015_linux-5.19.16.patch From: http://www.kernel.org Desc: Linux 5.19.16 +Patch: 1016_linux-5.19.17.patch +From: http://www.kernel.org +Desc: Linux 5.19.17 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1016_linux-5.19.17.patch b/1016_linux-5.19.17.patch new file mode 100644 index 00000000..af478d28 --- /dev/null +++ b/1016_linux-5.19.17.patch @@ -0,0 +1,27445 @@ +diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio +index d4ccc68fdcf05..b19ff517e5d65 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -188,7 +188,7 @@ Description: + Raw capacitance measurement from channel Y. Units after + application of scale and offset are nanofarads. + +-What: /sys/.../iio:deviceX/in_capacitanceY-in_capacitanceZ_raw ++What: /sys/.../iio:deviceX/in_capacitanceY-capacitanceZ_raw + KernelVersion: 3.2 + Contact: linux-iio@vger.kernel.org + Description: +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 1b38d0f70677e..5ef5d727ca343 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -3765,6 +3765,10 @@ + + nox2apic [X86-64,APIC] Do not enable x2APIC mode. + ++ NOTE: this parameter will be ignored on systems with the ++ LEGACY_XAPIC_DISABLED bit set in the ++ IA32_XAPIC_DISABLE_STATUS MSR. ++ + nps_mtm_hs_ctr= [KNL,ARC] + This parameter sets the maximum duration, in + cycles, each HW thread of the CTOP can run +diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst +index fda97b3fcf018..b8ae278a4c873 100644 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@ -76,6 +76,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A55 | #1530923 | ARM64_ERRATUM_1530923 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A55 | #2441007 | ARM64_ERRATUM_2441007 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A57 | #832075 | ARM64_ERRATUM_832075 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A57 | #852523 | N/A | +diff --git a/Documentation/filesystems/vfs.rst b/Documentation/filesystems/vfs.rst +index 08069ecd49a6e..743f6a63f1ca9 100644 +--- a/Documentation/filesystems/vfs.rst ++++ b/Documentation/filesystems/vfs.rst +@@ -274,6 +274,9 @@ or bottom half). + This is specifically for the inode itself being marked dirty, + not its data. If the update needs to be persisted by fdatasync(), + then I_DIRTY_DATASYNC will be set in the flags argument. ++ I_DIRTY_TIME will be set in the flags in case lazytime is enabled ++ and struct inode has times updated since the last ->dirty_inode ++ call. + + ``write_inode`` + this method is called when the VFS needs to write an inode to +diff --git a/Makefile b/Makefile +index a1d1978bbd039..2113ad46488a7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 19 +-SUBLEVEL = 16 ++SUBLEVEL = 17 + EXTRAVERSION = + NAME = Superb Owl + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 7630ba9cb6ccc..ccc4706484d32 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1653,7 +1653,6 @@ config CMDLINE + choice + prompt "Kernel command line type" if CMDLINE != "" + default CMDLINE_FROM_BOOTLOADER +- depends on ATAGS + + config CMDLINE_FROM_BOOTLOADER + bool "Use bootloader kernel arguments if available" +diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c +index cb2e069dc73fd..abfed1aa2baa8 100644 +--- a/arch/arm/boot/compressed/misc.c ++++ b/arch/arm/boot/compressed/misc.c +@@ -23,7 +23,9 @@ unsigned int __machine_arch_type; + #include <linux/types.h> + #include <linux/linkage.h> + #include "misc.h" ++#ifdef CONFIG_ARCH_EP93XX + #include "misc-ep93xx.h" ++#endif + + static void putstr(const char *ptr); + +diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S +index 1bcb68ac4b011..3fcb3e62dc569 100644 +--- a/arch/arm/boot/compressed/vmlinux.lds.S ++++ b/arch/arm/boot/compressed/vmlinux.lds.S +@@ -23,6 +23,7 @@ SECTIONS + *(.ARM.extab*) + *(.note.*) + *(.rel.*) ++ *(.printk_index) + /* + * Discard any r/w data - this produces a link error if we have any, + * which is required for PIC decompression. Local data generates +@@ -57,6 +58,7 @@ SECTIONS + *(.rodata) + *(.rodata.*) + *(.data.rel.ro) ++ *(.data.rel.ro.*) + } + .piggydata : { + *(.piggydata) +diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts +index f4878df39753e..487dece2033cd 100644 +--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts ++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts +@@ -478,7 +478,7 @@ + marvell,function = "spi0"; + }; + +- spi0cs1_pins: spi0cs1-pins { ++ spi0cs2_pins: spi0cs2-pins { + marvell,pins = "mpp26"; + marvell,function = "spi0"; + }; +@@ -513,7 +513,7 @@ + }; + }; + +- /* MISO, MOSI, SCLK and CS1 are routed to pin header CN11 */ ++ /* MISO, MOSI, SCLK and CS2 are routed to pin header CN11 */ + }; + + &uart0 { +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index 23f50c9be5273..6ca9108b76333 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -585,7 +585,7 @@ + clocks = <&camera 1>; + clock-names = "extclk"; + samsung,camclk-out = <1>; +- gpios = <&gpm1 6 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpm1 6 GPIO_ACTIVE_LOW>; + + port { + is_s5k6a3_ep: endpoint { +diff --git a/arch/arm/boot/dts/exynos4412-origen.dts b/arch/arm/boot/dts/exynos4412-origen.dts +index 6db09dba07ffd..a3905e27b9cd9 100644 +--- a/arch/arm/boot/dts/exynos4412-origen.dts ++++ b/arch/arm/boot/dts/exynos4412-origen.dts +@@ -95,7 +95,7 @@ + }; + + &ehci { +- samsung,vbus-gpio = <&gpx3 5 1>; ++ samsung,vbus-gpio = <&gpx3 5 GPIO_ACTIVE_HIGH>; + status = "okay"; + phys = <&exynos_usbphy 2>, <&exynos_usbphy 3>; + phy-names = "hsic0", "hsic1"; +diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts +index e7d9bfbfd0e4d..e7be05f205d32 100644 +--- a/arch/arm/boot/dts/imx6dl-riotboard.dts ++++ b/arch/arm/boot/dts/imx6dl-riotboard.dts +@@ -90,6 +90,7 @@ + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii-id"; + phy-handle = <&rgmii_phy>; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi +index fdd81fdc3f357..cd3183c36488a 100644 +--- a/arch/arm/boot/dts/imx6dl.dtsi ++++ b/arch/arm/boot/dts/imx6dl.dtsi +@@ -84,6 +84,9 @@ + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6QDL_CLK_OCRAM>; + }; + +diff --git a/arch/arm/boot/dts/imx6q-arm2.dts b/arch/arm/boot/dts/imx6q-arm2.dts +index 0b40f52268b3c..75586299d9cab 100644 +--- a/arch/arm/boot/dts/imx6q-arm2.dts ++++ b/arch/arm/boot/dts/imx6q-arm2.dts +@@ -178,6 +178,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6q-evi.dts b/arch/arm/boot/dts/imx6q-evi.dts +index c63f371ede8b9..78d941fef5dfb 100644 +--- a/arch/arm/boot/dts/imx6q-evi.dts ++++ b/arch/arm/boot/dts/imx6q-evi.dts +@@ -146,6 +146,7 @@ + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; + phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6q-mccmon6.dts b/arch/arm/boot/dts/imx6q-mccmon6.dts +index 55692c73943d6..64ab01018b71e 100644 +--- a/arch/arm/boot/dts/imx6q-mccmon6.dts ++++ b/arch/arm/boot/dts/imx6q-mccmon6.dts +@@ -100,6 +100,7 @@ + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; + phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi +index 9caba4529c718..a8069e0a8fe82 100644 +--- a/arch/arm/boot/dts/imx6q.dtsi ++++ b/arch/arm/boot/dts/imx6q.dtsi +@@ -163,6 +163,9 @@ + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x40000>; ++ ranges = <0 0x00900000 0x40000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6QDL_CLK_OCRAM>; + }; + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 6b791d515e294..683f6e58ab230 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -263,6 +263,10 @@ + phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + }; + ++&hdmi { ++ ddc-i2c-bus = <&i2c2>; ++}; ++ + &i2c_intern { + pmic@8 { + compatible = "fsl,pfuze100"; +@@ -387,7 +391,7 @@ + + /* HDMI_CTRL */ + &i2c2 { +- clock-frequency = <375000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + }; +diff --git a/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi b/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi +index 0ad4cb4f1e828..a53a5d0766a51 100644 +--- a/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi +@@ -192,6 +192,7 @@ + phy-mode = "rgmii"; + phy-handle = <ðphy>; + phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi +index beaa2dcd436ce..57c21a01f126d 100644 +--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi +@@ -334,6 +334,7 @@ + phy-mode = "rgmii"; + phy-handle = <ðphy>; + phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi +index ee7e2371f94bd..000e9dc97b1ac 100644 +--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi +@@ -263,6 +263,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi +index 904d5d051d63c..731759bdd7f57 100644 +--- a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi +@@ -267,6 +267,7 @@ + phy-mode = "rgmii"; + phy-handle = <ðphy>; + phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi +index 1368a47620372..3dbb460ef102e 100644 +--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi +@@ -295,6 +295,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii-id"; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qdl-tqma6a.dtsi b/arch/arm/boot/dts/imx6qdl-tqma6a.dtsi +index 7dc3f0005b0f0..0a36e1bce375d 100644 +--- a/arch/arm/boot/dts/imx6qdl-tqma6a.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-tqma6a.dtsi +@@ -7,6 +7,7 @@ + #include <dt-bindings/gpio/gpio.h> + + &fec { ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi +index d6ba4b2a60f6f..c096d25a6f5b5 100644 +--- a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi +@@ -192,6 +192,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; ++ /delete-property/ interrupts; + interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, + <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; + fsl,err006687-workaround-present; +diff --git a/arch/arm/boot/dts/imx6qp.dtsi b/arch/arm/boot/dts/imx6qp.dtsi +index 0503655138363..fc164991d2ae8 100644 +--- a/arch/arm/boot/dts/imx6qp.dtsi ++++ b/arch/arm/boot/dts/imx6qp.dtsi +@@ -9,12 +9,18 @@ + ocram2: sram@940000 { + compatible = "mmio-sram"; + reg = <0x00940000 0x20000>; ++ ranges = <0 0x00940000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6QDL_CLK_OCRAM>; + }; + + ocram3: sram@960000 { + compatible = "mmio-sram"; + reg = <0x00960000 0x20000>; ++ ranges = <0 0x00960000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6QDL_CLK_OCRAM>; + }; + +diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi +index 06a515121dfc5..01122ddfdc0d3 100644 +--- a/arch/arm/boot/dts/imx6sl.dtsi ++++ b/arch/arm/boot/dts/imx6sl.dtsi +@@ -61,10 +61,10 @@ + <792000 1175000>, + <396000 975000>; + fsl,soc-operating-points = +- /* ARM kHz SOC-PU uV */ +- <996000 1225000>, +- <792000 1175000>, +- <396000 1175000>; ++ /* ARM kHz SOC-PU uV */ ++ <996000 1225000>, ++ <792000 1175000>, ++ <396000 1175000>; + clock-latency = <61036>; /* two CLK32 periods */ + #cooling-cells = <2>; + clocks = <&clks IMX6SL_CLK_ARM>, <&clks IMX6SL_CLK_PLL2_PFD2>, +@@ -115,6 +115,9 @@ + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6SL_CLK_OCRAM>; + }; + +@@ -222,7 +225,7 @@ + + uart5: serial@2018000 { + compatible = "fsl,imx6sl-uart", +- "fsl,imx6q-uart", "fsl,imx21-uart"; ++ "fsl,imx6q-uart", "fsl,imx21-uart"; + reg = <0x02018000 0x4000>; + interrupts = <0 30 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6SL_CLK_UART>, +@@ -235,7 +238,7 @@ + + uart1: serial@2020000 { + compatible = "fsl,imx6sl-uart", +- "fsl,imx6q-uart", "fsl,imx21-uart"; ++ "fsl,imx6q-uart", "fsl,imx21-uart"; + reg = <0x02020000 0x4000>; + interrupts = <0 26 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6SL_CLK_UART>, +@@ -248,7 +251,7 @@ + + uart2: serial@2024000 { + compatible = "fsl,imx6sl-uart", +- "fsl,imx6q-uart", "fsl,imx21-uart"; ++ "fsl,imx6q-uart", "fsl,imx21-uart"; + reg = <0x02024000 0x4000>; + interrupts = <0 27 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6SL_CLK_UART>, +@@ -309,7 +312,7 @@ + + uart3: serial@2034000 { + compatible = "fsl,imx6sl-uart", +- "fsl,imx6q-uart", "fsl,imx21-uart"; ++ "fsl,imx6q-uart", "fsl,imx21-uart"; + reg = <0x02034000 0x4000>; + interrupts = <0 28 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6SL_CLK_UART>, +@@ -322,7 +325,7 @@ + + uart4: serial@2038000 { + compatible = "fsl,imx6sl-uart", +- "fsl,imx6q-uart", "fsl,imx21-uart"; ++ "fsl,imx6q-uart", "fsl,imx21-uart"; + reg = <0x02038000 0x4000>; + interrupts = <0 29 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6SL_CLK_UART>, +@@ -711,7 +714,7 @@ + #power-domain-cells = <0>; + power-supply = <®_pu>; + clocks = <&clks IMX6SL_CLK_GPU2D_OVG>, +- <&clks IMX6SL_CLK_GPU2D_PODF>; ++ <&clks IMX6SL_CLK_GPU2D_PODF>; + }; + + pd_disp: power-domain@2 { +diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi +index d4a000c3dde70..2873369a57c02 100644 +--- a/arch/arm/boot/dts/imx6sll.dtsi ++++ b/arch/arm/boot/dts/imx6sll.dtsi +@@ -115,6 +115,9 @@ + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + }; + + intc: interrupt-controller@a01000 { +diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi +index 35861bbea94e6..c84ea1fac5e98 100644 +--- a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi ++++ b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi +@@ -226,7 +226,7 @@ + &iomuxc { + pinctrl_bt_reg: btreggrp { + fsl,pins = +- <MX6SX_PAD_KEY_ROW2__GPIO2_IO_17 0x15059>; ++ <MX6SX_PAD_KEY_ROW2__GPIO2_IO_17 0x15059>; + }; + + pinctrl_enet1: enet1grp { +@@ -306,7 +306,6 @@ + >; + }; + +- + pinctrl_uart1: uart1grp { + fsl,pins = + <MX6SX_PAD_GPIO1_IO04__UART1_DCE_TX 0x1b0b1>, +@@ -347,24 +346,23 @@ + + pinctrl_otg1_reg: otg1grp { + fsl,pins = +- <MX6SX_PAD_GPIO1_IO09__GPIO1_IO_9 0x10b0>; ++ <MX6SX_PAD_GPIO1_IO09__GPIO1_IO_9 0x10b0>; + }; + +- + pinctrl_otg2_reg: otg2grp { + fsl,pins = +- <MX6SX_PAD_NAND_RE_B__GPIO4_IO_12 0x10b0>; ++ <MX6SX_PAD_NAND_RE_B__GPIO4_IO_12 0x10b0>; + }; + + pinctrl_usb_otg1: usbotg1grp { + fsl,pins = +- <MX6SX_PAD_GPIO1_IO10__ANATOP_OTG1_ID 0x17059>, +- <MX6SX_PAD_GPIO1_IO08__USB_OTG1_OC 0x10b0>; ++ <MX6SX_PAD_GPIO1_IO10__ANATOP_OTG1_ID 0x17059>, ++ <MX6SX_PAD_GPIO1_IO08__USB_OTG1_OC 0x10b0>; + }; + + pinctrl_usb_otg2: usbot2ggrp { + fsl,pins = +- <MX6SX_PAD_QSPI1A_DATA0__USB_OTG2_OC 0x10b0>; ++ <MX6SX_PAD_QSPI1A_DATA0__USB_OTG2_OC 0x10b0>; + }; + + pinctrl_usdhc2: usdhc2grp { +diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi +index fc6334336b3d0..719c61f7e9140 100644 +--- a/arch/arm/boot/dts/imx6sx.dtsi ++++ b/arch/arm/boot/dts/imx6sx.dtsi +@@ -164,12 +164,18 @@ + ocram_s: sram@8f8000 { + compatible = "mmio-sram"; + reg = <0x008f8000 0x4000>; ++ ranges = <0 0x008f8000 0x4000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6SX_CLK_OCRAM_S>; + }; + + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + clocks = <&clks IMX6SX_CLK_OCRAM>; + }; + +diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts +index f053f51227417..0fe0a2f5e433f 100644 +--- a/arch/arm/boot/dts/imx7d-sdb.dts ++++ b/arch/arm/boot/dts/imx7d-sdb.dts +@@ -206,12 +206,7 @@ + interrupt-parent = <&gpio2>; + interrupts = <29 0>; + pendown-gpio = <&gpio2 29 GPIO_ACTIVE_HIGH>; +- ti,x-min = /bits/ 16 <0>; +- ti,x-max = /bits/ 16 <0>; +- ti,y-min = /bits/ 16 <0>; +- ti,y-max = /bits/ 16 <0>; +- ti,pressure-max = /bits/ 16 <0>; +- ti,x-plate-ohms = /bits/ 16 <400>; ++ touchscreen-max-pressure = <255>; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/kirkwood-lsxl.dtsi b/arch/arm/boot/dts/kirkwood-lsxl.dtsi +index 7b151acb99846..88b70ba1c8fee 100644 +--- a/arch/arm/boot/dts/kirkwood-lsxl.dtsi ++++ b/arch/arm/boot/dts/kirkwood-lsxl.dtsi +@@ -10,6 +10,11 @@ + + ocp@f1000000 { + pinctrl: pin-controller@10000 { ++ /* Non-default UART pins */ ++ pmx_uart0: pmx-uart0 { ++ marvell,pins = "mpp4", "mpp5"; ++ }; ++ + pmx_power_hdd: pmx-power-hdd { + marvell,pins = "mpp10"; + marvell,function = "gpo"; +@@ -213,22 +218,11 @@ + &mdio { + status = "okay"; + +- ethphy0: ethernet-phy@0 { +- reg = <0>; +- }; +- + ethphy1: ethernet-phy@8 { + reg = <8>; + }; + }; + +-ð0 { +- status = "okay"; +- ethernet0-port@0 { +- phy-handle = <ðphy0>; +- }; +-}; +- + ð1 { + status = "okay"; + ethernet1-port@0 { +diff --git a/arch/arm/include/asm/stacktrace.h b/arch/arm/include/asm/stacktrace.h +index 3e78f921b8b2d..39be2d1aa27b8 100644 +--- a/arch/arm/include/asm/stacktrace.h ++++ b/arch/arm/include/asm/stacktrace.h +@@ -21,6 +21,9 @@ struct stackframe { + struct llist_node *kr_cur; + struct task_struct *tsk; + #endif ++#ifdef CONFIG_UNWINDER_FRAME_POINTER ++ bool ex_frame; ++#endif + }; + + static __always_inline +@@ -34,6 +37,9 @@ void arm_get_current_stackframe(struct pt_regs *regs, struct stackframe *frame) + frame->kr_cur = NULL; + frame->tsk = current; + #endif ++#ifdef CONFIG_UNWINDER_FRAME_POINTER ++ frame->ex_frame = in_entry_text(frame->pc); ++#endif + } + + extern int unwind_frame(struct stackframe *frame); +diff --git a/arch/arm/kernel/return_address.c b/arch/arm/kernel/return_address.c +index 8aac1e10b117a..38f1ea9c724d5 100644 +--- a/arch/arm/kernel/return_address.c ++++ b/arch/arm/kernel/return_address.c +@@ -47,6 +47,7 @@ here: + frame.kr_cur = NULL; + frame.tsk = current; + #endif ++ frame.ex_frame = false; + + walk_stackframe(&frame, save_return_addr, &data); + +diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c +index d0fa2037460ac..85443b5d19221 100644 +--- a/arch/arm/kernel/stacktrace.c ++++ b/arch/arm/kernel/stacktrace.c +@@ -9,6 +9,8 @@ + #include <asm/stacktrace.h> + #include <asm/traps.h> + ++#include "reboot.h" ++ + #if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) + /* + * Unwind the current stack frame and store the new register values in the +@@ -39,29 +41,74 @@ + * Note that with framepointer enabled, even the leaf functions have the same + * prologue and epilogue, therefore we can ignore the LR value in this case. + */ +-int notrace unwind_frame(struct stackframe *frame) ++ ++extern unsigned long call_with_stack_end; ++ ++static int frame_pointer_check(struct stackframe *frame) + { + unsigned long high, low; + unsigned long fp = frame->fp; ++ unsigned long pc = frame->pc; ++ ++ /* ++ * call_with_stack() is the only place we allow SP to jump from one ++ * stack to another, with FP and SP pointing to different stacks, ++ * skipping the FP boundary check at this point. ++ */ ++ if (pc >= (unsigned long)&call_with_stack && ++ pc < (unsigned long)&call_with_stack_end) ++ return 0; + + /* only go to a higher address on the stack */ + low = frame->sp; + high = ALIGN(low, THREAD_SIZE); + +-#ifdef CONFIG_CC_IS_CLANG + /* check current frame pointer is within bounds */ ++#ifdef CONFIG_CC_IS_CLANG + if (fp < low + 4 || fp > high - 4) + return -EINVAL; +- +- frame->sp = frame->fp; +- frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp)); +- frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4)); + #else +- /* check current frame pointer is within bounds */ + if (fp < low + 12 || fp > high - 4) + return -EINVAL; ++#endif ++ ++ return 0; ++} ++ ++int notrace unwind_frame(struct stackframe *frame) ++{ ++ unsigned long fp = frame->fp; ++ ++ if (frame_pointer_check(frame)) ++ return -EINVAL; ++ ++ /* ++ * When we unwind through an exception stack, include the saved PC ++ * value into the stack trace. ++ */ ++ if (frame->ex_frame) { ++ struct pt_regs *regs = (struct pt_regs *)frame->sp; ++ ++ /* ++ * We check that 'regs + sizeof(struct pt_regs)' (that is, ++ * ®s[1]) does not exceed the bottom of the stack to avoid ++ * accessing data outside the task's stack. This may happen ++ * when frame->ex_frame is a false positive. ++ */ ++ if ((unsigned long)®s[1] > ALIGN(frame->sp, THREAD_SIZE)) ++ return -EINVAL; ++ ++ frame->pc = regs->ARM_pc; ++ frame->ex_frame = false; ++ return 0; ++ } + + /* restore the registers from the stack frame */ ++#ifdef CONFIG_CC_IS_CLANG ++ frame->sp = frame->fp; ++ frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp)); ++ frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4)); ++#else + frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 12)); + frame->sp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 8)); + frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 4)); +@@ -72,6 +119,9 @@ int notrace unwind_frame(struct stackframe *frame) + (void *)frame->fp, &frame->kr_cur); + #endif + ++ if (in_entry_text(frame->pc)) ++ frame->ex_frame = true; ++ + return 0; + } + #endif +@@ -102,7 +152,6 @@ static int save_trace(struct stackframe *frame, void *d) + { + struct stack_trace_data *data = d; + struct stack_trace *trace = data->trace; +- struct pt_regs *regs; + unsigned long addr = frame->pc; + + if (data->no_sched_functions && in_sched_functions(addr)) +@@ -113,19 +162,6 @@ static int save_trace(struct stackframe *frame, void *d) + } + + trace->entries[trace->nr_entries++] = addr; +- +- if (trace->nr_entries >= trace->max_entries) +- return 1; +- +- if (!in_entry_text(frame->pc)) +- return 0; +- +- regs = (struct pt_regs *)frame->sp; +- if ((unsigned long)®s[1] > ALIGN(frame->sp, THREAD_SIZE)) +- return 0; +- +- trace->entries[trace->nr_entries++] = regs->ARM_pc; +- + return trace->nr_entries >= trace->max_entries; + } + +@@ -167,6 +203,9 @@ here: + frame.kr_cur = NULL; + frame.tsk = tsk; + #endif ++#ifdef CONFIG_UNWINDER_FRAME_POINTER ++ frame.ex_frame = false; ++#endif + + walk_stackframe(&frame, save_trace, &data); + } +@@ -188,6 +227,9 @@ void save_stack_trace_regs(struct pt_regs *regs, struct stack_trace *trace) + frame.kr_cur = NULL; + frame.tsk = current; + #endif ++#ifdef CONFIG_UNWINDER_FRAME_POINTER ++ frame.ex_frame = in_entry_text(frame.pc); ++#endif + + walk_stackframe(&frame, save_trace, &data); + } +diff --git a/arch/arm/lib/call_with_stack.S b/arch/arm/lib/call_with_stack.S +index 0a268a6c513c8..5030d4e8d1267 100644 +--- a/arch/arm/lib/call_with_stack.S ++++ b/arch/arm/lib/call_with_stack.S +@@ -46,4 +46,6 @@ UNWIND( .setfp fpreg, sp ) + pop {fpreg, pc} + UNWIND( .fnend ) + #endif ++ .globl call_with_stack_end ++call_with_stack_end: + ENDPROC(call_with_stack) +diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c +index fb688003d156e..712da6a81b23f 100644 +--- a/arch/arm/mm/dump.c ++++ b/arch/arm/mm/dump.c +@@ -346,7 +346,7 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start) + addr = start + i * PMD_SIZE; + domain = get_domain_name(pmd); + if (pmd_none(*pmd) || pmd_large(*pmd) || !pmd_present(*pmd)) +- note_page(st, addr, 3, pmd_val(*pmd), domain); ++ note_page(st, addr, 4, pmd_val(*pmd), domain); + else + walk_pte(st, pmd, addr, domain); + +diff --git a/arch/arm/mm/kasan_init.c b/arch/arm/mm/kasan_init.c +index 5ad0d6c56d56e..29d7233e5ad2e 100644 +--- a/arch/arm/mm/kasan_init.c ++++ b/arch/arm/mm/kasan_init.c +@@ -264,12 +264,17 @@ void __init kasan_init(void) + + /* + * 1. The module global variables are in MODULES_VADDR ~ MODULES_END, +- * so we need to map this area. ++ * so we need to map this area if CONFIG_KASAN_VMALLOC=n. With ++ * VMALLOC support KASAN will manage this region dynamically, ++ * refer to kasan_populate_vmalloc() and ARM's implementation of ++ * module_alloc(). + * 2. PKMAP_BASE ~ PKMAP_BASE+PMD_SIZE's shadow and MODULES_VADDR + * ~ MODULES_END's shadow is in the same PMD_SIZE, so we can't + * use kasan_populate_zero_shadow. + */ +- create_mapping((void *)MODULES_VADDR, (void *)(PKMAP_BASE + PMD_SIZE)); ++ if (!IS_ENABLED(CONFIG_KASAN_VMALLOC) && IS_ENABLED(CONFIG_MODULES)) ++ create_mapping((void *)MODULES_VADDR, (void *)(MODULES_END)); ++ create_mapping((void *)PKMAP_BASE, (void *)(PKMAP_BASE + PMD_SIZE)); + + /* + * KAsan may reuse the contents of kasan_early_shadow_pte directly, so +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index cd17e324aa51e..83a91e0ab8480 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -300,7 +300,11 @@ static struct mem_type mem_types[] __ro_after_init = { + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY | + L_PTE_XN | L_PTE_RDONLY, + .prot_l1 = PMD_TYPE_TABLE, ++#ifdef CONFIG_ARM_LPAE ++ .prot_sect = PMD_TYPE_SECT | L_PMD_SECT_RDONLY | PMD_SECT_AP2, ++#else + .prot_sect = PMD_TYPE_SECT, ++#endif + .domain = DOMAIN_KERNEL, + }, + [MT_ROM] = { +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index cc1e7bb49d38b..dfd9228c2adce 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -629,6 +629,23 @@ config ARM64_ERRATUM_1530923 + config ARM64_WORKAROUND_REPEAT_TLBI + bool + ++config ARM64_ERRATUM_2441007 ++ bool "Cortex-A55: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" ++ default y ++ select ARM64_WORKAROUND_REPEAT_TLBI ++ help ++ This option adds a workaround for ARM Cortex-A55 erratum #2441007. ++ ++ Under very rare circumstances, affected Cortex-A55 CPUs ++ may not handle a race between a break-before-make sequence on one ++ CPU, and another CPU accessing the same page. This could allow a ++ store to a page that has been unmapped. ++ ++ Work around this by adding the affected CPUs to the list that needs ++ TLB sequences to be done twice. ++ ++ If unsure, say Y. ++ + config ARM64_ERRATUM_1286807 + bool "Cortex-A76: Modification of the translation table for a virtual address might lead to read-after-read ordering violation" + default y +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts +index 23be1ec538ba6..c54536c0a2ba1 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts +@@ -321,6 +321,7 @@ + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d0 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d0 + MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 + >; + }; + +@@ -333,6 +334,7 @@ + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4 + MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 + >; + }; + +@@ -345,6 +347,7 @@ + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d6 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d6 + MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 + >; + }; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +index 8f90eb02550d8..6307af803429e 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +@@ -86,7 +86,6 @@ + pinctrl-0 = <&pinctrl_pmic>; + interrupt-parent = <&gpio1>; + interrupts = <0 IRQ_TYPE_LEVEL_LOW>; +- sd-vsel-gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; + + regulators { + reg_vdd_soc: BUCK1 { +@@ -229,7 +228,6 @@ + pinctrl_pmic: pmicgrp { + fsl,pins = < + MX8MM_IOMUXC_GPIO1_IO00_GPIO1_IO0 0x141 +- MX8MM_IOMUXC_GPIO1_IO04_GPIO1_IO4 0x141 + >; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 410d0d5e6f1e5..7faf2d71ba4f8 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -1168,7 +1168,7 @@ + interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>; + phys = <&usb3_phy0>, <&usb3_phy0>; + phy-names = "usb2-phy", "usb3-phy"; +- snps,dis-u2-freeclk-exists-quirk; ++ snps,gfladj-refclk-lpm-sel-quirk; + }; + + }; +@@ -1210,7 +1210,7 @@ + interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>; + phys = <&usb3_phy1>, <&usb3_phy1>; + phy-names = "usb2-phy", "usb3-phy"; +- snps,dis-u2-freeclk-exists-quirk; ++ snps,gfladj-refclk-lpm-sel-quirk; + }; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi +index 587e55aaa57bb..11f56138c5331 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi +@@ -1077,6 +1077,7 @@ + interrupts = <20 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_gauge>; ++ power-supplies = <&bq25895>; + maxim,over-heat-temp = <700>; + maxim,over-volt = <4500>; + maxim,rsns-microohm = <5000>; +diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts +index 7713e8060c5b6..de2d10e0315af 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts +@@ -536,42 +536,42 @@ + reg = <ADC5_XO_THERM_100K_PU>; + label = "xo_therm"; + qcom,ratiometric; +- qcom,hw-settle-time-us = <200>; ++ qcom,hw-settle-time = <200>; + }; + + adc-chan@4d { + reg = <ADC5_AMUX_THM1_100K_PU>; + label = "msm_therm"; + qcom,ratiometric; +- qcom,hw-settle-time-us = <200>; ++ qcom,hw-settle-time = <200>; + }; + + adc-chan@4f { + reg = <ADC5_AMUX_THM3_100K_PU>; + label = "pa_therm1"; + qcom,ratiometric; +- qcom,hw-settle-time-us = <200>; ++ qcom,hw-settle-time = <200>; + }; + + adc-chan@51 { + reg = <ADC5_AMUX_THM5_100K_PU>; + label = "quiet_therm"; + qcom,ratiometric; +- qcom,hw-settle-time-us = <200>; ++ qcom,hw-settle-time = <200>; + }; + + adc-chan@83 { + reg = <ADC5_VPH_PWR>; + label = "vph_pwr"; + qcom,ratiometric; +- qcom,hw-settle-time-us = <200>; ++ qcom,hw-settle-time = <200>; + }; + + adc-chan@85 { + reg = <ADC5_VCOIN>; + label = "vcoin"; + qcom,ratiometric; +- qcom,hw-settle-time-us = <200>; ++ qcom,hw-settle-time = <200>; + }; + }; + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g043.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043.dtsi +index b31fb713ae4d7..434ae73664a23 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g043.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g043.dtsi +@@ -334,8 +334,8 @@ + compatible = "renesas,r9a07g043-sci", "renesas,sci"; + reg = <0 0x1004d000 0 0x400>; + interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 406 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 407 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "eri", "rxi", "txi", "tei"; + clocks = <&cpg CPG_MOD R9A07G043_SCI0_CLKP>; +@@ -349,8 +349,8 @@ + compatible = "renesas,r9a07g043-sci", "renesas,sci"; + reg = <0 0x1004d400 0 0x400>; + interrupts = <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "eri", "rxi", "txi", "tei"; + clocks = <&cpg CPG_MOD R9A07G043_SCI1_CLKP>; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +index 3652e511160fb..265140b20dadd 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +@@ -394,8 +394,8 @@ + compatible = "renesas,r9a07g044-sci", "renesas,sci"; + reg = <0 0x1004d000 0 0x400>; + interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 406 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 407 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "eri", "rxi", "txi", "tei"; + clocks = <&cpg CPG_MOD R9A07G044_SCI0_CLKP>; +@@ -409,8 +409,8 @@ + compatible = "renesas,r9a07g044-sci", "renesas,sci"; + reg = <0 0x1004d400 0 0x400>; + interrupts = <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "eri", "rxi", "txi", "tei"; + clocks = <&cpg CPG_MOD R9A07G044_SCI1_CLKP>; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +index 4d6b9d7684c94..d0eeca4f6aa1b 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +@@ -399,8 +399,8 @@ + compatible = "renesas,r9a07g054-sci", "renesas,sci"; + reg = <0 0x1004d000 0 0x400>; + interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 406 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 407 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "eri", "rxi", "txi", "tei"; + clocks = <&cpg CPG_MOD R9A07G054_SCI0_CLKP>; +@@ -414,8 +414,8 @@ + compatible = "renesas,r9a07g054-sci", "renesas,sci"; + reg = <0 0x1004d400 0 0x400>; + interrupts = <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "eri", "rxi", "txi", "tei"; + clocks = <&cpg CPG_MOD R9A07G054_SCI1_CLKP>; +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index 121975dc82397..7e8552fd2b6ae 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -134,15 +134,17 @@ + >; + }; + +- main_usbss0_pins_default: main-usbss0-pins-default { ++ vdd_sd_dv_pins_default: vdd-sd-dv-pins-default { + pinctrl-single,pins = < +- J721E_IOPAD(0x120, PIN_OUTPUT, 0) /* (T4) USB0_DRVVBUS */ ++ J721E_IOPAD(0xd0, PIN_OUTPUT, 7) /* (T5) SPI0_D1.GPIO0_55 */ + >; + }; ++}; + +- vdd_sd_dv_pins_default: vdd-sd-dv-pins-default { ++&main_pmx1 { ++ main_usbss0_pins_default: main-usbss0-pins-default { + pinctrl-single,pins = < +- J721E_IOPAD(0xd0, PIN_OUTPUT, 7) /* (T5) SPI0_D1.GPIO0_55 */ ++ J721E_IOPAD(0x04, PIN_OUTPUT, 0) /* (T4) USB0_DRVVBUS */ + >; + }; + }; +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi +index 16684a2f054d9..e12a53f1857f8 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi +@@ -295,7 +295,16 @@ + main_pmx0: pinctrl@11c000 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ +- reg = <0x00 0x11c000 0x00 0x2b4>; ++ reg = <0x00 0x11c000 0x00 0x10c>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ main_pmx1: pinctrl@11c11c { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x11c11c 0x00 0xc>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; +diff --git a/arch/arm64/include/asm/mte.h b/arch/arm64/include/asm/mte.h +index aa523591a44e5..760c62f8e22f8 100644 +--- a/arch/arm64/include/asm/mte.h ++++ b/arch/arm64/include/asm/mte.h +@@ -42,7 +42,9 @@ void mte_sync_tags(pte_t old_pte, pte_t pte); + void mte_copy_page_tags(void *kto, const void *kfrom); + void mte_thread_init_user(void); + void mte_thread_switch(struct task_struct *next); ++void mte_cpu_setup(void); + void mte_suspend_enter(void); ++void mte_suspend_exit(void); + long set_mte_ctrl(struct task_struct *task, unsigned long arg); + long get_mte_ctrl(struct task_struct *task); + int mte_ptrace_copy_tags(struct task_struct *child, long request, +@@ -72,6 +74,9 @@ static inline void mte_thread_switch(struct task_struct *next) + static inline void mte_suspend_enter(void) + { + } ++static inline void mte_suspend_exit(void) ++{ ++} + static inline long set_mte_ctrl(struct task_struct *task, unsigned long arg) + { + return 0; +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index af137f91607da..9b7440d97a32e 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -214,6 +214,11 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { + ERRATA_MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xe), + }, + #endif ++#ifdef CONFIG_ARM64_ERRATUM_2441007 ++ { ++ ERRATA_MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), ++ }, ++#endif + #ifdef CONFIG_ARM64_ERRATUM_2441009 + { + /* Cortex-A510 r0p0 -> r1p1. Fixed in r1p2 */ +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index f34c9f8b9ee0a..6f29e12fcfd5f 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -1962,7 +1962,8 @@ static void bti_enable(const struct arm64_cpu_capabilities *__unused) + static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) + { + sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_ATA | SCTLR_EL1_ATA0); +- isb(); ++ ++ mte_cpu_setup(); + + /* + * Clear the tags in the zero page. This needs to be done via the +diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c +index ea5dc7c90f465..b49ba9a24bcc8 100644 +--- a/arch/arm64/kernel/ftrace.c ++++ b/arch/arm64/kernel/ftrace.c +@@ -217,11 +217,26 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, + unsigned long pc = rec->ip; + u32 old = 0, new; + ++ new = aarch64_insn_gen_nop(); ++ ++ /* ++ * When using mcount, callsites in modules may have been initalized to ++ * call an arbitrary module PLT (which redirects to the _mcount stub) ++ * rather than the ftrace PLT we'll use at runtime (which redirects to ++ * the ftrace trampoline). We can ignore the old PLT when initializing ++ * the callsite. ++ * ++ * Note: 'mod' is only set at module load time. ++ */ ++ if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_REGS) && ++ IS_ENABLED(CONFIG_ARM64_MODULE_PLTS) && mod) { ++ return aarch64_insn_patch_text_nosync((void *)pc, new); ++ } ++ + if (!ftrace_find_callable_addr(rec, mod, &addr)) + return -EINVAL; + + old = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); +- new = aarch64_insn_gen_nop(); + + return ftrace_modify_code(pc, old, new, true); + } +diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c +index f6b00743c3994..54fed9a7f3cca 100644 +--- a/arch/arm64/kernel/mte.c ++++ b/arch/arm64/kernel/mte.c +@@ -294,6 +294,49 @@ void mte_thread_switch(struct task_struct *next) + mte_check_tfsr_el1(); + } + ++void mte_cpu_setup(void) ++{ ++ u64 rgsr; ++ ++ /* ++ * CnP must be enabled only after the MAIR_EL1 register has been set ++ * up. Inconsistent MAIR_EL1 between CPUs sharing the same TLB may ++ * lead to the wrong memory type being used for a brief window during ++ * CPU power-up. ++ * ++ * CnP is not a boot feature so MTE gets enabled before CnP, but let's ++ * make sure that is the case. ++ */ ++ BUG_ON(read_sysreg(ttbr0_el1) & TTBR_CNP_BIT); ++ BUG_ON(read_sysreg(ttbr1_el1) & TTBR_CNP_BIT); ++ ++ /* Normal Tagged memory type at the corresponding MAIR index */ ++ sysreg_clear_set(mair_el1, ++ MAIR_ATTRIDX(MAIR_ATTR_MASK, MT_NORMAL_TAGGED), ++ MAIR_ATTRIDX(MAIR_ATTR_NORMAL_TAGGED, ++ MT_NORMAL_TAGGED)); ++ ++ write_sysreg_s(KERNEL_GCR_EL1, SYS_GCR_EL1); ++ ++ /* ++ * If GCR_EL1.RRND=1 is implemented the same way as RRND=0, then ++ * RGSR_EL1.SEED must be non-zero for IRG to produce ++ * pseudorandom numbers. As RGSR_EL1 is UNKNOWN out of reset, we ++ * must initialize it. ++ */ ++ rgsr = (read_sysreg(CNTVCT_EL0) & SYS_RGSR_EL1_SEED_MASK) << ++ SYS_RGSR_EL1_SEED_SHIFT; ++ if (rgsr == 0) ++ rgsr = 1 << SYS_RGSR_EL1_SEED_SHIFT; ++ write_sysreg_s(rgsr, SYS_RGSR_EL1); ++ ++ /* clear any pending tag check faults in TFSR*_EL1 */ ++ write_sysreg_s(0, SYS_TFSR_EL1); ++ write_sysreg_s(0, SYS_TFSRE0_EL1); ++ ++ local_flush_tlb_all(); ++} ++ + void mte_suspend_enter(void) + { + if (!system_supports_mte()) +@@ -310,6 +353,14 @@ void mte_suspend_enter(void) + mte_check_tfsr_el1(); + } + ++void mte_suspend_exit(void) ++{ ++ if (!system_supports_mte()) ++ return; ++ ++ mte_cpu_setup(); ++} ++ + long set_mte_ctrl(struct task_struct *task, unsigned long arg) + { + u64 mte_ctrl = (~((arg & PR_MTE_TAG_MASK) >> PR_MTE_TAG_SHIFT) & +diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c +index 2b0887e58a7c4..033cd080af680 100644 +--- a/arch/arm64/kernel/suspend.c ++++ b/arch/arm64/kernel/suspend.c +@@ -43,6 +43,8 @@ void notrace __cpu_suspend_exit(void) + { + unsigned int cpu = smp_processor_id(); + ++ mte_suspend_exit(); ++ + /* + * We are resuming from reset with the idmap active in TTBR0_EL1. + * We must uninstall the idmap and restore the expected MMU +diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c +index d4abb948eb14e..ea650f2b0e2e0 100644 +--- a/arch/arm64/kernel/topology.c ++++ b/arch/arm64/kernel/topology.c +@@ -22,46 +22,6 @@ + #include <asm/cputype.h> + #include <asm/topology.h> + +-void store_cpu_topology(unsigned int cpuid) +-{ +- struct cpu_topology *cpuid_topo = &cpu_topology[cpuid]; +- u64 mpidr; +- +- if (cpuid_topo->package_id != -1) +- goto topology_populated; +- +- mpidr = read_cpuid_mpidr(); +- +- /* Uniprocessor systems can rely on default topology values */ +- if (mpidr & MPIDR_UP_BITMASK) +- return; +- +- /* +- * This would be the place to create cpu topology based on MPIDR. +- * +- * However, it cannot be trusted to depict the actual topology; some +- * pieces of the architecture enforce an artificial cap on Aff0 values +- * (e.g. GICv3's ICC_SGI1R_EL1 limits it to 15), leading to an +- * artificial cycling of Aff1, Aff2 and Aff3 values. IOW, these end up +- * having absolutely no relationship to the actual underlying system +- * topology, and cannot be reasonably used as core / package ID. +- * +- * If the MT bit is set, Aff0 *could* be used to define a thread ID, but +- * we still wouldn't be able to obtain a sane core ID. This means we +- * need to entirely ignore MPIDR for any topology deduction. +- */ +- cpuid_topo->thread_id = -1; +- cpuid_topo->core_id = cpuid; +- cpuid_topo->package_id = cpu_to_node(cpuid); +- +- pr_debug("CPU%u: cluster %d core %d thread %d mpidr %#016llx\n", +- cpuid, cpuid_topo->package_id, cpuid_topo->core_id, +- cpuid_topo->thread_id, mpidr); +- +-topology_populated: +- update_siblings_masks(cpuid); +-} +- + #ifdef CONFIG_ACPI + static bool __init acpi_cpu_is_threaded(int cpu) + { +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index 50bbed947bec7..1a9684b114745 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -47,17 +47,19 @@ + + #ifdef CONFIG_KASAN_HW_TAGS + #define TCR_MTE_FLAGS TCR_TCMA1 | TCR_TBI1 | TCR_TBID1 +-#else ++#elif defined(CONFIG_ARM64_MTE) + /* + * The mte_zero_clear_page_tags() implementation uses DC GZVA, which relies on + * TBI being enabled at EL1. + */ + #define TCR_MTE_FLAGS TCR_TBI1 | TCR_TBID1 ++#else ++#define TCR_MTE_FLAGS 0 + #endif + + /* + * Default MAIR_EL1. MT_NORMAL_TAGGED is initially mapped as Normal memory and +- * changed during __cpu_setup to Normal Tagged if the system supports MTE. ++ * changed during mte_cpu_setup to Normal Tagged if the system supports MTE. + */ + #define MAIR_EL1_SET \ + (MAIR_ATTRIDX(MAIR_ATTR_DEVICE_nGnRnE, MT_DEVICE_nGnRnE) | \ +@@ -421,46 +423,8 @@ SYM_FUNC_START(__cpu_setup) + mov_q mair, MAIR_EL1_SET + mov_q tcr, TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \ + TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \ +- TCR_TBI0 | TCR_A1 | TCR_KASAN_SW_FLAGS +- +-#ifdef CONFIG_ARM64_MTE +- /* +- * Update MAIR_EL1, GCR_EL1 and TFSR*_EL1 if MTE is supported +- * (ID_AA64PFR1_EL1[11:8] > 1). +- */ +- mrs x10, ID_AA64PFR1_EL1 +- ubfx x10, x10, #ID_AA64PFR1_MTE_SHIFT, #4 +- cmp x10, #ID_AA64PFR1_MTE +- b.lt 1f +- +- /* Normal Tagged memory type at the corresponding MAIR index */ +- mov x10, #MAIR_ATTR_NORMAL_TAGGED +- bfi mair, x10, #(8 * MT_NORMAL_TAGGED), #8 ++ TCR_TBI0 | TCR_A1 | TCR_KASAN_SW_FLAGS | TCR_MTE_FLAGS + +- mov x10, #KERNEL_GCR_EL1 +- msr_s SYS_GCR_EL1, x10 +- +- /* +- * If GCR_EL1.RRND=1 is implemented the same way as RRND=0, then +- * RGSR_EL1.SEED must be non-zero for IRG to produce +- * pseudorandom numbers. As RGSR_EL1 is UNKNOWN out of reset, we +- * must initialize it. +- */ +- mrs x10, CNTVCT_EL0 +- ands x10, x10, #SYS_RGSR_EL1_SEED_MASK +- csinc x10, x10, xzr, ne +- lsl x10, x10, #SYS_RGSR_EL1_SEED_SHIFT +- msr_s SYS_RGSR_EL1, x10 +- +- /* clear any pending tag check faults in TFSR*_EL1 */ +- msr_s SYS_TFSR_EL1, xzr +- msr_s SYS_TFSRE0_EL1, xzr +- +- /* set the TCR_EL1 bits */ +- mov_q x10, TCR_MTE_FLAGS +- orr tcr, tcr, x10 +-1: +-#endif + tcr_clear_errata_bits tcr, x9, x5 + + #ifdef CONFIG_ARM64_VA_BITS_52 +diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c +index d6579ec3ea324..4c7b1f50e3b7d 100644 +--- a/arch/ia64/mm/numa.c ++++ b/arch/ia64/mm/numa.c +@@ -75,5 +75,6 @@ int memory_add_physaddr_to_nid(u64 addr) + return 0; + return nid; + } ++EXPORT_SYMBOL(memory_add_physaddr_to_nid); + #endif + #endif +diff --git a/arch/mips/bcm47xx/prom.c b/arch/mips/bcm47xx/prom.c +index 0a63721d0fbf3..5a33d6b48d779 100644 +--- a/arch/mips/bcm47xx/prom.c ++++ b/arch/mips/bcm47xx/prom.c +@@ -86,7 +86,7 @@ static __init void prom_init_mem(void) + pr_debug("Assume 128MB RAM\n"); + break; + } +- if (!memcmp(prom_init, prom_init + mem, 32)) ++ if (!memcmp((void *)prom_init, (void *)prom_init + mem, 32)) + break; + } + lowmem = mem; +@@ -159,7 +159,7 @@ void __init bcm47xx_prom_highmem_init(void) + + off = EXTVBASE + __pa(off); + for (extmem = 128 << 20; extmem < 512 << 20; extmem <<= 1) { +- if (!memcmp(prom_init, (void *)(off + extmem), 16)) ++ if (!memcmp((void *)prom_init, (void *)(off + extmem), 16)) + break; + } + extmem -= lowmem; +diff --git a/arch/mips/boot/dts/ralink/mt7621-gnubee-gb-pc2.dts b/arch/mips/boot/dts/ralink/mt7621-gnubee-gb-pc2.dts +index a6201a119a1f2..5bdc63187e77f 100644 +--- a/arch/mips/boot/dts/ralink/mt7621-gnubee-gb-pc2.dts ++++ b/arch/mips/boot/dts/ralink/mt7621-gnubee-gb-pc2.dts +@@ -83,12 +83,12 @@ + + &gmac1 { + status = "okay"; +- phy-handle = <ðphy7>; ++ phy-handle = <ðphy5>; + }; + + &mdio { +- ethphy7: ethernet-phy@7 { +- reg = <7>; ++ ethphy5: ethernet-phy@5 { ++ reg = <5>; + phy-mode = "rgmii-rxid"; + }; + }; +diff --git a/arch/mips/sgi-ip27/ip27-xtalk.c b/arch/mips/sgi-ip27/ip27-xtalk.c +index e762886d1dda9..5143d1cf8984c 100644 +--- a/arch/mips/sgi-ip27/ip27-xtalk.c ++++ b/arch/mips/sgi-ip27/ip27-xtalk.c +@@ -27,15 +27,18 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) + { + struct xtalk_bridge_platform_data *bd; + struct sgi_w1_platform_data *wd; +- struct platform_device *pdev; ++ struct platform_device *pdev_wd; ++ struct platform_device *pdev_bd; + struct resource w1_res; + unsigned long offset; + + offset = NODE_OFFSET(nasid); + + wd = kzalloc(sizeof(*wd), GFP_KERNEL); +- if (!wd) +- goto no_mem; ++ if (!wd) { ++ pr_warn("xtalk:n%d/%x bridge create out of memory\n", nasid, widget); ++ return; ++ } + + snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx", + offset + (widget << SWIN_SIZE_BITS)); +@@ -46,24 +49,35 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) + w1_res.end = w1_res.start + 3; + w1_res.flags = IORESOURCE_MEM; + +- pdev = platform_device_alloc("sgi_w1", PLATFORM_DEVID_AUTO); +- if (!pdev) { +- kfree(wd); +- goto no_mem; ++ pdev_wd = platform_device_alloc("sgi_w1", PLATFORM_DEVID_AUTO); ++ if (!pdev_wd) { ++ pr_warn("xtalk:n%d/%x bridge create out of memory\n", nasid, widget); ++ goto err_kfree_wd; ++ } ++ if (platform_device_add_resources(pdev_wd, &w1_res, 1)) { ++ pr_warn("xtalk:n%d/%x bridge failed to add platform resources.\n", nasid, widget); ++ goto err_put_pdev_wd; ++ } ++ if (platform_device_add_data(pdev_wd, wd, sizeof(*wd))) { ++ pr_warn("xtalk:n%d/%x bridge failed to add platform data.\n", nasid, widget); ++ goto err_put_pdev_wd; ++ } ++ if (platform_device_add(pdev_wd)) { ++ pr_warn("xtalk:n%d/%x bridge failed to add platform device.\n", nasid, widget); ++ goto err_put_pdev_wd; + } +- platform_device_add_resources(pdev, &w1_res, 1); +- platform_device_add_data(pdev, wd, sizeof(*wd)); + /* platform_device_add_data() duplicates the data */ + kfree(wd); +- platform_device_add(pdev); + + bd = kzalloc(sizeof(*bd), GFP_KERNEL); +- if (!bd) +- goto no_mem; +- pdev = platform_device_alloc("xtalk-bridge", PLATFORM_DEVID_AUTO); +- if (!pdev) { +- kfree(bd); +- goto no_mem; ++ if (!bd) { ++ pr_warn("xtalk:n%d/%x bridge create out of memory\n", nasid, widget); ++ goto err_unregister_pdev_wd; ++ } ++ pdev_bd = platform_device_alloc("xtalk-bridge", PLATFORM_DEVID_AUTO); ++ if (!pdev_bd) { ++ pr_warn("xtalk:n%d/%x bridge create out of memory\n", nasid, widget); ++ goto err_kfree_bd; + } + + +@@ -84,15 +98,31 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) + bd->io.flags = IORESOURCE_IO; + bd->io_offset = offset; + +- platform_device_add_data(pdev, bd, sizeof(*bd)); ++ if (platform_device_add_data(pdev_bd, bd, sizeof(*bd))) { ++ pr_warn("xtalk:n%d/%x bridge failed to add platform data.\n", nasid, widget); ++ goto err_put_pdev_bd; ++ } ++ if (platform_device_add(pdev_bd)) { ++ pr_warn("xtalk:n%d/%x bridge failed to add platform device.\n", nasid, widget); ++ goto err_put_pdev_bd; ++ } + /* platform_device_add_data() duplicates the data */ + kfree(bd); +- platform_device_add(pdev); + pr_info("xtalk:n%d/%x bridge widget\n", nasid, widget); + return; + +-no_mem: +- pr_warn("xtalk:n%d/%x bridge create out of memory\n", nasid, widget); ++err_put_pdev_bd: ++ platform_device_put(pdev_bd); ++err_kfree_bd: ++ kfree(bd); ++err_unregister_pdev_wd: ++ platform_device_unregister(pdev_wd); ++ return; ++err_put_pdev_wd: ++ platform_device_put(pdev_wd); ++err_kfree_wd: ++ kfree(wd); ++ return; + } + + static int probe_one_port(nasid_t nasid, int widget, int masterwid) +diff --git a/arch/mips/sgi-ip30/ip30-xtalk.c b/arch/mips/sgi-ip30/ip30-xtalk.c +index 8129524421cb0..7ceb2b23ea1cf 100644 +--- a/arch/mips/sgi-ip30/ip30-xtalk.c ++++ b/arch/mips/sgi-ip30/ip30-xtalk.c +@@ -40,12 +40,15 @@ static void bridge_platform_create(int widget, int masterwid) + { + struct xtalk_bridge_platform_data *bd; + struct sgi_w1_platform_data *wd; +- struct platform_device *pdev; ++ struct platform_device *pdev_wd; ++ struct platform_device *pdev_bd; + struct resource w1_res; + + wd = kzalloc(sizeof(*wd), GFP_KERNEL); +- if (!wd) +- goto no_mem; ++ if (!wd) { ++ pr_warn("xtalk:%x bridge create out of memory\n", widget); ++ return; ++ } + + snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx", + IP30_SWIN_BASE(widget)); +@@ -56,24 +59,35 @@ static void bridge_platform_create(int widget, int masterwid) + w1_res.end = w1_res.start + 3; + w1_res.flags = IORESOURCE_MEM; + +- pdev = platform_device_alloc("sgi_w1", PLATFORM_DEVID_AUTO); +- if (!pdev) { +- kfree(wd); +- goto no_mem; ++ pdev_wd = platform_device_alloc("sgi_w1", PLATFORM_DEVID_AUTO); ++ if (!pdev_wd) { ++ pr_warn("xtalk:%x bridge create out of memory\n", widget); ++ goto err_kfree_wd; ++ } ++ if (platform_device_add_resources(pdev_wd, &w1_res, 1)) { ++ pr_warn("xtalk:%x bridge failed to add platform resources.\n", widget); ++ goto err_put_pdev_wd; ++ } ++ if (platform_device_add_data(pdev_wd, wd, sizeof(*wd))) { ++ pr_warn("xtalk:%x bridge failed to add platform data.\n", widget); ++ goto err_put_pdev_wd; ++ } ++ if (platform_device_add(pdev_wd)) { ++ pr_warn("xtalk:%x bridge failed to add platform device.\n", widget); ++ goto err_put_pdev_wd; + } +- platform_device_add_resources(pdev, &w1_res, 1); +- platform_device_add_data(pdev, wd, sizeof(*wd)); + /* platform_device_add_data() duplicates the data */ + kfree(wd); +- platform_device_add(pdev); + + bd = kzalloc(sizeof(*bd), GFP_KERNEL); +- if (!bd) +- goto no_mem; +- pdev = platform_device_alloc("xtalk-bridge", PLATFORM_DEVID_AUTO); +- if (!pdev) { +- kfree(bd); +- goto no_mem; ++ if (!bd) { ++ pr_warn("xtalk:%x bridge create out of memory\n", widget); ++ goto err_unregister_pdev_wd; ++ } ++ pdev_bd = platform_device_alloc("xtalk-bridge", PLATFORM_DEVID_AUTO); ++ if (!pdev_bd) { ++ pr_warn("xtalk:%x bridge create out of memory\n", widget); ++ goto err_kfree_bd; + } + + bd->bridge_addr = IP30_RAW_SWIN_BASE(widget); +@@ -93,15 +107,31 @@ static void bridge_platform_create(int widget, int masterwid) + bd->io.flags = IORESOURCE_IO; + bd->io_offset = IP30_SWIN_BASE(widget); + +- platform_device_add_data(pdev, bd, sizeof(*bd)); ++ if (platform_device_add_data(pdev_bd, bd, sizeof(*bd))) { ++ pr_warn("xtalk:%x bridge failed to add platform data.\n", widget); ++ goto err_put_pdev_bd; ++ } ++ if (platform_device_add(pdev_bd)) { ++ pr_warn("xtalk:%x bridge failed to add platform device.\n", widget); ++ goto err_put_pdev_bd; ++ } + /* platform_device_add_data() duplicates the data */ + kfree(bd); +- platform_device_add(pdev); + pr_info("xtalk:%x bridge widget\n", widget); + return; + +-no_mem: +- pr_warn("xtalk:%x bridge create out of memory\n", widget); ++err_put_pdev_bd: ++ platform_device_put(pdev_bd); ++err_kfree_bd: ++ kfree(bd); ++err_unregister_pdev_wd: ++ platform_device_unregister(pdev_wd); ++ return; ++err_put_pdev_wd: ++ platform_device_put(pdev_wd); ++err_kfree_wd: ++ kfree(wd); ++ return; + } + + static unsigned int __init xbow_widget_active(s8 wid) +diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h +index 69765a6dbe89d..4229ae96eb385 100644 +--- a/arch/parisc/include/asm/pgtable.h ++++ b/arch/parisc/include/asm/pgtable.h +@@ -192,6 +192,11 @@ extern void __update_cache(pte_t pte); + #define _PAGE_PRESENT_BIT 22 /* (0x200) Software: translation valid */ + #define _PAGE_HPAGE_BIT 21 /* (0x400) Software: Huge Page */ + #define _PAGE_USER_BIT 20 /* (0x800) Software: User accessible page */ ++#ifdef CONFIG_HUGETLB_PAGE ++#define _PAGE_SPECIAL_BIT _PAGE_DMB_BIT /* DMB feature is currently unused */ ++#else ++#define _PAGE_SPECIAL_BIT _PAGE_HPAGE_BIT /* use unused HUGE PAGE bit */ ++#endif + + /* N.B. The bits are defined in terms of a 32 bit word above, so the */ + /* following macro is ok for both 32 and 64 bit. */ +@@ -219,7 +224,7 @@ extern void __update_cache(pte_t pte); + #define _PAGE_PRESENT (1 << xlate_pabit(_PAGE_PRESENT_BIT)) + #define _PAGE_HUGE (1 << xlate_pabit(_PAGE_HPAGE_BIT)) + #define _PAGE_USER (1 << xlate_pabit(_PAGE_USER_BIT)) +-#define _PAGE_SPECIAL (_PAGE_DMB) ++#define _PAGE_SPECIAL (1 << xlate_pabit(_PAGE_SPECIAL_BIT)) + + #define _PAGE_TABLE (_PAGE_PRESENT | _PAGE_READ | _PAGE_WRITE | _PAGE_DIRTY | _PAGE_ACCESSED) + #define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_SPECIAL) +diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S +index df8102fb435fc..0e5ebfe8d9d29 100644 +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -499,6 +499,10 @@ + * Finally, _PAGE_READ goes in the top bit of PL1 (so we + * trigger an access rights trap in user space if the user + * tries to read an unreadable page */ ++#if _PAGE_SPECIAL_BIT == _PAGE_DMB_BIT ++ /* need to drop DMB bit, as it's used as SPECIAL flag */ ++ depi 0,_PAGE_SPECIAL_BIT,1,\pte ++#endif + depd \pte,8,7,\prot + + /* PAGE_USER indicates the page can be read with user privileges, +@@ -529,6 +533,10 @@ + * makes the tlb entry for the differently formatted pa11 + * insertion instructions */ + .macro make_insert_tlb_11 spc,pte,prot ++#if _PAGE_SPECIAL_BIT == _PAGE_DMB_BIT ++ /* need to drop DMB bit, as it's used as SPECIAL flag */ ++ depi 0,_PAGE_SPECIAL_BIT,1,\pte ++#endif + zdep \spc,30,15,\prot + dep \pte,8,7,\prot + extru,= \pte,_PAGE_NO_CACHE_BIT,1,%r0 +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 4d8f26c1399be..d9d9f84c480b8 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -817,7 +817,7 @@ config DATA_SHIFT + default 24 if STRICT_KERNEL_RWX && PPC64 + range 17 28 if (STRICT_KERNEL_RWX || DEBUG_PAGEALLOC || KFENCE) && PPC_BOOK3S_32 + range 19 23 if (STRICT_KERNEL_RWX || DEBUG_PAGEALLOC || KFENCE) && PPC_8xx +- range 20 24 if (STRICT_KERNEL_RWX || DEBUG_PAGEALLOC || KFENCE) && PPC_FSL_BOOKE ++ range 20 24 if (STRICT_KERNEL_RWX || DEBUG_PAGEALLOC || KFENCE) && FSL_BOOKE + default 22 if STRICT_KERNEL_RWX && PPC_BOOK3S_32 + default 18 if (DEBUG_PAGEALLOC || KFENCE) && PPC_BOOK3S_32 + default 23 if STRICT_KERNEL_RWX && PPC_8xx +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index d54e1fe035517..dbeba3e209c0a 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -152,7 +152,7 @@ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power8 + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power9,-mtune=power8) + else + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5)) +-CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4) ++CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power4 + endif + else ifdef CONFIG_PPC_BOOK3E_64 + CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64 +diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile +index a9cd2ea4a8617..d32d95aea5d6f 100644 +--- a/arch/powerpc/boot/Makefile ++++ b/arch/powerpc/boot/Makefile +@@ -34,6 +34,7 @@ endif + + BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ + -fno-strict-aliasing -O2 -msoft-float -mno-altivec -mno-vsx \ ++ $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \ + -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \ + $(LINUXINCLUDE) + +diff --git a/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi b/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi +new file mode 100644 +index 0000000000000..7e2a90cde72e5 +--- /dev/null ++++ b/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi +@@ -0,0 +1,51 @@ ++/* ++ * e500v1 Power ISA Device Tree Source (include) ++ * ++ * Copyright 2012 Freescale Semiconductor Inc. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions are met: ++ * * Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * * Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * * Neither the name of Freescale Semiconductor nor the ++ * names of its contributors may be used to endorse or promote products ++ * derived from this software without specific prior written permission. ++ * ++ * ++ * ALTERNATIVELY, this software may be distributed under the terms of the ++ * GNU General Public License ("GPL") as published by the Free Software ++ * Foundation, either version 2 of that License or (at your option) any ++ * later version. ++ * ++ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY ++ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED ++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ++ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY ++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT ++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS ++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ++ */ ++ ++/ { ++ cpus { ++ power-isa-version = "2.03"; ++ power-isa-b; // Base ++ power-isa-e; // Embedded ++ power-isa-atb; // Alternate Time Base ++ power-isa-cs; // Cache Specification ++ power-isa-e.le; // Embedded.Little-Endian ++ power-isa-e.pm; // Embedded.Performance Monitor ++ power-isa-ecl; // Embedded Cache Locking ++ power-isa-mmc; // Memory Coherence ++ power-isa-sp; // Signal Processing Engine ++ power-isa-sp.fs; // SPE.Embedded Float Scalar Single ++ power-isa-sp.fv; // SPE.Embedded Float Vector ++ mmu-type = "power-embedded"; ++ }; ++}; +diff --git a/arch/powerpc/boot/dts/fsl/mpc8540ads.dts b/arch/powerpc/boot/dts/fsl/mpc8540ads.dts +index 18a885130538a..e03ae130162ba 100644 +--- a/arch/powerpc/boot/dts/fsl/mpc8540ads.dts ++++ b/arch/powerpc/boot/dts/fsl/mpc8540ads.dts +@@ -7,7 +7,7 @@ + + /dts-v1/; + +-/include/ "e500v2_power_isa.dtsi" ++/include/ "e500v1_power_isa.dtsi" + + / { + model = "MPC8540ADS"; +diff --git a/arch/powerpc/boot/dts/fsl/mpc8541cds.dts b/arch/powerpc/boot/dts/fsl/mpc8541cds.dts +index ac381e7b1c60e..a2a6c5cf852e9 100644 +--- a/arch/powerpc/boot/dts/fsl/mpc8541cds.dts ++++ b/arch/powerpc/boot/dts/fsl/mpc8541cds.dts +@@ -7,7 +7,7 @@ + + /dts-v1/; + +-/include/ "e500v2_power_isa.dtsi" ++/include/ "e500v1_power_isa.dtsi" + + / { + model = "MPC8541CDS"; +diff --git a/arch/powerpc/boot/dts/fsl/mpc8555cds.dts b/arch/powerpc/boot/dts/fsl/mpc8555cds.dts +index 9f58db2a7e661..901b6ff06dfbb 100644 +--- a/arch/powerpc/boot/dts/fsl/mpc8555cds.dts ++++ b/arch/powerpc/boot/dts/fsl/mpc8555cds.dts +@@ -7,7 +7,7 @@ + + /dts-v1/; + +-/include/ "e500v2_power_isa.dtsi" ++/include/ "e500v1_power_isa.dtsi" + + / { + model = "MPC8555CDS"; +diff --git a/arch/powerpc/boot/dts/fsl/mpc8560ads.dts b/arch/powerpc/boot/dts/fsl/mpc8560ads.dts +index a24722ccaebf1..c2f9aea78b29f 100644 +--- a/arch/powerpc/boot/dts/fsl/mpc8560ads.dts ++++ b/arch/powerpc/boot/dts/fsl/mpc8560ads.dts +@@ -7,7 +7,7 @@ + + /dts-v1/; + +-/include/ "e500v2_power_isa.dtsi" ++/include/ "e500v1_power_isa.dtsi" + + / { + model = "MPC8560ADS"; +diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig +index b571d084c148b..c05e37af9f1e8 100644 +--- a/arch/powerpc/configs/pseries_defconfig ++++ b/arch/powerpc/configs/pseries_defconfig +@@ -40,6 +40,7 @@ CONFIG_PPC_SPLPAR=y + CONFIG_DTL=y + CONFIG_PPC_SMLPAR=y + CONFIG_IBMEBUS=y ++CONFIG_LIBNVDIMM=m + CONFIG_PAPR_SCM=m + CONFIG_PPC_SVM=y + # CONFIG_PPC_PMAC is not set +diff --git a/arch/powerpc/include/asm/syscalls.h b/arch/powerpc/include/asm/syscalls.h +index a2b13e55254fb..da40219b303a6 100644 +--- a/arch/powerpc/include/asm/syscalls.h ++++ b/arch/powerpc/include/asm/syscalls.h +@@ -8,6 +8,18 @@ + #include <linux/types.h> + #include <linux/compat.h> + ++/* ++ * long long munging: ++ * The 32 bit ABI passes long longs in an odd even register pair. ++ * High and low parts are swapped depending on endian mode, ++ * so define a macro (similar to mips linux32) to handle that. ++ */ ++#ifdef __LITTLE_ENDIAN__ ++#define merge_64(low, high) (((u64)high << 32) | low) ++#else ++#define merge_64(high, low) (((u64)high << 32) | low) ++#endif ++ + struct rtas_args; + + asmlinkage long sys_mmap(unsigned long addr, size_t len, +diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c +index 784ea3289c840..0b656b897f997 100644 +--- a/arch/powerpc/kernel/interrupt.c ++++ b/arch/powerpc/kernel/interrupt.c +@@ -592,16 +592,6 @@ again: + + if (unlikely(stack_store)) + __hard_EE_RI_disable(); +- /* +- * Returning to a kernel context with local irqs disabled. +- * Here, if EE was enabled in the interrupted context, enable +- * it on return as well. A problem exists here where a soft +- * masked interrupt may have cleared MSR[EE] and set HARD_DIS +- * here, and it will still exist on return to the caller. This +- * will be resolved by the masked interrupt firing again. +- */ +- if (regs->msr & MSR_EE) +- local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS; + #endif /* CONFIG_PPC64 */ + } + +diff --git a/arch/powerpc/kernel/interrupt_64.S b/arch/powerpc/kernel/interrupt_64.S +index ce25b28cf418e..2ca1c037ea258 100644 +--- a/arch/powerpc/kernel/interrupt_64.S ++++ b/arch/powerpc/kernel/interrupt_64.S +@@ -559,15 +559,54 @@ _ASM_NOKPROBE_SYMBOL(interrupt_return_\srr\()_kernel) + ld r11,SOFTE(r1) + cmpwi r11,IRQS_ENABLED + stb r11,PACAIRQSOFTMASK(r13) +- bne 1f ++ beq .Linterrupt_return_\srr\()_soft_enabled ++ ++ /* ++ * Returning to soft-disabled context. ++ * Check if a MUST_HARD_MASK interrupt has become pending, in which ++ * case we need to disable MSR[EE] in the return context. ++ */ ++ ld r12,_MSR(r1) ++ andi. r10,r12,MSR_EE ++ beq .Lfast_kernel_interrupt_return_\srr\() // EE already disabled ++ lbz r11,PACAIRQHAPPENED(r13) ++ andi. r10,r11,PACA_IRQ_MUST_HARD_MASK ++ beq .Lfast_kernel_interrupt_return_\srr\() // No HARD_MASK pending ++ ++ /* Must clear MSR_EE from _MSR */ ++#ifdef CONFIG_PPC_BOOK3S ++ li r10,0 ++ /* Clear valid before changing _MSR */ ++ .ifc \srr,srr ++ stb r10,PACASRR_VALID(r13) ++ .else ++ stb r10,PACAHSRR_VALID(r13) ++ .endif ++#endif ++ xori r12,r12,MSR_EE ++ std r12,_MSR(r1) ++ b .Lfast_kernel_interrupt_return_\srr\() ++ ++.Linterrupt_return_\srr\()_soft_enabled: ++ /* ++ * In the soft-enabled case, need to double-check that we have no ++ * pending interrupts that might have come in before we reached the ++ * restart section of code, and restart the exit so those can be ++ * handled. ++ * ++ * If there are none, it is be possible that the interrupt still ++ * has PACA_IRQ_HARD_DIS set, which needs to be cleared for the ++ * interrupted context. This clear will not clobber a new pending ++ * interrupt coming in, because we're in the restart section, so ++ * such would return to the restart location. ++ */ + #ifdef CONFIG_PPC_BOOK3S + lbz r11,PACAIRQHAPPENED(r13) + andi. r11,r11,(~PACA_IRQ_HARD_DIS)@l + bne- interrupt_return_\srr\()_kernel_restart + #endif + li r11,0 +- stb r11,PACAIRQHAPPENED(r13) # clear out possible HARD_DIS +-1: ++ stb r11,PACAIRQHAPPENED(r13) // clear the possible HARD_DIS + + .Lfast_kernel_interrupt_return_\srr\(): + cmpdi cr1,r3,0 +diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c +index 1c97c0f177aed..ed4f6b992f974 100644 +--- a/arch/powerpc/kernel/kprobes.c ++++ b/arch/powerpc/kernel/kprobes.c +@@ -161,7 +161,13 @@ int arch_prepare_kprobe(struct kprobe *p) + preempt_disable(); + prev = get_kprobe(p->addr - 1); + preempt_enable_no_resched(); +- if (prev && ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) { ++ ++ /* ++ * When prev is a ftrace-based kprobe, we don't have an insn, and it ++ * doesn't probe for prefixed instruction. ++ */ ++ if (prev && !kprobe_ftrace(prev) && ++ ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) { + printk("Cannot register a kprobe on the second word of prefixed instruction\n"); + ret = -EINVAL; + } +diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c +index 938ab8838ab54..aa221958007ef 100644 +--- a/arch/powerpc/kernel/pci_dn.c ++++ b/arch/powerpc/kernel/pci_dn.c +@@ -330,6 +330,7 @@ struct pci_dn *pci_add_device_node_info(struct pci_controller *hose, + INIT_LIST_HEAD(&pdn->list); + parent = of_get_parent(dn); + pdn->parent = parent ? PCI_DN(parent) : NULL; ++ of_node_put(parent); + if (pdn->parent) + list_add_tail(&pdn->list, &pdn->parent->child_list); + +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 5761f08dae958..6562517bcb3b7 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -183,8 +183,10 @@ static void __init fixup_boot_paca(void) + get_paca()->cpu_start = 1; + /* Allow percpu accesses to work until we setup percpu data */ + get_paca()->data_offset = 0; +- /* Mark interrupts disabled in PACA */ ++ /* Mark interrupts soft and hard disabled in PACA */ + irq_soft_mask_set(IRQS_DISABLED); ++ get_paca()->irq_happened = PACA_IRQ_HARD_DIS; ++ WARN_ON(mfmsr() & MSR_EE); + } + + static void __init configure_exceptions(void) +diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c +index 16ff0399a2574..719bfc6d1e3f5 100644 +--- a/arch/powerpc/kernel/sys_ppc32.c ++++ b/arch/powerpc/kernel/sys_ppc32.c +@@ -56,18 +56,6 @@ unsigned long compat_sys_mmap2(unsigned long addr, size_t len, + return sys_mmap(addr, len, prot, flags, fd, pgoff << 12); + } + +-/* +- * long long munging: +- * The 32 bit ABI passes long longs in an odd even register pair. +- * High and low parts are swapped depending on endian mode, +- * so define a macro (similar to mips linux32) to handle that. +- */ +-#ifdef __LITTLE_ENDIAN__ +-#define merge_64(low, high) ((u64)high << 32) | low +-#else +-#define merge_64(high, low) ((u64)high << 32) | low +-#endif +- + compat_ssize_t compat_sys_pread64(unsigned int fd, char __user *ubuf, compat_size_t count, + u32 reg6, u32 pos1, u32 pos2) + { +@@ -94,7 +82,7 @@ asmlinkage int compat_sys_truncate64(const char __user * path, u32 reg4, + asmlinkage long compat_sys_fallocate(int fd, int mode, u32 offset1, u32 offset2, + u32 len1, u32 len2) + { +- return ksys_fallocate(fd, mode, ((loff_t)offset1 << 32) | offset2, ++ return ksys_fallocate(fd, mode, merge_64(offset1, offset2), + merge_64(len1, len2)); + } + +diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c +index fc999140bc27e..abc3fbb3c4902 100644 +--- a/arch/powerpc/kernel/syscalls.c ++++ b/arch/powerpc/kernel/syscalls.c +@@ -98,8 +98,8 @@ long ppc64_personality(unsigned long personality) + long ppc_fadvise64_64(int fd, int advice, u32 offset_high, u32 offset_low, + u32 len_high, u32 len_low) + { +- return ksys_fadvise64_64(fd, (u64)offset_high << 32 | offset_low, +- (u64)len_high << 32 | len_low, advice); ++ return ksys_fadvise64_64(fd, merge_64(offset_high, offset_low), ++ merge_64(len_high, len_low), advice); + } + + SYSCALL_DEFINE0(switch_endian) +diff --git a/arch/powerpc/math-emu/math_efp.c b/arch/powerpc/math-emu/math_efp.c +index 39b84e7452e1b..aa3bb8da1cb9b 100644 +--- a/arch/powerpc/math-emu/math_efp.c ++++ b/arch/powerpc/math-emu/math_efp.c +@@ -17,6 +17,7 @@ + + #include <linux/types.h> + #include <linux/prctl.h> ++#include <linux/module.h> + + #include <linux/uaccess.h> + #include <asm/reg.h> +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index 55a8fbfdb5b28..3510b55b36f8c 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -892,6 +892,7 @@ static void opal_export_attrs(void) + kobj = kobject_create_and_add("exports", opal_kobj); + if (!kobj) { + pr_warn("kobject_create_and_add() of exports failed\n"); ++ of_node_put(np); + return; + } + +diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c +index 500a1fc4a1d7d..b2a32f8a837ac 100644 +--- a/arch/powerpc/platforms/pseries/vas.c ++++ b/arch/powerpc/platforms/pseries/vas.c +@@ -332,7 +332,7 @@ static struct vas_window *vas_allocate_window(int vas_id, u64 flags, + * So no unpacking needs to be done. + */ + rc = plpar_hcall9(H_HOME_NODE_ASSOCIATIVITY, domain, +- VPHN_FLAG_VCPU, smp_processor_id()); ++ VPHN_FLAG_VCPU, hard_smp_processor_id()); + if (rc != H_SUCCESS) { + pr_err("H_HOME_NODE_ASSOCIATIVITY error: %d\n", rc); + goto out; +diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c +index ef9a5999fa93d..73c2d70706c0a 100644 +--- a/arch/powerpc/sysdev/fsl_msi.c ++++ b/arch/powerpc/sysdev/fsl_msi.c +@@ -209,8 +209,10 @@ static int fsl_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type) + dev_err(&pdev->dev, + "node %pOF has an invalid fsl,msi phandle %u\n", + hose->dn, np->phandle); ++ of_node_put(np); + return -EINVAL; + } ++ of_node_put(np); + } + + msi_for_each_desc(entry, &pdev->dev, MSI_DESC_NOTASSOCIATED) { +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index 1f02f15569749..696279ce03c92 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -52,7 +52,7 @@ config RISCV + select COMMON_CLK + select CPU_PM if CPU_IDLE + select EDAC_SUPPORT +- select GENERIC_ARCH_TOPOLOGY if SMP ++ select GENERIC_ARCH_TOPOLOGY + select GENERIC_ATOMIC64 if !64BIT + select GENERIC_CLOCKEVENTS_BROADCAST if SMP + select GENERIC_EARLY_IOREMAP +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 81029d40a6727..ccd0e000bbefd 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -37,6 +37,7 @@ else + endif + + ifeq ($(CONFIG_LD_IS_LLD),y) ++ifeq ($(shell test $(CONFIG_LLD_VERSION) -lt 150000; echo $$?),0) + KBUILD_CFLAGS += -mno-relax + KBUILD_AFLAGS += -mno-relax + ifndef CONFIG_AS_IS_LLVM +@@ -44,6 +45,7 @@ ifndef CONFIG_AS_IS_LLVM + KBUILD_AFLAGS += -Wa,-mno-relax + endif + endif ++endif + + # ISA string setting + riscv-march-$(CONFIG_ARCH_RV32I) := rv32ima +diff --git a/arch/riscv/include/asm/io.h b/arch/riscv/include/asm/io.h +index 69605a4742706..92080a2279372 100644 +--- a/arch/riscv/include/asm/io.h ++++ b/arch/riscv/include/asm/io.h +@@ -101,9 +101,9 @@ __io_reads_ins(reads, u32, l, __io_br(), __io_ar(addr)) + __io_reads_ins(ins, u8, b, __io_pbr(), __io_par(addr)) + __io_reads_ins(ins, u16, w, __io_pbr(), __io_par(addr)) + __io_reads_ins(ins, u32, l, __io_pbr(), __io_par(addr)) +-#define insb(addr, buffer, count) __insb((void __iomem *)(long)addr, buffer, count) +-#define insw(addr, buffer, count) __insw((void __iomem *)(long)addr, buffer, count) +-#define insl(addr, buffer, count) __insl((void __iomem *)(long)addr, buffer, count) ++#define insb(addr, buffer, count) __insb(PCI_IOBASE + (addr), buffer, count) ++#define insw(addr, buffer, count) __insw(PCI_IOBASE + (addr), buffer, count) ++#define insl(addr, buffer, count) __insl(PCI_IOBASE + (addr), buffer, count) + + __io_writes_outs(writes, u8, b, __io_bw(), __io_aw()) + __io_writes_outs(writes, u16, w, __io_bw(), __io_aw()) +@@ -115,22 +115,22 @@ __io_writes_outs(writes, u32, l, __io_bw(), __io_aw()) + __io_writes_outs(outs, u8, b, __io_pbw(), __io_paw()) + __io_writes_outs(outs, u16, w, __io_pbw(), __io_paw()) + __io_writes_outs(outs, u32, l, __io_pbw(), __io_paw()) +-#define outsb(addr, buffer, count) __outsb((void __iomem *)(long)addr, buffer, count) +-#define outsw(addr, buffer, count) __outsw((void __iomem *)(long)addr, buffer, count) +-#define outsl(addr, buffer, count) __outsl((void __iomem *)(long)addr, buffer, count) ++#define outsb(addr, buffer, count) __outsb(PCI_IOBASE + (addr), buffer, count) ++#define outsw(addr, buffer, count) __outsw(PCI_IOBASE + (addr), buffer, count) ++#define outsl(addr, buffer, count) __outsl(PCI_IOBASE + (addr), buffer, count) + + #ifdef CONFIG_64BIT + __io_reads_ins(reads, u64, q, __io_br(), __io_ar(addr)) + #define readsq(addr, buffer, count) __readsq(addr, buffer, count) + + __io_reads_ins(ins, u64, q, __io_pbr(), __io_par(addr)) +-#define insq(addr, buffer, count) __insq((void __iomem *)addr, buffer, count) ++#define insq(addr, buffer, count) __insq(PCI_IOBASE + (addr), buffer, count) + + __io_writes_outs(writes, u64, q, __io_bw(), __io_aw()) + #define writesq(addr, buffer, count) __writesq(addr, buffer, count) + + __io_writes_outs(outs, u64, q, __io_pbr(), __io_paw()) +-#define outsq(addr, buffer, count) __outsq((void __iomem *)addr, buffer, count) ++#define outsq(addr, buffer, count) __outsq(PCI_IOBASE + (addr), buffer, count) + #endif + + #include <asm-generic/io.h> +diff --git a/arch/riscv/include/asm/mmu.h b/arch/riscv/include/asm/mmu.h +index cedcf8ea3c766..0099dc1161683 100644 +--- a/arch/riscv/include/asm/mmu.h ++++ b/arch/riscv/include/asm/mmu.h +@@ -16,7 +16,6 @@ typedef struct { + atomic_long_t id; + #endif + void *vdso; +- void *vdso_info; + #ifdef CONFIG_SMP + /* A local icache flush is needed before user execution can resume. */ + cpumask_t icache_stale_mask; +diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c +index f0f36a4a0e9b8..061cf8db3156a 100644 +--- a/arch/riscv/kernel/setup.c ++++ b/arch/riscv/kernel/setup.c +@@ -251,10 +251,10 @@ static void __init parse_dtb(void) + pr_info("Machine model: %s\n", name); + dump_stack_set_arch_desc("%s (DT)", name); + } +- return; ++ } else { ++ pr_err("No DTB passed to the kernel\n"); + } + +- pr_err("No DTB passed to the kernel\n"); + #ifdef CONFIG_CMDLINE_FORCE + strscpy(boot_command_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE); + pr_info("Forcing kernel command line to: %s\n", boot_command_line); +diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c +index f1e4948a4b525..b4d5524b10773 100644 +--- a/arch/riscv/kernel/smpboot.c ++++ b/arch/riscv/kernel/smpboot.c +@@ -49,6 +49,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) + unsigned int curr_cpuid; + + curr_cpuid = smp_processor_id(); ++ store_cpu_topology(curr_cpuid); + numa_store_cpu_info(curr_cpuid); + numa_add_cpu(curr_cpuid); + +@@ -161,9 +162,9 @@ asmlinkage __visible void smp_callin(void) + mmgrab(mm); + current->active_mm = mm; + ++ store_cpu_topology(curr_cpuid); + notify_cpu_starting(curr_cpuid); + numa_add_cpu(curr_cpuid); +- update_siblings_masks(curr_cpuid); + set_cpu_online(curr_cpuid, 1); + + /* +diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c +index 571556bb9261a..5d3f2fbeb33c7 100644 +--- a/arch/riscv/kernel/sys_riscv.c ++++ b/arch/riscv/kernel/sys_riscv.c +@@ -18,9 +18,6 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, + if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) + return -EINVAL; + +- if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) +- return -EINVAL; +- + return ksys_mmap_pgoff(addr, len, prot, flags, fd, + offset >> (PAGE_SHIFT - page_shift_offset)); + } +diff --git a/arch/riscv/kernel/vdso.c b/arch/riscv/kernel/vdso.c +index 69b05b6c181b6..4abc9aebdfae2 100644 +--- a/arch/riscv/kernel/vdso.c ++++ b/arch/riscv/kernel/vdso.c +@@ -60,6 +60,11 @@ struct __vdso_info { + struct vm_special_mapping *cm; + }; + ++static struct __vdso_info vdso_info; ++#ifdef CONFIG_COMPAT ++static struct __vdso_info compat_vdso_info; ++#endif ++ + static int vdso_mremap(const struct vm_special_mapping *sm, + struct vm_area_struct *new_vma) + { +@@ -114,15 +119,18 @@ int vdso_join_timens(struct task_struct *task, struct time_namespace *ns) + { + struct mm_struct *mm = task->mm; + struct vm_area_struct *vma; +- struct __vdso_info *vdso_info = mm->context.vdso_info; + + mmap_read_lock(mm); + + for (vma = mm->mmap; vma; vma = vma->vm_next) { + unsigned long size = vma->vm_end - vma->vm_start; + +- if (vma_is_special_mapping(vma, vdso_info->dm)) ++ if (vma_is_special_mapping(vma, vdso_info.dm)) + zap_page_range(vma, vma->vm_start, size); ++#ifdef CONFIG_COMPAT ++ if (vma_is_special_mapping(vma, compat_vdso_info.dm)) ++ zap_page_range(vma, vma->vm_start, size); ++#endif + } + + mmap_read_unlock(mm); +@@ -264,7 +272,6 @@ static int __setup_additional_pages(struct mm_struct *mm, + + vdso_base += VVAR_SIZE; + mm->context.vdso = (void *)vdso_base; +- mm->context.vdso_info = (void *)vdso_info; + + ret = + _install_special_mapping(mm, vdso_base, vdso_text_len, +diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c +index 40694f0cab9e5..849674086561c 100644 +--- a/arch/riscv/mm/fault.c ++++ b/arch/riscv/mm/fault.c +@@ -184,7 +184,8 @@ static inline bool access_error(unsigned long cause, struct vm_area_struct *vma) + } + break; + case EXC_LOAD_PAGE_FAULT: +- if (!(vma->vm_flags & VM_READ)) { ++ /* Write implies read */ ++ if (!(vma->vm_flags & (VM_READ | VM_WRITE))) { + return true; + } + break; +diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h +index 8edb824049b9e..0cb0ca149ac34 100644 +--- a/arch/sh/include/asm/sections.h ++++ b/arch/sh/include/asm/sections.h +@@ -4,7 +4,7 @@ + + #include <asm-generic/sections.h> + +-extern long __machvec_start, __machvec_end; ++extern char __machvec_start[], __machvec_end[]; + extern char __uncached_start, __uncached_end; + extern char __start_eh_frame[], __stop_eh_frame[]; + +diff --git a/arch/sh/kernel/machvec.c b/arch/sh/kernel/machvec.c +index d606679a211e1..57efaf5b82ae0 100644 +--- a/arch/sh/kernel/machvec.c ++++ b/arch/sh/kernel/machvec.c +@@ -20,8 +20,8 @@ + #define MV_NAME_SIZE 32 + + #define for_each_mv(mv) \ +- for ((mv) = (struct sh_machine_vector *)&__machvec_start; \ +- (mv) && (unsigned long)(mv) < (unsigned long)&__machvec_end; \ ++ for ((mv) = (struct sh_machine_vector *)__machvec_start; \ ++ (mv) && (unsigned long)(mv) < (unsigned long)__machvec_end; \ + (mv)++) + + static struct sh_machine_vector * __init get_mv_byname(const char *name) +@@ -87,8 +87,8 @@ void __init sh_mv_setup(void) + if (!machvec_selected) { + unsigned long machvec_size; + +- machvec_size = ((unsigned long)&__machvec_end - +- (unsigned long)&__machvec_start); ++ machvec_size = ((unsigned long)__machvec_end - ++ (unsigned long)__machvec_start); + + /* + * Sanity check for machvec section alignment. Ensure +@@ -102,7 +102,7 @@ void __init sh_mv_setup(void) + * vector (usually the only one) from .machvec.init. + */ + if (machvec_size >= sizeof(struct sh_machine_vector)) +- sh_mv = *(struct sh_machine_vector *)&__machvec_start; ++ sh_mv = *(struct sh_machine_vector *)__machvec_start; + } + + pr_notice("Booting machvec: %s\n", get_system_type()); +diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c +index d9e023c78f568..f6f126ac34804 100644 +--- a/arch/um/kernel/um_arch.c ++++ b/arch/um/kernel/um_arch.c +@@ -96,7 +96,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) + + static void *c_start(struct seq_file *m, loff_t *pos) + { +- return *pos < NR_CPUS ? cpu_data + *pos : NULL; ++ return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; + } + + static void *c_next(struct seq_file *m, void *v, loff_t *pos) +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 25e2b8b75e40c..1cccedfc2a486 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -450,6 +450,11 @@ config X86_X2APIC + This allows 32-bit apic IDs (so it can support very large systems), + and accesses the local apic via MSRs not via mmio. + ++ Some Intel systems circa 2022 and later are locked into x2APIC mode ++ and can not fall back to the legacy APIC modes if SGX or TDX are ++ enabled in the BIOS. They will be unable to boot without enabling ++ this option. ++ + If you don't know what to do here, say N. + + config X86_MPPARSE +@@ -1930,7 +1935,7 @@ endchoice + + config X86_SGX + bool "Software Guard eXtensions (SGX)" +- depends on X86_64 && CPU_SUP_INTEL ++ depends on X86_64 && CPU_SUP_INTEL && X86_X2APIC + depends on CRYPTO=y + depends on CRYPTO_SHA256=y + select SRCU +diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h +index 8cbf623f0ecfb..b472ef76826ad 100644 +--- a/arch/x86/include/asm/cpu.h ++++ b/arch/x86/include/asm/cpu.h +@@ -94,4 +94,6 @@ static inline bool intel_cpu_signatures_match(unsigned int s1, unsigned int p1, + return p1 & p2; + } + ++extern u64 x86_read_arch_cap_msr(void); ++ + #endif /* _ASM_X86_CPU_H */ +diff --git a/arch/x86/include/asm/hyperv-tlfs.h b/arch/x86/include/asm/hyperv-tlfs.h +index 0a9407dc08598..6f0acc45e67a7 100644 +--- a/arch/x86/include/asm/hyperv-tlfs.h ++++ b/arch/x86/include/asm/hyperv-tlfs.h +@@ -546,7 +546,7 @@ struct hv_enlightened_vmcs { + u64 guest_rip; + + u32 hv_clean_fields; +- u32 hv_padding_32; ++ u32 padding32_1; + u32 hv_synthetic_controls; + struct { + u32 nested_flush_hypercall:1; +@@ -554,7 +554,7 @@ struct hv_enlightened_vmcs { + u32 reserved:30; + } __packed hv_enlightenments_control; + u32 hv_vp_id; +- ++ u32 padding32_2; + u64 hv_vm_id; + u64 partition_assist_page; + u64 padding64_4[4]; +diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h +index 0c3d3440fe278..aa675783412f8 100644 +--- a/arch/x86/include/asm/microcode.h ++++ b/arch/x86/include/asm/microcode.h +@@ -9,6 +9,7 @@ + struct ucode_patch { + struct list_head plist; + void *data; /* Intel uses only this one */ ++ unsigned int size; + u32 patch_id; + u16 equiv_cpu; + }; +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index e057e039173cb..9267bfe3c33f1 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -155,6 +155,11 @@ + * Return Stack Buffer Predictions. + */ + ++#define ARCH_CAP_XAPIC_DISABLE BIT(21) /* ++ * IA32_XAPIC_DISABLE_STATUS MSR ++ * supported ++ */ ++ + #define MSR_IA32_FLUSH_CMD 0x0000010b + #define L1D_FLUSH BIT(0) /* + * Writeback and invalidate the +@@ -1046,4 +1051,12 @@ + #define MSR_IA32_HW_FEEDBACK_PTR 0x17d0 + #define MSR_IA32_HW_FEEDBACK_CONFIG 0x17d1 + ++/* x2APIC locked status */ ++#define MSR_IA32_XAPIC_DISABLE_STATUS 0xBD ++#define LEGACY_XAPIC_DISABLED BIT(0) /* ++ * x2APIC mode is locked and ++ * disabling x2APIC will cause ++ * a #GP ++ */ ++ + #endif /* _ASM_X86_MSR_INDEX_H */ +diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h +index 89df6c6617f50..bc2e1b67319d3 100644 +--- a/arch/x86/include/asm/paravirt_types.h ++++ b/arch/x86/include/asm/paravirt_types.h +@@ -414,8 +414,17 @@ int paravirt_disable_iospace(void); + "=c" (__ecx) + #define PVOP_CALL_CLOBBERS PVOP_VCALL_CLOBBERS, "=a" (__eax) + +-/* void functions are still allowed [re]ax for scratch */ ++/* ++ * void functions are still allowed [re]ax for scratch. ++ * ++ * The ZERO_CALL_USED REGS feature may end up zeroing out callee-saved ++ * registers. Make sure we model this with the appropriate clobbers. ++ */ ++#ifdef CONFIG_ZERO_CALL_USED_REGS ++#define PVOP_VCALLEE_CLOBBERS "=a" (__eax), PVOP_VCALL_CLOBBERS ++#else + #define PVOP_VCALLEE_CLOBBERS "=a" (__eax) ++#endif + #define PVOP_CALLEE_CLOBBERS PVOP_VCALLEE_CLOBBERS + + #define EXTRA_CLOBBERS , "r8", "r9", "r10", "r11" +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 189d3a5e471ad..665993b2e80d2 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -61,6 +61,7 @@ + #include <asm/cpu_device_id.h> + #include <asm/intel-family.h> + #include <asm/irq_regs.h> ++#include <asm/cpu.h> + + unsigned int num_processors; + +@@ -1756,11 +1757,26 @@ EXPORT_SYMBOL_GPL(x2apic_mode); + + enum { + X2APIC_OFF, +- X2APIC_ON, + X2APIC_DISABLED, ++ /* All states below here have X2APIC enabled */ ++ X2APIC_ON, ++ X2APIC_ON_LOCKED + }; + static int x2apic_state; + ++static bool x2apic_hw_locked(void) ++{ ++ u64 ia32_cap; ++ u64 msr; ++ ++ ia32_cap = x86_read_arch_cap_msr(); ++ if (ia32_cap & ARCH_CAP_XAPIC_DISABLE) { ++ rdmsrl(MSR_IA32_XAPIC_DISABLE_STATUS, msr); ++ return (msr & LEGACY_XAPIC_DISABLED); ++ } ++ return false; ++} ++ + static void __x2apic_disable(void) + { + u64 msr; +@@ -1798,6 +1814,10 @@ static int __init setup_nox2apic(char *str) + apicid); + return 0; + } ++ if (x2apic_hw_locked()) { ++ pr_warn("APIC locked in x2apic mode, can't disable\n"); ++ return 0; ++ } + pr_warn("x2apic already enabled.\n"); + __x2apic_disable(); + } +@@ -1812,10 +1832,18 @@ early_param("nox2apic", setup_nox2apic); + void x2apic_setup(void) + { + /* +- * If x2apic is not in ON state, disable it if already enabled ++ * Try to make the AP's APIC state match that of the BSP, but if the ++ * BSP is unlocked and the AP is locked then there is a state mismatch. ++ * Warn about the mismatch in case a GP fault occurs due to a locked AP ++ * trying to be turned off. ++ */ ++ if (x2apic_state != X2APIC_ON_LOCKED && x2apic_hw_locked()) ++ pr_warn("x2apic lock mismatch between BSP and AP.\n"); ++ /* ++ * If x2apic is not in ON or LOCKED state, disable it if already enabled + * from BIOS. + */ +- if (x2apic_state != X2APIC_ON) { ++ if (x2apic_state < X2APIC_ON) { + __x2apic_disable(); + return; + } +@@ -1836,6 +1864,11 @@ static __init void x2apic_disable(void) + if (x2apic_id >= 255) + panic("Cannot disable x2apic, id: %08x\n", x2apic_id); + ++ if (x2apic_hw_locked()) { ++ pr_warn("Cannot disable locked x2apic, id: %08x\n", x2apic_id); ++ return; ++ } ++ + __x2apic_disable(); + register_lapic_address(mp_lapic_addr); + } +@@ -1894,7 +1927,10 @@ void __init check_x2apic(void) + if (x2apic_enabled()) { + pr_info("x2apic: enabled by BIOS, switching to x2apic ops\n"); + x2apic_mode = 1; +- x2apic_state = X2APIC_ON; ++ if (x2apic_hw_locked()) ++ x2apic_state = X2APIC_ON_LOCKED; ++ else ++ x2apic_state = X2APIC_ON; + } else if (!boot_cpu_has(X86_FEATURE_X2APIC)) { + x2apic_state = X2APIC_DISABLED; + } +diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c +index da696eb4821a0..e77032c5f85cc 100644 +--- a/arch/x86/kernel/cpu/feat_ctl.c ++++ b/arch/x86/kernel/cpu/feat_ctl.c +@@ -1,11 +1,11 @@ + // SPDX-License-Identifier: GPL-2.0 + #include <linux/tboot.h> + ++#include <asm/cpu.h> + #include <asm/cpufeature.h> + #include <asm/msr-index.h> + #include <asm/processor.h> + #include <asm/vmx.h> +-#include "cpu.h" + + #undef pr_fmt + #define pr_fmt(fmt) "x86/cpu: " fmt +diff --git a/arch/x86/kernel/cpu/mce/apei.c b/arch/x86/kernel/cpu/mce/apei.c +index 717192915f28a..8ed341714686a 100644 +--- a/arch/x86/kernel/cpu/mce/apei.c ++++ b/arch/x86/kernel/cpu/mce/apei.c +@@ -29,15 +29,26 @@ + void apei_mce_report_mem_error(int severity, struct cper_sec_mem_err *mem_err) + { + struct mce m; ++ int lsb; + + if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) + return; + ++ /* ++ * Even if the ->validation_bits are set for address mask, ++ * to be extra safe, check and reject an error radius '0', ++ * and fall back to the default page size. ++ */ ++ if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) ++ lsb = find_first_bit((void *)&mem_err->physical_addr_mask, PAGE_SHIFT); ++ else ++ lsb = PAGE_SHIFT; ++ + mce_setup(&m); + m.bank = -1; + /* Fake a memory read error with unknown channel */ + m.status = MCI_STATUS_VAL | MCI_STATUS_EN | MCI_STATUS_ADDRV | MCI_STATUS_MISCV | 0x9f; +- m.misc = (MCI_MISC_ADDR_PHYS << 6) | PAGE_SHIFT; ++ m.misc = (MCI_MISC_ADDR_PHYS << 6) | lsb; + + if (severity >= GHES_SEV_RECOVERABLE) + m.status |= MCI_STATUS_UC; +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 8b2fcdfa6d316..615bc6efa1dd4 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -788,6 +788,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover, + kfree(patch); + return -EINVAL; + } ++ patch->size = *patch_size; + + mc_hdr = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE); + proc_id = mc_hdr->processor_rev_id; +@@ -869,7 +870,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) + return ret; + + memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); +- memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE)); ++ memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); + + return ret; + } +diff --git a/arch/x86/kernel/cpu/resctrl/pseudo_lock.c b/arch/x86/kernel/cpu/resctrl/pseudo_lock.c +index db813f819ad6c..4d8398986f784 100644 +--- a/arch/x86/kernel/cpu/resctrl/pseudo_lock.c ++++ b/arch/x86/kernel/cpu/resctrl/pseudo_lock.c +@@ -420,6 +420,7 @@ static int pseudo_lock_fn(void *_rdtgrp) + struct pseudo_lock_region *plr = rdtgrp->plr; + u32 rmid_p, closid_p; + unsigned long i; ++ u64 saved_msr; + #ifdef CONFIG_KASAN + /* + * The registers used for local register variables are also used +@@ -463,6 +464,7 @@ static int pseudo_lock_fn(void *_rdtgrp) + * the buffer and evict pseudo-locked memory read earlier from the + * cache. + */ ++ saved_msr = __rdmsr(MSR_MISC_FEATURE_CONTROL); + __wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0); + closid_p = this_cpu_read(pqr_state.cur_closid); + rmid_p = this_cpu_read(pqr_state.cur_rmid); +@@ -514,7 +516,7 @@ static int pseudo_lock_fn(void *_rdtgrp) + __wrmsr(IA32_PQR_ASSOC, rmid_p, closid_p); + + /* Re-enable the hardware prefetcher(s) */ +- wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0); ++ wrmsrl(MSR_MISC_FEATURE_CONTROL, saved_msr); + local_irq_enable(); + + plr->thread_done = 1; +@@ -871,6 +873,7 @@ bool rdtgroup_pseudo_locked_in_hierarchy(struct rdt_domain *d) + static int measure_cycles_lat_fn(void *_plr) + { + struct pseudo_lock_region *plr = _plr; ++ u32 saved_low, saved_high; + unsigned long i; + u64 start, end; + void *mem_r; +@@ -879,6 +882,7 @@ static int measure_cycles_lat_fn(void *_plr) + /* + * Disable hardware prefetchers. + */ ++ rdmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high); + wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0); + mem_r = READ_ONCE(plr->kmem); + /* +@@ -895,7 +899,7 @@ static int measure_cycles_lat_fn(void *_plr) + end = rdtsc_ordered(); + trace_pseudo_lock_mem_latency((u32)(end - start)); + } +- wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0); ++ wrmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high); + local_irq_enable(); + plr->thread_done = 1; + wake_up_interruptible(&plr->lock_thread_wq); +@@ -940,6 +944,7 @@ static int measure_residency_fn(struct perf_event_attr *miss_attr, + u64 hits_before = 0, hits_after = 0, miss_before = 0, miss_after = 0; + struct perf_event *miss_event, *hit_event; + int hit_pmcnum, miss_pmcnum; ++ u32 saved_low, saved_high; + unsigned int line_size; + unsigned int size; + unsigned long i; +@@ -973,6 +978,7 @@ static int measure_residency_fn(struct perf_event_attr *miss_attr, + /* + * Disable hardware prefetchers. + */ ++ rdmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high); + wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0); + + /* Initialize rest of local variables */ +@@ -1031,7 +1037,7 @@ static int measure_residency_fn(struct perf_event_attr *miss_attr, + */ + rmb(); + /* Re-enable hardware prefetchers */ +- wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0); ++ wrmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high); + local_irq_enable(); + out_hit: + perf_event_release_kernel(hit_event); +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 0c4a866813b31..695a5d159de87 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1955,7 +1955,7 @@ static int em_pop_sreg(struct x86_emulate_ctxt *ctxt) + if (rc != X86EMUL_CONTINUE) + return rc; + +- if (ctxt->modrm_reg == VCPU_SREG_SS) ++ if (seg == VCPU_SREG_SS) + ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS; + if (ctxt->op_bytes > 2) + rsp_increment(ctxt, ctxt->op_bytes - 2); +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index 67215fd6bd4a5..b98b8cede2642 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -2322,9 +2322,14 @@ static void prepare_vmcs02_early(struct vcpu_vmx *vmx, struct loaded_vmcs *vmcs0 + * are emulated by vmx_set_efer() in prepare_vmcs02(), but speculate + * on the related bits (if supported by the CPU) in the hope that + * we can avoid VMWrites during vmx_set_efer(). ++ * ++ * Similarly, take vmcs01's PERF_GLOBAL_CTRL in the hope that if KVM is ++ * loading PERF_GLOBAL_CTRL via the VMCS for L1, then KVM will want to ++ * do the same for L2. + */ + exec_control = __vm_entry_controls_get(vmcs01); +- exec_control |= vmcs12->vm_entry_controls; ++ exec_control |= (vmcs12->vm_entry_controls & ++ ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL); + exec_control &= ~(VM_ENTRY_IA32E_MODE | VM_ENTRY_LOAD_IA32_EFER); + if (cpu_has_load_ia32_efer()) { + if (guest_efer & EFER_LMA) +@@ -3834,7 +3839,16 @@ static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu, + u32 intr_info = nr | INTR_INFO_VALID_MASK; + + if (vcpu->arch.exception.has_error_code) { +- vmcs12->vm_exit_intr_error_code = vcpu->arch.exception.error_code; ++ /* ++ * Intel CPUs do not generate error codes with bits 31:16 set, ++ * and more importantly VMX disallows setting bits 31:16 in the ++ * injected error code for VM-Entry. Drop the bits to mimic ++ * hardware and avoid inducing failure on nested VM-Entry if L1 ++ * chooses to inject the exception back to L2. AMD CPUs _do_ ++ * generate "full" 32-bit error codes, so KVM allows userspace ++ * to inject exception error codes with bits 31:16 set. ++ */ ++ vmcs12->vm_exit_intr_error_code = (u16)vcpu->arch.exception.error_code; + intr_info |= INTR_INFO_DELIVER_CODE_MASK; + } + +@@ -4264,14 +4278,6 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, + nested_vmx_abort(vcpu, + VMX_ABORT_SAVE_GUEST_MSR_FAIL); + } +- +- /* +- * Drop what we picked up for L2 via vmx_complete_interrupts. It is +- * preserved above and would only end up incorrectly in L1. +- */ +- vcpu->arch.nmi_injected = false; +- kvm_clear_exception_queue(vcpu); +- kvm_clear_interrupt_queue(vcpu); + } + + /* +@@ -4611,6 +4617,17 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason, + WARN_ON_ONCE(nested_early_check); + } + ++ /* ++ * Drop events/exceptions that were queued for re-injection to L2 ++ * (picked up via vmx_complete_interrupts()), as well as exceptions ++ * that were pending for L2. Note, this must NOT be hoisted above ++ * prepare_vmcs12(), events/exceptions queued for re-injection need to ++ * be captured in vmcs12 (see vmcs12_save_pending_event()). ++ */ ++ vcpu->arch.nmi_injected = false; ++ kvm_clear_exception_queue(vcpu); ++ kvm_clear_interrupt_queue(vcpu); ++ + vmx_switch_vmcs(vcpu, &vmx->vmcs01); + + /* Update any VMCS fields that might have changed while L2 ran */ +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index b09a50e0af29d..98526e708f327 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -1687,7 +1687,17 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu) + kvm_deliver_exception_payload(vcpu); + + if (has_error_code) { +- vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code); ++ /* ++ * Despite the error code being architecturally defined as 32 ++ * bits, and the VMCS field being 32 bits, Intel CPUs and thus ++ * VMX don't actually supporting setting bits 31:16. Hardware ++ * will (should) never provide a bogus error code, but AMD CPUs ++ * do generate error codes with bits 31:16 set, and so KVM's ++ * ABI lets userspace shove in arbitrary 32-bit values. Drop ++ * the upper bits to avoid VM-Fail, losing information that ++ * does't really exist is preferable to killing the VM. ++ */ ++ vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, (u16)error_code); + intr_info |= INTR_INFO_DELIVER_CODE_MASK; + } + +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 41d170653e8d9..fc4d899f10f65 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -2216,7 +2216,7 @@ cleanup: + return ret; + } + +-static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs) ++static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs, u8 *image, u8 *buf) + { + u8 *jg_reloc, *prog = *pprog; + int pivot, err, jg_bytes = 1; +@@ -2232,12 +2232,12 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs) + EMIT2_off32(0x81, add_1reg(0xF8, BPF_REG_3), + progs[a]); + err = emit_cond_near_jump(&prog, /* je func */ +- (void *)progs[a], prog, ++ (void *)progs[a], image + (prog - buf), + X86_JE); + if (err) + return err; + +- emit_indirect_jump(&prog, 2 /* rdx */, prog); ++ emit_indirect_jump(&prog, 2 /* rdx */, image + (prog - buf)); + + *pprog = prog; + return 0; +@@ -2262,7 +2262,7 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs) + jg_reloc = prog; + + err = emit_bpf_dispatcher(&prog, a, a + pivot, /* emit lower_part */ +- progs); ++ progs, image, buf); + if (err) + return err; + +@@ -2276,7 +2276,7 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs) + emit_code(jg_reloc - jg_bytes, jg_offset, jg_bytes); + + err = emit_bpf_dispatcher(&prog, a + pivot + 1, /* emit upper_part */ +- b, progs); ++ b, progs, image, buf); + if (err) + return err; + +@@ -2296,12 +2296,12 @@ static int cmp_ips(const void *a, const void *b) + return 0; + } + +-int arch_prepare_bpf_dispatcher(void *image, s64 *funcs, int num_funcs) ++int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs) + { +- u8 *prog = image; ++ u8 *prog = buf; + + sort(funcs, num_funcs, sizeof(funcs[0]), cmp_ips, NULL); +- return emit_bpf_dispatcher(&prog, 0, num_funcs - 1, funcs); ++ return emit_bpf_dispatcher(&prog, 0, num_funcs - 1, funcs, image, buf); + } + + struct x64_jit_data { +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 0ed2e487a693f..9b1a58dda935b 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -765,6 +765,7 @@ static void xen_load_idt(const struct desc_ptr *desc) + { + static DEFINE_SPINLOCK(lock); + static struct trap_info traps[257]; ++ static const struct trap_info zero = { }; + unsigned out; + + trace_xen_cpu_load_idt(desc); +@@ -774,7 +775,7 @@ static void xen_load_idt(const struct desc_ptr *desc) + memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc)); + + out = xen_convert_trap_info(desc, traps, false); +- memset(&traps[out], 0, sizeof(traps[0])); ++ traps[out] = zero; + + xen_mc_flush(); + if (HYPERVISOR_set_trap_table(traps)) +diff --git a/block/bio.c b/block/bio.c +index eb7cc591ee931..225e2edcb5049 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -760,8 +760,6 @@ EXPORT_SYMBOL(bio_put); + static int __bio_clone(struct bio *bio, struct bio *bio_src, gfp_t gfp) + { + bio_set_flag(bio, BIO_CLONED); +- if (bio_flagged(bio_src, BIO_THROTTLED)) +- bio_set_flag(bio, BIO_THROTTLED); + bio->bi_ioprio = bio_src->bi_ioprio; + bio->bi_iter = bio_src->bi_iter; + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 69d0a58f9e2f1..302b8d92deef1 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4481,14 +4481,14 @@ static bool blk_mq_elv_switch_none(struct list_head *head, + list_add(&qe->node, head); + + /* +- * After elevator_switch_mq, the previous elevator_queue will be ++ * After elevator_switch, the previous elevator_queue will be + * released by elevator_release. The reference of the io scheduler + * module get by elevator_get will also be put. So we need to get + * a reference of the io scheduler module here to prevent it to be + * removed. + */ + __module_get(qe->type->elevator_owner); +- elevator_switch_mq(q, NULL); ++ elevator_switch(q, NULL); + mutex_unlock(&q->sysfs_lock); + + return true; +@@ -4520,7 +4520,7 @@ static void blk_mq_elv_switch_back(struct list_head *head, + kfree(qe); + + mutex_lock(&q->sysfs_lock); +- elevator_switch_mq(q, t); ++ elevator_switch(q, t); + mutex_unlock(&q->sysfs_lock); + } + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 139b2d7a99e2f..acdd85a07f923 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -806,12 +806,12 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio, + u64 bps_limit, unsigned long *wait) + { + bool rw = bio_data_dir(bio); +- u64 bytes_allowed, extra_bytes, tmp; ++ u64 bytes_allowed, extra_bytes; + unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd; + unsigned int bio_size = throtl_bio_data_size(bio); + + /* no need to throttle if this bio's bytes have been accounted */ +- if (bps_limit == U64_MAX || bio_flagged(bio, BIO_THROTTLED)) { ++ if (bps_limit == U64_MAX || bio_flagged(bio, BIO_BPS_THROTTLED)) { + if (wait) + *wait = 0; + return true; +@@ -824,10 +824,8 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio, + jiffy_elapsed_rnd = tg->td->throtl_slice; + + jiffy_elapsed_rnd = roundup(jiffy_elapsed_rnd, tg->td->throtl_slice); +- +- tmp = bps_limit * jiffy_elapsed_rnd; +- do_div(tmp, HZ); +- bytes_allowed = tmp; ++ bytes_allowed = mul_u64_u64_div_u64(bps_limit, (u64)jiffy_elapsed_rnd, ++ (u64)HZ); + + if (tg->bytes_disp[rw] + bio_size <= bytes_allowed) { + if (wait) +@@ -921,22 +919,13 @@ static void throtl_charge_bio(struct throtl_grp *tg, struct bio *bio) + unsigned int bio_size = throtl_bio_data_size(bio); + + /* Charge the bio to the group */ +- if (!bio_flagged(bio, BIO_THROTTLED)) { ++ if (!bio_flagged(bio, BIO_BPS_THROTTLED)) { + tg->bytes_disp[rw] += bio_size; + tg->last_bytes_disp[rw] += bio_size; + } + + tg->io_disp[rw]++; + tg->last_io_disp[rw]++; +- +- /* +- * BIO_THROTTLED is used to prevent the same bio to be throttled +- * more than once as a throttled bio will go through blk-throtl the +- * second time when it eventually gets issued. Set it when a bio +- * is being charged to a tg. +- */ +- if (!bio_flagged(bio, BIO_THROTTLED)) +- bio_set_flag(bio, BIO_THROTTLED); + } + + /** +@@ -1026,6 +1015,7 @@ static void tg_dispatch_one_bio(struct throtl_grp *tg, bool rw) + sq->nr_queued[rw]--; + + throtl_charge_bio(tg, bio); ++ bio_set_flag(bio, BIO_BPS_THROTTLED); + + /* + * If our parent is another tg, we just need to transfer @bio to +@@ -2159,8 +2149,10 @@ again: + qn = &tg->qnode_on_parent[rw]; + sq = sq->parent_sq; + tg = sq_to_tg(sq); +- if (!tg) ++ if (!tg) { ++ bio_set_flag(bio, BIO_BPS_THROTTLED); + goto out_unlock; ++ } + } + + /* out-of-limit, queue to @tg */ +@@ -2189,8 +2181,6 @@ again: + } + + out_unlock: +- bio_set_flag(bio, BIO_THROTTLED); +- + #ifdef CONFIG_BLK_DEV_THROTTLING_LOW + if (throttled || !td->track_bio_latency) + bio->bi_issue.value |= BIO_ISSUE_THROTL_SKIP_LATENCY; +diff --git a/block/blk-throttle.h b/block/blk-throttle.h +index c1b6029961272..ee7299e6dea91 100644 +--- a/block/blk-throttle.h ++++ b/block/blk-throttle.h +@@ -175,7 +175,7 @@ static inline bool blk_throtl_bio(struct bio *bio) + struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg); + + /* no need to throttle bps any more if the bio has been throttled */ +- if (bio_flagged(bio, BIO_THROTTLED) && ++ if (bio_flagged(bio, BIO_BPS_THROTTLED) && + !(tg->flags & THROTL_TG_HAS_IOPS_LIMIT)) + return false; + +diff --git a/block/blk-wbt.c b/block/blk-wbt.c +index ae6ea0b545799..e91d334b2788c 100644 +--- a/block/blk-wbt.c ++++ b/block/blk-wbt.c +@@ -841,8 +841,11 @@ int wbt_init(struct request_queue *q) + rwb->last_comp = rwb->last_issue = jiffies; + rwb->win_nsec = RWB_WINDOW_NSEC; + rwb->enable_state = WBT_STATE_ON_DEFAULT; +- rwb->wc = 1; ++ rwb->wc = test_bit(QUEUE_FLAG_WC, &q->queue_flags); + rwb->rq_depth.default_depth = RWB_DEF_DEPTH; ++ rwb->min_lat_nsec = wbt_default_latency_nsec(q); ++ ++ wbt_queue_depth_changed(&rwb->rqos); + + /* + * Assign rwb and add the stats callback. +@@ -853,11 +856,6 @@ int wbt_init(struct request_queue *q) + + blk_stat_add_callback(q, rwb->cb); + +- rwb->min_lat_nsec = wbt_default_latency_nsec(q); +- +- wbt_queue_depth_changed(&rwb->rqos); +- wbt_set_write_cache(q, test_bit(QUEUE_FLAG_WC, &q->queue_flags)); +- + return 0; + + err_free: +diff --git a/block/blk.h b/block/blk.h +index 0d6668663ab5d..af2aaea239665 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -260,8 +260,7 @@ bool blk_bio_list_merge(struct request_queue *q, struct list_head *list, + + void blk_insert_flush(struct request *rq); + +-int elevator_switch_mq(struct request_queue *q, +- struct elevator_type *new_e); ++int elevator_switch(struct request_queue *q, struct elevator_type *new_e); + void elevator_exit(struct request_queue *q); + int elv_register_queue(struct request_queue *q, bool uevent); + void elv_unregister_queue(struct request_queue *q); +diff --git a/block/elevator.c b/block/elevator.c +index c319765892bb9..bd71f0fc4e4b6 100644 +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -588,7 +588,7 @@ void elv_unregister(struct elevator_type *e) + } + EXPORT_SYMBOL_GPL(elv_unregister); + +-int elevator_switch_mq(struct request_queue *q, ++static int elevator_switch_mq(struct request_queue *q, + struct elevator_type *new_e) + { + int ret; +@@ -723,7 +723,7 @@ void elevator_init_mq(struct request_queue *q) + * need for the new one. this way we have a chance of going back to the old + * one, if the new one fails init for some reason. + */ +-static int elevator_switch(struct request_queue *q, struct elevator_type *new_e) ++int elevator_switch(struct request_queue *q, struct elevator_type *new_e) + { + int err; + +diff --git a/crypto/akcipher.c b/crypto/akcipher.c +index f866085c8a4a3..ab975a420e1e9 100644 +--- a/crypto/akcipher.c ++++ b/crypto/akcipher.c +@@ -120,6 +120,12 @@ static int akcipher_default_op(struct akcipher_request *req) + return -ENOSYS; + } + ++static int akcipher_default_set_key(struct crypto_akcipher *tfm, ++ const void *key, unsigned int keylen) ++{ ++ return -ENOSYS; ++} ++ + int crypto_register_akcipher(struct akcipher_alg *alg) + { + struct crypto_alg *base = &alg->base; +@@ -132,6 +138,8 @@ int crypto_register_akcipher(struct akcipher_alg *alg) + alg->encrypt = akcipher_default_op; + if (!alg->decrypt) + alg->decrypt = akcipher_default_op; ++ if (!alg->set_priv_key) ++ alg->set_priv_key = akcipher_default_set_key; + + akcipher_prepare_alg(alg); + return crypto_register_alg(base); +diff --git a/drivers/acpi/acpi_fpdt.c b/drivers/acpi/acpi_fpdt.c +index 6922a44b3ce70..a2056c4c8cb70 100644 +--- a/drivers/acpi/acpi_fpdt.c ++++ b/drivers/acpi/acpi_fpdt.c +@@ -143,6 +143,23 @@ static const struct attribute_group boot_attr_group = { + + static struct kobject *fpdt_kobj; + ++#if defined CONFIG_X86 && defined CONFIG_PHYS_ADDR_T_64BIT ++#include <linux/processor.h> ++static bool fpdt_address_valid(u64 address) ++{ ++ /* ++ * On some systems the table contains invalid addresses ++ * with unsuppored high address bits set, check for this. ++ */ ++ return !(address >> boot_cpu_data.x86_phys_bits); ++} ++#else ++static bool fpdt_address_valid(u64 address) ++{ ++ return true; ++} ++#endif ++ + static int fpdt_process_subtable(u64 address, u32 subtable_type) + { + struct fpdt_subtable_header *subtable_header; +@@ -151,6 +168,11 @@ static int fpdt_process_subtable(u64 address, u32 subtable_type) + u32 length, offset; + int result; + ++ if (!fpdt_address_valid(address)) { ++ pr_info(FW_BUG "invalid physical address: 0x%llx!\n", address); ++ return -EINVAL; ++ } ++ + subtable_header = acpi_os_map_memory(address, sizeof(*subtable_header)); + if (!subtable_header) + return -ENOMEM; +diff --git a/drivers/acpi/acpi_pcc.c b/drivers/acpi/acpi_pcc.c +index a12b55d812096..ee4ce5ba1fb24 100644 +--- a/drivers/acpi/acpi_pcc.c ++++ b/drivers/acpi/acpi_pcc.c +@@ -23,6 +23,12 @@ + + #include <acpi/pcc.h> + ++/* ++ * Arbitrary retries in case the remote processor is slow to respond ++ * to PCC commands ++ */ ++#define PCC_CMD_WAIT_RETRIES_NUM 500 ++ + struct pcc_data { + struct pcc_mbox_chan *pcc_chan; + void __iomem *pcc_comm_addr; +@@ -63,6 +69,7 @@ acpi_pcc_address_space_setup(acpi_handle region_handle, u32 function, + if (IS_ERR(data->pcc_chan)) { + pr_err("Failed to find PCC channel for subspace %d\n", + ctx->subspace_id); ++ kfree(data); + return AE_NOT_FOUND; + } + +@@ -72,6 +79,8 @@ acpi_pcc_address_space_setup(acpi_handle region_handle, u32 function, + if (!data->pcc_comm_addr) { + pr_err("Failed to ioremap PCC comm region mem for %d\n", + ctx->subspace_id); ++ pcc_mbox_free_channel(data->pcc_chan); ++ kfree(data); + return AE_NO_MEMORY; + } + +@@ -86,6 +95,7 @@ acpi_pcc_address_space_handler(u32 function, acpi_physical_address addr, + { + int ret; + struct pcc_data *data = region_context; ++ u64 usecs_lat; + + reinit_completion(&data->done); + +@@ -96,10 +106,22 @@ acpi_pcc_address_space_handler(u32 function, acpi_physical_address addr, + if (ret < 0) + return AE_ERROR; + +- if (data->pcc_chan->mchan->mbox->txdone_irq) +- wait_for_completion(&data->done); ++ if (data->pcc_chan->mchan->mbox->txdone_irq) { ++ /* ++ * pcc_chan->latency is just a Nominal value. In reality the remote ++ * processor could be much slower to reply. So add an arbitrary ++ * amount of wait on top of Nominal. ++ */ ++ usecs_lat = PCC_CMD_WAIT_RETRIES_NUM * data->pcc_chan->latency; ++ ret = wait_for_completion_timeout(&data->done, ++ usecs_to_jiffies(usecs_lat)); ++ if (ret == 0) { ++ pr_err("PCC command executed timeout!\n"); ++ return AE_TIME; ++ } ++ } + +- mbox_client_txdone(data->pcc_chan->mchan, ret); ++ mbox_chan_txdone(data->pcc_chan->mchan, ret); + + memcpy_fromio(value, data->pcc_comm_addr, data->ctx.length); + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index eaea733b368ae..03f5f92b603c4 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -496,6 +496,22 @@ static const struct dmi_system_id video_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE R830"), + }, + }, ++ { ++ .callback = video_disable_backlight_sysfs_if, ++ .ident = "Toshiba Satellite Z830", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE Z830"), ++ }, ++ }, ++ { ++ .callback = video_disable_backlight_sysfs_if, ++ .ident = "Toshiba Portege Z830", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE Z830"), ++ }, ++ }, + /* + * Some machine's _DOD IDs don't have bit 31(Device ID Scheme) set + * but the IDs actually follow the Device ID Scheme. +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index d91ad378c00d6..80ad530583c9c 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -985,7 +985,7 @@ static void ghes_proc_in_irq(struct irq_work *irq_work) + ghes_estatus_cache_add(generic, estatus); + } + +- if (task_work_pending && current->mm != &init_mm) { ++ if (task_work_pending && current->mm) { + estatus_node->task_work.func = ghes_kick_task_work; + estatus_node->task_work_cpu = smp_processor_id(); + ret = task_work_add(current, &estatus_node->task_work, +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 664070fc83498..d7cdd8406c84f 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -207,9 +207,26 @@ static const struct x86_cpu_id storage_d3_cpu_ids[] = { + {} + }; + ++static const struct dmi_system_id force_storage_d3_dmi[] = { ++ { ++ /* ++ * _ADR is ambiguous between GPP1.DEV0 and GPP1.NVME ++ * but .NVME is needed to get StorageD3Enable node ++ * https://bugzilla.kernel.org/show_bug.cgi?id=216440 ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 14 7425 2-in-1"), ++ } ++ }, ++ {} ++}; ++ + bool force_storage_d3(void) + { +- return x86_match_cpu(storage_d3_cpu_ids); ++ const struct dmi_system_id *dmi_id = dmi_first_match(force_storage_d3_dmi); ++ ++ return dmi_id || x86_match_cpu(storage_d3_cpu_ids); + } + + /* +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 32495ae96567a..986f1923a76da 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -451,14 +451,24 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev, + } + } + +- hpriv->nports = child_nodes = of_get_child_count(dev->of_node); ++ /* ++ * Too many sub-nodes most likely means having something wrong with ++ * the firmware. ++ */ ++ child_nodes = of_get_child_count(dev->of_node); ++ if (child_nodes > AHCI_MAX_PORTS) { ++ rc = -EINVAL; ++ goto err_out; ++ } + + /* + * If no sub-node was found, we still need to set nports to + * one in order to be able to use the + * ahci_platform_[en|dis]able_[phys|regulators] functions. + */ +- if (!child_nodes) ++ if (child_nodes) ++ hpriv->nports = child_nodes; ++ else + hpriv->nports = 1; + + hpriv->phys = devm_kcalloc(dev, hpriv->nports, sizeof(*hpriv->phys), GFP_KERNEL); +diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c +index 579c851a2bd74..5e94767c28774 100644 +--- a/drivers/base/arch_topology.c ++++ b/drivers/base/arch_topology.c +@@ -791,4 +791,23 @@ void __init init_cpu_topology(void) + else if (of_have_populated_dt() && parse_dt_topology()) + reset_cpu_topology(); + } ++ ++void store_cpu_topology(unsigned int cpuid) ++{ ++ struct cpu_topology *cpuid_topo = &cpu_topology[cpuid]; ++ ++ if (cpuid_topo->package_id != -1) ++ goto topology_populated; ++ ++ cpuid_topo->thread_id = -1; ++ cpuid_topo->core_id = cpuid; ++ cpuid_topo->package_id = cpu_to_node(cpuid); ++ ++ pr_debug("CPU%u: package %d core %d thread %d\n", ++ cpuid, cpuid_topo->package_id, cpuid_topo->core_id, ++ cpuid_topo->thread_id); ++ ++topology_populated: ++ update_siblings_masks(cpuid); ++} + #endif +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 20e9c53eec53f..3a3680b3c4fe2 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1414,10 +1414,12 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd) + mutex_unlock(&nbd->config_lock); + ret = wait_event_interruptible(config->recv_wq, + atomic_read(&config->recv_threads) == 0); +- if (ret) ++ if (ret) { + sock_shutdown(nbd); +- flush_workqueue(nbd->recv_workq); ++ nbd_clear_que(nbd); ++ } + ++ flush_workqueue(nbd->recv_workq); + mutex_lock(&nbd->config_lock); + nbd_bdev_reset(nbd); + /* user requested, ignore socket errors */ +diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c +index 818681c89db8b..d44a966675179 100644 +--- a/drivers/bluetooth/btintel.c ++++ b/drivers/bluetooth/btintel.c +@@ -2439,15 +2439,20 @@ static int btintel_setup_combined(struct hci_dev *hdev) + INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) + set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, + &hdev->quirks); ++ if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22) ++ set_bit(HCI_QUIRK_VALID_LE_STATES, ++ &hdev->quirks); + + err = btintel_legacy_rom_setup(hdev, &ver); + break; + case 0x0b: /* SfP */ +- case 0x0c: /* WsP */ + case 0x11: /* JfP */ + case 0x12: /* ThP */ + case 0x13: /* HrP */ + case 0x14: /* CcP */ ++ set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); ++ fallthrough; ++ case 0x0c: /* WsP */ + /* Apply the device specific HCI quirks + * + * All Legacy bootloader devices support WBS +@@ -2455,11 +2460,6 @@ static int btintel_setup_combined(struct hci_dev *hdev) + set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, + &hdev->quirks); + +- /* Valid LE States quirk for JfP/ThP familiy */ +- if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12) +- set_bit(HCI_QUIRK_VALID_LE_STATES, +- &hdev->quirks); +- + /* Setup MSFT Extension support */ + btintel_set_msft_opcode(hdev, ver.hw_variant); + +@@ -2530,9 +2530,8 @@ static int btintel_setup_combined(struct hci_dev *hdev) + */ + set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); + +- /* Valid LE States quirk for JfP/ThP familiy */ +- if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12) +- set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); ++ /* Set Valid LE States quirk */ ++ set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); + + /* Setup MSFT Extension support */ + btintel_set_msft_opcode(hdev, ver.hw_variant); +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index aaba2d7371781..6a320ece32765 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2451,15 +2451,29 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, + + set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); + ++ /* WMT cmd/event doesn't follow up the generic HCI cmd/event handling, ++ * it needs constantly polling control pipe until the host received the ++ * WMT event, thus, we should require to specifically acquire PM counter ++ * on the USB to prevent the interface from entering auto suspended ++ * while WMT cmd/event in progress. ++ */ ++ err = usb_autopm_get_interface(data->intf); ++ if (err < 0) ++ goto err_free_wc; ++ + err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc); + + if (err < 0) { + clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); ++ usb_autopm_put_interface(data->intf); + goto err_free_wc; + } + + /* Submit control IN URB on demand to process the WMT event */ + err = btusb_mtk_submit_wmt_recv_urb(hdev); ++ ++ usb_autopm_put_interface(data->intf); ++ + if (err < 0) + goto err_free_wc; + +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index f537673ede174..865112e96ff9f 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -493,6 +493,11 @@ static int hci_uart_tty_open(struct tty_struct *tty) + BT_ERR("Can't allocate control structure"); + return -ENFILE; + } ++ if (percpu_init_rwsem(&hu->proto_lock)) { ++ BT_ERR("Can't allocate semaphore structure"); ++ kfree(hu); ++ return -ENOMEM; ++ } + + tty->disc_data = hu; + hu->tty = tty; +@@ -505,8 +510,6 @@ static int hci_uart_tty_open(struct tty_struct *tty) + INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); + +- percpu_init_rwsem(&hu->proto_lock); +- + /* Flush any pending characters in the driver */ + tty_driver_flush_buffer(tty); + +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index c0e5f42ec6b7d..f16fd79bc02b8 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -310,11 +310,12 @@ int hci_uart_register_device(struct hci_uart *hu, + + serdev_device_set_client_ops(hu->serdev, &hci_serdev_client_ops); + ++ if (percpu_init_rwsem(&hu->proto_lock)) ++ return -ENOMEM; ++ + err = serdev_device_open(hu->serdev); + if (err) +- return err; +- +- percpu_init_rwsem(&hu->proto_lock); ++ goto err_rwsem; + + err = p->open(hu); + if (err) +@@ -389,6 +390,8 @@ err_alloc: + p->close(hu); + err_open: + serdev_device_close(hu->serdev); ++err_rwsem: ++ percpu_free_rwsem(&hu->proto_lock); + return err; + } + EXPORT_SYMBOL_GPL(hci_uart_register_device); +@@ -410,5 +413,6 @@ void hci_uart_unregister_device(struct hci_uart *hu) + clear_bit(HCI_UART_PROTO_READY, &hu->flags); + serdev_device_close(hu->serdev); + } ++ percpu_free_rwsem(&hu->proto_lock); + } + EXPORT_SYMBOL_GPL(hci_uart_unregister_device); +diff --git a/drivers/char/hw_random/arm_smccc_trng.c b/drivers/char/hw_random/arm_smccc_trng.c +index b24ac39a903b3..e34c3ea692b6c 100644 +--- a/drivers/char/hw_random/arm_smccc_trng.c ++++ b/drivers/char/hw_random/arm_smccc_trng.c +@@ -71,8 +71,6 @@ static int smccc_trng_read(struct hwrng *rng, void *data, size_t max, bool wait) + MAX_BITS_PER_CALL); + + arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_RND, bits, &res); +- if ((int)res.a0 < 0) +- return (int)res.a0; + + switch ((int)res.a0) { + case SMCCC_RET_SUCCESS: +@@ -88,6 +86,8 @@ static int smccc_trng_read(struct hwrng *rng, void *data, size_t max, bool wait) + return copied; + cond_resched(); + break; ++ default: ++ return -EIO; + } + } + +diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c +index 16f227b995e8a..d7045dfaf16cf 100644 +--- a/drivers/char/hw_random/core.c ++++ b/drivers/char/hw_random/core.c +@@ -507,16 +507,17 @@ static int hwrng_fillfn(void *unused) + rng->quality = current_quality; /* obsolete */ + quality = rng->quality; + mutex_unlock(&reading_mutex); ++ ++ if (rc <= 0) ++ hwrng_msleep(rng, 10000); ++ + put_rng(rng); + + if (!quality) + break; + +- if (rc <= 0) { +- pr_warn("hwrng: no data available\n"); +- msleep_interruptible(10000); ++ if (rc <= 0) + continue; +- } + + /* If we cannot credit at least one bit of entropy, + * keep track of the remainder for the next iteration +@@ -570,6 +571,7 @@ int hwrng_register(struct hwrng *rng) + + init_completion(&rng->cleanup_done); + complete(&rng->cleanup_done); ++ init_completion(&rng->dying); + + if (!current_rng || + (!cur_rng_set_by_user && rng->quality > current_rng->quality)) { +@@ -617,6 +619,7 @@ void hwrng_unregister(struct hwrng *rng) + + old_rng = current_rng; + list_del(&rng->list); ++ complete_all(&rng->dying); + if (current_rng == rng) { + err = enable_best_rng(); + if (err) { +@@ -685,6 +688,14 @@ void devm_hwrng_unregister(struct device *dev, struct hwrng *rng) + } + EXPORT_SYMBOL_GPL(devm_hwrng_unregister); + ++long hwrng_msleep(struct hwrng *rng, unsigned int msecs) ++{ ++ unsigned long timeout = msecs_to_jiffies(msecs) + 1; ++ ++ return wait_for_completion_interruptible_timeout(&rng->dying, timeout); ++} ++EXPORT_SYMBOL_GPL(hwrng_msleep); ++ + static int __init hwrng_modinit(void) + { + int ret; +diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c +index b05d676ca814c..2964efeb71c33 100644 +--- a/drivers/char/hw_random/imx-rngc.c ++++ b/drivers/char/hw_random/imx-rngc.c +@@ -270,13 +270,6 @@ static int imx_rngc_probe(struct platform_device *pdev) + goto err; + } + +- ret = devm_request_irq(&pdev->dev, +- irq, imx_rngc_irq, 0, pdev->name, (void *)rngc); +- if (ret) { +- dev_err(rngc->dev, "Can't get interrupt working.\n"); +- goto err; +- } +- + init_completion(&rngc->rng_op_done); + + rngc->rng.name = pdev->name; +@@ -290,6 +283,13 @@ static int imx_rngc_probe(struct platform_device *pdev) + + imx_rngc_irq_mask_clear(rngc); + ++ ret = devm_request_irq(&pdev->dev, ++ irq, imx_rngc_irq, 0, pdev->name, (void *)rngc); ++ if (ret) { ++ dev_err(rngc->dev, "Can't get interrupt working.\n"); ++ return ret; ++ } ++ + if (self_test) { + ret = imx_rngc_self_test(rngc); + if (ret) { +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 8dfb28d5ae3fa..5defbc479a5c7 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1178,7 +1178,7 @@ static void __cold entropy_timer(struct timer_list *timer) + */ + static void __cold try_to_generate_entropy(void) + { +- enum { NUM_TRIAL_SAMPLES = 8192, MAX_SAMPLES_PER_BIT = HZ / 30 }; ++ enum { NUM_TRIAL_SAMPLES = 8192, MAX_SAMPLES_PER_BIT = HZ / 15 }; + struct entropy_timer_state stack; + unsigned int i, num_different = 0; + unsigned long last = random_get_entropy(); +@@ -1197,7 +1197,7 @@ static void __cold try_to_generate_entropy(void) + timer_setup_on_stack(&stack.timer, entropy_timer, 0); + while (!crng_ready() && !signal_pending(current)) { + if (!timer_pending(&stack.timer)) +- mod_timer(&stack.timer, jiffies + 1); ++ mod_timer(&stack.timer, jiffies); + mix_pool_bytes(&stack.entropy, sizeof(stack.entropy)); + schedule(); + stack.entropy = random_get_entropy(); +diff --git a/drivers/clk/baikal-t1/ccu-div.c b/drivers/clk/baikal-t1/ccu-div.c +index 4062092d67f90..a6642f3d33d44 100644 +--- a/drivers/clk/baikal-t1/ccu-div.c ++++ b/drivers/clk/baikal-t1/ccu-div.c +@@ -34,6 +34,7 @@ + #define CCU_DIV_CTL_CLKDIV_MASK(_width) \ + GENMASK((_width) + CCU_DIV_CTL_CLKDIV_FLD - 1, CCU_DIV_CTL_CLKDIV_FLD) + #define CCU_DIV_CTL_LOCK_SHIFTED BIT(27) ++#define CCU_DIV_CTL_GATE_REF_BUF BIT(28) + #define CCU_DIV_CTL_LOCK_NORMAL BIT(31) + + #define CCU_DIV_RST_DELAY_US 1 +@@ -170,6 +171,40 @@ static int ccu_div_gate_is_enabled(struct clk_hw *hw) + return !!(val & CCU_DIV_CTL_EN); + } + ++static int ccu_div_buf_enable(struct clk_hw *hw) ++{ ++ struct ccu_div *div = to_ccu_div(hw); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&div->lock, flags); ++ regmap_update_bits(div->sys_regs, div->reg_ctl, ++ CCU_DIV_CTL_GATE_REF_BUF, 0); ++ spin_unlock_irqrestore(&div->lock, flags); ++ ++ return 0; ++} ++ ++static void ccu_div_buf_disable(struct clk_hw *hw) ++{ ++ struct ccu_div *div = to_ccu_div(hw); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&div->lock, flags); ++ regmap_update_bits(div->sys_regs, div->reg_ctl, ++ CCU_DIV_CTL_GATE_REF_BUF, CCU_DIV_CTL_GATE_REF_BUF); ++ spin_unlock_irqrestore(&div->lock, flags); ++} ++ ++static int ccu_div_buf_is_enabled(struct clk_hw *hw) ++{ ++ struct ccu_div *div = to_ccu_div(hw); ++ u32 val = 0; ++ ++ regmap_read(div->sys_regs, div->reg_ctl, &val); ++ ++ return !(val & CCU_DIV_CTL_GATE_REF_BUF); ++} ++ + static unsigned long ccu_div_var_recalc_rate(struct clk_hw *hw, + unsigned long parent_rate) + { +@@ -323,6 +358,7 @@ static const struct ccu_div_dbgfs_bit ccu_div_bits[] = { + CCU_DIV_DBGFS_BIT_ATTR("div_en", CCU_DIV_CTL_EN), + CCU_DIV_DBGFS_BIT_ATTR("div_rst", CCU_DIV_CTL_RST), + CCU_DIV_DBGFS_BIT_ATTR("div_bypass", CCU_DIV_CTL_SET_CLKDIV), ++ CCU_DIV_DBGFS_BIT_ATTR("div_buf", CCU_DIV_CTL_GATE_REF_BUF), + CCU_DIV_DBGFS_BIT_ATTR("div_lock", CCU_DIV_CTL_LOCK_NORMAL) + }; + +@@ -441,6 +477,9 @@ static void ccu_div_var_debug_init(struct clk_hw *hw, struct dentry *dentry) + continue; + } + ++ if (!strcmp("div_buf", name)) ++ continue; ++ + bits[didx] = ccu_div_bits[bidx]; + bits[didx].div = div; + +@@ -477,6 +516,21 @@ static void ccu_div_gate_debug_init(struct clk_hw *hw, struct dentry *dentry) + &ccu_div_dbgfs_fixed_clkdiv_fops); + } + ++static void ccu_div_buf_debug_init(struct clk_hw *hw, struct dentry *dentry) ++{ ++ struct ccu_div *div = to_ccu_div(hw); ++ struct ccu_div_dbgfs_bit *bit; ++ ++ bit = kmalloc(sizeof(*bit), GFP_KERNEL); ++ if (!bit) ++ return; ++ ++ *bit = ccu_div_bits[3]; ++ bit->div = div; ++ debugfs_create_file_unsafe(bit->name, ccu_div_dbgfs_mode, dentry, bit, ++ &ccu_div_dbgfs_bit_fops); ++} ++ + static void ccu_div_fixed_debug_init(struct clk_hw *hw, struct dentry *dentry) + { + struct ccu_div *div = to_ccu_div(hw); +@@ -489,6 +543,7 @@ static void ccu_div_fixed_debug_init(struct clk_hw *hw, struct dentry *dentry) + + #define ccu_div_var_debug_init NULL + #define ccu_div_gate_debug_init NULL ++#define ccu_div_buf_debug_init NULL + #define ccu_div_fixed_debug_init NULL + + #endif /* !CONFIG_DEBUG_FS */ +@@ -520,6 +575,13 @@ static const struct clk_ops ccu_div_gate_ops = { + .debug_init = ccu_div_gate_debug_init + }; + ++static const struct clk_ops ccu_div_buf_ops = { ++ .enable = ccu_div_buf_enable, ++ .disable = ccu_div_buf_disable, ++ .is_enabled = ccu_div_buf_is_enabled, ++ .debug_init = ccu_div_buf_debug_init ++}; ++ + static const struct clk_ops ccu_div_fixed_ops = { + .recalc_rate = ccu_div_fixed_recalc_rate, + .round_rate = ccu_div_fixed_round_rate, +@@ -566,6 +628,8 @@ struct ccu_div *ccu_div_hw_register(const struct ccu_div_init_data *div_init) + } else if (div_init->type == CCU_DIV_GATE) { + hw_init.ops = &ccu_div_gate_ops; + div->divider = div_init->divider; ++ } else if (div_init->type == CCU_DIV_BUF) { ++ hw_init.ops = &ccu_div_buf_ops; + } else if (div_init->type == CCU_DIV_FIXED) { + hw_init.ops = &ccu_div_fixed_ops; + div->divider = div_init->divider; +@@ -579,6 +643,7 @@ struct ccu_div *ccu_div_hw_register(const struct ccu_div_init_data *div_init) + goto err_free_div; + } + parent_data.fw_name = div_init->parent_name; ++ parent_data.name = div_init->parent_name; + hw_init.parent_data = &parent_data; + hw_init.num_parents = 1; + +diff --git a/drivers/clk/baikal-t1/ccu-div.h b/drivers/clk/baikal-t1/ccu-div.h +index 795665caefbdc..4eb49ff4803c6 100644 +--- a/drivers/clk/baikal-t1/ccu-div.h ++++ b/drivers/clk/baikal-t1/ccu-div.h +@@ -13,6 +13,14 @@ + #include <linux/bits.h> + #include <linux/of.h> + ++/* ++ * CCU Divider private clock IDs ++ * @CCU_SYS_SATA_CLK: CCU SATA internal clock ++ * @CCU_SYS_XGMAC_CLK: CCU XGMAC internal clock ++ */ ++#define CCU_SYS_SATA_CLK -1 ++#define CCU_SYS_XGMAC_CLK -2 ++ + /* + * CCU Divider private flags + * @CCU_DIV_SKIP_ONE: Due to some reason divider can't be set to 1. +@@ -31,11 +39,13 @@ + * enum ccu_div_type - CCU Divider types + * @CCU_DIV_VAR: Clocks gate with variable divider. + * @CCU_DIV_GATE: Clocks gate with fixed divider. ++ * @CCU_DIV_BUF: Clock gate with no divider. + * @CCU_DIV_FIXED: Ungateable clock with fixed divider. + */ + enum ccu_div_type { + CCU_DIV_VAR, + CCU_DIV_GATE, ++ CCU_DIV_BUF, + CCU_DIV_FIXED + }; + +diff --git a/drivers/clk/baikal-t1/clk-ccu-div.c b/drivers/clk/baikal-t1/clk-ccu-div.c +index f141fda12b09a..90f4fda406ee6 100644 +--- a/drivers/clk/baikal-t1/clk-ccu-div.c ++++ b/drivers/clk/baikal-t1/clk-ccu-div.c +@@ -76,6 +76,16 @@ + .divider = _divider \ + } + ++#define CCU_DIV_BUF_INFO(_id, _name, _pname, _base, _flags) \ ++ { \ ++ .id = _id, \ ++ .name = _name, \ ++ .parent_name = _pname, \ ++ .base = _base, \ ++ .type = CCU_DIV_BUF, \ ++ .flags = _flags \ ++ } ++ + #define CCU_DIV_FIXED_INFO(_id, _name, _pname, _divider) \ + { \ + .id = _id, \ +@@ -188,11 +198,14 @@ static const struct ccu_div_rst_map axi_rst_map[] = { + * for the SoC devices registers IO-operations. + */ + static const struct ccu_div_info sys_info[] = { +- CCU_DIV_VAR_INFO(CCU_SYS_SATA_REF_CLK, "sys_sata_ref_clk", ++ CCU_DIV_VAR_INFO(CCU_SYS_SATA_CLK, "sys_sata_clk", + "sata_clk", CCU_SYS_SATA_REF_BASE, 4, + CLK_SET_RATE_GATE, + CCU_DIV_SKIP_ONE | CCU_DIV_LOCK_SHIFTED | + CCU_DIV_RESET_DOMAIN), ++ CCU_DIV_BUF_INFO(CCU_SYS_SATA_REF_CLK, "sys_sata_ref_clk", ++ "sys_sata_clk", CCU_SYS_SATA_REF_BASE, ++ CLK_SET_RATE_PARENT), + CCU_DIV_VAR_INFO(CCU_SYS_APB_CLK, "sys_apb_clk", + "pcie_clk", CCU_SYS_APB_BASE, 5, + CLK_IS_CRITICAL, CCU_DIV_RESET_DOMAIN), +@@ -204,10 +217,12 @@ static const struct ccu_div_info sys_info[] = { + "eth_clk", CCU_SYS_GMAC1_BASE, 5), + CCU_DIV_FIXED_INFO(CCU_SYS_GMAC1_PTP_CLK, "sys_gmac1_ptp_clk", + "eth_clk", 10), +- CCU_DIV_GATE_INFO(CCU_SYS_XGMAC_REF_CLK, "sys_xgmac_ref_clk", +- "eth_clk", CCU_SYS_XGMAC_BASE, 8), ++ CCU_DIV_GATE_INFO(CCU_SYS_XGMAC_CLK, "sys_xgmac_clk", ++ "eth_clk", CCU_SYS_XGMAC_BASE, 1), ++ CCU_DIV_FIXED_INFO(CCU_SYS_XGMAC_REF_CLK, "sys_xgmac_ref_clk", ++ "sys_xgmac_clk", 8), + CCU_DIV_FIXED_INFO(CCU_SYS_XGMAC_PTP_CLK, "sys_xgmac_ptp_clk", +- "eth_clk", 10), ++ "sys_xgmac_clk", 8), + CCU_DIV_GATE_INFO(CCU_SYS_USB_CLK, "sys_usb_clk", + "eth_clk", CCU_SYS_USB_BASE, 10), + CCU_DIV_VAR_INFO(CCU_SYS_PVT_CLK, "sys_pvt_clk", +@@ -396,6 +411,9 @@ static int ccu_div_clk_register(struct ccu_div_data *data) + init.base = info->base; + init.sys_regs = data->sys_regs; + init.divider = info->divider; ++ } else if (init.type == CCU_DIV_BUF) { ++ init.base = info->base; ++ init.sys_regs = data->sys_regs; + } else { + init.divider = info->divider; + } +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 48a1eb9f2d551..e74fe6219d14e 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -30,6 +30,7 @@ + #include <linux/debugfs.h> + #include <linux/delay.h> + #include <linux/io.h> ++#include <linux/math.h> + #include <linux/module.h> + #include <linux/of_device.h> + #include <linux/platform_device.h> +@@ -502,6 +503,8 @@ struct bcm2835_clock_data { + bool low_jitter; + + u32 tcnt_mux; ++ ++ bool round_up; + }; + + struct bcm2835_gate_data { +@@ -966,9 +969,9 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw, + return div; + } + +-static long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock, +- unsigned long parent_rate, +- u32 div) ++static unsigned long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock, ++ unsigned long parent_rate, ++ u32 div) + { + const struct bcm2835_clock_data *data = clock->data; + u64 temp; +@@ -993,12 +996,34 @@ static long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock, + return temp; + } + ++static unsigned long bcm2835_round_rate(unsigned long rate) ++{ ++ unsigned long scaler; ++ unsigned long limit; ++ ++ limit = rate / 100000; ++ ++ scaler = 1; ++ while (scaler < limit) ++ scaler *= 10; ++ ++ /* ++ * If increasing a clock by less than 0.1% changes it ++ * from ..999.. to ..000.., round up. ++ */ ++ if ((rate + scaler - 1) / scaler % 1000 == 0) ++ rate = roundup(rate, scaler); ++ ++ return rate; ++} ++ + static unsigned long bcm2835_clock_get_rate(struct clk_hw *hw, + unsigned long parent_rate) + { + struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw); + struct bcm2835_cprman *cprman = clock->cprman; + const struct bcm2835_clock_data *data = clock->data; ++ unsigned long rate; + u32 div; + + if (data->int_bits == 0 && data->frac_bits == 0) +@@ -1006,7 +1031,12 @@ static unsigned long bcm2835_clock_get_rate(struct clk_hw *hw, + + div = cprman_read(cprman, data->div_reg); + +- return bcm2835_clock_rate_from_divisor(clock, parent_rate, div); ++ rate = bcm2835_clock_rate_from_divisor(clock, parent_rate, div); ++ ++ if (data->round_up) ++ rate = bcm2835_round_rate(rate); ++ ++ return rate; + } + + static void bcm2835_clock_wait_busy(struct bcm2835_clock *clock) +@@ -1784,7 +1814,7 @@ static const struct bcm2835_clk_desc clk_desc_array[] = { + .load_mask = CM_PLLC_LOADPER, + .hold_mask = CM_PLLC_HOLDPER, + .fixed_divider = 1, +- .flags = CLK_SET_RATE_PARENT), ++ .flags = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT), + + /* + * PLLD is the display PLL, used to drive DSI display panels. +@@ -2143,7 +2173,8 @@ static const struct bcm2835_clk_desc clk_desc_array[] = { + .div_reg = CM_UARTDIV, + .int_bits = 10, + .frac_bits = 12, +- .tcnt_mux = 28), ++ .tcnt_mux = 28, ++ .round_up = true), + + /* TV encoder clock. Only operating frequency is 108Mhz. */ + [BCM2835_CLOCK_VEC] = REGISTER_PER_CLK( +diff --git a/drivers/clk/berlin/bg2.c b/drivers/clk/berlin/bg2.c +index bccdfa00fd373..67a9edbba29c4 100644 +--- a/drivers/clk/berlin/bg2.c ++++ b/drivers/clk/berlin/bg2.c +@@ -500,12 +500,15 @@ static void __init berlin2_clock_setup(struct device_node *np) + int n, ret; + + clk_data = kzalloc(struct_size(clk_data, hws, MAX_CLKS), GFP_KERNEL); +- if (!clk_data) ++ if (!clk_data) { ++ of_node_put(parent_np); + return; ++ } + clk_data->num = MAX_CLKS; + hws = clk_data->hws; + + gbase = of_iomap(parent_np, 0); ++ of_node_put(parent_np); + if (!gbase) + return; + +diff --git a/drivers/clk/berlin/bg2q.c b/drivers/clk/berlin/bg2q.c +index e9518d35f262e..dd2784bb75b64 100644 +--- a/drivers/clk/berlin/bg2q.c ++++ b/drivers/clk/berlin/bg2q.c +@@ -286,19 +286,23 @@ static void __init berlin2q_clock_setup(struct device_node *np) + int n, ret; + + clk_data = kzalloc(struct_size(clk_data, hws, MAX_CLKS), GFP_KERNEL); +- if (!clk_data) ++ if (!clk_data) { ++ of_node_put(parent_np); + return; ++ } + clk_data->num = MAX_CLKS; + hws = clk_data->hws; + + gbase = of_iomap(parent_np, 0); + if (!gbase) { ++ of_node_put(parent_np); + pr_err("%pOF: Unable to map global base\n", np); + return; + } + + /* BG2Q CPU PLL is not part of global registers */ + cpupll_base = of_iomap(parent_np, 1); ++ of_node_put(parent_np); + if (!cpupll_base) { + pr_err("%pOF: Unable to map cpupll base\n", np); + iounmap(gbase); +diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c +index 24dab2312bc6f..9c3305bcb27ae 100644 +--- a/drivers/clk/clk-ast2600.c ++++ b/drivers/clk/clk-ast2600.c +@@ -622,7 +622,7 @@ static int aspeed_g6_clk_probe(struct platform_device *pdev) + regmap_write(map, 0x308, 0x12000); /* 3x3 = 9 */ + + /* P-Bus (BCLK) clock divider */ +- hw = clk_hw_register_divider_table(dev, "bclk", "hpll", 0, ++ hw = clk_hw_register_divider_table(dev, "bclk", "epll", 0, + scu_g6_base + ASPEED_G6_CLK_SELECTION1, 20, 3, 0, + ast2600_div_table, + &aspeed_g6_clk_lock); +diff --git a/drivers/clk/clk-oxnas.c b/drivers/clk/clk-oxnas.c +index cda5e258355bc..584e293156ad6 100644 +--- a/drivers/clk/clk-oxnas.c ++++ b/drivers/clk/clk-oxnas.c +@@ -207,7 +207,7 @@ static const struct of_device_id oxnas_stdclk_dt_ids[] = { + + static int oxnas_stdclk_probe(struct platform_device *pdev) + { +- struct device_node *np = pdev->dev.of_node; ++ struct device_node *np = pdev->dev.of_node, *parent_np; + const struct oxnas_stdclk_data *data; + struct regmap *regmap; + int ret; +@@ -215,7 +215,9 @@ static int oxnas_stdclk_probe(struct platform_device *pdev) + + data = of_device_get_match_data(&pdev->dev); + +- regmap = syscon_node_to_regmap(of_get_parent(np)); ++ parent_np = of_get_parent(np); ++ regmap = syscon_node_to_regmap(parent_np); ++ of_node_put(parent_np); + if (IS_ERR(regmap)) { + dev_err(&pdev->dev, "failed to have parent regmap\n"); + return PTR_ERR(regmap); +diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c +index 88898b97a4431..5eddb9f0d6bdb 100644 +--- a/drivers/clk/clk-qoriq.c ++++ b/drivers/clk/clk-qoriq.c +@@ -1063,8 +1063,13 @@ static void __init _clockgen_init(struct device_node *np, bool legacy); + */ + static void __init legacy_init_clockgen(struct device_node *np) + { +- if (!clockgen.node) +- _clockgen_init(of_get_parent(np), true); ++ if (!clockgen.node) { ++ struct device_node *parent_np; ++ ++ parent_np = of_get_parent(np); ++ _clockgen_init(parent_np, true); ++ of_node_put(parent_np); ++ } + } + + /* Legacy node */ +@@ -1159,6 +1164,7 @@ static struct clk * __init create_sysclk(const char *name) + sysclk = of_get_child_by_name(clockgen.node, "sysclk"); + if (sysclk) { + clk = sysclk_from_fixed(sysclk, name); ++ of_node_put(sysclk); + if (!IS_ERR(clk)) + return clk; + } +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index e7be3e54b9be4..03cfef494b49b 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -1204,7 +1204,7 @@ static const struct vc5_chip_info idt_5p49v6901_info = { + .model = IDT_VC6_5P49V6901, + .clk_fod_cnt = 4, + .clk_out_cnt = 5, +- .flags = VC5_HAS_PFD_FREQ_DBL, ++ .flags = VC5_HAS_PFD_FREQ_DBL | VC5_HAS_BYPASS_SYNC_BIT, + }; + + static const struct vc5_chip_info idt_5p49v6965_info = { +diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c +index c56e406138dbe..1e6870f3671f6 100644 +--- a/drivers/clk/imx/clk-scu.c ++++ b/drivers/clk/imx/clk-scu.c +@@ -695,7 +695,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name, + pr_warn("%s: failed to attached the power domain %d\n", + name, ret); + +- platform_device_add(pdev); ++ ret = platform_device_add(pdev); ++ if (ret) { ++ platform_device_put(pdev); ++ return ERR_PTR(ret); ++ } + + /* For API backwards compatiblilty, simply return NULL for success */ + return NULL; +diff --git a/drivers/clk/mediatek/clk-mt8183-mfgcfg.c b/drivers/clk/mediatek/clk-mt8183-mfgcfg.c +index d774edaf760be..230299728859c 100644 +--- a/drivers/clk/mediatek/clk-mt8183-mfgcfg.c ++++ b/drivers/clk/mediatek/clk-mt8183-mfgcfg.c +@@ -18,9 +18,9 @@ static const struct mtk_gate_regs mfg_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_MFG(_id, _name, _parent, _shift) \ +- GATE_MTK(_id, _name, _parent, &mfg_cg_regs, _shift, \ +- &mtk_clk_gate_ops_setclr) ++#define GATE_MFG(_id, _name, _parent, _shift) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &mfg_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, CLK_SET_RATE_PARENT) + + static const struct mtk_gate mfg_clks[] = { + GATE_MFG(CLK_MFG_BG3D, "mfg_bg3d", "mfg_sel", 0) +diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +index 8ebe3b9415c48..0faa876815e83 100644 +--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c ++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +@@ -54,8 +54,12 @@ static const struct mtk_gate_regs infra_ao4_cg_regs = { + #define GATE_INFRA_AO1(_id, _name, _parent, _shift) \ + GATE_INFRA_AO1_FLAGS(_id, _name, _parent, _shift, 0) + ++#define GATE_INFRA_AO2_FLAGS(_id, _name, _parent, _shift, _flag) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &infra_ao2_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, _flag) ++ + #define GATE_INFRA_AO2(_id, _name, _parent, _shift) \ +- GATE_MTK(_id, _name, _parent, &infra_ao2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) ++ GATE_INFRA_AO2_FLAGS(_id, _name, _parent, _shift, 0) + + #define GATE_INFRA_AO3_FLAGS(_id, _name, _parent, _shift, _flag) \ + GATE_MTK_FLAGS(_id, _name, _parent, &infra_ao3_cg_regs, _shift, \ +@@ -135,8 +139,11 @@ static const struct mtk_gate infra_ao_clks[] = { + GATE_INFRA_AO2(CLK_INFRA_AO_UNIPRO_SYS, "infra_ao_unipro_sys", "top_ufs", 11), + GATE_INFRA_AO2(CLK_INFRA_AO_UNIPRO_TICK, "infra_ao_unipro_tick", "top_ufs_tick1us", 12), + GATE_INFRA_AO2(CLK_INFRA_AO_UFS_MP_SAP_B, "infra_ao_ufs_mp_sap_b", "top_ufs_mp_sap_cfg", 13), +- GATE_INFRA_AO2(CLK_INFRA_AO_PWRMCU, "infra_ao_pwrmcu", "top_pwrmcu", 15), +- GATE_INFRA_AO2(CLK_INFRA_AO_PWRMCU_BUS_H, "infra_ao_pwrmcu_bus_h", "top_axi", 17), ++ /* pwrmcu is used by ATF for platform PM: clocks must never be disabled by the kernel */ ++ GATE_INFRA_AO2_FLAGS(CLK_INFRA_AO_PWRMCU, "infra_ao_pwrmcu", "top_pwrmcu", 15, ++ CLK_IS_CRITICAL), ++ GATE_INFRA_AO2_FLAGS(CLK_INFRA_AO_PWRMCU_BUS_H, "infra_ao_pwrmcu_bus_h", "top_axi", 17, ++ CLK_IS_CRITICAL), + GATE_INFRA_AO2(CLK_INFRA_AO_APDMA_B, "infra_ao_apdma_b", "top_axi", 18), + GATE_INFRA_AO2(CLK_INFRA_AO_SPI4, "infra_ao_spi4", "top_spi", 25), + GATE_INFRA_AO2(CLK_INFRA_AO_SPI5, "infra_ao_spi5", "top_spi", 26), +diff --git a/drivers/clk/mediatek/clk-mt8195-mfg.c b/drivers/clk/mediatek/clk-mt8195-mfg.c +index 9411c556a5a97..c94cb71bd9b94 100644 +--- a/drivers/clk/mediatek/clk-mt8195-mfg.c ++++ b/drivers/clk/mediatek/clk-mt8195-mfg.c +@@ -17,10 +17,12 @@ static const struct mtk_gate_regs mfg_cg_regs = { + }; + + #define GATE_MFG(_id, _name, _parent, _shift) \ +- GATE_MTK(_id, _name, _parent, &mfg_cg_regs, _shift, &mtk_clk_gate_ops_setclr) ++ GATE_MTK_FLAGS(_id, _name, _parent, &mfg_cg_regs, \ ++ _shift, &mtk_clk_gate_ops_setclr, \ ++ CLK_SET_RATE_PARENT) + + static const struct mtk_gate mfg_clks[] = { +- GATE_MFG(CLK_MFG_BG3D, "mfg_bg3d", "top_mfg_core_tmp", 0), ++ GATE_MFG(CLK_MFG_BG3D, "mfg_bg3d", "mfg_ck_fast_ref", 0), + }; + + static const struct mtk_clk_desc mfg_desc = { +diff --git a/drivers/clk/mediatek/clk-mt8195-vdo0.c b/drivers/clk/mediatek/clk-mt8195-vdo0.c +index 261a7f76dd3cc..07b46bfd50406 100644 +--- a/drivers/clk/mediatek/clk-mt8195-vdo0.c ++++ b/drivers/clk/mediatek/clk-mt8195-vdo0.c +@@ -37,6 +37,10 @@ static const struct mtk_gate_regs vdo0_2_cg_regs = { + #define GATE_VDO0_2(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &vdo0_2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + ++#define GATE_VDO0_2_FLAGS(_id, _name, _parent, _shift, _flags) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &vdo0_2_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, _flags) ++ + static const struct mtk_gate vdo0_clks[] = { + /* VDO0_0 */ + GATE_VDO0_0(CLK_VDO0_DISP_OVL0, "vdo0_disp_ovl0", "top_vpp", 0), +@@ -85,7 +89,8 @@ static const struct mtk_gate vdo0_clks[] = { + /* VDO0_2 */ + GATE_VDO0_2(CLK_VDO0_DSI0_DSI, "vdo0_dsi0_dsi", "top_dsi_occ", 0), + GATE_VDO0_2(CLK_VDO0_DSI1_DSI, "vdo0_dsi1_dsi", "top_dsi_occ", 8), +- GATE_VDO0_2(CLK_VDO0_DP_INTF0_DP_INTF, "vdo0_dp_intf0_dp_intf", "top_edp", 16), ++ GATE_VDO0_2_FLAGS(CLK_VDO0_DP_INTF0_DP_INTF, "vdo0_dp_intf0_dp_intf", ++ "top_edp", 16, CLK_SET_RATE_PARENT), + }; + + static int clk_mt8195_vdo0_probe(struct platform_device *pdev) +diff --git a/drivers/clk/mediatek/clk-mt8195-vdo1.c b/drivers/clk/mediatek/clk-mt8195-vdo1.c +index 3378487d2c904..d54d7726d1866 100644 +--- a/drivers/clk/mediatek/clk-mt8195-vdo1.c ++++ b/drivers/clk/mediatek/clk-mt8195-vdo1.c +@@ -43,6 +43,10 @@ static const struct mtk_gate_regs vdo1_3_cg_regs = { + #define GATE_VDO1_2(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &vdo1_2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + ++#define GATE_VDO1_2_FLAGS(_id, _name, _parent, _shift, _flags) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &vdo1_2_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, _flags) ++ + #define GATE_VDO1_3(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &vdo1_3_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +@@ -99,7 +103,7 @@ static const struct mtk_gate vdo1_clks[] = { + GATE_VDO1_2(CLK_VDO1_DISP_MONITOR_DPI0, "vdo1_disp_monitor_dpi0", "top_vpp", 1), + GATE_VDO1_2(CLK_VDO1_DPI1, "vdo1_dpi1", "top_vpp", 8), + GATE_VDO1_2(CLK_VDO1_DISP_MONITOR_DPI1, "vdo1_disp_monitor_dpi1", "top_vpp", 9), +- GATE_VDO1_2(CLK_VDO1_DPINTF, "vdo1_dpintf", "top_vpp", 16), ++ GATE_VDO1_2_FLAGS(CLK_VDO1_DPINTF, "vdo1_dpintf", "top_dp", 16, CLK_SET_RATE_PARENT), + GATE_VDO1_2(CLK_VDO1_DISP_MONITOR_DPINTF, "vdo1_disp_monitor_dpintf", "top_vpp", 17), + /* VDO1_3 */ + GATE_VDO1_3(CLK_VDO1_26M_SLOW, "vdo1_26m_slow", "clk26m", 8), +diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c +index b9188000ab3c6..35845163edae4 100644 +--- a/drivers/clk/mediatek/clk-mtk.c ++++ b/drivers/clk/mediatek/clk-mtk.c +@@ -80,7 +80,7 @@ err: + if (IS_ERR_OR_NULL(clk_data->hws[rc->id])) + continue; + +- clk_unregister_fixed_rate(clk_data->hws[rc->id]->clk); ++ clk_hw_unregister_fixed_rate(clk_data->hws[rc->id]); + clk_data->hws[rc->id] = ERR_PTR(-ENOENT); + } + +@@ -102,7 +102,7 @@ void mtk_clk_unregister_fixed_clks(const struct mtk_fixed_clk *clks, int num, + if (IS_ERR_OR_NULL(clk_data->hws[rc->id])) + continue; + +- clk_unregister_fixed_rate(clk_data->hws[rc->id]->clk); ++ clk_hw_unregister_fixed_rate(clk_data->hws[rc->id]); + clk_data->hws[rc->id] = ERR_PTR(-ENOENT); + } + } +@@ -146,7 +146,7 @@ err: + if (IS_ERR_OR_NULL(clk_data->hws[ff->id])) + continue; + +- clk_unregister_fixed_factor(clk_data->hws[ff->id]->clk); ++ clk_hw_unregister_fixed_factor(clk_data->hws[ff->id]); + clk_data->hws[ff->id] = ERR_PTR(-ENOENT); + } + +@@ -168,7 +168,7 @@ void mtk_clk_unregister_factors(const struct mtk_fixed_factor *clks, int num, + if (IS_ERR_OR_NULL(clk_data->hws[ff->id])) + continue; + +- clk_unregister_fixed_factor(clk_data->hws[ff->id]->clk); ++ clk_hw_unregister_fixed_factor(clk_data->hws[ff->id]); + clk_data->hws[ff->id] = ERR_PTR(-ENOENT); + } + } +@@ -393,7 +393,7 @@ err: + if (IS_ERR_OR_NULL(clk_data->hws[mcd->id])) + continue; + +- mtk_clk_unregister_composite(clk_data->hws[mcd->id]); ++ clk_hw_unregister_divider(clk_data->hws[mcd->id]); + clk_data->hws[mcd->id] = ERR_PTR(-ENOENT); + } + +@@ -414,7 +414,7 @@ void mtk_clk_unregister_dividers(const struct mtk_clk_divider *mcds, int num, + if (IS_ERR_OR_NULL(clk_data->hws[mcd->id])) + continue; + +- clk_unregister_divider(clk_data->hws[mcd->id]->clk); ++ clk_hw_unregister_divider(clk_data->hws[mcd->id]); + clk_data->hws[mcd->id] = ERR_PTR(-ENOENT); + } + } +diff --git a/drivers/clk/meson/meson-aoclk.c b/drivers/clk/meson/meson-aoclk.c +index 27cd2c1f3f612..434cd8f9de826 100644 +--- a/drivers/clk/meson/meson-aoclk.c ++++ b/drivers/clk/meson/meson-aoclk.c +@@ -38,6 +38,7 @@ int meson_aoclkc_probe(struct platform_device *pdev) + struct meson_aoclk_reset_controller *rstc; + struct meson_aoclk_data *data; + struct device *dev = &pdev->dev; ++ struct device_node *np; + struct regmap *regmap; + int ret, clkid; + +@@ -49,7 +50,9 @@ int meson_aoclkc_probe(struct platform_device *pdev) + if (!rstc) + return -ENOMEM; + +- regmap = syscon_node_to_regmap(of_get_parent(dev->of_node)); ++ np = of_get_parent(dev->of_node); ++ regmap = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(regmap)) { + dev_err(dev, "failed to get regmap\n"); + return PTR_ERR(regmap); +diff --git a/drivers/clk/meson/meson-eeclk.c b/drivers/clk/meson/meson-eeclk.c +index 8d5a5dab955a8..0e5e6b57eb20e 100644 +--- a/drivers/clk/meson/meson-eeclk.c ++++ b/drivers/clk/meson/meson-eeclk.c +@@ -18,6 +18,7 @@ int meson_eeclkc_probe(struct platform_device *pdev) + { + const struct meson_eeclkc_data *data; + struct device *dev = &pdev->dev; ++ struct device_node *np; + struct regmap *map; + int ret, i; + +@@ -26,7 +27,9 @@ int meson_eeclkc_probe(struct platform_device *pdev) + return -EINVAL; + + /* Get the hhi system controller node */ +- map = syscon_node_to_regmap(of_get_parent(dev->of_node)); ++ np = of_get_parent(dev->of_node); ++ map = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(map)) { + dev_err(dev, + "failed to get HHI regmap\n"); +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 8f3b7a94a6677..827e78fb16a84 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -3792,12 +3792,15 @@ static void __init meson8b_clkc_init_common(struct device_node *np, + struct clk_hw_onecell_data *clk_hw_onecell_data) + { + struct meson8b_clk_reset *rstc; ++ struct device_node *parent_np; + const char *notifier_clk_name; + struct clk *notifier_clk; + struct regmap *map; + int i, ret; + +- map = syscon_node_to_regmap(of_get_parent(np)); ++ parent_np = of_get_parent(np); ++ map = syscon_node_to_regmap(parent_np); ++ of_node_put(parent_np); + if (IS_ERR(map)) { + pr_err("failed to get HHI regmap - Trying obsolete regs\n"); + return; +diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig +index bc4dcf356d828..b1b141abc01c2 100644 +--- a/drivers/clk/qcom/Kconfig ++++ b/drivers/clk/qcom/Kconfig +@@ -637,6 +637,7 @@ config SM_DISPCC_6350 + + config SM_GCC_6115 + tristate "SM6115 and SM4250 Global Clock Controller" ++ select QCOM_GDSC + help + Support for the global clock controller on SM6115 and SM4250 devices. + Say Y if you want to use peripheral devices such as UART, SPI, +diff --git a/drivers/clk/qcom/apss-ipq6018.c b/drivers/clk/qcom/apss-ipq6018.c +index d78ff2f310bfa..b5d93657e1ee3 100644 +--- a/drivers/clk/qcom/apss-ipq6018.c ++++ b/drivers/clk/qcom/apss-ipq6018.c +@@ -57,7 +57,7 @@ static struct clk_branch apcs_alias0_core_clk = { + .parent_hws = (const struct clk_hw *[]){ + &apcs_alias0_clk_src.clkr.hw }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, ++ .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, + .ops = &clk_branch2_ops, + }, + }, +diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c +index 9b97425008ce1..db918c92a522c 100644 +--- a/drivers/clk/qcom/gcc-sdm660.c ++++ b/drivers/clk/qcom/gcc-sdm660.c +@@ -757,7 +757,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_data = gcc_parent_data_xo_gpll0_gpll4_gpll0_early_div, + .num_parents = ARRAY_SIZE(gcc_parent_data_xo_gpll0_gpll4_gpll0_early_div), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +diff --git a/drivers/clk/qcom/gcc-sm6115.c b/drivers/clk/qcom/gcc-sm6115.c +index 68fe9f6f0d2f3..e24a977c25806 100644 +--- a/drivers/clk/qcom/gcc-sm6115.c ++++ b/drivers/clk/qcom/gcc-sm6115.c +@@ -53,11 +53,25 @@ static struct pll_vco gpll10_vco[] = { + { 750000000, 1500000000, 1 }, + }; + ++static const u8 clk_alpha_pll_regs_offset[][PLL_OFF_MAX_REGS] = { ++ [CLK_ALPHA_PLL_TYPE_DEFAULT] = { ++ [PLL_OFF_L_VAL] = 0x04, ++ [PLL_OFF_ALPHA_VAL] = 0x08, ++ [PLL_OFF_ALPHA_VAL_U] = 0x0c, ++ [PLL_OFF_TEST_CTL] = 0x10, ++ [PLL_OFF_TEST_CTL_U] = 0x14, ++ [PLL_OFF_USER_CTL] = 0x18, ++ [PLL_OFF_USER_CTL_U] = 0x1c, ++ [PLL_OFF_CONFIG_CTL] = 0x20, ++ [PLL_OFF_STATUS] = 0x24, ++ }, ++}; ++ + static struct clk_alpha_pll gpll0 = { + .offset = 0x0, + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(0), +@@ -83,7 +97,7 @@ static struct clk_alpha_pll_postdiv gpll0_out_aux2 = { + .post_div_table = post_div_table_gpll0_out_aux2, + .num_post_div = ARRAY_SIZE(post_div_table_gpll0_out_aux2), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_aux2", + .parent_hws = (const struct clk_hw *[]){ &gpll0.clkr.hw }, +@@ -115,7 +129,7 @@ static struct clk_alpha_pll_postdiv gpll0_out_main = { + .post_div_table = post_div_table_gpll0_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll0_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll0.clkr.hw }, +@@ -137,7 +151,7 @@ static struct clk_alpha_pll gpll10 = { + .offset = 0xa000, + .vco_table = gpll10_vco, + .num_vco = ARRAY_SIZE(gpll10_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(10), +@@ -163,7 +177,7 @@ static struct clk_alpha_pll_postdiv gpll10_out_main = { + .post_div_table = post_div_table_gpll10_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll10_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll10_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll10.clkr.hw }, +@@ -189,7 +203,7 @@ static struct clk_alpha_pll gpll11 = { + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), + .flags = SUPPORTS_DYNAMIC_UPDATE, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(11), +@@ -215,7 +229,7 @@ static struct clk_alpha_pll_postdiv gpll11_out_main = { + .post_div_table = post_div_table_gpll11_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll11_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll11_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll11.clkr.hw }, +@@ -229,7 +243,7 @@ static struct clk_alpha_pll gpll3 = { + .offset = 0x3000, + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(3), +@@ -248,7 +262,7 @@ static struct clk_alpha_pll gpll4 = { + .offset = 0x4000, + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(4), +@@ -274,7 +288,7 @@ static struct clk_alpha_pll_postdiv gpll4_out_main = { + .post_div_table = post_div_table_gpll4_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll4_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll4_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll4.clkr.hw }, +@@ -287,7 +301,7 @@ static struct clk_alpha_pll gpll6 = { + .offset = 0x6000, + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(6), +@@ -313,7 +327,7 @@ static struct clk_alpha_pll_postdiv gpll6_out_main = { + .post_div_table = post_div_table_gpll6_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll6_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll6_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll6.clkr.hw }, +@@ -326,7 +340,7 @@ static struct clk_alpha_pll gpll7 = { + .offset = 0x7000, + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr = { + .enable_reg = 0x79000, + .enable_mask = BIT(7), +@@ -352,7 +366,7 @@ static struct clk_alpha_pll_postdiv gpll7_out_main = { + .post_div_table = post_div_table_gpll7_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll7_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll7_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll7.clkr.hw }, +@@ -380,7 +394,7 @@ static struct clk_alpha_pll gpll8 = { + .offset = 0x8000, + .vco_table = default_vco, + .num_vco = ARRAY_SIZE(default_vco), +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .flags = SUPPORTS_DYNAMIC_UPDATE, + .clkr = { + .enable_reg = 0x79000, +@@ -407,7 +421,7 @@ static struct clk_alpha_pll_postdiv gpll8_out_main = { + .post_div_table = post_div_table_gpll8_out_main, + .num_post_div = ARRAY_SIZE(post_div_table_gpll8_out_main), + .width = 4, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs_offset[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll8_out_main", + .parent_hws = (const struct clk_hw *[]){ &gpll8.clkr.hw }, +diff --git a/drivers/clk/samsung/clk-exynosautov9.c b/drivers/clk/samsung/clk-exynosautov9.c +index d9e1f8e4a7b45..487a71b32a009 100644 +--- a/drivers/clk/samsung/clk-exynosautov9.c ++++ b/drivers/clk/samsung/clk-exynosautov9.c +@@ -1170,9 +1170,9 @@ static const struct samsung_cmu_info fsys2_cmu_info __initconst = { + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_2 0x2058 + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_3 0x205c + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_4 0x2060 +-#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_7 0x206c + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_5 0x2064 + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_6 0x2068 ++#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_7 0x206c + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_8 0x2070 + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_9 0x2074 + #define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_10 0x204c +@@ -1418,14 +1418,14 @@ static const struct samsung_cmu_info peric0_cmu_info __initconst = { + #define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_IPCLK_11 0x2020 + #define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_0 0x2044 + #define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_1 0x2048 +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_2 0x2058 +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_3 0x205c +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_4 0x2060 +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7 0x206c +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_5 0x2064 +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_6 0x2068 +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_8 0x2070 +-#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_9 0x2074 ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_2 0x2054 ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_3 0x2058 ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_4 0x205c ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_5 0x2060 ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_6 0x2064 ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7 0x2068 ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_8 0x206c ++#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_9 0x2070 + #define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_10 0x204c + #define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_11 0x2050 + +@@ -1463,9 +1463,9 @@ static const unsigned long peric1_clk_regs[] __initconst = { + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_2, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_3, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_4, +- CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_5, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_6, ++ CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_8, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_9, + CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_10, +diff --git a/drivers/clk/sprd/common.c b/drivers/clk/sprd/common.c +index d620bbbcdfc88..ce81e4087a8fc 100644 +--- a/drivers/clk/sprd/common.c ++++ b/drivers/clk/sprd/common.c +@@ -41,7 +41,7 @@ int sprd_clk_regmap_init(struct platform_device *pdev, + { + void __iomem *base; + struct device *dev = &pdev->dev; +- struct device_node *node = dev->of_node; ++ struct device_node *node = dev->of_node, *np; + struct regmap *regmap; + + if (of_find_property(node, "sprd,syscon", NULL)) { +@@ -50,9 +50,10 @@ int sprd_clk_regmap_init(struct platform_device *pdev, + pr_err("%s: failed to get syscon regmap\n", __func__); + return PTR_ERR(regmap); + } +- } else if (of_device_is_compatible(of_get_parent(dev->of_node), +- "syscon")) { +- regmap = device_node_to_regmap(of_get_parent(dev->of_node)); ++ } else if (of_device_is_compatible(np = of_get_parent(node), "syscon") || ++ (of_node_put(np), 0)) { ++ regmap = device_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(regmap)) { + dev_err(dev, "failed to get regmap from its parent.\n"); + return PTR_ERR(regmap); +diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c +index 582a22c049194..d820292a381d0 100644 +--- a/drivers/clk/st/clkgen-fsyn.c ++++ b/drivers/clk/st/clkgen-fsyn.c +@@ -987,6 +987,7 @@ static void __init st_of_quadfs_setup(struct device_node *np, + const char *pll_name, *clk_parent_name; + void __iomem *reg; + spinlock_t *lock; ++ struct device_node *parent_np; + + /* + * First check for reg property within the node to keep backward +@@ -994,7 +995,9 @@ static void __init st_of_quadfs_setup(struct device_node *np, + */ + reg = of_iomap(np, 0); + if (!reg) { +- reg = of_iomap(of_get_parent(np), 0); ++ parent_np = of_get_parent(np); ++ reg = of_iomap(parent_np, 0); ++ of_node_put(parent_np); + if (!reg) { + pr_err("%s: Failed to get base address\n", __func__); + return; +diff --git a/drivers/clk/st/clkgen-mux.c b/drivers/clk/st/clkgen-mux.c +index ee39af7a0b721..596e939ad905e 100644 +--- a/drivers/clk/st/clkgen-mux.c ++++ b/drivers/clk/st/clkgen-mux.c +@@ -56,6 +56,7 @@ static void __init st_of_clkgen_mux_setup(struct device_node *np, + void __iomem *reg; + const char **parents; + int num_parents = 0; ++ struct device_node *parent_np; + + /* + * First check for reg property within the node to keep backward +@@ -63,7 +64,9 @@ static void __init st_of_clkgen_mux_setup(struct device_node *np, + */ + reg = of_iomap(np, 0); + if (!reg) { +- reg = of_iomap(of_get_parent(np), 0); ++ parent_np = of_get_parent(np); ++ reg = of_iomap(parent_np, 0); ++ of_node_put(parent_np); + if (!reg) { + pr_err("%s: Failed to get base address\n", __func__); + return; +diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c +index ef718c4b38267..f7405a58877e2 100644 +--- a/drivers/clk/tegra/clk-tegra114.c ++++ b/drivers/clk/tegra/clk-tegra114.c +@@ -1317,6 +1317,7 @@ static void __init tegra114_clock_init(struct device_node *np) + } + + pmc_base = of_iomap(node, 0); ++ of_node_put(node); + if (!pmc_base) { + pr_err("Can't map pmc registers\n"); + WARN_ON(1); +diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c +index be3c33441cfc4..8a4514f6d5033 100644 +--- a/drivers/clk/tegra/clk-tegra20.c ++++ b/drivers/clk/tegra/clk-tegra20.c +@@ -1131,6 +1131,7 @@ static void __init tegra20_clock_init(struct device_node *np) + } + + pmc_base = of_iomap(node, 0); ++ of_node_put(node); + if (!pmc_base) { + pr_err("Can't map pmc registers\n"); + BUG(); +diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c +index b9099012dc7b1..499f999e91e13 100644 +--- a/drivers/clk/tegra/clk-tegra210.c ++++ b/drivers/clk/tegra/clk-tegra210.c +@@ -3748,6 +3748,7 @@ static void __init tegra210_clock_init(struct device_node *np) + } + + pmc_base = of_iomap(node, 0); ++ of_node_put(node); + if (!pmc_base) { + pr_err("Can't map pmc registers\n"); + WARN_ON(1); +diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c +index aa0950c4f4985..5c278d6c985e9 100644 +--- a/drivers/clk/ti/clk-dra7-atl.c ++++ b/drivers/clk/ti/clk-dra7-atl.c +@@ -253,14 +253,16 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) + if (rc) { + pr_err("%s: failed to lookup atl clock %d\n", __func__, + i); +- return -EINVAL; ++ ret = -EINVAL; ++ goto pm_put; + } + + clk = of_clk_get_from_provider(&clkspec); + if (IS_ERR(clk)) { + pr_err("%s: failed to get atl clock %d from provider\n", + __func__, i); +- return PTR_ERR(clk); ++ ret = PTR_ERR(clk); ++ goto pm_put; + } + + cdesc = to_atl_desc(__clk_get_hw(clk)); +@@ -293,8 +295,9 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) + if (cdesc->enabled) + atl_clk_enable(__clk_get_hw(clk)); + } +- pm_runtime_put_sync(cinfo->dev); + ++pm_put: ++ pm_runtime_put_sync(cinfo->dev); + return ret; + } + +diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c +index 121d8610beb15..6b2de32ef88df 100644 +--- a/drivers/clk/ti/clk.c ++++ b/drivers/clk/ti/clk.c +@@ -148,11 +148,12 @@ static struct device_node *ti_find_clock_provider(struct device_node *from, + break; + } + } +- of_node_put(from); + kfree(tmp); + +- if (found) ++ if (found) { ++ of_node_put(from); + return np; ++ } + + /* Fall back to using old node name base provider name */ + return of_find_node_by_name(from, name); +diff --git a/drivers/clk/zynqmp/clkc.c b/drivers/clk/zynqmp/clkc.c +index eb25303eefed4..2c9da6623b84e 100644 +--- a/drivers/clk/zynqmp/clkc.c ++++ b/drivers/clk/zynqmp/clkc.c +@@ -710,6 +710,13 @@ static void zynqmp_get_clock_info(void) + FIELD_PREP(CLK_ATTR_NODE_INDEX, i); + + zynqmp_pm_clock_get_name(clock[i].clk_id, &name); ++ ++ /* ++ * Terminate with NULL character in case name provided by firmware ++ * is longer and truncated due to size limit. ++ */ ++ name.name[sizeof(name.name) - 1] = '\0'; ++ + if (!strcmp(name.name, RESERVED_CLK_NAME)) + continue; + strncpy(clock[i].clk_name, name.name, MAX_NAME_LEN); +diff --git a/drivers/clk/zynqmp/pll.c b/drivers/clk/zynqmp/pll.c +index 91a6b4cc910eb..0d3e1377b092c 100644 +--- a/drivers/clk/zynqmp/pll.c ++++ b/drivers/clk/zynqmp/pll.c +@@ -102,26 +102,25 @@ static long zynqmp_pll_round_rate(struct clk_hw *hw, unsigned long rate, + unsigned long *prate) + { + u32 fbdiv; +- long rate_div, f; ++ u32 mult, div; + +- /* Enable the fractional mode if needed */ +- rate_div = (rate * FRAC_DIV) / *prate; +- f = rate_div % FRAC_DIV; +- if (f) { +- if (rate > PS_PLL_VCO_MAX) { +- fbdiv = rate / PS_PLL_VCO_MAX; +- rate = rate / (fbdiv + 1); +- } +- if (rate < PS_PLL_VCO_MIN) { +- fbdiv = DIV_ROUND_UP(PS_PLL_VCO_MIN, rate); +- rate = rate * fbdiv; +- } +- return rate; ++ /* Let rate fall inside the range PS_PLL_VCO_MIN ~ PS_PLL_VCO_MAX */ ++ if (rate > PS_PLL_VCO_MAX) { ++ div = DIV_ROUND_UP(rate, PS_PLL_VCO_MAX); ++ rate = rate / div; ++ } ++ if (rate < PS_PLL_VCO_MIN) { ++ mult = DIV_ROUND_UP(PS_PLL_VCO_MIN, rate); ++ rate = rate * mult; + } + + fbdiv = DIV_ROUND_CLOSEST(rate, *prate); +- fbdiv = clamp_t(u32, fbdiv, PLL_FBDIV_MIN, PLL_FBDIV_MAX); +- return *prate * fbdiv; ++ if (fbdiv < PLL_FBDIV_MIN || fbdiv > PLL_FBDIV_MAX) { ++ fbdiv = clamp_t(u32, fbdiv, PLL_FBDIV_MIN, PLL_FBDIV_MAX); ++ rate = *prate * fbdiv; ++ } ++ ++ return rate; + } + + /** +diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c +index 9ab8221ee3c65..a7ff77550e173 100644 +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -44,8 +44,8 @@ + #define CNTACR_RWVT BIT(4) + #define CNTACR_RWPT BIT(5) + +-#define CNTVCT_LO 0x00 +-#define CNTPCT_LO 0x08 ++#define CNTPCT_LO 0x00 ++#define CNTVCT_LO 0x08 + #define CNTFRQ 0x10 + #define CNTP_CVAL_LO 0x20 + #define CNTP_CTL 0x2c +@@ -473,6 +473,8 @@ static const struct arch_timer_erratum_workaround ool_workarounds[] = { + .desc = "ARM erratum 858921", + .read_cntpct_el0 = arm64_858921_read_cntpct_el0, + .read_cntvct_el0 = arm64_858921_read_cntvct_el0, ++ .set_next_event_phys = erratum_set_next_event_phys, ++ .set_next_event_virt = erratum_set_next_event_virt, + }, + #endif + #ifdef CONFIG_SUN50I_ERRATUM_UNKNOWN1 +diff --git a/drivers/clocksource/timer-gxp.c b/drivers/clocksource/timer-gxp.c +index 8b38b32123880..fe4fa8d7b3f13 100644 +--- a/drivers/clocksource/timer-gxp.c ++++ b/drivers/clocksource/timer-gxp.c +@@ -171,6 +171,7 @@ static int gxp_timer_probe(struct platform_device *pdev) + { + struct platform_device *gxp_watchdog_device; + struct device *dev = &pdev->dev; ++ int ret; + + if (!gxp_timer) { + pr_err("Gxp Timer not initialized, cannot create watchdog"); +@@ -187,7 +188,11 @@ static int gxp_timer_probe(struct platform_device *pdev) + gxp_watchdog_device->dev.platform_data = gxp_timer->counter; + gxp_watchdog_device->dev.parent = dev; + +- return platform_device_add(gxp_watchdog_device); ++ ret = platform_device_add(gxp_watchdog_device); ++ if (ret) ++ platform_device_put(gxp_watchdog_device); ++ ++ return ret; + } + + static const struct of_device_id gxp_timer_of_match[] = { +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index 9ac75c1cde9c2..d63a28c5f95a9 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -152,6 +152,7 @@ static inline int amd_pstate_enable(bool enable) + static int pstate_init_perf(struct amd_cpudata *cpudata) + { + u64 cap1; ++ u32 highest_perf; + + int ret = rdmsrl_safe_on_cpu(cpudata->cpu, MSR_AMD_CPPC_CAP1, + &cap1); +@@ -163,7 +164,11 @@ static int pstate_init_perf(struct amd_cpudata *cpudata) + * + * CPPC entry doesn't indicate the highest performance in some ASICs. + */ +- WRITE_ONCE(cpudata->highest_perf, amd_get_highest_perf()); ++ highest_perf = amd_get_highest_perf(); ++ if (highest_perf > AMD_CPPC_HIGHEST_PERF(cap1)) ++ highest_perf = AMD_CPPC_HIGHEST_PERF(cap1); ++ ++ WRITE_ONCE(cpudata->highest_perf, highest_perf); + + WRITE_ONCE(cpudata->nominal_perf, AMD_CPPC_NOMINAL_PERF(cap1)); + WRITE_ONCE(cpudata->lowest_nonlinear_perf, AMD_CPPC_LOWNONLIN_PERF(cap1)); +@@ -175,12 +180,17 @@ static int pstate_init_perf(struct amd_cpudata *cpudata) + static int cppc_init_perf(struct amd_cpudata *cpudata) + { + struct cppc_perf_caps cppc_perf; ++ u32 highest_perf; + + int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf); + if (ret) + return ret; + +- WRITE_ONCE(cpudata->highest_perf, amd_get_highest_perf()); ++ highest_perf = amd_get_highest_perf(); ++ if (highest_perf > cppc_perf.highest_perf) ++ highest_perf = cppc_perf.highest_perf; ++ ++ WRITE_ONCE(cpudata->highest_perf, highest_perf); + + WRITE_ONCE(cpudata->nominal_perf, cppc_perf.nominal_perf); + WRITE_ONCE(cpudata->lowest_nonlinear_perf, +@@ -312,7 +322,7 @@ static int amd_pstate_target(struct cpufreq_policy *policy, + return -ENODEV; + + cap_perf = READ_ONCE(cpudata->highest_perf); +- min_perf = READ_ONCE(cpudata->lowest_nonlinear_perf); ++ min_perf = READ_ONCE(cpudata->lowest_perf); + max_perf = cap_perf; + + freqs.old = policy->cur; +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 57cdb36798854..fc3ebeb0bbe59 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -2416,6 +2416,7 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = { + X86_MATCH(SKYLAKE_X, core_funcs), + X86_MATCH(COMETLAKE, core_funcs), + X86_MATCH(ICELAKE_X, core_funcs), ++ X86_MATCH(TIGERLAKE, core_funcs), + {} + }; + MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids); +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index 36c79580fba25..9817fa8e9e4d7 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -317,14 +317,14 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) + if (IS_ERR(opp)) { + dev_warn(dev, "Can't find the OPP for throttling: %pe!\n", opp); + } else { +- throttled_freq = freq_hz / HZ_PER_KHZ; +- +- /* Update thermal pressure (the boost frequencies are accepted) */ +- arch_update_thermal_pressure(policy->related_cpus, throttled_freq); +- + dev_pm_opp_put(opp); + } + ++ throttled_freq = freq_hz / HZ_PER_KHZ; ++ ++ /* Update thermal pressure (the boost frequencies are accepted) */ ++ arch_update_thermal_pressure(policy->related_cpus, throttled_freq); ++ + /* + * In the unlikely case policy is unregistered do not enable + * polling or h/w interrupt +diff --git a/drivers/cpuidle/cpuidle-riscv-sbi.c b/drivers/cpuidle/cpuidle-riscv-sbi.c +index 1151e5e2ba824..33c92fec4365f 100644 +--- a/drivers/cpuidle/cpuidle-riscv-sbi.c ++++ b/drivers/cpuidle/cpuidle-riscv-sbi.c +@@ -97,8 +97,13 @@ static int sbi_cpuidle_enter_state(struct cpuidle_device *dev, + struct cpuidle_driver *drv, int idx) + { + u32 *states = __this_cpu_read(sbi_cpuidle_data.states); ++ u32 state = states[idx]; + +- return CPU_PM_CPU_IDLE_ENTER_PARAM(sbi_suspend, idx, states[idx]); ++ if (state & SBI_HSM_SUSP_NON_RET_BIT) ++ return CPU_PM_CPU_IDLE_ENTER_PARAM(sbi_suspend, idx, state); ++ else ++ return CPU_PM_CPU_IDLE_ENTER_RETENTION_PARAM(sbi_suspend, ++ idx, state); + } + + static int __sbi_enter_domain_idle_state(struct cpuidle_device *dev, +diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c +index 8c32d0eb8fcf2..6872ac3440010 100644 +--- a/drivers/crypto/cavium/cpt/cptpf_main.c ++++ b/drivers/crypto/cavium/cpt/cptpf_main.c +@@ -253,6 +253,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) + const struct firmware *fw_entry; + struct device *dev = &cpt->pdev->dev; + struct ucode_header *ucode; ++ unsigned int code_length; + struct microcode *mcode; + int j, ret = 0; + +@@ -263,11 +264,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) + ucode = (struct ucode_header *)fw_entry->data; + mcode = &cpt->mcode[cpt->next_mc_idx]; + memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ); +- mcode->code_size = ntohl(ucode->code_length) * 2; +- if (!mcode->code_size) { ++ code_length = ntohl(ucode->code_length); ++ if (code_length == 0 || code_length >= INT_MAX / 2) { + ret = -EINVAL; + goto fw_release; + } ++ mcode->code_size = code_length * 2; + + mcode->is_ae = is_ae; + mcode->core_mask = 0ULL; +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 7d4b4ad1db1f3..9f753cb4f5f18 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -641,6 +641,10 @@ static void ccp_dma_release(struct ccp_device *ccp) + for (i = 0; i < ccp->cmd_q_count; i++) { + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; ++ ++ if (dma_chan->client_count) ++ dma_release_channel(dma_chan); ++ + tasklet_kill(&chan->cleanup_tasklet); + list_del_rcu(&dma_chan->device_node); + } +@@ -766,8 +770,8 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + if (!dmaengine) + return; + +- dma_async_device_unregister(dma_dev); + ccp_dma_release(ccp); ++ dma_async_device_unregister(dma_dev); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 9f588c9728f8b..6c49e6d06114f 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -231,7 +231,7 @@ static int sev_read_init_ex_file(void) + return 0; + } + +-static void sev_write_init_ex_file(void) ++static int sev_write_init_ex_file(void) + { + struct sev_device *sev = psp_master->sev_data; + struct file *fp; +@@ -241,14 +241,16 @@ static void sev_write_init_ex_file(void) + lockdep_assert_held(&sev_cmd_mutex); + + if (!sev_init_ex_buffer) +- return; ++ return 0; + + fp = open_file_as_root(init_ex_path, O_CREAT | O_WRONLY, 0600); + if (IS_ERR(fp)) { ++ int ret = PTR_ERR(fp); ++ + dev_err(sev->dev, +- "SEV: could not open file for write, error %ld\n", +- PTR_ERR(fp)); +- return; ++ "SEV: could not open file for write, error %d\n", ++ ret); ++ return ret; + } + + nwrite = kernel_write(fp, sev_init_ex_buffer, NV_LENGTH, &offset); +@@ -259,18 +261,20 @@ static void sev_write_init_ex_file(void) + dev_err(sev->dev, + "SEV: failed to write %u bytes to non volatile memory area, ret %ld\n", + NV_LENGTH, nwrite); +- return; ++ return -EIO; + } + + dev_dbg(sev->dev, "SEV: write successful to NV file\n"); ++ ++ return 0; + } + +-static void sev_write_init_ex_file_if_required(int cmd_id) ++static int sev_write_init_ex_file_if_required(int cmd_id) + { + lockdep_assert_held(&sev_cmd_mutex); + + if (!sev_init_ex_buffer) +- return; ++ return 0; + + /* + * Only a few platform commands modify the SPI/NV area, but none of the +@@ -285,10 +289,10 @@ static void sev_write_init_ex_file_if_required(int cmd_id) + case SEV_CMD_PEK_GEN: + break; + default: +- return; ++ return 0; + } + +- sev_write_init_ex_file(); ++ return sev_write_init_ex_file(); + } + + static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) +@@ -361,7 +365,7 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) + cmd, reg & PSP_CMDRESP_ERR_MASK); + ret = -EIO; + } else { +- sev_write_init_ex_file_if_required(cmd); ++ ret = sev_write_init_ex_file_if_required(cmd); + } + + print_hex_dump_debug("(out): ", DUMP_PREFIX_OFFSET, 16, 2, data, +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index b4ca2eb034d7d..eb82e9864d148 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -2229,8 +2229,10 @@ static ssize_t qm_cmd_write(struct file *filp, const char __user *buffer, + return ret; + + /* Judge if the instance is being reset. */ +- if (unlikely(atomic_read(&qm->status.flags) == QM_STOP)) +- return 0; ++ if (unlikely(atomic_read(&qm->status.flags) == QM_STOP)) { ++ ret = 0; ++ goto put_dfx_access; ++ } + + if (count > QM_DBG_WRITE_LEN) { + ret = -ENOSPC; +diff --git a/drivers/crypto/hisilicon/zip/zip_crypto.c b/drivers/crypto/hisilicon/zip/zip_crypto.c +index 67869513e48c1..d90b10ae005bc 100644 +--- a/drivers/crypto/hisilicon/zip/zip_crypto.c ++++ b/drivers/crypto/hisilicon/zip/zip_crypto.c +@@ -122,12 +122,12 @@ static int sgl_sge_nr_set(const char *val, const struct kernel_param *kp) + if (ret || n == 0 || n > HISI_ACC_SGL_SGE_NR_MAX) + return -EINVAL; + +- return param_set_int(val, kp); ++ return param_set_ushort(val, kp); + } + + static const struct kernel_param_ops sgl_sge_nr_ops = { + .set = sgl_sge_nr_set, +- .get = param_get_int, ++ .get = param_get_ushort, + }; + + static u16 sgl_sge_nr = HZIP_SGL_SGE_NR; +diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c +index bc60b58022564..2124416742f84 100644 +--- a/drivers/crypto/inside-secure/safexcel_hash.c ++++ b/drivers/crypto/inside-secure/safexcel_hash.c +@@ -383,7 +383,7 @@ static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring, + u32 x; + + x = ipad[i] ^ ipad[i + 4]; +- cache[i] ^= swab(x); ++ cache[i] ^= swab32(x); + } + } + cache_len = AES_BLOCK_SIZE; +@@ -821,7 +821,7 @@ static int safexcel_ahash_final(struct ahash_request *areq) + u32 *result = (void *)areq->result; + + /* K3 */ +- result[i] = swab(ctx->base.ipad.word[i + 4]); ++ result[i] = swab32(ctx->base.ipad.word[i + 4]); + } + areq->result[0] ^= 0x80; // 10- padding + crypto_cipher_encrypt_one(ctx->kaes, areq->result, areq->result); +@@ -2106,7 +2106,7 @@ static int safexcel_xcbcmac_setkey(struct crypto_ahash *tfm, const u8 *key, + crypto_cipher_encrypt_one(ctx->kaes, (u8 *)key_tmp + AES_BLOCK_SIZE, + "\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3\x3"); + for (i = 0; i < 3 * AES_BLOCK_SIZE / sizeof(u32); i++) +- ctx->base.ipad.word[i] = swab(key_tmp[i]); ++ ctx->base.ipad.word[i] = swab32(key_tmp[i]); + + crypto_cipher_clear_flags(ctx->kaes, CRYPTO_TFM_REQ_MASK); + crypto_cipher_set_flags(ctx->kaes, crypto_ahash_get_flags(tfm) & +@@ -2189,7 +2189,7 @@ static int safexcel_cmac_setkey(struct crypto_ahash *tfm, const u8 *key, + return ret; + + for (i = 0; i < len / sizeof(u32); i++) +- ctx->base.ipad.word[i + 8] = swab(aes.key_enc[i]); ++ ctx->base.ipad.word[i + 8] = swab32(aes.key_enc[i]); + + /* precompute the CMAC key material */ + crypto_cipher_clear_flags(ctx->kaes, CRYPTO_TFM_REQ_MASK); +diff --git a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c +index 40b482198ebc5..a765eefb18c2f 100644 +--- a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c ++++ b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c +@@ -286,6 +286,7 @@ static int process_tar_file(struct device *dev, + struct tar_ucode_info_t *tar_info; + struct otx_cpt_ucode_hdr *ucode_hdr; + int ucode_type, ucode_size; ++ unsigned int code_length; + + /* + * If size is less than microcode header size then don't report +@@ -303,7 +304,13 @@ static int process_tar_file(struct device *dev, + if (get_ucode_type(ucode_hdr, &ucode_type)) + return 0; + +- ucode_size = ntohl(ucode_hdr->code_length) * 2; ++ code_length = ntohl(ucode_hdr->code_length); ++ if (code_length >= INT_MAX / 2) { ++ dev_err(dev, "Invalid code_length %u\n", code_length); ++ return -EINVAL; ++ } ++ ++ ucode_size = code_length * 2; + if (!ucode_size || (size < round_up(ucode_size, 16) + + sizeof(struct otx_cpt_ucode_hdr) + OTX_CPT_UCODE_SIGN_LEN)) { + dev_err(dev, "Ucode %s invalid size\n", filename); +@@ -886,6 +893,7 @@ static int ucode_load(struct device *dev, struct otx_cpt_ucode *ucode, + { + struct otx_cpt_ucode_hdr *ucode_hdr; + const struct firmware *fw; ++ unsigned int code_length; + int ret; + + set_ucode_filename(ucode, ucode_filename); +@@ -896,7 +904,13 @@ static int ucode_load(struct device *dev, struct otx_cpt_ucode *ucode, + ucode_hdr = (struct otx_cpt_ucode_hdr *) fw->data; + memcpy(ucode->ver_str, ucode_hdr->ver_str, OTX_CPT_UCODE_VER_STR_SZ); + ucode->ver_num = ucode_hdr->ver_num; +- ucode->size = ntohl(ucode_hdr->code_length) * 2; ++ code_length = ntohl(ucode_hdr->code_length); ++ if (code_length >= INT_MAX / 2) { ++ dev_err(dev, "Ucode invalid code_length %u\n", code_length); ++ ret = -EINVAL; ++ goto release_fw; ++ } ++ ucode->size = code_length * 2; + if (!ucode->size || (fw->size < round_up(ucode->size, 16) + + sizeof(struct otx_cpt_ucode_hdr) + OTX_CPT_UCODE_SIGN_LEN)) { + dev_err(dev, "Ucode %s invalid size\n", ucode_filename); +diff --git a/drivers/crypto/qat/qat_common/adf_gen4_hw_data.h b/drivers/crypto/qat/qat_common/adf_gen4_hw_data.h +index 43b8f864806bd..4fb4b3df5a188 100644 +--- a/drivers/crypto/qat/qat_common/adf_gen4_hw_data.h ++++ b/drivers/crypto/qat/qat_common/adf_gen4_hw_data.h +@@ -107,7 +107,7 @@ do { \ + * Timeout is in cycles. Clock speed may vary across products but this + * value should be a few milli-seconds. + */ +-#define ADF_SSM_WDT_DEFAULT_VALUE 0x200000 ++#define ADF_SSM_WDT_DEFAULT_VALUE 0x7000000ULL + #define ADF_SSM_WDT_PKE_DEFAULT_VALUE 0x8000000 + #define ADF_SSMWDTL_OFFSET 0x54 + #define ADF_SSMWDTH_OFFSET 0x5C +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index 148edbe379e31..0828d856d6b00 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -673,11 +673,14 @@ static void qat_alg_free_bufl(struct qat_crypto_instance *inst, + dma_addr_t blpout = qat_req->buf.bloutp; + size_t sz = qat_req->buf.sz; + size_t sz_out = qat_req->buf.sz_out; ++ int bl_dma_dir; + int i; + ++ bl_dma_dir = blp != blpout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL; ++ + for (i = 0; i < bl->num_bufs; i++) + dma_unmap_single(dev, bl->bufers[i].addr, +- bl->bufers[i].len, DMA_BIDIRECTIONAL); ++ bl->bufers[i].len, bl_dma_dir); + + dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE); + +@@ -691,7 +694,7 @@ static void qat_alg_free_bufl(struct qat_crypto_instance *inst, + for (i = bufless; i < blout->num_bufs; i++) { + dma_unmap_single(dev, blout->bufers[i].addr, + blout->bufers[i].len, +- DMA_BIDIRECTIONAL); ++ DMA_FROM_DEVICE); + } + dma_unmap_single(dev, blpout, sz_out, DMA_TO_DEVICE); + +@@ -716,6 +719,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + struct scatterlist *sg; + size_t sz_out, sz = struct_size(bufl, bufers, n); + int node = dev_to_node(&GET_DEV(inst->accel_dev)); ++ int bufl_dma_dir; + + if (unlikely(!n)) + return -EINVAL; +@@ -733,6 +737,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + qat_req->buf.sgl_src_valid = true; + } + ++ bufl_dma_dir = sgl != sglout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL; ++ + for_each_sg(sgl, sg, n, i) + bufl->bufers[i].addr = DMA_MAPPING_ERROR; + +@@ -744,7 +750,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + + bufl->bufers[y].addr = dma_map_single(dev, sg_virt(sg), + sg->length, +- DMA_BIDIRECTIONAL); ++ bufl_dma_dir); + bufl->bufers[y].len = sg->length; + if (unlikely(dma_mapping_error(dev, bufl->bufers[y].addr))) + goto err_in; +@@ -787,7 +793,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + + bufers[y].addr = dma_map_single(dev, sg_virt(sg), + sg->length, +- DMA_BIDIRECTIONAL); ++ DMA_FROM_DEVICE); + if (unlikely(dma_mapping_error(dev, bufers[y].addr))) + goto err_out; + bufers[y].len = sg->length; +@@ -817,7 +823,7 @@ err_out: + if (!dma_mapping_error(dev, buflout->bufers[i].addr)) + dma_unmap_single(dev, buflout->bufers[i].addr, + buflout->bufers[i].len, +- DMA_BIDIRECTIONAL); ++ DMA_FROM_DEVICE); + + if (!qat_req->buf.sgl_dst_valid) + kfree(buflout); +@@ -831,7 +837,7 @@ err_in: + if (!dma_mapping_error(dev, bufl->bufers[i].addr)) + dma_unmap_single(dev, bufl->bufers[i].addr, + bufl->bufers[i].len, +- DMA_BIDIRECTIONAL); ++ bufl_dma_dir); + + if (!qat_req->buf.sgl_src_valid) + kfree(bufl); +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 457084b344c17..b07ae4ba165e7 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -26,10 +26,10 @@ + #include <linux/kernel.h> + #include <linux/kthread.h> + #include <linux/module.h> +-#include <linux/mutex.h> + #include <linux/of.h> + #include <linux/of_device.h> + #include <linux/platform_device.h> ++#include <linux/spinlock.h> + + #define SHA_BUFFER_LEN PAGE_SIZE + #define SAHARA_MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE +@@ -196,7 +196,7 @@ struct sahara_dev { + void __iomem *regs_base; + struct clk *clk_ipg; + struct clk *clk_ahb; +- struct mutex queue_mutex; ++ spinlock_t queue_spinlock; + struct task_struct *kthread; + struct completion dma_completion; + +@@ -642,9 +642,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) + + rctx->mode = mode; + +- mutex_lock(&dev->queue_mutex); ++ spin_lock_bh(&dev->queue_spinlock); + err = crypto_enqueue_request(&dev->queue, &req->base); +- mutex_unlock(&dev->queue_mutex); ++ spin_unlock_bh(&dev->queue_spinlock); + + wake_up_process(dev->kthread); + +@@ -1043,10 +1043,10 @@ static int sahara_queue_manage(void *data) + do { + __set_current_state(TASK_INTERRUPTIBLE); + +- mutex_lock(&dev->queue_mutex); ++ spin_lock_bh(&dev->queue_spinlock); + backlog = crypto_get_backlog(&dev->queue); + async_req = crypto_dequeue_request(&dev->queue); +- mutex_unlock(&dev->queue_mutex); ++ spin_unlock_bh(&dev->queue_spinlock); + + if (backlog) + backlog->complete(backlog, -EINPROGRESS); +@@ -1092,9 +1092,9 @@ static int sahara_sha_enqueue(struct ahash_request *req, int last) + rctx->first = 1; + } + +- mutex_lock(&dev->queue_mutex); ++ spin_lock_bh(&dev->queue_spinlock); + ret = crypto_enqueue_request(&dev->queue, &req->base); +- mutex_unlock(&dev->queue_mutex); ++ spin_unlock_bh(&dev->queue_spinlock); + + wake_up_process(dev->kthread); + +@@ -1449,7 +1449,7 @@ static int sahara_probe(struct platform_device *pdev) + + crypto_init_queue(&dev->queue, SAHARA_QUEUE_LENGTH); + +- mutex_init(&dev->queue_mutex); ++ spin_lock_init(&dev->queue_spinlock); + + dev_ptr = dev; + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index 38e8767ec3715..bf11d32205f38 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -124,17 +124,20 @@ static int begin_cpu_udmabuf(struct dma_buf *buf, + { + struct udmabuf *ubuf = buf->priv; + struct device *dev = ubuf->device->this_device; ++ int ret = 0; + + if (!ubuf->sg) { + ubuf->sg = get_sg_table(dev, buf, direction); +- if (IS_ERR(ubuf->sg)) +- return PTR_ERR(ubuf->sg); ++ if (IS_ERR(ubuf->sg)) { ++ ret = PTR_ERR(ubuf->sg); ++ ubuf->sg = NULL; ++ } + } else { + dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents, + direction); + } + +- return 0; ++ return ret; + } + + static int end_cpu_udmabuf(struct dma_buf *buf, +diff --git a/drivers/dma/hisi_dma.c b/drivers/dma/hisi_dma.c +index 43817ced3a3e1..0233b42143c77 100644 +--- a/drivers/dma/hisi_dma.c ++++ b/drivers/dma/hisi_dma.c +@@ -180,7 +180,8 @@ static void hisi_dma_reset_qp_point(struct hisi_dma_dev *hdma_dev, u32 index) + hisi_dma_chan_write(hdma_dev->base, HISI_DMA_CQ_HEAD_PTR, index, 0); + } + +-static void hisi_dma_reset_hw_chan(struct hisi_dma_chan *chan) ++static void hisi_dma_reset_or_disable_hw_chan(struct hisi_dma_chan *chan, ++ bool disable) + { + struct hisi_dma_dev *hdma_dev = chan->hdma_dev; + u32 index = chan->qp_num, tmp; +@@ -201,8 +202,11 @@ static void hisi_dma_reset_hw_chan(struct hisi_dma_chan *chan) + hisi_dma_do_reset(hdma_dev, index); + hisi_dma_reset_qp_point(hdma_dev, index); + hisi_dma_pause_dma(hdma_dev, index, false); +- hisi_dma_enable_dma(hdma_dev, index, true); +- hisi_dma_unmask_irq(hdma_dev, index); ++ ++ if (!disable) { ++ hisi_dma_enable_dma(hdma_dev, index, true); ++ hisi_dma_unmask_irq(hdma_dev, index); ++ } + + ret = readl_relaxed_poll_timeout(hdma_dev->base + + HISI_DMA_Q_FSM_STS + index * HISI_DMA_OFFSET, tmp, +@@ -218,7 +222,7 @@ static void hisi_dma_free_chan_resources(struct dma_chan *c) + struct hisi_dma_chan *chan = to_hisi_dma_chan(c); + struct hisi_dma_dev *hdma_dev = chan->hdma_dev; + +- hisi_dma_reset_hw_chan(chan); ++ hisi_dma_reset_or_disable_hw_chan(chan, false); + vchan_free_chan_resources(&chan->vc); + + memset(chan->sq, 0, sizeof(struct hisi_dma_sqe) * hdma_dev->chan_depth); +@@ -267,7 +271,6 @@ static void hisi_dma_start_transfer(struct hisi_dma_chan *chan) + + vd = vchan_next_desc(&chan->vc); + if (!vd) { +- dev_err(&hdma_dev->pdev->dev, "no issued task!\n"); + chan->desc = NULL; + return; + } +@@ -299,7 +302,7 @@ static void hisi_dma_issue_pending(struct dma_chan *c) + + spin_lock_irqsave(&chan->vc.lock, flags); + +- if (vchan_issue_pending(&chan->vc)) ++ if (vchan_issue_pending(&chan->vc) && !chan->desc) + hisi_dma_start_transfer(chan); + + spin_unlock_irqrestore(&chan->vc.lock, flags); +@@ -394,7 +397,7 @@ static void hisi_dma_enable_qp(struct hisi_dma_dev *hdma_dev, u32 qp_index) + + static void hisi_dma_disable_qp(struct hisi_dma_dev *hdma_dev, u32 qp_index) + { +- hisi_dma_reset_hw_chan(&hdma_dev->chan[qp_index]); ++ hisi_dma_reset_or_disable_hw_chan(&hdma_dev->chan[qp_index], true); + } + + static void hisi_dma_enable_qps(struct hisi_dma_dev *hdma_dev) +@@ -432,18 +435,15 @@ static irqreturn_t hisi_dma_irq(int irq, void *data) + desc = chan->desc; + cqe = chan->cq + chan->cq_head; + if (desc) { ++ chan->cq_head = (chan->cq_head + 1) % hdma_dev->chan_depth; ++ hisi_dma_chan_write(hdma_dev->base, HISI_DMA_CQ_HEAD_PTR, ++ chan->qp_num, chan->cq_head); + if (FIELD_GET(STATUS_MASK, cqe->w0) == STATUS_SUCC) { +- chan->cq_head = (chan->cq_head + 1) % +- hdma_dev->chan_depth; +- hisi_dma_chan_write(hdma_dev->base, +- HISI_DMA_CQ_HEAD_PTR, chan->qp_num, +- chan->cq_head); + vchan_cookie_complete(&desc->vd); ++ hisi_dma_start_transfer(chan); + } else { + dev_err(&hdma_dev->pdev->dev, "task error!\n"); + } +- +- chan->desc = NULL; + } + + spin_unlock(&chan->vc.lock); +diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c +index 743ead5ebc579..5b9921475be6c 100644 +--- a/drivers/dma/idxd/irq.c ++++ b/drivers/dma/idxd/irq.c +@@ -324,13 +324,11 @@ halt: + idxd->state = IDXD_DEV_HALTED; + idxd_wqs_quiesce(idxd); + idxd_wqs_unmap_portal(idxd); +- spin_lock(&idxd->dev_lock); + idxd_device_clear_state(idxd); + dev_err(&idxd->pdev->dev, + "idxd halted, need %s.\n", + gensts.reset_type == IDXD_DEVICE_RESET_FLR ? + "FLR" : "system reset"); +- spin_unlock(&idxd->dev_lock); + return -ENXIO; + } + } +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index 37ff4ec7db76f..e2070df6cad28 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -656,7 +656,7 @@ static void __cleanup(struct ioatdma_chan *ioat_chan, dma_addr_t phys_complete) + if (active - i == 0) { + dev_dbg(to_dev(ioat_chan), "%s: cancel completion timeout\n", + __func__); +- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT); ++ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT); + } + + /* microsecond delay by sysfs variable per pending descriptor */ +@@ -682,7 +682,7 @@ static void ioat_cleanup(struct ioatdma_chan *ioat_chan) + + if (chanerr & + (IOAT_CHANERR_HANDLE_MASK | IOAT_CHANERR_RECOVER_MASK)) { +- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT); ++ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT); + ioat_eh(ioat_chan); + } + } +@@ -879,7 +879,7 @@ static void check_active(struct ioatdma_chan *ioat_chan) + } + + if (test_and_clear_bit(IOAT_CHAN_ACTIVE, &ioat_chan->state)) +- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT); ++ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT); + } + + static void ioat_reboot_chan(struct ioatdma_chan *ioat_chan) +diff --git a/drivers/dma/mxs-dma.c b/drivers/dma/mxs-dma.c +index 994fc4d2aca42..dc147cc2436e9 100644 +--- a/drivers/dma/mxs-dma.c ++++ b/drivers/dma/mxs-dma.c +@@ -670,7 +670,7 @@ static enum dma_status mxs_dma_tx_status(struct dma_chan *chan, + return mxs_chan->status; + } + +-static int __init mxs_dma_init(struct mxs_dma_engine *mxs_dma) ++static int mxs_dma_init(struct mxs_dma_engine *mxs_dma) + { + int ret; + +@@ -741,7 +741,7 @@ static struct dma_chan *mxs_dma_xlate(struct of_phandle_args *dma_spec, + ofdma->of_node); + } + +-static int __init mxs_dma_probe(struct platform_device *pdev) ++static int mxs_dma_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; + const struct mxs_dma_type *dma_type; +@@ -839,10 +839,7 @@ static struct platform_driver mxs_dma_driver = { + .name = "mxs-dma", + .of_match_table = mxs_dma_dt_ids, + }, ++ .probe = mxs_dma_probe, + }; + +-static int __init mxs_dma_module_init(void) +-{ +- return platform_driver_probe(&mxs_dma_driver, mxs_dma_probe); +-} +-subsys_initcall(mxs_dma_module_init); ++builtin_platform_driver(mxs_dma_driver); +diff --git a/drivers/dma/qcom/qcom_adm.c b/drivers/dma/qcom/qcom_adm.c +index facdacf8aede6..d56caf1681ffb 100644 +--- a/drivers/dma/qcom/qcom_adm.c ++++ b/drivers/dma/qcom/qcom_adm.c +@@ -379,13 +379,13 @@ static struct dma_async_tx_descriptor *adm_prep_slave_sg(struct dma_chan *chan, + if (blk_size < 0) { + dev_err(adev->dev, "invalid burst value: %d\n", + burst); +- return ERR_PTR(-EINVAL); ++ return NULL; + } + + crci = achan->crci & 0xf; + if (!crci || achan->crci > 0x1f) { + dev_err(adev->dev, "invalid crci value\n"); +- return ERR_PTR(-EINVAL); ++ return NULL; + } + } + +@@ -403,8 +403,10 @@ static struct dma_async_tx_descriptor *adm_prep_slave_sg(struct dma_chan *chan, + } + + async_desc = kzalloc(sizeof(*async_desc), GFP_NOWAIT); +- if (!async_desc) +- return ERR_PTR(-ENOMEM); ++ if (!async_desc) { ++ dev_err(adev->dev, "not enough memory for async_desc struct\n"); ++ return NULL; ++ } + + async_desc->mux = achan->mux ? ADM_CRCI_CTL_MUX_SEL : 0; + async_desc->crci = crci; +@@ -414,8 +416,10 @@ static struct dma_async_tx_descriptor *adm_prep_slave_sg(struct dma_chan *chan, + sizeof(*cple) + 2 * ADM_DESC_ALIGN; + + async_desc->cpl = kzalloc(async_desc->dma_len, GFP_NOWAIT); +- if (!async_desc->cpl) ++ if (!async_desc->cpl) { ++ dev_err(adev->dev, "not enough memory for cpl struct\n"); + goto free; ++ } + + async_desc->adev = adev; + +@@ -437,8 +441,10 @@ static struct dma_async_tx_descriptor *adm_prep_slave_sg(struct dma_chan *chan, + async_desc->dma_addr = dma_map_single(adev->dev, async_desc->cpl, + async_desc->dma_len, + DMA_TO_DEVICE); +- if (dma_mapping_error(adev->dev, async_desc->dma_addr)) ++ if (dma_mapping_error(adev->dev, async_desc->dma_addr)) { ++ dev_err(adev->dev, "dma mapping error for cpl\n"); + goto free; ++ } + + cple_addr = async_desc->dma_addr + ((void *)cple - async_desc->cpl); + +@@ -454,7 +460,7 @@ static struct dma_async_tx_descriptor *adm_prep_slave_sg(struct dma_chan *chan, + + free: + kfree(async_desc); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + /** +@@ -494,7 +500,7 @@ static int adm_slave_config(struct dma_chan *chan, struct dma_slave_config *cfg) + + spin_lock_irqsave(&achan->vc.lock, flag); + memcpy(&achan->slave, cfg, sizeof(struct dma_slave_config)); +- if (cfg->peripheral_size == sizeof(config)) ++ if (cfg->peripheral_size == sizeof(*config)) + achan->crci = config->crci; + spin_unlock_irqrestore(&achan->vc.lock, flag); + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index 2f0d2c68c93c6..fcfcde947b307 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -300,8 +300,6 @@ struct udma_chan { + + struct udma_tx_drain tx_drain; + +- u32 bcnt; /* number of bytes completed since the start of the channel */ +- + /* Channel configuration parameters */ + struct udma_chan_config config; + +@@ -757,6 +755,20 @@ static void udma_reset_rings(struct udma_chan *uc) + } + } + ++static void udma_decrement_byte_counters(struct udma_chan *uc, u32 val) ++{ ++ if (uc->desc->dir == DMA_DEV_TO_MEM) { ++ udma_rchanrt_write(uc, UDMA_CHAN_RT_BCNT_REG, val); ++ udma_rchanrt_write(uc, UDMA_CHAN_RT_SBCNT_REG, val); ++ udma_rchanrt_write(uc, UDMA_CHAN_RT_PEER_BCNT_REG, val); ++ } else { ++ udma_tchanrt_write(uc, UDMA_CHAN_RT_BCNT_REG, val); ++ udma_tchanrt_write(uc, UDMA_CHAN_RT_SBCNT_REG, val); ++ if (!uc->bchan) ++ udma_tchanrt_write(uc, UDMA_CHAN_RT_PEER_BCNT_REG, val); ++ } ++} ++ + static void udma_reset_counters(struct udma_chan *uc) + { + u32 val; +@@ -790,8 +802,6 @@ static void udma_reset_counters(struct udma_chan *uc) + val = udma_rchanrt_read(uc, UDMA_CHAN_RT_PEER_BCNT_REG); + udma_rchanrt_write(uc, UDMA_CHAN_RT_PEER_BCNT_REG, val); + } +- +- uc->bcnt = 0; + } + + static int udma_reset_chan(struct udma_chan *uc, bool hard) +@@ -1115,7 +1125,7 @@ static void udma_check_tx_completion(struct work_struct *work) + if (uc->desc) { + struct udma_desc *d = uc->desc; + +- uc->bcnt += d->residue; ++ udma_decrement_byte_counters(uc, d->residue); + udma_start(uc); + vchan_cookie_complete(&d->vd); + break; +@@ -1168,7 +1178,7 @@ static irqreturn_t udma_ring_irq_handler(int irq, void *data) + vchan_cyclic_callback(&d->vd); + } else { + if (udma_is_desc_really_done(uc, d)) { +- uc->bcnt += d->residue; ++ udma_decrement_byte_counters(uc, d->residue); + udma_start(uc); + vchan_cookie_complete(&d->vd); + } else { +@@ -1204,7 +1214,7 @@ static irqreturn_t udma_udma_irq_handler(int irq, void *data) + vchan_cyclic_callback(&d->vd); + } else { + /* TODO: figure out the real amount of data */ +- uc->bcnt += d->residue; ++ udma_decrement_byte_counters(uc, d->residue); + udma_start(uc); + vchan_cookie_complete(&d->vd); + } +@@ -3809,7 +3819,6 @@ static enum dma_status udma_tx_status(struct dma_chan *chan, + bcnt = udma_tchanrt_read(uc, UDMA_CHAN_RT_BCNT_REG); + } + +- bcnt -= uc->bcnt; + if (bcnt && !(bcnt % uc->desc->residue)) + residue = 0; + else +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index fe567be0f118b..804f542be3f28 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -280,14 +280,6 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle, + goto fail; + } + +- /* +- * Now that we have done our final memory allocation (and free) +- * we can get the memory map key needed for exit_boot_services(). +- */ +- status = efi_get_memory_map(&map); +- if (status != EFI_SUCCESS) +- goto fail_free_new_fdt; +- + status = update_fdt((void *)fdt_addr, fdt_size, + (void *)*new_fdt_addr, MAX_FDT_SIZE, cmdline_ptr, + initrd_addr, initrd_size); +diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c +index adaa492c3d2df..4e2575dfeb908 100644 +--- a/drivers/firmware/google/gsmi.c ++++ b/drivers/firmware/google/gsmi.c +@@ -681,6 +681,15 @@ static struct notifier_block gsmi_die_notifier = { + static int gsmi_panic_callback(struct notifier_block *nb, + unsigned long reason, void *arg) + { ++ ++ /* ++ * Panic callbacks are executed with all other CPUs stopped, ++ * so we must not attempt to spin waiting for gsmi_dev.lock ++ * to be released. ++ */ ++ if (spin_is_locked(&gsmi_dev.lock)) ++ return NOTIFY_DONE; ++ + gsmi_shutdown_reason(GSMI_SHUTDOWN_PANIC); + return NOTIFY_DONE; + } +diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c +index 6bff39ff21a0d..eabaf495a481e 100644 +--- a/drivers/fpga/dfl.c ++++ b/drivers/fpga/dfl.c +@@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev, + return -EINVAL; + + fds = memdup_user((void __user *)(arg + sizeof(hdr)), +- hdr.count * sizeof(s32)); ++ array_size(hdr.count, sizeof(s32))); + if (IS_ERR(fds)) + return PTR_ERR(fds); + +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index 3a7b78e367011..5858e6339a10b 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -1314,6 +1314,9 @@ int fsi_master_register(struct fsi_master *master) + + mutex_init(&master->scan_lock); + master->idx = ida_simple_get(&master_ida, 0, INT_MAX, GFP_KERNEL); ++ if (master->idx < 0) ++ return master->idx; ++ + dev_set_name(&master->dev, "fsi%d", master->idx); + master->dev.class = &fsi_master_class; + +diff --git a/drivers/fsi/fsi-occ.c b/drivers/fsi/fsi-occ.c +index c9cc75fbdfb9d..28c176d038a26 100644 +--- a/drivers/fsi/fsi-occ.c ++++ b/drivers/fsi/fsi-occ.c +@@ -94,6 +94,7 @@ static int occ_open(struct inode *inode, struct file *file) + client->occ = occ; + mutex_init(&client->lock); + file->private_data = client; ++ get_device(occ->dev); + + /* We allocate a 1-page buffer, make sure it all fits */ + BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE); +@@ -197,6 +198,7 @@ static int occ_release(struct inode *inode, struct file *file) + { + struct occ_client *client = file->private_data; + ++ put_device(client->occ->dev); + free_page((unsigned long)client->buffer); + kfree(client); + +@@ -493,12 +495,19 @@ int fsi_occ_submit(struct device *dev, const void *request, size_t req_len, + for (i = 1; i < req_len - 2; ++i) + checksum += byte_request[i]; + +- mutex_lock(&occ->occ_lock); ++ rc = mutex_lock_interruptible(&occ->occ_lock); ++ if (rc) ++ return rc; + + occ->client_buffer = response; + occ->client_buffer_size = user_resp_len; + occ->client_response_size = 0; + ++ if (!occ->buffer) { ++ rc = -ENOENT; ++ goto done; ++ } ++ + /* + * Get a sequence number and update the counter. Avoid a sequence + * number of 0 which would pass the response check below even if the +@@ -671,10 +680,13 @@ static int occ_remove(struct platform_device *pdev) + { + struct occ *occ = platform_get_drvdata(pdev); + +- kvfree(occ->buffer); +- + misc_deregister(&occ->mdev); + ++ mutex_lock(&occ->occ_lock); ++ kvfree(occ->buffer); ++ occ->buffer = NULL; ++ mutex_unlock(&occ->occ_lock); ++ + device_for_each_child(&pdev->dev, NULL, occ_unregister_child); + + ida_simple_remove(&occ_ida, occ->idx); +diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c +index bb953f6478647..fd31e36f5b9a5 100644 +--- a/drivers/gpio/gpio-rockchip.c ++++ b/drivers/gpio/gpio-rockchip.c +@@ -19,6 +19,7 @@ + #include <linux/of_address.h> + #include <linux/of_device.h> + #include <linux/of_irq.h> ++#include <linux/pinctrl/consumer.h> + #include <linux/pinctrl/pinconf-generic.h> + #include <linux/regmap.h> + +@@ -155,6 +156,12 @@ static int rockchip_gpio_set_direction(struct gpio_chip *chip, + unsigned long flags; + u32 data = input ? 0 : 1; + ++ ++ if (input) ++ pinctrl_gpio_direction_input(bank->pin_base + offset); ++ else ++ pinctrl_gpio_direction_output(bank->pin_base + offset); ++ + raw_spin_lock_irqsave(&bank->slock, flags); + rockchip_gpio_writel_bit(bank, offset, data, bank->gpio_regs->port_ddr); + raw_spin_unlock_irqrestore(&bank->slock, flags); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index b7933c2ce765c..491d4846fc02c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -1674,10 +1674,12 @@ amdgpu_connector_add(struct amdgpu_device *adev, + adev->mode_info.dither_property, + AMDGPU_FMT_DITHER_DISABLE); + +- if (amdgpu_audio != 0) ++ if (amdgpu_audio != 0) { + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.audio_property, + AMDGPU_AUDIO_AUTO); ++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO; ++ } + + subpixel_order = SubPixelHorizontalRGB; + connector->interlace_allowed = true; +@@ -1799,6 +1801,7 @@ amdgpu_connector_add(struct amdgpu_device *adev, + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.audio_property, + AMDGPU_AUDIO_AUTO); ++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO; + } + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.dither_property, +@@ -1852,6 +1855,7 @@ amdgpu_connector_add(struct amdgpu_device *adev, + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.audio_property, + AMDGPU_AUDIO_AUTO); ++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO; + } + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.dither_property, +@@ -1902,6 +1906,7 @@ amdgpu_connector_add(struct amdgpu_device *adev, + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.audio_property, + AMDGPU_AUDIO_AUTO); ++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO; + } + drm_object_attach_property(&amdgpu_connector->base.base, + adev->mode_info.dither_property, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 0a8c15c3a04c3..7e6c59ec3018e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -35,8 +35,6 @@ + #include <linux/pci.h> + #include <linux/pm_runtime.h> + #include <drm/drm_crtc_helper.h> +-#include <drm/drm_damage_helper.h> +-#include <drm/drm_drv.h> + #include <drm/drm_edid.h> + #include <drm/drm_gem_framebuffer_helper.h> + #include <drm/drm_fb_helper.h> +@@ -497,12 +495,6 @@ static const struct drm_framebuffer_funcs amdgpu_fb_funcs = { + .create_handle = drm_gem_fb_create_handle, + }; + +-static const struct drm_framebuffer_funcs amdgpu_fb_funcs_atomic = { +- .destroy = drm_gem_fb_destroy, +- .create_handle = drm_gem_fb_create_handle, +- .dirty = drm_atomic_helper_dirtyfb, +-}; +- + uint32_t amdgpu_display_supported_domains(struct amdgpu_device *adev, + uint64_t bo_flags) + { +@@ -1077,10 +1069,8 @@ static int amdgpu_display_gem_fb_verify_and_init(struct drm_device *dev, + if (ret) + goto err; + +- if (drm_drv_uses_atomic_modeset(dev)) +- ret = drm_framebuffer_init(dev, &rfb->base, &amdgpu_fb_funcs_atomic); +- else +- ret = drm_framebuffer_init(dev, &rfb->base, &amdgpu_fb_funcs); ++ ret = drm_framebuffer_init(dev, &rfb->base, &amdgpu_fb_funcs); ++ + if (ret) + goto err; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 8890300766a5b..5e8ca32bc3a90 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2548,8 +2548,11 @@ static int amdgpu_pmops_runtime_resume(struct device *dev) + amdgpu_device_baco_exit(drm_dev); + } + ret = amdgpu_device_resume(drm_dev, false); +- if (ret) ++ if (ret) { ++ if (amdgpu_device_supports_px(drm_dev)) ++ pci_disable_device(pdev); + return ret; ++ } + + if (amdgpu_device_supports_px(drm_dev)) + drm_dev->switch_power_state = DRM_SWITCH_POWER_ON; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c +index 1fd3cbca20a29..718db7d98e5a3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c +@@ -211,12 +211,15 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p, + int r; + + /* Wait for PD/PT moves to be completed */ +- dma_resv_for_each_fence(&cursor, bo->tbo.base.resv, +- DMA_RESV_USAGE_KERNEL, fence) { ++ dma_resv_iter_begin(&cursor, bo->tbo.base.resv, DMA_RESV_USAGE_KERNEL); ++ dma_resv_for_each_fence_unlocked(&cursor, fence) { + r = amdgpu_sync_fence(&p->job->sync, fence); +- if (r) ++ if (r) { ++ dma_resv_iter_end(&cursor); + return r; ++ } + } ++ dma_resv_iter_end(&cursor); + + do { + ndw = p->num_dw_left; +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c +index bc11b2de37aeb..a1d26c4d80b8c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c +@@ -169,17 +169,17 @@ static void mmhub_v3_0_init_system_aperture_regs(struct amdgpu_device *adev) + uint64_t value; + uint32_t tmp; + +- /* Disable AGP. */ +- WREG32_SOC15(MMHUB, 0, regMMMC_VM_AGP_BASE, 0); +- WREG32_SOC15(MMHUB, 0, regMMMC_VM_AGP_TOP, 0); +- WREG32_SOC15(MMHUB, 0, regMMMC_VM_AGP_BOT, 0x00FFFFFF); +- + if (!amdgpu_sriov_vf(adev)) { + /* + * the new L1 policy will block SRIOV guest from writing + * these regs, and they will be programed at host. + * so skip programing these regs. + */ ++ /* Disable AGP. */ ++ WREG32_SOC15(MMHUB, 0, regMMMC_VM_AGP_BASE, 0); ++ WREG32_SOC15(MMHUB, 0, regMMMC_VM_AGP_TOP, 0); ++ WREG32_SOC15(MMHUB, 0, regMMMC_VM_AGP_BOT, 0x00FFFFFF); ++ + /* Program the system aperture low logical page number. */ + WREG32_SOC15(MMHUB, 0, regMMMC_VM_SYSTEM_APERTURE_LOW_ADDR, + adev->gmc.vram_start >> 18); +diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c +index 8d5c452a91007..6d3bfb0f03469 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc21.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c +@@ -551,6 +551,10 @@ static int soc21_common_early_init(void *handle) + AMD_PG_SUPPORT_JPEG | + AMD_PG_SUPPORT_ATHUB | + AMD_PG_SUPPORT_MMHUB; ++ if (amdgpu_sriov_vf(adev)) { ++ adev->cg_flags = 0; ++ adev->pg_flags = 0; ++ } + adev->external_rev_id = adev->rev_id + 0x1; // TODO: need update + break; + case IP_VERSION(11, 0, 2): +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index e1797657b04c7..7d3fc5849466f 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -1232,6 +1232,24 @@ static void init_interrupts(struct device_queue_manager *dqm) + dqm->dev->kfd2kgd->init_interrupts(dqm->dev->adev, i); + } + ++static void init_sdma_bitmaps(struct device_queue_manager *dqm) ++{ ++ unsigned int num_sdma_queues = ++ min_t(unsigned int, sizeof(dqm->sdma_bitmap)*8, ++ get_num_sdma_queues(dqm)); ++ unsigned int num_xgmi_sdma_queues = ++ min_t(unsigned int, sizeof(dqm->xgmi_sdma_bitmap)*8, ++ get_num_xgmi_sdma_queues(dqm)); ++ ++ if (num_sdma_queues) ++ dqm->sdma_bitmap = GENMASK_ULL(num_sdma_queues-1, 0); ++ if (num_xgmi_sdma_queues) ++ dqm->xgmi_sdma_bitmap = GENMASK_ULL(num_xgmi_sdma_queues-1, 0); ++ ++ dqm->sdma_bitmap &= ~get_reserved_sdma_queues_bitmap(dqm); ++ pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap); ++} ++ + static int initialize_nocpsch(struct device_queue_manager *dqm) + { + int pipe, queue; +@@ -1260,11 +1278,7 @@ static int initialize_nocpsch(struct device_queue_manager *dqm) + + memset(dqm->vmid_pasid, 0, sizeof(dqm->vmid_pasid)); + +- dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm)); +- dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm)); +- pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap); +- +- dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm)); ++ init_sdma_bitmaps(dqm); + + return 0; + } +@@ -1442,9 +1456,6 @@ static int set_sched_resources(struct device_queue_manager *dqm) + + static int initialize_cpsch(struct device_queue_manager *dqm) + { +- uint64_t num_sdma_queues; +- uint64_t num_xgmi_sdma_queues; +- + pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm)); + + mutex_init(&dqm->lock_hidden); +@@ -1453,24 +1464,10 @@ static int initialize_cpsch(struct device_queue_manager *dqm) + dqm->active_cp_queue_count = 0; + dqm->gws_queue_count = 0; + dqm->active_runlist = false; +- +- num_sdma_queues = get_num_sdma_queues(dqm); +- if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap)) +- dqm->sdma_bitmap = ULLONG_MAX; +- else +- dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1); +- +- dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm)); +- pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap); +- +- num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm); +- if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap)) +- dqm->xgmi_sdma_bitmap = ULLONG_MAX; +- else +- dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1); +- + INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception); + ++ init_sdma_bitmaps(dqm); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c781f92db9590..42a8ebc597230 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1363,13 +1363,21 @@ static struct hpd_rx_irq_offload_work_queue *hpd_rx_irq_create_workqueue(struct + + if (hpd_rx_offload_wq[i].wq == NULL) { + DRM_ERROR("create amdgpu_dm_hpd_rx_offload_wq fail!"); +- return NULL; ++ goto out_err; + } + + spin_lock_init(&hpd_rx_offload_wq[i].offload_lock); + } + + return hpd_rx_offload_wq; ++ ++out_err: ++ for (i = 0; i < max_caps; i++) { ++ if (hpd_rx_offload_wq[i].wq) ++ destroy_workqueue(hpd_rx_offload_wq[i].wq); ++ } ++ kfree(hpd_rx_offload_wq); ++ return NULL; + } + + struct amdgpu_stutter_quirk { +@@ -9157,15 +9165,15 @@ static void amdgpu_dm_handle_vrr_transition(struct dm_crtc_state *old_state, + * We also need vupdate irq for the actual core vblank handling + * at end of vblank. + */ +- dm_set_vupdate_irq(new_state->base.crtc, true); +- drm_crtc_vblank_get(new_state->base.crtc); ++ WARN_ON(dm_set_vupdate_irq(new_state->base.crtc, true) != 0); ++ WARN_ON(drm_crtc_vblank_get(new_state->base.crtc) != 0); + DRM_DEBUG_DRIVER("%s: crtc=%u VRR off->on: Get vblank ref\n", + __func__, new_state->base.crtc->base.id); + } else if (old_vrr_active && !new_vrr_active) { + /* Transition VRR active -> inactive: + * Allow vblank irq disable again for fixed refresh rate. + */ +- dm_set_vupdate_irq(new_state->base.crtc, false); ++ WARN_ON(dm_set_vupdate_irq(new_state->base.crtc, false) != 0); + drm_crtc_vblank_put(new_state->base.crtc); + DRM_DEBUG_DRIVER("%s: crtc=%u VRR on->off: Drop vblank ref\n", + __func__, new_state->base.crtc->base.id); +@@ -9916,23 +9924,6 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + mutex_unlock(&dm->dc_lock); + } + +- /* Count number of newly disabled CRTCs for dropping PM refs later. */ +- for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, +- new_crtc_state, i) { +- if (old_crtc_state->active && !new_crtc_state->active) +- crtc_disable_count++; +- +- dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); +- dm_old_crtc_state = to_dm_crtc_state(old_crtc_state); +- +- /* For freesync config update on crtc state and params for irq */ +- update_stream_irq_parameters(dm, dm_new_crtc_state); +- +- /* Handle vrr on->off / off->on transitions */ +- amdgpu_dm_handle_vrr_transition(dm_old_crtc_state, +- dm_new_crtc_state); +- } +- + /** + * Enable interrupts for CRTCs that are newly enabled or went through + * a modeset. It was intentionally deferred until after the front end +@@ -9942,16 +9933,29 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { + struct amdgpu_crtc *acrtc = to_amdgpu_crtc(crtc); + #ifdef CONFIG_DEBUG_FS +- bool configure_crc = false; + enum amdgpu_dm_pipe_crc_source cur_crc_src; + #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) +- struct crc_rd_work *crc_rd_wrk = dm->crc_rd_wrk; ++ struct crc_rd_work *crc_rd_wrk; ++#endif ++#endif ++ /* Count number of newly disabled CRTCs for dropping PM refs later. */ ++ if (old_crtc_state->active && !new_crtc_state->active) ++ crtc_disable_count++; ++ ++ dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); ++ dm_old_crtc_state = to_dm_crtc_state(old_crtc_state); ++ ++ /* For freesync config update on crtc state and params for irq */ ++ update_stream_irq_parameters(dm, dm_new_crtc_state); ++ ++#ifdef CONFIG_DEBUG_FS ++#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) ++ crc_rd_wrk = dm->crc_rd_wrk; + #endif + spin_lock_irqsave(&adev_to_drm(adev)->event_lock, flags); + cur_crc_src = acrtc->dm_irq_params.crc_src; + spin_unlock_irqrestore(&adev_to_drm(adev)->event_lock, flags); + #endif +- dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); + + if (new_crtc_state->active && + (!old_crtc_state->active || +@@ -9959,16 +9963,19 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + dc_stream_retain(dm_new_crtc_state->stream); + acrtc->dm_irq_params.stream = dm_new_crtc_state->stream; + manage_dm_interrupts(adev, acrtc, true); ++ } ++ /* Handle vrr on->off / off->on transitions */ ++ amdgpu_dm_handle_vrr_transition(dm_old_crtc_state, dm_new_crtc_state); + + #ifdef CONFIG_DEBUG_FS ++ if (new_crtc_state->active && ++ (!old_crtc_state->active || ++ drm_atomic_crtc_needs_modeset(new_crtc_state))) { + /** + * Frontend may have changed so reapply the CRC capture + * settings for the stream. + */ +- dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); +- + if (amdgpu_dm_is_valid_crc_source(cur_crc_src)) { +- configure_crc = true; + #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) + if (amdgpu_dm_crc_window_is_activated(crtc)) { + spin_lock_irqsave(&adev_to_drm(adev)->event_lock, flags); +@@ -9980,14 +9987,12 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state) + spin_unlock_irqrestore(&adev_to_drm(adev)->event_lock, flags); + } + #endif +- } +- +- if (configure_crc) + if (amdgpu_dm_crtc_configure_crc_source( + crtc, dm_new_crtc_state, cur_crc_src)) + DRM_DEBUG_DRIVER("Failed to configure crc source"); +-#endif ++ } + } ++#endif + } + + for_each_new_crtc_in_state(state, crtc, new_crtc_state, j) +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c +index 141fd2721501e..5b804f81db814 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c +@@ -60,11 +60,15 @@ static bool link_supports_psrsu(struct dc_link *link) + */ + void amdgpu_dm_set_psr_caps(struct dc_link *link) + { +- if (!(link->connector_signal & SIGNAL_TYPE_EDP)) ++ if (!(link->connector_signal & SIGNAL_TYPE_EDP)) { ++ link->psr_settings.psr_feature_enabled = false; + return; ++ } + +- if (link->type == dc_connection_none) ++ if (link->type == dc_connection_none) { ++ link->psr_settings.psr_feature_enabled = false; + return; ++ } + + if (link->dpcd_caps.psr_info.psr_version == 0) { + link->psr_settings.psr_version = DC_PSR_VERSION_UNSUPPORTED; +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 9dbd965d8afb3..6ca29b887fce9 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2632,11 +2632,8 @@ static void copy_stream_update_to_stream(struct dc *dc, + if (update->abm_level) + stream->abm_level = *update->abm_level; + +- if (update->periodic_interrupt0) +- stream->periodic_interrupt0 = *update->periodic_interrupt0; +- +- if (update->periodic_interrupt1) +- stream->periodic_interrupt1 = *update->periodic_interrupt1; ++ if (update->periodic_interrupt) ++ stream->periodic_interrupt = *update->periodic_interrupt; + + if (update->gamut_remap) + stream->gamut_remap_matrix = *update->gamut_remap; +@@ -2723,13 +2720,8 @@ static void commit_planes_do_stream_update(struct dc *dc, + + if (!pipe_ctx->top_pipe && !pipe_ctx->prev_odm_pipe && pipe_ctx->stream == stream) { + +- if (stream_update->periodic_interrupt0 && +- dc->hwss.setup_periodic_interrupt) +- dc->hwss.setup_periodic_interrupt(dc, pipe_ctx, VLINE0); +- +- if (stream_update->periodic_interrupt1 && +- dc->hwss.setup_periodic_interrupt) +- dc->hwss.setup_periodic_interrupt(dc, pipe_ctx, VLINE1); ++ if (stream_update->periodic_interrupt && dc->hwss.setup_periodic_interrupt) ++ dc->hwss.setup_periodic_interrupt(dc, pipe_ctx); + + if ((stream_update->hdr_static_metadata && !stream->use_dynamic_meta) || + stream_update->vrr_infopacket || +diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h +index 58941f4defb35..a7f319d404a1f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h +@@ -200,8 +200,7 @@ struct dc_stream_state { + /* DMCU info */ + unsigned int abm_level; + +- struct periodic_interrupt_config periodic_interrupt0; +- struct periodic_interrupt_config periodic_interrupt1; ++ struct periodic_interrupt_config periodic_interrupt; + + /* from core_stream struct */ + struct dc_context *ctx; +@@ -268,8 +267,7 @@ struct dc_stream_update { + struct dc_info_packet *hdr_static_metadata; + unsigned int *abm_level; + +- struct periodic_interrupt_config *periodic_interrupt0; +- struct periodic_interrupt_config *periodic_interrupt1; ++ struct periodic_interrupt_config *periodic_interrupt; + + struct dc_info_packet *vrr_infopacket; + struct dc_info_packet *vsc_infopacket; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index d9ab279915355..33c87e53b6a3f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -3623,7 +3623,7 @@ void dcn10_calc_vupdate_position( + { + const struct dc_crtc_timing *dc_crtc_timing = &pipe_ctx->stream->timing; + int vline_int_offset_from_vupdate = +- pipe_ctx->stream->periodic_interrupt0.lines_offset; ++ pipe_ctx->stream->periodic_interrupt.lines_offset; + int vupdate_offset_from_vsync = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx); + int start_position; + +@@ -3648,18 +3648,10 @@ void dcn10_calc_vupdate_position( + static void dcn10_cal_vline_position( + struct dc *dc, + struct pipe_ctx *pipe_ctx, +- enum vline_select vline, + uint32_t *start_line, + uint32_t *end_line) + { +- enum vertical_interrupt_ref_point ref_point = INVALID_POINT; +- +- if (vline == VLINE0) +- ref_point = pipe_ctx->stream->periodic_interrupt0.ref_point; +- else if (vline == VLINE1) +- ref_point = pipe_ctx->stream->periodic_interrupt1.ref_point; +- +- switch (ref_point) { ++ switch (pipe_ctx->stream->periodic_interrupt.ref_point) { + case START_V_UPDATE: + dcn10_calc_vupdate_position( + dc, +@@ -3668,7 +3660,9 @@ static void dcn10_cal_vline_position( + end_line); + break; + case START_V_SYNC: +- // Suppose to do nothing because vsync is 0; ++ // vsync is line 0 so start_line is just the requested line offset ++ *start_line = pipe_ctx->stream->periodic_interrupt.lines_offset; ++ *end_line = *start_line + 2; + break; + default: + ASSERT(0); +@@ -3678,24 +3672,15 @@ static void dcn10_cal_vline_position( + + void dcn10_setup_periodic_interrupt( + struct dc *dc, +- struct pipe_ctx *pipe_ctx, +- enum vline_select vline) ++ struct pipe_ctx *pipe_ctx) + { + struct timing_generator *tg = pipe_ctx->stream_res.tg; ++ uint32_t start_line = 0; ++ uint32_t end_line = 0; + +- if (vline == VLINE0) { +- uint32_t start_line = 0; +- uint32_t end_line = 0; ++ dcn10_cal_vline_position(dc, pipe_ctx, &start_line, &end_line); + +- dcn10_cal_vline_position(dc, pipe_ctx, vline, &start_line, &end_line); +- +- tg->funcs->setup_vertical_interrupt0(tg, start_line, end_line); +- +- } else if (vline == VLINE1) { +- pipe_ctx->stream_res.tg->funcs->setup_vertical_interrupt1( +- tg, +- pipe_ctx->stream->periodic_interrupt1.lines_offset); +- } ++ tg->funcs->setup_vertical_interrupt0(tg, start_line, end_line); + } + + void dcn10_setup_vupdate_interrupt(struct dc *dc, struct pipe_ctx *pipe_ctx) +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h +index 9ae07c77fdc01..0ef7bf7ddb75e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h +@@ -175,8 +175,7 @@ void dcn10_set_cursor_attribute(struct pipe_ctx *pipe_ctx); + void dcn10_set_cursor_sdr_white_level(struct pipe_ctx *pipe_ctx); + void dcn10_setup_periodic_interrupt( + struct dc *dc, +- struct pipe_ctx *pipe_ctx, +- enum vline_select vline); ++ struct pipe_ctx *pipe_ctx); + enum dc_status dcn10_set_clock(struct dc *dc, + enum dc_clock_type clock_type, + uint32_t clk_khz, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c +index 23621ff08c905..52fb2bf3d5781 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c +@@ -150,9 +150,9 @@ static void dcn31_hpo_dp_stream_enc_dp_blank( + * 10us*5000=50ms. This covers 41.7ms of minimum 24 Hz mode + + * a little more because we may not trust delay accuracy. + */ +- //REG_WAIT(DP_SYM32_ENC_VID_STREAM_CONTROL, +- // VID_STREAM_STATUS, 0, +- // 10, 5000); ++ REG_WAIT(DP_SYM32_ENC_VID_STREAM_CONTROL, ++ VID_STREAM_STATUS, 0, ++ 10, 5000); + + /* Disable SDP tranmission */ + REG_UPDATE(DP_SYM32_ENC_SDP_CONTROL, +diff --git a/drivers/gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c b/drivers/gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c +index 6ca288fb5fb9e..2d46bc527b218 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c +@@ -26,12 +26,12 @@ + #include "bw_fixed.h" + + +-#define MIN_I64 \ +- (int64_t)(-(1LL << 63)) +- + #define MAX_I64 \ + (int64_t)((1ULL << 63) - 1) + ++#define MIN_I64 \ ++ (-MAX_I64 - 1) ++ + #define FRACTIONAL_PART_MASK \ + ((1ULL << BW_FIXED_BITS_PER_FRACTIONAL_PART) - 1) + +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +index 05053f3b4ab7b..21a9eedec0928 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +@@ -32,11 +32,6 @@ + #include "inc/hw/link_encoder.h" + #include "core_status.h" + +-enum vline_select { +- VLINE0, +- VLINE1 +-}; +- + struct pipe_ctx; + struct dc_state; + struct dc_stream_status; +@@ -116,8 +111,7 @@ struct hw_sequencer_funcs { + int group_index, int group_size, + struct pipe_ctx *grouped_pipes[]); + void (*setup_periodic_interrupt)(struct dc *dc, +- struct pipe_ctx *pipe_ctx, +- enum vline_select vline); ++ struct pipe_ctx *pipe_ctx); + void (*set_drr)(struct pipe_ctx **pipe_ctx, int num_pipes, + struct dc_crtc_timing_adjust adjust); + void (*set_static_screen_control)(struct pipe_ctx **pipe_ctx, +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +index 59172acb97380..292f533d8cf0d 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +@@ -235,7 +235,7 @@ void komeda_crtc_handle_event(struct komeda_crtc *kcrtc, + crtc->state->event = NULL; + drm_crtc_send_vblank_event(crtc, event); + } else { +- DRM_WARN("CRTC[%d]: FLIP happen but no pending commit.\n", ++ DRM_WARN("CRTC[%d]: FLIP happened but no pending commit.\n", + drm_crtc_index(&kcrtc->base)); + } + spin_unlock_irqrestore(&crtc->dev->event_lock, flags); +@@ -286,7 +286,7 @@ komeda_crtc_atomic_enable(struct drm_crtc *crtc, + komeda_crtc_do_flush(crtc, old); + } + +-static void ++void + komeda_crtc_flush_and_wait_for_flip_done(struct komeda_crtc *kcrtc, + struct completion *input_flip_done) + { +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_kms.c b/drivers/gpu/drm/arm/display/komeda/komeda_kms.c +index 93b7f09b96ca9..327051bba5b68 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_kms.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_kms.c +@@ -69,6 +69,25 @@ static const struct drm_driver komeda_kms_driver = { + .minor = 1, + }; + ++static void komeda_kms_atomic_commit_hw_done(struct drm_atomic_state *state) ++{ ++ struct drm_device *dev = state->dev; ++ struct komeda_kms_dev *kms = to_kdev(dev); ++ int i; ++ ++ for (i = 0; i < kms->n_crtcs; i++) { ++ struct komeda_crtc *kcrtc = &kms->crtcs[i]; ++ ++ if (kcrtc->base.state->active) { ++ struct completion *flip_done = NULL; ++ if (kcrtc->base.state->event) ++ flip_done = kcrtc->base.state->event->base.completion; ++ komeda_crtc_flush_and_wait_for_flip_done(kcrtc, flip_done); ++ } ++ } ++ drm_atomic_helper_commit_hw_done(state); ++} ++ + static void komeda_kms_commit_tail(struct drm_atomic_state *old_state) + { + struct drm_device *dev = old_state->dev; +@@ -81,7 +100,7 @@ static void komeda_kms_commit_tail(struct drm_atomic_state *old_state) + + drm_atomic_helper_commit_modeset_enables(dev, old_state); + +- drm_atomic_helper_commit_hw_done(old_state); ++ komeda_kms_atomic_commit_hw_done(old_state); + + drm_atomic_helper_wait_for_flip_done(dev, old_state); + +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_kms.h b/drivers/gpu/drm/arm/display/komeda/komeda_kms.h +index 456f3c4357193..bf6e8fba50613 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_kms.h ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_kms.h +@@ -182,6 +182,8 @@ void komeda_kms_cleanup_private_objs(struct komeda_kms_dev *kms); + + void komeda_crtc_handle_event(struct komeda_crtc *kcrtc, + struct komeda_events *evts); ++void komeda_crtc_flush_and_wait_for_flip_done(struct komeda_crtc *kcrtc, ++ struct completion *input_flip_done); + + struct komeda_kms_dev *komeda_kms_attach(struct komeda_dev *mdev); + void komeda_kms_detach(struct komeda_kms_dev *kms); +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h +index a031a0cd1f181..94de73cbeb2dd 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h +@@ -394,10 +394,7 @@ void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1); + #else + static inline int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511) + { +- unsigned int offset = adv7511->type == ADV7533 ? +- ADV7533_REG_CEC_OFFSET : 0; +- +- regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL + offset, ++ regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL, + ADV7511_CEC_CTRL_POWER_DOWN); + return 0; + } +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c b/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c +index 0b266f28f150f..99964f5a5457b 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c +@@ -359,7 +359,7 @@ int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511) + goto err_cec_alloc; + } + +- regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL + offset, 0); ++ regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL, 0); + /* cec soft reset */ + regmap_write(adv7511->regmap_cec, + ADV7511_REG_CEC_SOFT_RESET + offset, 0x01); +@@ -386,7 +386,7 @@ err_cec_alloc: + dev_info(dev, "Initializing CEC failed with error %d, disabling CEC\n", + ret); + err_cec_parse_dt: +- regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL + offset, ++ regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL, + ADV7511_CEC_CTRL_POWER_DOWN); + return ret == -EPROBE_DEFER ? ret : 0; + } +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 38bf28720f3a2..6031bdd923420 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1340,9 +1340,6 @@ static int adv7511_remove(struct i2c_client *i2c) + { + struct adv7511 *adv7511 = i2c_get_clientdata(i2c); + +- i2c_unregister_device(adv7511->i2c_cec); +- clk_disable_unprepare(adv7511->cec_clk); +- + adv7511_uninit_regulators(adv7511); + + drm_bridge_remove(&adv7511->bridge); +@@ -1350,6 +1347,8 @@ static int adv7511_remove(struct i2c_client *i2c) + adv7511_audio_exit(adv7511); + + cec_unregister_adapter(adv7511->cec_adap); ++ i2c_unregister_device(adv7511->i2c_cec); ++ clk_disable_unprepare(adv7511->cec_clk); + + i2c_unregister_device(adv7511->i2c_packet); + i2c_unregister_device(adv7511->i2c_edid); +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 4b673c4792d77..a09d1a39ab0ae 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -2954,6 +2954,9 @@ static void it6505_bridge_atomic_enable(struct drm_bridge *bridge, + + it6505_int_mask_enable(it6505); + it6505_video_reset(it6505); ++ ++ it6505_drm_dp_link_set_power(&it6505->aux, &it6505->link, ++ DP_SET_POWER_D0); + } + + static void it6505_bridge_atomic_disable(struct drm_bridge *bridge, +@@ -2965,9 +2968,9 @@ static void it6505_bridge_atomic_disable(struct drm_bridge *bridge, + DRM_DEV_DEBUG_DRIVER(dev, "start"); + + if (it6505->powered) { +- it6505_video_disable(it6505); + it6505_drm_dp_link_set_power(&it6505->aux, &it6505->link, + DP_SET_POWER_D3); ++ it6505_video_disable(it6505); + } + } + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index c0b182d1374e4..7f688ebd36ebc 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -807,13 +807,14 @@ static int lt9611_connector_init(struct drm_bridge *bridge, struct lt9611 *lt961 + + drm_connector_helper_add(<9611->connector, + <9611_bridge_connector_helper_funcs); +- drm_connector_attach_encoder(<9611->connector, bridge->encoder); + + if (!bridge->encoder) { + DRM_ERROR("Parent encoder object not found"); + return -ENODEV; + } + ++ drm_connector_attach_encoder(<9611->connector, bridge->encoder); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +index cce98bf2a4e73..72248a565579e 100644 +--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c ++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +@@ -296,7 +296,9 @@ static void ge_b850v3_lvds_remove(void) + * This check is to avoid both the drivers + * removing the bridge in their remove() function + */ +- if (!ge_b850v3_lvds_ptr) ++ if (!ge_b850v3_lvds_ptr || ++ !ge_b850v3_lvds_ptr->stdp2690_i2c || ++ !ge_b850v3_lvds_ptr->stdp4028_i2c) + goto out; + + drm_bridge_remove(&ge_b850v3_lvds_ptr->bridge); +diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c +index edb939b14c04e..38dcc606b4992 100644 +--- a/drivers/gpu/drm/bridge/parade-ps8640.c ++++ b/drivers/gpu/drm/bridge/parade-ps8640.c +@@ -596,8 +596,8 @@ static int ps8640_probe(struct i2c_client *client) + if (!ps_bridge) + return -ENOMEM; + +- ps_bridge->supplies[0].supply = "vdd33"; +- ps_bridge->supplies[1].supply = "vdd12"; ++ ps_bridge->supplies[0].supply = "vdd12"; ++ ps_bridge->supplies[1].supply = "vdd33"; + ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ps_bridge->supplies), + ps_bridge->supplies); + if (ret) +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 3e1be9894ed17..0552e9a3c8380 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -3095,6 +3095,7 @@ static irqreturn_t dw_hdmi_irq(int irq, void *dev_id) + { + struct dw_hdmi *hdmi = dev_id; + u8 intr_stat, phy_int_pol, phy_pol_mask, phy_stat; ++ enum drm_connector_status status = connector_status_unknown; + + intr_stat = hdmi_readb(hdmi, HDMI_IH_PHY_STAT0); + phy_int_pol = hdmi_readb(hdmi, HDMI_PHY_POL0); +@@ -3133,13 +3134,15 @@ static irqreturn_t dw_hdmi_irq(int irq, void *dev_id) + cec_notifier_phys_addr_invalidate(hdmi->cec_notifier); + mutex_unlock(&hdmi->cec_notifier_mutex); + } +- } + +- if (intr_stat & HDMI_IH_PHY_STAT0_HPD) { +- enum drm_connector_status status = phy_int_pol & HDMI_PHY_HPD +- ? connector_status_connected +- : connector_status_disconnected; ++ if (phy_stat & HDMI_PHY_HPD) ++ status = connector_status_connected; ++ ++ if (!(phy_stat & (HDMI_PHY_HPD | HDMI_PHY_RX_SENSE))) ++ status = connector_status_disconnected; ++ } + ++ if (status != connector_status_unknown) { + dev_dbg(hdmi->dev, "EVENT=%s\n", + status == connector_status_connected ? + "plugin" : "plugout"); +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 16affb42086ad..c41c6c464b7fc 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1986,9 +1986,10 @@ static int tc_probe_bridge_endpoint(struct tc_data *tc) + + for_each_endpoint_of_node(dev->of_node, node) { + of_graph_parse_endpoint(node, &endpoint); +- if (endpoint.port > 2) ++ if (endpoint.port > 2) { ++ of_node_put(node); + return -EINVAL; +- ++ } + mode |= BIT(endpoint.port); + } + +diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c +index e7c22c2ca90c4..f27cd710bc86b 100644 +--- a/drivers/gpu/drm/display/drm_dp_helper.c ++++ b/drivers/gpu/drm/display/drm_dp_helper.c +@@ -2636,17 +2636,8 @@ int drm_dp_set_phy_test_pattern(struct drm_dp_aux *aux, + struct drm_dp_phy_test_params *data, u8 dp_rev) + { + int err, i; +- u8 link_config[2]; + u8 test_pattern; + +- link_config[0] = drm_dp_link_rate_to_bw_code(data->link_rate); +- link_config[1] = data->num_lanes; +- if (data->enhanced_frame_cap) +- link_config[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN; +- err = drm_dp_dpcd_write(aux, DP_LINK_BW_SET, link_config, 2); +- if (err < 0) +- return err; +- + test_pattern = data->phy_pattern; + if (dp_rev < 0x12) { + test_pattern = (test_pattern << 2) & +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index 18f2b6075b780..28dd741f7da1b 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4916,14 +4916,14 @@ void drm_dp_mst_dump_topology(struct seq_file *m, + seq_printf(m, "dpcd: %*ph\n", DP_RECEIVER_CAP_SIZE, buf); + + ret = drm_dp_dpcd_read(mgr->aux, DP_FAUX_CAP, buf, 2); +- if (ret) { ++ if (ret != 2) { + seq_printf(m, "faux/mst read failed\n"); + goto out; + } + seq_printf(m, "faux/mst: %*ph\n", 2, buf); + + ret = drm_dp_dpcd_read(mgr->aux, DP_MSTM_CTRL, buf, 1); +- if (ret) { ++ if (ret != 1) { + seq_printf(m, "mst ctrl read failed\n"); + goto out; + } +@@ -4931,7 +4931,7 @@ void drm_dp_mst_dump_topology(struct seq_file *m, + + /* dump the standard OUI branch header */ + ret = drm_dp_dpcd_read(mgr->aux, DP_BRANCH_OUI, buf, DP_BRANCH_OUI_HEADER_SIZE); +- if (ret) { ++ if (ret != DP_BRANCH_OUI_HEADER_SIZE) { + seq_printf(m, "branch oui read failed\n"); + goto out; + } +diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c +index c96847fc0ebcb..36ca4092c1ab1 100644 +--- a/drivers/gpu/drm/drm_bridge.c ++++ b/drivers/gpu/drm/drm_bridge.c +@@ -823,8 +823,8 @@ static int select_bus_fmt_recursive(struct drm_bridge *first_bridge, + struct drm_connector_state *conn_state, + u32 out_bus_fmt) + { ++ unsigned int i, num_in_bus_fmts = 0; + struct drm_bridge_state *cur_state; +- unsigned int num_in_bus_fmts, i; + struct drm_bridge *prev_bridge; + u32 *in_bus_fmts; + int ret; +@@ -945,7 +945,7 @@ drm_atomic_bridge_chain_select_bus_fmts(struct drm_bridge *bridge, + struct drm_connector *conn = conn_state->connector; + struct drm_encoder *encoder = bridge->encoder; + struct drm_bridge_state *last_bridge_state; +- unsigned int i, num_out_bus_fmts; ++ unsigned int i, num_out_bus_fmts = 0; + struct drm_bridge *last_bridge; + u32 *out_bus_fmts; + int ret = 0; +diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c +index 51fcf12980235..7f1097947731d 100644 +--- a/drivers/gpu/drm/drm_ioctl.c ++++ b/drivers/gpu/drm/drm_ioctl.c +@@ -472,7 +472,13 @@ EXPORT_SYMBOL(drm_invalid_op); + */ + static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value) + { +- int len; ++ size_t len; ++ ++ /* don't attempt to copy a NULL pointer */ ++ if (WARN_ONCE(!value, "BUG: the value to copy was not set!")) { ++ *buf_len = 0; ++ return 0; ++ } + + /* don't overflow userbuf */ + len = strlen(value); +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index c40bde96cfdf0..c317ee9fa4458 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -346,6 +346,7 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv) + { + struct mipi_dsi_device *dsi = to_mipi_dsi_device(dev); + ++ mipi_dsi_detach(dsi); + mipi_dsi_device_unregister(dsi); + + return 0; +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index d4e0f2e855488..2d82f236d6699 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -103,6 +103,12 @@ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data lcd1080x1920_leftside_up = { ++ .width = 1080, ++ .height = 1920, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = { + .width = 1200, + .height = 1920, +@@ -128,6 +134,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* Anbernic Win600 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Anbernic"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Win600"), ++ }, ++ .driver_data = (void *)&lcd720x1280_rightside_up, + }, { /* Asus T100HA */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +@@ -152,6 +164,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* AYA NEO AIR */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), ++ DMI_MATCH(DMI_BOARD_NAME, "AIR"), ++ }, ++ .driver_data = (void *)&lcd1080x1920_leftside_up, + }, { /* AYA NEO NEXT */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), +diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c +index 91caf4523b34d..d8d037ed5dd54 100644 +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -123,7 +123,7 @@ find_raw_section(const void *_bdb, enum bdb_block_id section_id) + * Offset from the start of BDB to the start of the + * block data (just past the block header). + */ +-static u32 block_offset(const void *bdb, enum bdb_block_id section_id) ++static u32 raw_block_offset(const void *bdb, enum bdb_block_id section_id) + { + const void *block; + +@@ -134,18 +134,6 @@ static u32 block_offset(const void *bdb, enum bdb_block_id section_id) + return block - bdb; + } + +-/* size of the block excluding the header */ +-static u32 block_size(const void *bdb, enum bdb_block_id section_id) +-{ +- const void *block; +- +- block = find_raw_section(bdb, section_id); +- if (!block) +- return 0; +- +- return get_blocksize(block); +-} +- + struct bdb_block_entry { + struct list_head node; + enum bdb_block_id section_id; +@@ -230,9 +218,14 @@ static bool validate_lfp_data_ptrs(const void *bdb, + { + int fp_timing_size, dvo_timing_size, panel_pnp_id_size, panel_name_size; + int data_block_size, lfp_data_size; ++ const void *data_block; + int i; + +- data_block_size = block_size(bdb, BDB_LVDS_LFP_DATA); ++ data_block = find_raw_section(bdb, BDB_LVDS_LFP_DATA); ++ if (!data_block) ++ return false; ++ ++ data_block_size = get_blocksize(data_block); + if (data_block_size == 0) + return false; + +@@ -260,21 +253,6 @@ static bool validate_lfp_data_ptrs(const void *bdb, + if (16 * lfp_data_size > data_block_size) + return false; + +- /* +- * Except for vlv/chv machines all real VBTs seem to have 6 +- * unaccounted bytes in the fp_timing table. And it doesn't +- * appear to be a really intentional hole as the fp_timing +- * 0xffff terminator is always within those 6 missing bytes. +- */ +- if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size && +- fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size) +- return false; +- +- if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset || +- ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset || +- ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size) +- return false; +- + /* make sure the table entries have uniform size */ + for (i = 1; i < 16; i++) { + if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size || +@@ -288,6 +266,23 @@ static bool validate_lfp_data_ptrs(const void *bdb, + return false; + } + ++ /* ++ * Except for vlv/chv machines all real VBTs seem to have 6 ++ * unaccounted bytes in the fp_timing table. And it doesn't ++ * appear to be a really intentional hole as the fp_timing ++ * 0xffff terminator is always within those 6 missing bytes. ++ */ ++ if (fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size == lfp_data_size) ++ fp_timing_size += 6; ++ ++ if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size) ++ return false; ++ ++ if (ptrs->ptr[0].fp_timing.offset + fp_timing_size != ptrs->ptr[0].dvo_timing.offset || ++ ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset || ++ ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size) ++ return false; ++ + /* make sure the tables fit inside the data block */ + for (i = 0; i < 16; i++) { + if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size || +@@ -299,6 +294,15 @@ static bool validate_lfp_data_ptrs(const void *bdb, + if (ptrs->panel_name.offset + 16 * panel_name_size > data_block_size) + return false; + ++ /* make sure fp_timing terminators are present at expected locations */ ++ for (i = 0; i < 16; i++) { ++ const u16 *t = data_block + ptrs->ptr[i].fp_timing.offset + ++ fp_timing_size - 2; ++ ++ if (*t != 0xffff) ++ return false; ++ } ++ + return true; + } + +@@ -309,7 +313,7 @@ static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block) + u32 offset; + int i; + +- offset = block_offset(bdb, BDB_LVDS_LFP_DATA); ++ offset = raw_block_offset(bdb, BDB_LVDS_LFP_DATA); + + for (i = 0; i < 16; i++) { + if (ptrs->ptr[i].fp_timing.offset < offset || +@@ -332,18 +336,6 @@ static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block) + return validate_lfp_data_ptrs(bdb, ptrs); + } + +-static const void *find_fp_timing_terminator(const u8 *data, int size) +-{ +- int i; +- +- for (i = 0; i < size - 1; i++) { +- if (data[i] == 0xff && data[i+1] == 0xff) +- return &data[i]; +- } +- +- return NULL; +-} +- + static int make_lfp_data_ptr(struct lvds_lfp_data_ptr_table *table, + int table_size, int total_size) + { +@@ -367,11 +359,22 @@ static void next_lfp_data_ptr(struct lvds_lfp_data_ptr_table *next, + static void *generate_lfp_data_ptrs(struct drm_i915_private *i915, + const void *bdb) + { +- int i, size, table_size, block_size, offset; +- const void *t0, *t1, *block; ++ int i, size, table_size, block_size, offset, fp_timing_size; + struct bdb_lvds_lfp_data_ptrs *ptrs; ++ const void *block; + void *ptrs_block; + ++ /* ++ * The hardcoded fp_timing_size is only valid for ++ * modernish VBTs. All older VBTs definitely should ++ * include block 41 and thus we don't need to ++ * generate one. ++ */ ++ if (i915->vbt.version < 155) ++ return NULL; ++ ++ fp_timing_size = 38; ++ + block = find_raw_section(bdb, BDB_LVDS_LFP_DATA); + if (!block) + return NULL; +@@ -380,17 +383,8 @@ static void *generate_lfp_data_ptrs(struct drm_i915_private *i915, + + block_size = get_blocksize(block); + +- size = block_size; +- t0 = find_fp_timing_terminator(block, size); +- if (!t0) +- return NULL; +- +- size -= t0 - block - 2; +- t1 = find_fp_timing_terminator(t0 + 2, size); +- if (!t1) +- return NULL; +- +- size = t1 - t0; ++ size = fp_timing_size + sizeof(struct lvds_dvo_timing) + ++ sizeof(struct lvds_pnp_id); + if (size * 16 > block_size) + return NULL; + +@@ -408,7 +402,7 @@ static void *generate_lfp_data_ptrs(struct drm_i915_private *i915, + table_size = sizeof(struct lvds_dvo_timing); + size = make_lfp_data_ptr(&ptrs->ptr[0].dvo_timing, table_size, size); + +- table_size = t0 - block + 2; ++ table_size = fp_timing_size; + size = make_lfp_data_ptr(&ptrs->ptr[0].fp_timing, table_size, size); + + if (ptrs->ptr[0].fp_timing.table_size) +@@ -423,14 +417,14 @@ static void *generate_lfp_data_ptrs(struct drm_i915_private *i915, + return NULL; + } + +- size = t1 - t0; ++ size = fp_timing_size + sizeof(struct lvds_dvo_timing) + ++ sizeof(struct lvds_pnp_id); + for (i = 1; i < 16; i++) { + next_lfp_data_ptr(&ptrs->ptr[i].fp_timing, &ptrs->ptr[i-1].fp_timing, size); + next_lfp_data_ptr(&ptrs->ptr[i].dvo_timing, &ptrs->ptr[i-1].dvo_timing, size); + next_lfp_data_ptr(&ptrs->ptr[i].panel_pnp_id, &ptrs->ptr[i-1].panel_pnp_id, size); + } + +- size = t1 - t0; + table_size = sizeof(struct lvds_lfp_panel_name); + + if (16 * (size + table_size) <= block_size) { +diff --git a/drivers/gpu/drm/i915/gt/gen6_ppgtt.c b/drivers/gpu/drm/i915/gt/gen6_ppgtt.c +index 1bb766c79dcbe..5aaacc53fa4ca 100644 +--- a/drivers/gpu/drm/i915/gt/gen6_ppgtt.c ++++ b/drivers/gpu/drm/i915/gt/gen6_ppgtt.c +@@ -247,6 +247,7 @@ err_scratch1: + i915_gem_object_put(vm->scratch[1]); + err_scratch0: + i915_gem_object_put(vm->scratch[0]); ++ vm->scratch[0] = NULL; + return ret; + } + +@@ -268,9 +269,10 @@ static void gen6_ppgtt_cleanup(struct i915_address_space *vm) + gen6_ppgtt_free_pd(ppgtt); + free_scratch(vm); + +- mutex_destroy(&ppgtt->flush); ++ if (ppgtt->base.pd) ++ free_pd(&ppgtt->base.vm, ppgtt->base.pd); + +- free_pd(&ppgtt->base.vm, ppgtt->base.pd); ++ mutex_destroy(&ppgtt->flush); + } + + static void pd_vma_bind(struct i915_address_space *vm, +@@ -449,19 +451,17 @@ struct i915_ppgtt *gen6_ppgtt_create(struct intel_gt *gt) + + err = gen6_ppgtt_init_scratch(ppgtt); + if (err) +- goto err_free; ++ goto err_put; + + ppgtt->base.pd = gen6_alloc_top_pd(ppgtt); + if (IS_ERR(ppgtt->base.pd)) { + err = PTR_ERR(ppgtt->base.pd); +- goto err_scratch; ++ goto err_put; + } + + return &ppgtt->base; + +-err_scratch: +- free_scratch(&ppgtt->base.vm); +-err_free: +- kfree(ppgtt); ++err_put: ++ i915_vm_put(&ppgtt->base.vm); + return ERR_PTR(err); + } +diff --git a/drivers/gpu/drm/i915/gt/gen8_ppgtt.c b/drivers/gpu/drm/i915/gt/gen8_ppgtt.c +index c7bd5d71b03e5..2128b7a72a257 100644 +--- a/drivers/gpu/drm/i915/gt/gen8_ppgtt.c ++++ b/drivers/gpu/drm/i915/gt/gen8_ppgtt.c +@@ -196,7 +196,10 @@ static void gen8_ppgtt_cleanup(struct i915_address_space *vm) + if (intel_vgpu_active(vm->i915)) + gen8_ppgtt_notify_vgt(ppgtt, false); + +- __gen8_ppgtt_cleanup(vm, ppgtt->pd, gen8_pd_top_count(vm), vm->top); ++ if (ppgtt->pd) ++ __gen8_ppgtt_cleanup(vm, ppgtt->pd, ++ gen8_pd_top_count(vm), vm->top); ++ + free_scratch(vm); + } + +@@ -803,8 +806,10 @@ static int gen8_init_scratch(struct i915_address_space *vm) + struct drm_i915_gem_object *obj; + + obj = vm->alloc_pt_dma(vm, I915_GTT_PAGE_SIZE_4K); +- if (IS_ERR(obj)) ++ if (IS_ERR(obj)) { ++ ret = PTR_ERR(obj); + goto free_scratch; ++ } + + ret = map_pt_dma(vm, obj); + if (ret) { +@@ -823,7 +828,8 @@ static int gen8_init_scratch(struct i915_address_space *vm) + free_scratch: + while (i--) + i915_gem_object_put(vm->scratch[i]); +- return -ENOMEM; ++ vm->scratch[0] = NULL; ++ return ret; + } + + static int gen8_preallocate_top_level_pdp(struct i915_ppgtt *ppgtt) +@@ -901,6 +907,7 @@ err_pd: + struct i915_ppgtt *gen8_ppgtt_create(struct intel_gt *gt, + unsigned long lmem_pt_obj_flags) + { ++ struct i915_page_directory *pd; + struct i915_ppgtt *ppgtt; + int err; + +@@ -946,21 +953,7 @@ struct i915_ppgtt *gen8_ppgtt_create(struct intel_gt *gt, + ppgtt->vm.alloc_scratch_dma = alloc_pt_dma; + } + +- err = gen8_init_scratch(&ppgtt->vm); +- if (err) +- goto err_free; +- +- ppgtt->pd = gen8_alloc_top_pd(&ppgtt->vm); +- if (IS_ERR(ppgtt->pd)) { +- err = PTR_ERR(ppgtt->pd); +- goto err_free_scratch; +- } +- +- if (!i915_vm_is_4lvl(&ppgtt->vm)) { +- err = gen8_preallocate_top_level_pdp(ppgtt); +- if (err) +- goto err_free_pd; +- } ++ ppgtt->vm.pte_encode = gen8_pte_encode; + + ppgtt->vm.bind_async_flags = I915_VMA_LOCAL_BIND; + ppgtt->vm.insert_entries = gen8_ppgtt_insert; +@@ -971,22 +964,31 @@ struct i915_ppgtt *gen8_ppgtt_create(struct intel_gt *gt, + ppgtt->vm.allocate_va_range = gen8_ppgtt_alloc; + ppgtt->vm.clear_range = gen8_ppgtt_clear; + ppgtt->vm.foreach = gen8_ppgtt_foreach; ++ ppgtt->vm.cleanup = gen8_ppgtt_cleanup; + +- ppgtt->vm.pte_encode = gen8_pte_encode; ++ err = gen8_init_scratch(&ppgtt->vm); ++ if (err) ++ goto err_put; ++ ++ pd = gen8_alloc_top_pd(&ppgtt->vm); ++ if (IS_ERR(pd)) { ++ err = PTR_ERR(pd); ++ goto err_put; ++ } ++ ppgtt->pd = pd; ++ ++ if (!i915_vm_is_4lvl(&ppgtt->vm)) { ++ err = gen8_preallocate_top_level_pdp(ppgtt); ++ if (err) ++ goto err_put; ++ } + + if (intel_vgpu_active(gt->i915)) + gen8_ppgtt_notify_vgt(ppgtt, true); + +- ppgtt->vm.cleanup = gen8_ppgtt_cleanup; +- + return ppgtt; + +-err_free_pd: +- __gen8_ppgtt_cleanup(&ppgtt->vm, ppgtt->pd, +- gen8_pd_top_count(&ppgtt->vm), ppgtt->vm.top); +-err_free_scratch: +- free_scratch(&ppgtt->vm); +-err_free: +- kfree(ppgtt); ++err_put: ++ i915_vm_put(&ppgtt->vm); + return ERR_PTR(err); + } +diff --git a/drivers/gpu/drm/i915/gt/intel_gtt.c b/drivers/gpu/drm/i915/gt/intel_gtt.c +index b67831833c9a3..2eaeba14319e9 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gtt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gtt.c +@@ -405,6 +405,9 @@ void free_scratch(struct i915_address_space *vm) + { + int i; + ++ if (!vm->scratch[0]) ++ return; ++ + for (i = 0; i <= vm->top; i++) + i915_gem_object_put(vm->scratch[i]); + } +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 7d5803f2343a9..c2571d2170d91 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -5307,10 +5307,22 @@ skl_compute_wm_params(const struct intel_crtc_state *crtc_state, + modifier == I915_FORMAT_MOD_4_TILED || + modifier == I915_FORMAT_MOD_Yf_TILED || + modifier == I915_FORMAT_MOD_Y_TILED_CCS || +- modifier == I915_FORMAT_MOD_Yf_TILED_CCS; ++ modifier == I915_FORMAT_MOD_Yf_TILED_CCS || ++ modifier == I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS || ++ modifier == I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS || ++ modifier == I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC || ++ modifier == I915_FORMAT_MOD_4_TILED_DG2_RC_CCS || ++ modifier == I915_FORMAT_MOD_4_TILED_DG2_MC_CCS || ++ modifier == I915_FORMAT_MOD_4_TILED_DG2_RC_CCS_CC; + wp->x_tiled = modifier == I915_FORMAT_MOD_X_TILED; + wp->rc_surface = modifier == I915_FORMAT_MOD_Y_TILED_CCS || +- modifier == I915_FORMAT_MOD_Yf_TILED_CCS; ++ modifier == I915_FORMAT_MOD_Yf_TILED_CCS || ++ modifier == I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS || ++ modifier == I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS || ++ modifier == I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC || ++ modifier == I915_FORMAT_MOD_4_TILED_DG2_RC_CCS || ++ modifier == I915_FORMAT_MOD_4_TILED_DG2_MC_CCS || ++ modifier == I915_FORMAT_MOD_4_TILED_DG2_RC_CCS_CC; + wp->is_planar = intel_format_info_is_yuv_semiplanar(format, modifier); + + wp->width = width; +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index bd4ca11d3ff53..86b90d0f5780a 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -388,10 +388,14 @@ static void meson_drv_unbind(struct device *dev) + drm_dev_unregister(drm); + drm_kms_helper_poll_fini(drm); + drm_atomic_helper_shutdown(drm); +- component_unbind_all(dev, drm); + free_irq(priv->vsync_irq, drm); + drm_dev_put(drm); + ++ meson_encoder_hdmi_remove(priv); ++ meson_encoder_cvbs_remove(priv); ++ ++ component_unbind_all(dev, drm); ++ + if (priv->afbcd.ops) + priv->afbcd.ops->exit(priv); + } +@@ -493,6 +497,13 @@ static int meson_drv_probe(struct platform_device *pdev) + return 0; + }; + ++static int meson_drv_remove(struct platform_device *pdev) ++{ ++ component_master_del(&pdev->dev, &meson_drv_master_ops); ++ ++ return 0; ++} ++ + static struct meson_drm_match_data meson_drm_gxbb_data = { + .compat = VPU_COMPATIBLE_GXBB, + }; +@@ -530,6 +541,7 @@ static const struct dev_pm_ops meson_drv_pm_ops = { + + static struct platform_driver meson_drm_platform_driver = { + .probe = meson_drv_probe, ++ .remove = meson_drv_remove, + .shutdown = meson_drv_shutdown, + .driver = { + .name = "meson-drm", +diff --git a/drivers/gpu/drm/meson/meson_drv.h b/drivers/gpu/drm/meson/meson_drv.h +index 177dac3ca3bea..c62ee358456fa 100644 +--- a/drivers/gpu/drm/meson/meson_drv.h ++++ b/drivers/gpu/drm/meson/meson_drv.h +@@ -25,6 +25,12 @@ enum vpu_compatible { + VPU_COMPATIBLE_G12A = 3, + }; + ++enum { ++ MESON_ENC_CVBS = 0, ++ MESON_ENC_HDMI, ++ MESON_ENC_LAST, ++}; ++ + struct meson_drm_match_data { + enum vpu_compatible compat; + struct meson_afbcd_ops *afbcd_ops; +@@ -51,6 +57,7 @@ struct meson_drm { + struct drm_crtc *crtc; + struct drm_plane *primary_plane; + struct drm_plane *overlay_plane; ++ void *encoders[MESON_ENC_LAST]; + + const struct meson_drm_soc_limits *limits; + +diff --git a/drivers/gpu/drm/meson/meson_encoder_cvbs.c b/drivers/gpu/drm/meson/meson_encoder_cvbs.c +index 8110a6e39320f..5675bc2a92cf8 100644 +--- a/drivers/gpu/drm/meson/meson_encoder_cvbs.c ++++ b/drivers/gpu/drm/meson/meson_encoder_cvbs.c +@@ -281,5 +281,18 @@ int meson_encoder_cvbs_init(struct meson_drm *priv) + } + drm_connector_attach_encoder(connector, &meson_encoder_cvbs->encoder); + ++ priv->encoders[MESON_ENC_CVBS] = meson_encoder_cvbs; ++ + return 0; + } ++ ++void meson_encoder_cvbs_remove(struct meson_drm *priv) ++{ ++ struct meson_encoder_cvbs *meson_encoder_cvbs; ++ ++ if (priv->encoders[MESON_ENC_CVBS]) { ++ meson_encoder_cvbs = priv->encoders[MESON_ENC_CVBS]; ++ drm_bridge_remove(&meson_encoder_cvbs->bridge); ++ drm_bridge_remove(meson_encoder_cvbs->next_bridge); ++ } ++} +diff --git a/drivers/gpu/drm/meson/meson_encoder_cvbs.h b/drivers/gpu/drm/meson/meson_encoder_cvbs.h +index 61d9d183ce7fb..09710fec3c660 100644 +--- a/drivers/gpu/drm/meson/meson_encoder_cvbs.h ++++ b/drivers/gpu/drm/meson/meson_encoder_cvbs.h +@@ -25,5 +25,6 @@ struct meson_cvbs_mode { + extern struct meson_cvbs_mode meson_cvbs_modes[MESON_CVBS_MODES_COUNT]; + + int meson_encoder_cvbs_init(struct meson_drm *priv); ++void meson_encoder_cvbs_remove(struct meson_drm *priv); + + #endif /* __MESON_VENC_CVBS_H */ +diff --git a/drivers/gpu/drm/meson/meson_encoder_hdmi.c b/drivers/gpu/drm/meson/meson_encoder_hdmi.c +index a7692584487cc..af6025037ecc0 100644 +--- a/drivers/gpu/drm/meson/meson_encoder_hdmi.c ++++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.c +@@ -446,6 +446,8 @@ int meson_encoder_hdmi_init(struct meson_drm *priv) + meson_encoder_hdmi->cec_notifier = notifier; + } + ++ priv->encoders[MESON_ENC_HDMI] = meson_encoder_hdmi; ++ + dev_dbg(priv->dev, "HDMI encoder initialized\n"); + + return 0; +@@ -454,3 +456,14 @@ err_put_node: + of_node_put(remote); + return ret; + } ++ ++void meson_encoder_hdmi_remove(struct meson_drm *priv) ++{ ++ struct meson_encoder_hdmi *meson_encoder_hdmi; ++ ++ if (priv->encoders[MESON_ENC_HDMI]) { ++ meson_encoder_hdmi = priv->encoders[MESON_ENC_HDMI]; ++ drm_bridge_remove(&meson_encoder_hdmi->bridge); ++ drm_bridge_remove(meson_encoder_hdmi->next_bridge); ++ } ++} +diff --git a/drivers/gpu/drm/meson/meson_encoder_hdmi.h b/drivers/gpu/drm/meson/meson_encoder_hdmi.h +index ed19494f09563..a6cd38eb5f71c 100644 +--- a/drivers/gpu/drm/meson/meson_encoder_hdmi.h ++++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.h +@@ -8,5 +8,6 @@ + #define __MESON_ENCODER_HDMI_H + + int meson_encoder_hdmi_init(struct meson_drm *priv); ++void meson_encoder_hdmi_remove(struct meson_drm *priv); + + #endif /* __MESON_ENCODER_HDMI_H */ +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +index e23e2552e8020..8902d3615ca93 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +@@ -383,12 +383,9 @@ static int dpu_kms_parse_data_bus_icc_path(struct dpu_kms *dpu_kms) + struct icc_path *path1; + struct drm_device *dev = dpu_kms->dev; + struct device *dpu_dev = dev->dev; +- struct device *mdss_dev = dpu_dev->parent; + +- /* Interconnects are a part of MDSS device tree binding, not the +- * MDP/DPU device. */ +- path0 = of_icc_get(mdss_dev, "mdp0-mem"); +- path1 = of_icc_get(mdss_dev, "mdp1-mem"); ++ path0 = msm_icc_get(dpu_dev, "mdp0-mem"); ++ path1 = msm_icc_get(dpu_dev, "mdp1-mem"); + + if (IS_ERR_OR_NULL(path0)) + return PTR_ERR_OR_ZERO(path0); +@@ -828,12 +825,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms) + _dpu_kms_mmu_destroy(dpu_kms); + + if (dpu_kms->catalog) { +- for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { +- u32 vbif_idx = dpu_kms->catalog->vbif[i].id; +- +- if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) { +- dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]); +- dpu_kms->hw_vbif[vbif_idx] = NULL; ++ for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) { ++ if (dpu_kms->hw_vbif[i]) { ++ dpu_hw_vbif_destroy(dpu_kms->hw_vbif[i]); ++ dpu_kms->hw_vbif[i] = NULL; + } + } + } +@@ -1135,7 +1130,7 @@ static int dpu_kms_hw_init(struct msm_kms *kms) + for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { + u32 vbif_idx = dpu_kms->catalog->vbif[i].id; + +- dpu_kms->hw_vbif[i] = dpu_hw_vbif_init(vbif_idx, ++ dpu_kms->hw_vbif[vbif_idx] = dpu_hw_vbif_init(vbif_idx, + dpu_kms->vbif[vbif_idx], dpu_kms->catalog); + if (IS_ERR_OR_NULL(dpu_kms->hw_vbif[vbif_idx])) { + rc = PTR_ERR(dpu_kms->hw_vbif[vbif_idx]); +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c +index 21d20373eb8b3..a18fb649301c9 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c +@@ -11,6 +11,14 @@ + #include "dpu_hw_vbif.h" + #include "dpu_trace.h" + ++static struct dpu_hw_vbif *dpu_get_vbif(struct dpu_kms *dpu_kms, enum dpu_vbif vbif_idx) ++{ ++ if (vbif_idx < ARRAY_SIZE(dpu_kms->hw_vbif)) ++ return dpu_kms->hw_vbif[vbif_idx]; ++ ++ return NULL; ++} ++ + /** + * _dpu_vbif_wait_for_xin_halt - wait for the xin to halt + * @vbif: Pointer to hardware vbif driver +@@ -148,20 +156,15 @@ exit: + void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms, + struct dpu_vbif_set_ot_params *params) + { +- struct dpu_hw_vbif *vbif = NULL; ++ struct dpu_hw_vbif *vbif; + struct dpu_hw_mdp *mdp; + bool forced_on = false; + u32 ot_lim; +- int ret, i; ++ int ret; + + mdp = dpu_kms->hw_mdp; + +- for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) { +- if (dpu_kms->hw_vbif[i] && +- dpu_kms->hw_vbif[i]->idx == params->vbif_idx) +- vbif = dpu_kms->hw_vbif[i]; +- } +- ++ vbif = dpu_get_vbif(dpu_kms, params->vbif_idx); + if (!vbif || !mdp) { + DRM_DEBUG_ATOMIC("invalid arguments vbif %d mdp %d\n", + vbif != NULL, mdp != NULL); +@@ -204,7 +207,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms, + void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms, + struct dpu_vbif_set_qos_params *params) + { +- struct dpu_hw_vbif *vbif = NULL; ++ struct dpu_hw_vbif *vbif; + struct dpu_hw_mdp *mdp; + bool forced_on = false; + const struct dpu_vbif_qos_tbl *qos_tbl; +@@ -216,13 +219,7 @@ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms, + } + mdp = dpu_kms->hw_mdp; + +- for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) { +- if (dpu_kms->hw_vbif[i] && +- dpu_kms->hw_vbif[i]->idx == params->vbif_idx) { +- vbif = dpu_kms->hw_vbif[i]; +- break; +- } +- } ++ vbif = dpu_get_vbif(dpu_kms, params->vbif_idx); + + if (!vbif || !vbif->cap) { + DPU_ERROR("invalid vbif %d\n", params->vbif_idx); +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c +index 3d5621a68f858..b0c372fef5d51 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c +@@ -921,12 +921,9 @@ fail: + + static int mdp5_setup_interconnect(struct platform_device *pdev) + { +- /* Interconnects are a part of MDSS device tree binding, not the +- * MDP5 device. */ +- struct device *mdss_dev = pdev->dev.parent; +- struct icc_path *path0 = of_icc_get(mdss_dev, "mdp0-mem"); +- struct icc_path *path1 = of_icc_get(mdss_dev, "mdp1-mem"); +- struct icc_path *path_rot = of_icc_get(mdss_dev, "rotator-mem"); ++ struct icc_path *path0 = msm_icc_get(&pdev->dev, "mdp0-mem"); ++ struct icc_path *path1 = msm_icc_get(&pdev->dev, "mdp1-mem"); ++ struct icc_path *path_rot = msm_icc_get(&pdev->dev, "rotator-mem"); + + if (IS_ERR(path0)) + return PTR_ERR(path0); +diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c +index 7257515871a9f..676279d0ca8d9 100644 +--- a/drivers/gpu/drm/msm/dp/dp_catalog.c ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c +@@ -431,7 +431,7 @@ void dp_catalog_ctrl_config_msa(struct dp_catalog *dp_catalog, + + if (rate == link_rate_hbr3) + pixel_div = 6; +- else if (rate == 1620000 || rate == 270000) ++ else if (rate == 162000 || rate == 270000) + pixel_div = 2; + else if (rate == link_rate_hbr2) + pixel_div = 4; +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 7c0314d6566af..c5f931b2574ce 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1169,10 +1169,15 @@ void msm_drv_shutdown(struct platform_device *pdev) + struct msm_drm_private *priv = platform_get_drvdata(pdev); + struct drm_device *drm = priv ? priv->dev : NULL; + +- if (!priv || !priv->kms) +- return; +- +- drm_atomic_helper_shutdown(drm); ++ /* ++ * Shutdown the hw if we're far enough along where things might be on. ++ * If we run this too early, we'll end up panicking in any variety of ++ * places. Since we don't register the drm device until late in ++ * msm_drm_init, drm_dev->registered is used as an indicator that the ++ * shutdown will be successful. ++ */ ++ if (drm && drm->registered) ++ drm_atomic_helper_shutdown(drm); + } + + static struct platform_driver msm_platform_driver = { +diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h +index 099a67d10c3a7..17e8b6571f6ff 100644 +--- a/drivers/gpu/drm/msm/msm_drv.h ++++ b/drivers/gpu/drm/msm/msm_drv.h +@@ -442,6 +442,8 @@ void __iomem *msm_ioremap_size(struct platform_device *pdev, const char *name, + phys_addr_t *size); + void __iomem *msm_ioremap_quiet(struct platform_device *pdev, const char *name); + ++struct icc_path *msm_icc_get(struct device *dev, const char *name); ++ + #define msm_writel(data, addr) writel((data), (addr)) + #define msm_readl(addr) readl((addr)) + +diff --git a/drivers/gpu/drm/msm/msm_io_utils.c b/drivers/gpu/drm/msm/msm_io_utils.c +index 7b504617833ad..d02cd29ce8299 100644 +--- a/drivers/gpu/drm/msm/msm_io_utils.c ++++ b/drivers/gpu/drm/msm/msm_io_utils.c +@@ -5,6 +5,8 @@ + * Author: Rob Clark <robdclark@gmail.com> + */ + ++#include <linux/interconnect.h> ++ + #include "msm_drv.h" + + /* +@@ -124,3 +126,23 @@ void msm_hrtimer_work_init(struct msm_hrtimer_work *work, + work->worker = worker; + kthread_init_work(&work->work, fn); + } ++ ++struct icc_path *msm_icc_get(struct device *dev, const char *name) ++{ ++ struct device *mdss_dev = dev->parent; ++ struct icc_path *path; ++ ++ path = of_icc_get(dev, name); ++ if (path) ++ return path; ++ ++ /* ++ * If there are no interconnects attached to the corresponding device ++ * node, of_icc_get() will return NULL. ++ * ++ * If the MDP5/DPU device node doesn't have interconnects, lookup the ++ * path in the parent (MDSS) device. ++ */ ++ return of_icc_get(mdss_dev, name); ++ ++} +diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c +index e29175e4b44ce..07a327ad5e2a8 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -281,8 +281,10 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size, int *align, u32 domain, + break; + } + +- if (WARN_ON(pi < 0)) ++ if (WARN_ON(pi < 0)) { ++ kfree(nvbo); + return ERR_PTR(-EINVAL); ++ } + + /* Disable compression if suitable settings couldn't be found. */ + if (nvbo->comp && !vmm->page[pi].comp) { +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index df83c4654e269..96be2ecb86d4d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -503,7 +503,8 @@ nouveau_connector_set_encoder(struct drm_connector *connector, + connector->interlace_allowed = + nv_encoder->caps.dp_interlace; + else +- connector->interlace_allowed = true; ++ connector->interlace_allowed = ++ drm->client.device.info.family < NV_DEVICE_INFO_V0_VOLTA; + connector->doublescan_allowed = true; + } else + if (nv_encoder->dcb->type == DCB_OUTPUT_LVDS || +diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c +index 347488685f745..9608121e49b7e 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_prime.c ++++ b/drivers/gpu/drm/nouveau/nouveau_prime.c +@@ -71,7 +71,6 @@ struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, + ret = nouveau_bo_init(nvbo, size, align, NOUVEAU_GEM_DOMAIN_GART, + sg, robj); + if (ret) { +- nouveau_bo_ref(NULL, &nvbo); + obj = ERR_PTR(ret); + goto unlock; + } +diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c +index 0399f3390a0ad..c4febb8619103 100644 +--- a/drivers/gpu/drm/omapdrm/dss/dss.c ++++ b/drivers/gpu/drm/omapdrm/dss/dss.c +@@ -1176,6 +1176,7 @@ static void __dss_uninit_ports(struct dss_device *dss, unsigned int num_ports) + default: + break; + } ++ of_node_put(port); + } + } + +@@ -1208,11 +1209,13 @@ static int dss_init_ports(struct dss_device *dss) + default: + break; + } ++ of_node_put(port); + } + + return 0; + + error: ++ of_node_put(port); + __dss_uninit_ports(dss, i); + return r; + } +diff --git a/drivers/gpu/drm/pl111/pl111_versatile.c b/drivers/gpu/drm/pl111/pl111_versatile.c +index bdd883f4f0da5..963a5d5e6987a 100644 +--- a/drivers/gpu/drm/pl111/pl111_versatile.c ++++ b/drivers/gpu/drm/pl111/pl111_versatile.c +@@ -402,6 +402,7 @@ static int pl111_vexpress_clcd_init(struct device *dev, struct device_node *np, + if (of_device_is_compatible(child, "arm,pl111")) { + has_coretile_clcd = true; + ct_clcd = child; ++ of_node_put(child); + break; + } + if (of_device_is_compatible(child, "arm,hdlcd")) { +diff --git a/drivers/gpu/drm/tiny/bochs.c b/drivers/gpu/drm/tiny/bochs.c +index ed971c8bb4463..0cedb6f6f5591 100644 +--- a/drivers/gpu/drm/tiny/bochs.c ++++ b/drivers/gpu/drm/tiny/bochs.c +@@ -306,6 +306,8 @@ static void bochs_hw_fini(struct drm_device *dev) + static void bochs_hw_blank(struct bochs_device *bochs, bool blank) + { + DRM_DEBUG_DRIVER("hw_blank %d\n", blank); ++ /* enable color bit (so VGA_IS1_RC access works) */ ++ bochs_vga_writeb(bochs, VGA_MIS_W, VGA_MIS_COLOR); + /* discard ar_flip_flop */ + (void)bochs_vga_readb(bochs, VGA_IS1_RC); + /* blank or unblank; we need only update index and set 0x20 */ +diff --git a/drivers/gpu/drm/udl/udl_modeset.c b/drivers/gpu/drm/udl/udl_modeset.c +index e67c40a48fb46..b43e6ff06310f 100644 +--- a/drivers/gpu/drm/udl/udl_modeset.c ++++ b/drivers/gpu/drm/udl/udl_modeset.c +@@ -382,9 +382,6 @@ udl_simple_display_pipe_enable(struct drm_simple_display_pipe *pipe, + + udl_handle_damage(fb, &shadow_plane_state->data[0], 0, 0, fb->width, fb->height); + +- if (!crtc_state->mode_changed) +- return; +- + /* enable display */ + udl_crtc_write_mode_to_hw(crtc); + } +diff --git a/drivers/gpu/drm/vc4/vc4_vec.c b/drivers/gpu/drm/vc4/vc4_vec.c +index 11fc3d6f66b1e..4e2250b8fa23e 100644 +--- a/drivers/gpu/drm/vc4/vc4_vec.c ++++ b/drivers/gpu/drm/vc4/vc4_vec.c +@@ -256,7 +256,7 @@ static void vc4_vec_ntsc_j_mode_set(struct vc4_vec *vec) + static const struct drm_display_mode ntsc_mode = { + DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 13500, + 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0, +- 480, 480 + 3, 480 + 3 + 3, 480 + 3 + 3 + 16, 0, ++ 480, 480 + 7, 480 + 7 + 6, 525, 0, + DRM_MODE_FLAG_INTERLACE) + }; + +@@ -278,7 +278,7 @@ static void vc4_vec_pal_m_mode_set(struct vc4_vec *vec) + static const struct drm_display_mode pal_mode = { + DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 13500, + 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0, +- 576, 576 + 2, 576 + 2 + 3, 576 + 2 + 3 + 20, 0, ++ 576, 576 + 4, 576 + 4 + 6, 625, 0, + DRM_MODE_FLAG_INTERLACE) + }; + +diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c +index f73352e7b8329..96e71813864a7 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_display.c ++++ b/drivers/gpu/drm/virtio/virtgpu_display.c +@@ -348,6 +348,8 @@ int virtio_gpu_modeset_init(struct virtio_gpu_device *vgdev) + vgdev->ddev->mode_config.max_width = XRES_MAX; + vgdev->ddev->mode_config.max_height = YRES_MAX; + ++ vgdev->ddev->mode_config.fb_modifiers_not_supported = true; ++ + for (i = 0 ; i < vgdev->num_scanouts; ++i) + vgdev_output_init(vgdev, i); + +diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c +index 580a788098361..7db48d17ee3a8 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_gem.c ++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c +@@ -228,8 +228,10 @@ int virtio_gpu_array_lock_resv(struct virtio_gpu_object_array *objs) + + for (i = 0; i < objs->nents; ++i) { + ret = dma_resv_reserve_fences(objs->objs[i]->resv, 1); +- if (ret) ++ if (ret) { ++ virtio_gpu_array_unlock_resv(objs); + return ret; ++ } + } + return ret; + } +diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +index 9b2702116f93e..5d05093014ac3 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c ++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +@@ -47,7 +47,7 @@ static int virtio_gpu_fence_event_create(struct drm_device *dev, + struct virtio_gpu_fence_event *e = NULL; + int ret; + +- if (!(vfpriv->ring_idx_mask & (1 << ring_idx))) ++ if (!(vfpriv->ring_idx_mask & BIT_ULL(ring_idx))) + return 0; + + e = kzalloc(sizeof(*e), GFP_KERNEL); +@@ -168,7 +168,7 @@ static int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data, + * array contains any fence from a foreign context. + */ + ret = 0; +- if (!dma_fence_match_context(in_fence, vgdev->fence_drv.context)) ++ if (!dma_fence_match_context(in_fence, fence_ctx + ring_idx)) + ret = dma_fence_wait(in_fence, true); + + dma_fence_put(in_fence); +diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c +index 1cc8f3fc8e4ba..75a159df0af66 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -170,6 +170,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, + shmem->pages = drm_gem_shmem_get_sg_table(&bo->base); + if (IS_ERR(shmem->pages)) { + drm_gem_shmem_unpin(&bo->base); ++ shmem->pages = NULL; + return PTR_ERR(shmem->pages); + } + +@@ -248,6 +249,8 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, + + ret = virtio_gpu_object_shmem_init(vgdev, bo, &ents, &nents); + if (ret != 0) { ++ if (fence) ++ virtio_gpu_array_unlock_resv(objs); + virtio_gpu_array_put_free(objs); + virtio_gpu_free_object(&shmem_obj->base); + return ret; +diff --git a/drivers/gpu/drm/virtio/virtgpu_plane.c b/drivers/gpu/drm/virtio/virtgpu_plane.c +index 6d3cc9e238a4a..7148f3813d8bd 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_plane.c ++++ b/drivers/gpu/drm/virtio/virtgpu_plane.c +@@ -266,14 +266,14 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane, + } + + static void virtio_gpu_plane_cleanup_fb(struct drm_plane *plane, +- struct drm_plane_state *old_state) ++ struct drm_plane_state *state) + { + struct virtio_gpu_framebuffer *vgfb; + +- if (!plane->state->fb) ++ if (!state->fb) + return; + +- vgfb = to_virtio_gpu_framebuffer(plane->state->fb); ++ vgfb = to_virtio_gpu_framebuffer(state->fb); + if (vgfb->fence) { + dma_fence_put(&vgfb->fence->f); + vgfb->fence = NULL; +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c +index 7c052efe88365..2edf31806b740 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c +@@ -595,7 +595,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev, + bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); + +- if (use_dma_api) ++ if (virtio_gpu_is_shmem(bo) && use_dma_api) + dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, + shmem->pages, DMA_TO_DEVICE); + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +index 2aceac7856e21..089046fa21bea 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +@@ -1076,6 +1076,7 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data, + + if (desc_len < 0) { + atomic_set(&dev_priv->mksstat_user_pids[slot], 0); ++ __free_page(page); + return -EFAULT; + } + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 2e72922e36f56..91a4d3fc30e08 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1186,7 +1186,7 @@ static void mt_touch_report(struct hid_device *hid, + int contact_count = -1; + + /* sticky fingers release in progress, abort */ +- if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) ++ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) + return; + + scantime = *app->scantime; +@@ -1267,7 +1267,7 @@ static void mt_touch_report(struct hid_device *hid, + del_timer(&td->release_timer); + } + +- clear_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags); ++ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags); + } + + static int mt_touch_input_configured(struct hid_device *hdev, +@@ -1699,11 +1699,11 @@ static void mt_expired_timeout(struct timer_list *t) + * An input report came in just before we release the sticky fingers, + * it will take care of the sticky fingers. + */ +- if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) ++ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) + return; + if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags)) + mt_release_contacts(hdev); +- clear_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags); ++ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags); + } + + static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index f33a03c96ba68..cce3248879525 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -761,12 +761,31 @@ static int joycon_read_stick_calibration(struct joycon_ctlr *ctlr, u16 cal_addr, + cal_y->max = cal_y->center + y_max_above; + cal_y->min = cal_y->center - y_min_below; + +- return 0; ++ /* check if calibration values are plausible */ ++ if (cal_x->min >= cal_x->center || cal_x->center >= cal_x->max || ++ cal_y->min >= cal_y->center || cal_y->center >= cal_y->max) ++ ret = -EINVAL; ++ ++ return ret; + } + + static const u16 DFLT_STICK_CAL_CEN = 2000; + static const u16 DFLT_STICK_CAL_MAX = 3500; + static const u16 DFLT_STICK_CAL_MIN = 500; ++static void joycon_use_default_calibration(struct hid_device *hdev, ++ struct joycon_stick_cal *cal_x, ++ struct joycon_stick_cal *cal_y, ++ const char *stick, int ret) ++{ ++ hid_warn(hdev, ++ "Failed to read %s stick cal, using defaults; e=%d\n", ++ stick, ret); ++ ++ cal_x->center = cal_y->center = DFLT_STICK_CAL_CEN; ++ cal_x->max = cal_y->max = DFLT_STICK_CAL_MAX; ++ cal_x->min = cal_y->min = DFLT_STICK_CAL_MIN; ++} ++ + static int joycon_request_calibration(struct joycon_ctlr *ctlr) + { + u16 left_stick_addr = JC_CAL_FCT_DATA_LEFT_ADDR; +@@ -794,38 +813,24 @@ static int joycon_request_calibration(struct joycon_ctlr *ctlr) + &ctlr->left_stick_cal_x, + &ctlr->left_stick_cal_y, + true); +- if (ret) { +- hid_warn(ctlr->hdev, +- "Failed to read left stick cal, using dflts; e=%d\n", +- ret); +- +- ctlr->left_stick_cal_x.center = DFLT_STICK_CAL_CEN; +- ctlr->left_stick_cal_x.max = DFLT_STICK_CAL_MAX; +- ctlr->left_stick_cal_x.min = DFLT_STICK_CAL_MIN; + +- ctlr->left_stick_cal_y.center = DFLT_STICK_CAL_CEN; +- ctlr->left_stick_cal_y.max = DFLT_STICK_CAL_MAX; +- ctlr->left_stick_cal_y.min = DFLT_STICK_CAL_MIN; +- } ++ if (ret) ++ joycon_use_default_calibration(ctlr->hdev, ++ &ctlr->left_stick_cal_x, ++ &ctlr->left_stick_cal_y, ++ "left", ret); + + /* read the right stick calibration data */ + ret = joycon_read_stick_calibration(ctlr, right_stick_addr, + &ctlr->right_stick_cal_x, + &ctlr->right_stick_cal_y, + false); +- if (ret) { +- hid_warn(ctlr->hdev, +- "Failed to read right stick cal, using dflts; e=%d\n", +- ret); +- +- ctlr->right_stick_cal_x.center = DFLT_STICK_CAL_CEN; +- ctlr->right_stick_cal_x.max = DFLT_STICK_CAL_MAX; +- ctlr->right_stick_cal_x.min = DFLT_STICK_CAL_MIN; + +- ctlr->right_stick_cal_y.center = DFLT_STICK_CAL_CEN; +- ctlr->right_stick_cal_y.max = DFLT_STICK_CAL_MAX; +- ctlr->right_stick_cal_y.min = DFLT_STICK_CAL_MIN; +- } ++ if (ret) ++ joycon_use_default_calibration(ctlr->hdev, ++ &ctlr->right_stick_cal_x, ++ &ctlr->right_stick_cal_y, ++ "right", ret); + + hid_dbg(ctlr->hdev, "calibration:\n" + "l_x_c=%d l_x_max=%d l_x_min=%d\n" +diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c +index 26373b82fe812..6da80e442fdd1 100644 +--- a/drivers/hid/hid-roccat.c ++++ b/drivers/hid/hid-roccat.c +@@ -257,6 +257,8 @@ int roccat_report_event(int minor, u8 const *data) + if (!new_value) + return -ENOMEM; + ++ mutex_lock(&device->cbuf_lock); ++ + report = &device->cbuf[device->cbuf_end]; + + /* passing NULL is safe */ +@@ -276,6 +278,8 @@ int roccat_report_event(int minor, u8 const *data) + reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE; + } + ++ mutex_unlock(&device->cbuf_lock); ++ + wake_up_interruptible(&device->wait); + return 0; + } +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index c0fe66e50c58d..cf3315a408c8c 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -153,6 +153,7 @@ static int uclogic_input_configured(struct hid_device *hdev, + suffix = "Pad"; + break; + case HID_DG_PEN: ++ case HID_DG_DIGITIZER: + suffix = "Pen"; + break; + case HID_CP_CONSUMER_CONTROL: +diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c +index 21f11a5b965b1..49ffd808d17ff 100644 +--- a/drivers/hsi/clients/ssi_protocol.c ++++ b/drivers/hsi/clients/ssi_protocol.c +@@ -931,6 +931,7 @@ static int ssip_pn_open(struct net_device *dev) + if (err < 0) { + dev_err(&cl->device, "Register HSI port event failed (%d)\n", + err); ++ hsi_release_port(cl); + return err; + } + dev_dbg(&cl->device, "Configuring SSI port\n"); +diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c +index 44a3f5660c109..eb98201583185 100644 +--- a/drivers/hsi/controllers/omap_ssi_core.c ++++ b/drivers/hsi/controllers/omap_ssi_core.c +@@ -524,6 +524,7 @@ static int ssi_probe(struct platform_device *pd) + if (!childpdev) { + err = -ENODEV; + dev_err(&pd->dev, "failed to create ssi controller port\n"); ++ of_node_put(child); + goto out3; + } + } +diff --git a/drivers/hsi/controllers/omap_ssi_port.c b/drivers/hsi/controllers/omap_ssi_port.c +index a0cb5be246e1c..b9495b720f1bd 100644 +--- a/drivers/hsi/controllers/omap_ssi_port.c ++++ b/drivers/hsi/controllers/omap_ssi_port.c +@@ -230,10 +230,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch) + if (msg->ttype == HSI_MSG_READ) { + err = dma_map_sg(&ssi->device, msg->sgt.sgl, msg->sgt.nents, + DMA_FROM_DEVICE); +- if (err < 0) { ++ if (!err) { + dev_dbg(&ssi->device, "DMA map SG failed !\n"); + pm_runtime_put_autosuspend(omap_port->pdev); +- return err; ++ return -EIO; + } + csdp = SSI_DST_BURST_4x32_BIT | SSI_DST_MEMORY_PORT | + SSI_SRC_SINGLE_ACCESS0 | SSI_SRC_PERIPHERAL_PORT | +@@ -247,10 +247,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch) + } else { + err = dma_map_sg(&ssi->device, msg->sgt.sgl, msg->sgt.nents, + DMA_TO_DEVICE); +- if (err < 0) { ++ if (!err) { + dev_dbg(&ssi->device, "DMA map SG failed !\n"); + pm_runtime_put_autosuspend(omap_port->pdev); +- return err; ++ return -EIO; + } + csdp = SSI_SRC_BURST_4x32_BIT | SSI_SRC_MEMORY_PORT | + SSI_DST_SINGLE_ACCESS0 | SSI_DST_PERIPHERAL_PORT | +diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c +index 1fe37418ff46c..f29ce49294daf 100644 +--- a/drivers/hwmon/gsc-hwmon.c ++++ b/drivers/hwmon/gsc-hwmon.c +@@ -267,6 +267,7 @@ gsc_hwmon_get_devtree_pdata(struct device *dev) + pdata->nchannels = nchannels; + + /* fan controller base address */ ++ of_node_get(dev->parent->of_node); + fan = of_find_compatible_node(dev->parent->of_node, NULL, "gw,gsc-fan"); + if (fan && of_property_read_u32(fan, "reg", &pdata->fan_base)) { + dev_err(dev, "fan node without base\n"); +diff --git a/drivers/hwmon/occ/p9_sbe.c b/drivers/hwmon/occ/p9_sbe.c +index a91937e28e12b..775147f31cb10 100644 +--- a/drivers/hwmon/occ/p9_sbe.c ++++ b/drivers/hwmon/occ/p9_sbe.c +@@ -14,6 +14,8 @@ + + #include "common.h" + ++#define OCC_CHECKSUM_RETRIES 3 ++ + struct p9_sbe_occ { + struct occ occ; + bool sbe_error; +@@ -81,18 +83,23 @@ done: + static int p9_sbe_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len, + void *resp, size_t resp_len) + { ++ size_t original_resp_len = resp_len; + struct p9_sbe_occ *ctx = to_p9_sbe_occ(occ); +- int rc; ++ int rc, i; + +- rc = fsi_occ_submit(ctx->sbe, cmd, len, resp, &resp_len); +- if (rc < 0) { ++ for (i = 0; i < OCC_CHECKSUM_RETRIES; ++i) { ++ rc = fsi_occ_submit(ctx->sbe, cmd, len, resp, &resp_len); ++ if (rc >= 0) ++ break; + if (resp_len) { + if (p9_sbe_occ_save_ffdc(ctx, resp, resp_len)) + sysfs_notify(&occ->bus_dev->kobj, NULL, + bin_attr_ffdc.attr.name); ++ return rc; + } +- +- return rc; ++ if (rc != -EBADE) ++ return rc; ++ resp_len = original_resp_len; + } + + switch (((struct occ_response *)resp)->return_status) { +diff --git a/drivers/hwmon/pmbus/mp2888.c b/drivers/hwmon/pmbus/mp2888.c +index 8ecd4adfef40e..24e5194706cf6 100644 +--- a/drivers/hwmon/pmbus/mp2888.c ++++ b/drivers/hwmon/pmbus/mp2888.c +@@ -34,7 +34,7 @@ struct mp2888_data { + int curr_sense_gain; + }; + +-#define to_mp2888_data(x) container_of(x, struct mp2888_data, info) ++#define to_mp2888_data(x) container_of(x, struct mp2888_data, info) + + static int mp2888_read_byte_data(struct i2c_client *client, int page, int reg) + { +@@ -109,7 +109,7 @@ mp2888_read_phase(struct i2c_client *client, struct mp2888_data *data, int page, + * - Kcs is the DrMOS current sense gain of power stage, which is obtained from the + * register MP2888_MFR_VR_CONFIG1, bits 13-12 with the following selection of DrMOS + * (data->curr_sense_gain): +- * 00b - 5µA/A, 01b - 8.5µA/A, 10b - 9.7µA/A, 11b - 10µA/A. ++ * 00b - 8.5µA/A, 01b - 9.7µA/A, 1b - 10µA/A, 11b - 5µA/A. + * - Rcs is the internal phase current sense resistor. This parameter depends on hardware + * assembly. By default it is set to 1kΩ. In case of different assembly, user should + * scale this parameter by dividing it by Rcs. +@@ -118,10 +118,9 @@ mp2888_read_phase(struct i2c_client *client, struct mp2888_data *data, int page, + * because sampling of current occurrence of bit weight has a big deviation, especially for + * light load. + */ +- ret = DIV_ROUND_CLOSEST(ret * 100 - 9800, data->curr_sense_gain); +- ret = (data->phase_curr_resolution) ? ret * 2 : ret; ++ ret = DIV_ROUND_CLOSEST(ret * 200 - 19600, data->curr_sense_gain); + /* Scale according to total current resolution. */ +- ret = (data->total_curr_resolution) ? ret * 8 : ret * 4; ++ ret = (data->total_curr_resolution) ? ret * 2 : ret; + return ret; + } + +@@ -212,7 +211,7 @@ static int mp2888_read_word_data(struct i2c_client *client, int page, int phase, + ret = pmbus_read_word_data(client, page, phase, reg); + if (ret < 0) + return ret; +- ret = data->total_curr_resolution ? ret * 2 : ret; ++ ret = data->total_curr_resolution ? ret : DIV_ROUND_CLOSEST(ret, 2); + break; + case PMBUS_POUT_OP_WARN_LIMIT: + ret = pmbus_read_word_data(client, page, phase, reg); +@@ -223,7 +222,7 @@ static int mp2888_read_word_data(struct i2c_client *client, int page, int phase, + * set 1. Actual power is reported with 0.5W or 1W respectively resolution. Scaling + * is needed to match both. + */ +- ret = data->total_curr_resolution ? ret * 4 : ret * 2; ++ ret = data->total_curr_resolution ? ret * 2 : ret; + break; + /* + * The below registers are not implemented by device or implemented not according to the +diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c +index c19df3ade48e3..13ac2d8f22c79 100644 +--- a/drivers/hwmon/sht4x.c ++++ b/drivers/hwmon/sht4x.c +@@ -129,7 +129,7 @@ unlock: + + static ssize_t sht4x_interval_write(struct sht4x_data *data, long val) + { +- data->update_interval = clamp_val(val, SHT4X_MIN_POLL_INTERVAL, UINT_MAX); ++ data->update_interval = clamp_val(val, SHT4X_MIN_POLL_INTERVAL, INT_MAX); + + return 0; + } +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 70b80e7109905..4d3a3b464ecd8 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -126,8 +126,9 @@ + * status codes + */ + #define STATUS_IDLE 0x0 +-#define STATUS_WRITE_IN_PROGRESS 0x1 +-#define STATUS_READ_IN_PROGRESS 0x2 ++#define STATUS_ACTIVE 0x1 ++#define STATUS_WRITE_IN_PROGRESS 0x2 ++#define STATUS_READ_IN_PROGRESS 0x4 + + /* + * operation modes +@@ -334,12 +335,14 @@ void i2c_dw_disable_int(struct dw_i2c_dev *dev); + + static inline void __i2c_dw_enable(struct dw_i2c_dev *dev) + { ++ dev->status |= STATUS_ACTIVE; + regmap_write(dev->map, DW_IC_ENABLE, 1); + } + + static inline void __i2c_dw_disable_nowait(struct dw_i2c_dev *dev) + { + regmap_write(dev->map, DW_IC_ENABLE, 0); ++ dev->status &= ~STATUS_ACTIVE; + } + + void __i2c_dw_disable(struct dw_i2c_dev *dev); +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 44a94b225ed82..dc3c5a15a95b9 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -716,6 +716,19 @@ static int i2c_dw_irq_handler_master(struct dw_i2c_dev *dev) + u32 stat; + + stat = i2c_dw_read_clear_intrbits(dev); ++ ++ if (!(dev->status & STATUS_ACTIVE)) { ++ /* ++ * Unexpected interrupt in driver point of view. State ++ * variables are either unset or stale so acknowledge and ++ * disable interrupts for suppressing further interrupts if ++ * interrupt really came from this HW (E.g. firmware has left ++ * the HW active). ++ */ ++ regmap_write(dev->map, DW_IC_INTR_MASK, 0); ++ return 0; ++ } ++ + if (stat & DW_IC_INTR_TX_ABRT) { + dev->cmd_err |= DW_IC_ERR_TX_ABRT; + dev->status = STATUS_IDLE; +diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c +index 608e612094556..ca368482b2464 100644 +--- a/drivers/i2c/busses/i2c-designware-pcidrv.c ++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c +@@ -27,7 +27,6 @@ + #include "i2c-ccgx-ucsi.h" + + #define DRIVER_NAME "i2c-designware-pci" +-#define AMD_CLK_RATE_HZ 100000 + + enum dw_pci_ctl_id_t { + medfield, +@@ -100,11 +99,6 @@ static u32 mfld_get_clk_rate_khz(struct dw_i2c_dev *dev) + return 25000; + } + +-static u32 navi_amd_get_clk_rate_khz(struct dw_i2c_dev *dev) +-{ +- return AMD_CLK_RATE_HZ; +-} +- + static int mfld_setup(struct pci_dev *pdev, struct dw_pci_controller *c) + { + struct dw_i2c_dev *dev = dev_get_drvdata(&pdev->dev); +@@ -126,15 +120,6 @@ static int mfld_setup(struct pci_dev *pdev, struct dw_pci_controller *c) + return -ENODEV; + } + +-static int navi_amd_setup(struct pci_dev *pdev, struct dw_pci_controller *c) +-{ +- struct dw_i2c_dev *dev = dev_get_drvdata(&pdev->dev); +- +- dev->flags |= MODEL_AMD_NAVI_GPU; +- dev->timings.bus_freq_hz = I2C_MAX_STANDARD_MODE_FREQ; +- return 0; +-} +- + static int mrfld_setup(struct pci_dev *pdev, struct dw_pci_controller *c) + { + /* +@@ -159,6 +144,20 @@ static u32 ehl_get_clk_rate_khz(struct dw_i2c_dev *dev) + return 100000; + } + ++static u32 navi_amd_get_clk_rate_khz(struct dw_i2c_dev *dev) ++{ ++ return 100000; ++} ++ ++static int navi_amd_setup(struct pci_dev *pdev, struct dw_pci_controller *c) ++{ ++ struct dw_i2c_dev *dev = dev_get_drvdata(&pdev->dev); ++ ++ dev->flags |= MODEL_AMD_NAVI_GPU; ++ dev->timings.bus_freq_hz = I2C_MAX_STANDARD_MODE_FREQ; ++ return 0; ++} ++ + static struct dw_pci_controller dw_pci_controllers[] = { + [medfield] = { + .bus_num = -1, +@@ -389,6 +388,7 @@ static const struct pci_device_id i2_designware_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x4bbe), elkhartlake }, + { PCI_VDEVICE(INTEL, 0x4bbf), elkhartlake }, + { PCI_VDEVICE(INTEL, 0x4bc0), elkhartlake }, ++ /* AMD NAVI */ + { PCI_VDEVICE(ATI, 0x7314), navi_amd }, + { PCI_VDEVICE(ATI, 0x73a4), navi_amd }, + { PCI_VDEVICE(ATI, 0x73e4), navi_amd }, +diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c +index ad5efd7497d1c..0e840eba4fd64 100644 +--- a/drivers/i2c/busses/i2c-mlxbf.c ++++ b/drivers/i2c/busses/i2c-mlxbf.c +@@ -306,6 +306,7 @@ static u64 mlxbf_i2c_corepll_frequency; + * exact. + */ + #define MLXBF_I2C_SMBUS_TIMEOUT (300 * 1000) /* 300ms */ ++#define MLXBF_I2C_SMBUS_LOCK_POLL_TIMEOUT (300 * 1000) /* 300ms */ + + /* Encapsulates timing parameters. */ + struct mlxbf_i2c_timings { +@@ -514,6 +515,25 @@ static bool mlxbf_smbus_master_wait_for_idle(struct mlxbf_i2c_priv *priv) + return false; + } + ++/* ++ * wait for the lock to be released before acquiring it. ++ */ ++static bool mlxbf_i2c_smbus_master_lock(struct mlxbf_i2c_priv *priv) ++{ ++ if (mlxbf_smbus_poll(priv->smbus->io, MLXBF_I2C_SMBUS_MASTER_GW, ++ MLXBF_I2C_MASTER_LOCK_BIT, true, ++ MLXBF_I2C_SMBUS_LOCK_POLL_TIMEOUT)) ++ return true; ++ ++ return false; ++} ++ ++static void mlxbf_i2c_smbus_master_unlock(struct mlxbf_i2c_priv *priv) ++{ ++ /* Clear the gw to clear the lock */ ++ writel(0, priv->smbus->io + MLXBF_I2C_SMBUS_MASTER_GW); ++} ++ + static bool mlxbf_i2c_smbus_transaction_success(u32 master_status, + u32 cause_status) + { +@@ -705,10 +725,19 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, + slave = request->slave & GENMASK(6, 0); + addr = slave << 1; + +- /* First of all, check whether the HW is idle. */ +- if (WARN_ON(!mlxbf_smbus_master_wait_for_idle(priv))) ++ /* ++ * Try to acquire the smbus gw lock before any reads of the GW register since ++ * a read sets the lock. ++ */ ++ if (WARN_ON(!mlxbf_i2c_smbus_master_lock(priv))) + return -EBUSY; + ++ /* Check whether the HW is idle */ ++ if (WARN_ON(!mlxbf_smbus_master_wait_for_idle(priv))) { ++ ret = -EBUSY; ++ goto out_unlock; ++ } ++ + /* Set first byte. */ + data_desc[data_idx++] = addr; + +@@ -732,8 +761,10 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, + write_en = 1; + write_len += operation->length; + if (data_idx + operation->length > +- MLXBF_I2C_MASTER_DATA_DESC_SIZE) +- return -ENOBUFS; ++ MLXBF_I2C_MASTER_DATA_DESC_SIZE) { ++ ret = -ENOBUFS; ++ goto out_unlock; ++ } + memcpy(data_desc + data_idx, + operation->buffer, operation->length); + data_idx += operation->length; +@@ -765,7 +796,7 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, + ret = mlxbf_i2c_smbus_enable(priv, slave, write_len, block_en, + pec_en, 0); + if (ret) +- return ret; ++ goto out_unlock; + } + + if (read_en) { +@@ -792,6 +823,9 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, + priv->smbus->io + MLXBF_I2C_SMBUS_MASTER_FSM); + } + ++out_unlock: ++ mlxbf_i2c_smbus_master_unlock(priv); ++ + return ret; + } + +diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c +index edad1f30121dd..502253f53d966 100644 +--- a/drivers/iio/adc/ad7923.c ++++ b/drivers/iio/adc/ad7923.c +@@ -93,6 +93,7 @@ enum ad7923_id { + .sign = 'u', \ + .realbits = (bits), \ + .storagebits = 16, \ ++ .shift = 12 - (bits), \ + .endianness = IIO_BE, \ + }, \ + } +@@ -268,7 +269,8 @@ static int ad7923_read_raw(struct iio_dev *indio_dev, + return ret; + + if (chan->address == EXTRACT(ret, 12, 4)) +- *val = EXTRACT(ret, 0, 12); ++ *val = EXTRACT(ret, chan->scan_type.shift, ++ chan->scan_type.realbits); + else + return -EIO; + +diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c +index b764823ce57e3..2c087d52f1644 100644 +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -77,7 +77,7 @@ struct at91_adc_reg_layout { + #define AT91_SAMA5D2_MR_ANACH BIT(23) + /* Tracking Time */ + #define AT91_SAMA5D2_MR_TRACKTIM(v) ((v) << 24) +-#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xff ++#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xf + /* Transfer Time */ + #define AT91_SAMA5D2_MR_TRANSFER(v) ((v) << 28) + #define AT91_SAMA5D2_MR_TRANSFER_MAX 0x3 +@@ -1542,10 +1542,12 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, + ret = at91_adc_read_position(st, chan->channel, + &tmp_val); + *val = tmp_val; ++ if (ret > 0) ++ ret = at91_adc_adjust_val_osr(st, val); + mutex_unlock(&st->lock); + iio_device_release_direct_mode(indio_dev); + +- return at91_adc_adjust_val_osr(st, val); ++ return ret; + } + if (chan->type == IIO_PRESSURE) { + ret = iio_device_claim_direct_mode(indio_dev); +@@ -1556,10 +1558,12 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, + ret = at91_adc_read_pressure(st, chan->channel, + &tmp_val); + *val = tmp_val; ++ if (ret > 0) ++ ret = at91_adc_adjust_val_osr(st, val); + mutex_unlock(&st->lock); + iio_device_release_direct_mode(indio_dev); + +- return at91_adc_adjust_val_osr(st, val); ++ return ret; + } + + /* in this case we have a voltage channel */ +@@ -1646,16 +1650,20 @@ static int at91_adc_write_raw(struct iio_dev *indio_dev, + /* if no change, optimize out */ + if (val == st->oversampling_ratio) + return 0; ++ mutex_lock(&st->lock); + st->oversampling_ratio = val; + /* update ratio */ + at91_adc_config_emr(st); ++ mutex_unlock(&st->lock); + return 0; + case IIO_CHAN_INFO_SAMP_FREQ: + if (val < st->soc_info.min_sample_rate || + val > st->soc_info.max_sample_rate) + return -EINVAL; + ++ mutex_lock(&st->lock); + at91_adc_setup_samp_freq(indio_dev, val); ++ mutex_unlock(&st->lock); + return 0; + default: + return -EINVAL; +@@ -2108,6 +2116,9 @@ static __maybe_unused int at91_adc_suspend(struct device *dev) + struct iio_dev *indio_dev = dev_get_drvdata(dev); + struct at91_adc_state *st = iio_priv(indio_dev); + ++ if (iio_buffer_enabled(indio_dev)) ++ at91_adc_buffer_postdisable(indio_dev); ++ + /* + * Do a sofware reset of the ADC before we go to suspend. + * this will ensure that all pins are free from being muxed by the ADC +@@ -2151,14 +2162,11 @@ static __maybe_unused int at91_adc_resume(struct device *dev) + if (!iio_buffer_enabled(indio_dev)) + return 0; + +- /* check if we are enabling triggered buffer or the touchscreen */ +- if (at91_adc_current_chan_is_touch(indio_dev)) +- return at91_adc_configure_touch(st, true); +- else +- return at91_adc_configure_trigger(st->trig, true); ++ ret = at91_adc_buffer_prepare(indio_dev); ++ if (ret) ++ goto vref_disable_resume; + +- /* not needed but more explicit */ +- return 0; ++ return at91_adc_configure_trigger(st->trig, true); + + vref_disable_resume: + regulator_disable(st->vref); +diff --git a/drivers/iio/adc/ltc2497.c b/drivers/iio/adc/ltc2497.c +index f7c786f37ceb1..78b93c99cc47c 100644 +--- a/drivers/iio/adc/ltc2497.c ++++ b/drivers/iio/adc/ltc2497.c +@@ -41,6 +41,19 @@ static int ltc2497_result_and_measure(struct ltc2497core_driverdata *ddata, + } + + *val = (be32_to_cpu(st->buf) >> 14) - (1 << 17); ++ ++ /* ++ * The part started a new conversion at the end of the above i2c ++ * transfer, so if the address didn't change since the last call ++ * everything is fine and we can return early. ++ * If not (which should only happen when some sort of bulk ++ * conversion is implemented) we have to program the new ++ * address. Note that this probably fails as the conversion that ++ * was triggered above is like not complete yet and the two ++ * operations have to be done in a single transfer. ++ */ ++ if (ddata->addr_prev == address) ++ return 0; + } + + ret = i2c_smbus_write_byte(st->client, +diff --git a/drivers/iio/dac/ad5593r.c b/drivers/iio/dac/ad5593r.c +index 34e1319a97126..356dc0bab1153 100644 +--- a/drivers/iio/dac/ad5593r.c ++++ b/drivers/iio/dac/ad5593r.c +@@ -13,6 +13,8 @@ + #include <linux/module.h> + #include <linux/mod_devicetable.h> + ++#include <asm/unaligned.h> ++ + #define AD5593R_MODE_CONF (0 << 4) + #define AD5593R_MODE_DAC_WRITE (1 << 4) + #define AD5593R_MODE_ADC_READBACK (4 << 4) +@@ -20,6 +22,24 @@ + #define AD5593R_MODE_GPIO_READBACK (6 << 4) + #define AD5593R_MODE_REG_READBACK (7 << 4) + ++static int ad5593r_read_word(struct i2c_client *i2c, u8 reg, u16 *value) ++{ ++ int ret; ++ u8 buf[2]; ++ ++ ret = i2c_smbus_write_byte(i2c, reg); ++ if (ret < 0) ++ return ret; ++ ++ ret = i2c_master_recv(i2c, buf, sizeof(buf)); ++ if (ret < 0) ++ return ret; ++ ++ *value = get_unaligned_be16(buf); ++ ++ return 0; ++} ++ + static int ad5593r_write_dac(struct ad5592r_state *st, unsigned chan, u16 value) + { + struct i2c_client *i2c = to_i2c_client(st->dev); +@@ -38,13 +58,7 @@ static int ad5593r_read_adc(struct ad5592r_state *st, unsigned chan, u16 *value) + if (val < 0) + return (int) val; + +- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_ADC_READBACK); +- if (val < 0) +- return (int) val; +- +- *value = (u16) val; +- +- return 0; ++ return ad5593r_read_word(i2c, AD5593R_MODE_ADC_READBACK, value); + } + + static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value) +@@ -58,25 +72,19 @@ static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value) + static int ad5593r_reg_read(struct ad5592r_state *st, u8 reg, u16 *value) + { + struct i2c_client *i2c = to_i2c_client(st->dev); +- s32 val; +- +- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_REG_READBACK | reg); +- if (val < 0) +- return (int) val; + +- *value = (u16) val; +- +- return 0; ++ return ad5593r_read_word(i2c, AD5593R_MODE_REG_READBACK | reg, value); + } + + static int ad5593r_gpio_read(struct ad5592r_state *st, u8 *value) + { + struct i2c_client *i2c = to_i2c_client(st->dev); +- s32 val; ++ u16 val; ++ int ret; + +- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_GPIO_READBACK); +- if (val < 0) +- return (int) val; ++ ret = ad5593r_read_word(i2c, AD5593R_MODE_GPIO_READBACK, &val); ++ if (ret) ++ return ret; + + *value = (u8) val; + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index df74765d33dcb..87fd2a0d44f2a 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -165,9 +165,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, + + idev = bus_find_device(&iio_bus_type, NULL, iiospec.np, + iio_dev_node_match); +- of_node_put(iiospec.np); +- if (idev == NULL) ++ if (idev == NULL) { ++ of_node_put(iiospec.np); + return -EPROBE_DEFER; ++ } + + indio_dev = dev_to_iio_dev(idev); + channel->indio_dev = indio_dev; +@@ -175,6 +176,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, + index = indio_dev->info->of_xlate(indio_dev, &iiospec); + else + index = __of_iio_simple_xlate(indio_dev, &iiospec); ++ of_node_put(iiospec.np); + if (index < 0) + goto err_put; + channel->channel = &indio_dev->channels[index]; +@@ -410,6 +412,8 @@ struct iio_channel *devm_of_iio_channel_get_by_name(struct device *dev, + channel = of_iio_channel_get_by_name(np, channel_name); + if (IS_ERR(channel)) + return channel; ++ if (!channel) ++ return ERR_PTR(-ENODEV); + + ret = devm_add_action_or_reset(dev, devm_iio_channel_free, channel); + if (ret) +diff --git a/drivers/iio/magnetometer/yamaha-yas530.c b/drivers/iio/magnetometer/yamaha-yas530.c +index b2bc637150bfa..40192aa46b048 100644 +--- a/drivers/iio/magnetometer/yamaha-yas530.c ++++ b/drivers/iio/magnetometer/yamaha-yas530.c +@@ -132,7 +132,7 @@ struct yas5xx { + unsigned int version; + char name[16]; + struct yas5xx_calibration calibration; +- u8 hard_offsets[3]; ++ s8 hard_offsets[3]; + struct iio_mount_matrix orientation; + struct regmap *map; + struct regulator_bulk_data regs[2]; +diff --git a/drivers/iio/pressure/dps310.c b/drivers/iio/pressure/dps310.c +index 36fb7ae0d0a9d..984a3f511a1ae 100644 +--- a/drivers/iio/pressure/dps310.c ++++ b/drivers/iio/pressure/dps310.c +@@ -89,6 +89,7 @@ struct dps310_data { + s32 c00, c10, c20, c30, c01, c11, c21; + s32 pressure_raw; + s32 temp_raw; ++ bool timeout_recovery_failed; + }; + + static const struct iio_chan_spec dps310_channels[] = { +@@ -159,6 +160,102 @@ static int dps310_get_coefs(struct dps310_data *data) + return 0; + } + ++/* ++ * Some versions of the chip will read temperatures in the ~60C range when ++ * it's actually ~20C. This is the manufacturer recommended workaround ++ * to correct the issue. The registers used below are undocumented. ++ */ ++static int dps310_temp_workaround(struct dps310_data *data) ++{ ++ int rc; ++ int reg; ++ ++ rc = regmap_read(data->regmap, 0x32, ®); ++ if (rc) ++ return rc; ++ ++ /* ++ * If bit 1 is set then the device is okay, and the workaround does not ++ * need to be applied ++ */ ++ if (reg & BIT(1)) ++ return 0; ++ ++ rc = regmap_write(data->regmap, 0x0e, 0xA5); ++ if (rc) ++ return rc; ++ ++ rc = regmap_write(data->regmap, 0x0f, 0x96); ++ if (rc) ++ return rc; ++ ++ rc = regmap_write(data->regmap, 0x62, 0x02); ++ if (rc) ++ return rc; ++ ++ rc = regmap_write(data->regmap, 0x0e, 0x00); ++ if (rc) ++ return rc; ++ ++ return regmap_write(data->regmap, 0x0f, 0x00); ++} ++ ++static int dps310_startup(struct dps310_data *data) ++{ ++ int rc; ++ int ready; ++ ++ /* ++ * Set up pressure sensor in single sample, one measurement per second ++ * mode ++ */ ++ rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0); ++ if (rc) ++ return rc; ++ ++ /* ++ * Set up external (MEMS) temperature sensor in single sample, one ++ * measurement per second mode ++ */ ++ rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT); ++ if (rc) ++ return rc; ++ ++ /* Temp and pressure shifts are disabled when PRC <= 8 */ ++ rc = regmap_write_bits(data->regmap, DPS310_CFG_REG, ++ DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0); ++ if (rc) ++ return rc; ++ ++ /* MEAS_CFG doesn't update correctly unless first written with 0 */ ++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, ++ DPS310_MEAS_CTRL_BITS, 0); ++ if (rc) ++ return rc; ++ ++ /* Turn on temperature and pressure measurement in the background */ ++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, ++ DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN | ++ DPS310_TEMP_EN | DPS310_BACKGROUND); ++ if (rc) ++ return rc; ++ ++ /* ++ * Calibration coefficients required for reporting temperature. ++ * They are available 40ms after the device has started ++ */ ++ rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, ++ ready & DPS310_COEF_RDY, 10000, 40000); ++ if (rc) ++ return rc; ++ ++ rc = dps310_get_coefs(data); ++ if (rc) ++ return rc; ++ ++ return dps310_temp_workaround(data); ++} ++ + static int dps310_get_pres_precision(struct dps310_data *data) + { + int rc; +@@ -297,11 +394,69 @@ static int dps310_get_temp_k(struct dps310_data *data) + return scale_factors[ilog2(rc)]; + } + ++static int dps310_reset_wait(struct dps310_data *data) ++{ ++ int rc; ++ ++ rc = regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC); ++ if (rc) ++ return rc; ++ ++ /* Wait for device chip access: 2.5ms in specification */ ++ usleep_range(2500, 12000); ++ return 0; ++} ++ ++static int dps310_reset_reinit(struct dps310_data *data) ++{ ++ int rc; ++ ++ rc = dps310_reset_wait(data); ++ if (rc) ++ return rc; ++ ++ return dps310_startup(data); ++} ++ ++static int dps310_ready_status(struct dps310_data *data, int ready_bit, int timeout) ++{ ++ int sleep = DPS310_POLL_SLEEP_US(timeout); ++ int ready; ++ ++ return regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, ready & ready_bit, ++ sleep, timeout); ++} ++ ++static int dps310_ready(struct dps310_data *data, int ready_bit, int timeout) ++{ ++ int rc; ++ ++ rc = dps310_ready_status(data, ready_bit, timeout); ++ if (rc) { ++ if (rc == -ETIMEDOUT && !data->timeout_recovery_failed) { ++ /* Reset and reinitialize the chip. */ ++ if (dps310_reset_reinit(data)) { ++ data->timeout_recovery_failed = true; ++ } else { ++ /* Try again to get sensor ready status. */ ++ if (dps310_ready_status(data, ready_bit, timeout)) ++ data->timeout_recovery_failed = true; ++ else ++ return 0; ++ } ++ } ++ ++ return rc; ++ } ++ ++ data->timeout_recovery_failed = false; ++ return 0; ++} ++ + static int dps310_read_pres_raw(struct dps310_data *data) + { + int rc; + int rate; +- int ready; + int timeout; + s32 raw; + u8 val[3]; +@@ -313,9 +468,7 @@ static int dps310_read_pres_raw(struct dps310_data *data) + timeout = DPS310_POLL_TIMEOUT_US(rate); + + /* Poll for sensor readiness; base the timeout upon the sample rate. */ +- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, +- ready & DPS310_PRS_RDY, +- DPS310_POLL_SLEEP_US(timeout), timeout); ++ rc = dps310_ready(data, DPS310_PRS_RDY, timeout); + if (rc) + goto done; + +@@ -352,7 +505,6 @@ static int dps310_read_temp_raw(struct dps310_data *data) + { + int rc; + int rate; +- int ready; + int timeout; + + if (mutex_lock_interruptible(&data->lock)) +@@ -362,10 +514,8 @@ static int dps310_read_temp_raw(struct dps310_data *data) + timeout = DPS310_POLL_TIMEOUT_US(rate); + + /* Poll for sensor readiness; base the timeout upon the sample rate. */ +- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, +- ready & DPS310_TMP_RDY, +- DPS310_POLL_SLEEP_US(timeout), timeout); +- if (rc < 0) ++ rc = dps310_ready(data, DPS310_TMP_RDY, timeout); ++ if (rc) + goto done; + + rc = dps310_read_temp_ready(data); +@@ -660,7 +810,7 @@ static void dps310_reset(void *action_data) + { + struct dps310_data *data = action_data; + +- regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC); ++ dps310_reset_wait(data); + } + + static const struct regmap_config dps310_regmap_config = { +@@ -677,52 +827,12 @@ static const struct iio_info dps310_info = { + .write_raw = dps310_write_raw, + }; + +-/* +- * Some verions of chip will read temperatures in the ~60C range when +- * its actually ~20C. This is the manufacturer recommended workaround +- * to correct the issue. The registers used below are undocumented. +- */ +-static int dps310_temp_workaround(struct dps310_data *data) +-{ +- int rc; +- int reg; +- +- rc = regmap_read(data->regmap, 0x32, ®); +- if (rc < 0) +- return rc; +- +- /* +- * If bit 1 is set then the device is okay, and the workaround does not +- * need to be applied +- */ +- if (reg & BIT(1)) +- return 0; +- +- rc = regmap_write(data->regmap, 0x0e, 0xA5); +- if (rc < 0) +- return rc; +- +- rc = regmap_write(data->regmap, 0x0f, 0x96); +- if (rc < 0) +- return rc; +- +- rc = regmap_write(data->regmap, 0x62, 0x02); +- if (rc < 0) +- return rc; +- +- rc = regmap_write(data->regmap, 0x0e, 0x00); +- if (rc < 0) +- return rc; +- +- return regmap_write(data->regmap, 0x0f, 0x00); +-} +- + static int dps310_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { + struct dps310_data *data; + struct iio_dev *iio; +- int rc, ready; ++ int rc; + + iio = devm_iio_device_alloc(&client->dev, sizeof(*data)); + if (!iio) +@@ -747,54 +857,8 @@ static int dps310_probe(struct i2c_client *client, + if (rc) + return rc; + +- /* +- * Set up pressure sensor in single sample, one measurement per second +- * mode +- */ +- rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0); +- +- /* +- * Set up external (MEMS) temperature sensor in single sample, one +- * measurement per second mode +- */ +- rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT); +- if (rc < 0) +- return rc; +- +- /* Temp and pressure shifts are disabled when PRC <= 8 */ +- rc = regmap_write_bits(data->regmap, DPS310_CFG_REG, +- DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0); +- if (rc < 0) +- return rc; +- +- /* MEAS_CFG doesn't update correctly unless first written with 0 */ +- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, +- DPS310_MEAS_CTRL_BITS, 0); +- if (rc < 0) +- return rc; +- +- /* Turn on temperature and pressure measurement in the background */ +- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, +- DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN | +- DPS310_TEMP_EN | DPS310_BACKGROUND); +- if (rc < 0) +- return rc; +- +- /* +- * Calibration coefficients required for reporting temperature. +- * They are available 40ms after the device has started +- */ +- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, +- ready & DPS310_COEF_RDY, 10000, 40000); +- if (rc < 0) +- return rc; +- +- rc = dps310_get_coefs(data); +- if (rc < 0) +- return rc; +- +- rc = dps310_temp_workaround(data); +- if (rc < 0) ++ rc = dps310_startup(data); ++ if (rc) + return rc; + + rc = devm_iio_device_register(&client->dev, iio); +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index b985e0d9bc05e..5c910f5c01b35 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1632,14 +1632,13 @@ static void cm_path_set_rec_type(struct ib_device *ib_device, u32 port_num, + + static void cm_format_path_lid_from_req(struct cm_req_msg *req_msg, + struct sa_path_rec *primary_path, +- struct sa_path_rec *alt_path) ++ struct sa_path_rec *alt_path, ++ struct ib_wc *wc) + { + u32 lid; + + if (primary_path->rec_type != SA_PATH_REC_TYPE_OPA) { +- sa_path_set_dlid(primary_path, +- IBA_GET(CM_REQ_PRIMARY_LOCAL_PORT_LID, +- req_msg)); ++ sa_path_set_dlid(primary_path, wc->slid); + sa_path_set_slid(primary_path, + IBA_GET(CM_REQ_PRIMARY_REMOTE_PORT_LID, + req_msg)); +@@ -1676,7 +1675,8 @@ static void cm_format_path_lid_from_req(struct cm_req_msg *req_msg, + + static void cm_format_paths_from_req(struct cm_req_msg *req_msg, + struct sa_path_rec *primary_path, +- struct sa_path_rec *alt_path) ++ struct sa_path_rec *alt_path, ++ struct ib_wc *wc) + { + primary_path->dgid = + *IBA_GET_MEM_PTR(CM_REQ_PRIMARY_LOCAL_PORT_GID, req_msg); +@@ -1734,7 +1734,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg, + if (sa_path_is_roce(alt_path)) + alt_path->roce.route_resolved = false; + } +- cm_format_path_lid_from_req(req_msg, primary_path, alt_path); ++ cm_format_path_lid_from_req(req_msg, primary_path, alt_path, wc); + } + + static u16 cm_get_bth_pkey(struct cm_work *work) +@@ -2148,7 +2148,7 @@ static int cm_req_handler(struct cm_work *work) + if (cm_req_has_alt_path(req_msg)) + work->path[1].rec_type = work->path[0].rec_type; + cm_format_paths_from_req(req_msg, &work->path[0], +- &work->path[1]); ++ &work->path[1], work->mad_recv_wc->wc); + if (cm_id_priv->av.ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE) + sa_path_set_dmac(&work->path[0], + cm_id_priv->av.ah_attr.roce.dmac); +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 046376bd68e27..4796f6a8828ca 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -739,6 +739,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) + mr->uobject = uobj; + atomic_inc(&pd->usecnt); + mr->iova = cmd.hca_va; ++ mr->length = cmd.length; + + rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR); + rdma_restrack_set_name(&mr->res, NULL); +@@ -861,8 +862,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) + mr->pd = new_pd; + atomic_inc(&new_pd->usecnt); + } +- if (cmd.flags & IB_MR_REREG_TRANS) ++ if (cmd.flags & IB_MR_REREG_TRANS) { + mr->iova = cmd.hca_va; ++ mr->length = cmd.length; ++ } + } + + memset(&resp, 0, sizeof(resp)); +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index e54b3f1b730e0..f8964c8cf0ade 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2149,6 +2149,8 @@ struct ib_mr *ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + mr->pd = pd; + mr->dm = NULL; + atomic_inc(&pd->usecnt); ++ mr->iova = virt_addr; ++ mr->length = length; + + rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR); + rdma_restrack_parent_name(&mr->res, &pd->res); +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 867972c2a894d..dedfa56f57731 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -249,7 +249,6 @@ struct ib_mr *hns_roce_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + goto err_alloc_pbl; + + mr->ibmr.rkey = mr->ibmr.lkey = mr->key; +- mr->ibmr.length = length; + + return &mr->ibmr; + +diff --git a/drivers/infiniband/hw/irdma/defs.h b/drivers/infiniband/hw/irdma/defs.h +index e03e03082a5fb..c1906cab5c8ad 100644 +--- a/drivers/infiniband/hw/irdma/defs.h ++++ b/drivers/infiniband/hw/irdma/defs.h +@@ -314,6 +314,7 @@ enum irdma_cqp_op_type { + #define IRDMA_AE_IB_REMOTE_ACCESS_ERROR 0x020d + #define IRDMA_AE_IB_REMOTE_OP_ERROR 0x020e + #define IRDMA_AE_WQE_LSMM_TOO_LONG 0x0220 ++#define IRDMA_AE_INVALID_REQUEST 0x0223 + #define IRDMA_AE_DDP_INVALID_MSN_GAP_IN_MSN 0x0301 + #define IRDMA_AE_DDP_UBE_DDP_MESSAGE_TOO_LONG_FOR_AVAILABLE_BUFFER 0x0303 + #define IRDMA_AE_DDP_UBE_INVALID_DDP_VERSION 0x0304 +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 6bba1335993a1..971cc7a7f3bc0 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -138,59 +138,68 @@ static void irdma_set_flush_fields(struct irdma_sc_qp *qp, + qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; + + switch (info->ae_id) { +- case IRDMA_AE_AMP_UNALLOCATED_STAG: + case IRDMA_AE_AMP_BOUNDS_VIOLATION: + case IRDMA_AE_AMP_INVALID_STAG: +- qp->event_type = IRDMA_QP_EVENT_ACCESS_ERR; +- fallthrough; ++ case IRDMA_AE_AMP_RIGHTS_VIOLATION: ++ case IRDMA_AE_AMP_UNALLOCATED_STAG: + case IRDMA_AE_AMP_BAD_PD: +- case IRDMA_AE_UDA_XMIT_BAD_PD: ++ case IRDMA_AE_AMP_BAD_QP: ++ case IRDMA_AE_AMP_BAD_STAG_KEY: ++ case IRDMA_AE_AMP_BAD_STAG_INDEX: ++ case IRDMA_AE_AMP_TO_WRAP: ++ case IRDMA_AE_PRIV_OPERATION_DENIED: + qp->flush_code = FLUSH_PROT_ERR; ++ qp->event_type = IRDMA_QP_EVENT_ACCESS_ERR; + break; +- case IRDMA_AE_AMP_BAD_QP: ++ case IRDMA_AE_UDA_XMIT_BAD_PD: + case IRDMA_AE_WQE_UNEXPECTED_OPCODE: + qp->flush_code = FLUSH_LOC_QP_OP_ERR; ++ qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; ++ break; ++ case IRDMA_AE_UDA_XMIT_DGRAM_TOO_LONG: ++ case IRDMA_AE_UDA_XMIT_DGRAM_TOO_SHORT: ++ case IRDMA_AE_UDA_L4LEN_INVALID: ++ case IRDMA_AE_DDP_UBE_INVALID_MO: ++ case IRDMA_AE_DDP_UBE_DDP_MESSAGE_TOO_LONG_FOR_AVAILABLE_BUFFER: ++ qp->flush_code = FLUSH_LOC_LEN_ERR; ++ qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; + break; +- case IRDMA_AE_AMP_BAD_STAG_KEY: +- case IRDMA_AE_AMP_BAD_STAG_INDEX: +- case IRDMA_AE_AMP_TO_WRAP: +- case IRDMA_AE_AMP_RIGHTS_VIOLATION: + case IRDMA_AE_AMP_INVALIDATE_NO_REMOTE_ACCESS_RIGHTS: +- case IRDMA_AE_PRIV_OPERATION_DENIED: +- case IRDMA_AE_IB_INVALID_REQUEST: + case IRDMA_AE_IB_REMOTE_ACCESS_ERROR: + qp->flush_code = FLUSH_REM_ACCESS_ERR; + qp->event_type = IRDMA_QP_EVENT_ACCESS_ERR; + break; + case IRDMA_AE_LLP_SEGMENT_TOO_SMALL: +- case IRDMA_AE_DDP_UBE_DDP_MESSAGE_TOO_LONG_FOR_AVAILABLE_BUFFER: +- case IRDMA_AE_UDA_XMIT_DGRAM_TOO_LONG: +- case IRDMA_AE_UDA_XMIT_DGRAM_TOO_SHORT: +- case IRDMA_AE_UDA_L4LEN_INVALID: ++ case IRDMA_AE_LLP_RECEIVED_MPA_CRC_ERROR: + case IRDMA_AE_ROCE_RSP_LENGTH_ERROR: +- qp->flush_code = FLUSH_LOC_LEN_ERR; ++ case IRDMA_AE_IB_REMOTE_OP_ERROR: ++ qp->flush_code = FLUSH_REM_OP_ERR; ++ qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; + break; + case IRDMA_AE_LCE_QP_CATASTROPHIC: + qp->flush_code = FLUSH_FATAL_ERR; ++ qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; + break; +- case IRDMA_AE_DDP_UBE_INVALID_MO: + case IRDMA_AE_IB_RREQ_AND_Q1_FULL: +- case IRDMA_AE_LLP_RECEIVED_MPA_CRC_ERROR: + qp->flush_code = FLUSH_GENERAL_ERR; + break; + case IRDMA_AE_LLP_TOO_MANY_RETRIES: + qp->flush_code = FLUSH_RETRY_EXC_ERR; ++ qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; + break; + case IRDMA_AE_AMP_MWBIND_INVALID_RIGHTS: + case IRDMA_AE_AMP_MWBIND_BIND_DISABLED: + case IRDMA_AE_AMP_MWBIND_INVALID_BOUNDS: + qp->flush_code = FLUSH_MW_BIND_ERR; ++ qp->event_type = IRDMA_QP_EVENT_ACCESS_ERR; + break; +- case IRDMA_AE_IB_REMOTE_OP_ERROR: +- qp->flush_code = FLUSH_REM_OP_ERR; ++ case IRDMA_AE_IB_INVALID_REQUEST: ++ qp->flush_code = FLUSH_REM_INV_REQ_ERR; ++ qp->event_type = IRDMA_QP_EVENT_REQ_ERR; + break; + default: +- qp->flush_code = FLUSH_FATAL_ERR; ++ qp->flush_code = FLUSH_GENERAL_ERR; ++ qp->event_type = IRDMA_QP_EVENT_CATASTROPHIC; + break; + } + } +diff --git a/drivers/infiniband/hw/irdma/type.h b/drivers/infiniband/hw/irdma/type.h +index 9e7b8ecb137ab..517d41a1c2894 100644 +--- a/drivers/infiniband/hw/irdma/type.h ++++ b/drivers/infiniband/hw/irdma/type.h +@@ -98,6 +98,7 @@ enum irdma_term_mpa_errors { + enum irdma_qp_event_type { + IRDMA_QP_EVENT_CATASTROPHIC, + IRDMA_QP_EVENT_ACCESS_ERR, ++ IRDMA_QP_EVENT_REQ_ERR, + }; + + enum irdma_hw_stats_index_32b { +diff --git a/drivers/infiniband/hw/irdma/user.h b/drivers/infiniband/hw/irdma/user.h +index ddd0ebbdd7d54..2ef61923c9268 100644 +--- a/drivers/infiniband/hw/irdma/user.h ++++ b/drivers/infiniband/hw/irdma/user.h +@@ -103,6 +103,7 @@ enum irdma_flush_opcode { + FLUSH_FATAL_ERR, + FLUSH_RETRY_EXC_ERR, + FLUSH_MW_BIND_ERR, ++ FLUSH_REM_INV_REQ_ERR, + }; + + enum irdma_cmpl_status { +diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c +index f4d774451160d..c9513b9fc42d5 100644 +--- a/drivers/infiniband/hw/irdma/utils.c ++++ b/drivers/infiniband/hw/irdma/utils.c +@@ -2478,6 +2478,9 @@ void irdma_ib_qp_event(struct irdma_qp *iwqp, enum irdma_qp_event_type event) + case IRDMA_QP_EVENT_ACCESS_ERR: + ibevent.event = IB_EVENT_QP_ACCESS_ERR; + break; ++ case IRDMA_QP_EVENT_REQ_ERR: ++ ibevent.event = IB_EVENT_QP_REQ_ERR; ++ break; + } + ibevent.device = iwqp->ibqp.device; + ibevent.element.qp = &iwqp->ibqp; +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index ab73d1715f991..c5652efb3df22 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -299,13 +299,19 @@ static void irdma_alloc_push_page(struct irdma_qp *iwqp) + static int irdma_alloc_ucontext(struct ib_ucontext *uctx, + struct ib_udata *udata) + { ++#define IRDMA_ALLOC_UCTX_MIN_REQ_LEN offsetofend(struct irdma_alloc_ucontext_req, rsvd8) ++#define IRDMA_ALLOC_UCTX_MIN_RESP_LEN offsetofend(struct irdma_alloc_ucontext_resp, rsvd) + struct ib_device *ibdev = uctx->device; + struct irdma_device *iwdev = to_iwdev(ibdev); +- struct irdma_alloc_ucontext_req req; ++ struct irdma_alloc_ucontext_req req = {}; + struct irdma_alloc_ucontext_resp uresp = {}; + struct irdma_ucontext *ucontext = to_ucontext(uctx); + struct irdma_uk_attrs *uk_attrs; + ++ if (udata->inlen < IRDMA_ALLOC_UCTX_MIN_REQ_LEN || ++ udata->outlen < IRDMA_ALLOC_UCTX_MIN_RESP_LEN) ++ return -EINVAL; ++ + if (ib_copy_from_udata(&req, udata, min(sizeof(req), udata->inlen))) + return -EINVAL; + +@@ -317,7 +323,7 @@ static int irdma_alloc_ucontext(struct ib_ucontext *uctx, + + uk_attrs = &iwdev->rf->sc_dev.hw_attrs.uk_attrs; + /* GEN_1 legacy support with libi40iw */ +- if (udata->outlen < sizeof(uresp)) { ++ if (udata->outlen == IRDMA_ALLOC_UCTX_MIN_RESP_LEN) { + if (uk_attrs->hw_rev != IRDMA_GEN_1) + return -EOPNOTSUPP; + +@@ -389,6 +395,7 @@ static void irdma_dealloc_ucontext(struct ib_ucontext *context) + */ + static int irdma_alloc_pd(struct ib_pd *pd, struct ib_udata *udata) + { ++#define IRDMA_ALLOC_PD_MIN_RESP_LEN offsetofend(struct irdma_alloc_pd_resp, rsvd) + struct irdma_pd *iwpd = to_iwpd(pd); + struct irdma_device *iwdev = to_iwdev(pd->device); + struct irdma_sc_dev *dev = &iwdev->rf->sc_dev; +@@ -398,6 +405,9 @@ static int irdma_alloc_pd(struct ib_pd *pd, struct ib_udata *udata) + u32 pd_id = 0; + int err; + ++ if (udata && udata->outlen < IRDMA_ALLOC_PD_MIN_RESP_LEN) ++ return -EINVAL; ++ + err = irdma_alloc_rsrc(rf, rf->allocated_pds, rf->max_pd, &pd_id, + &rf->next_pd); + if (err) +@@ -814,12 +824,14 @@ static int irdma_create_qp(struct ib_qp *ibqp, + struct ib_qp_init_attr *init_attr, + struct ib_udata *udata) + { ++#define IRDMA_CREATE_QP_MIN_REQ_LEN offsetofend(struct irdma_create_qp_req, user_compl_ctx) ++#define IRDMA_CREATE_QP_MIN_RESP_LEN offsetofend(struct irdma_create_qp_resp, rsvd) + struct ib_pd *ibpd = ibqp->pd; + struct irdma_pd *iwpd = to_iwpd(ibpd); + struct irdma_device *iwdev = to_iwdev(ibpd->device); + struct irdma_pci_f *rf = iwdev->rf; + struct irdma_qp *iwqp = to_iwqp(ibqp); +- struct irdma_create_qp_req req; ++ struct irdma_create_qp_req req = {}; + struct irdma_create_qp_resp uresp = {}; + u32 qp_num = 0; + int err_code; +@@ -836,6 +848,10 @@ static int irdma_create_qp(struct ib_qp *ibqp, + if (err_code) + return err_code; + ++ if (udata && (udata->inlen < IRDMA_CREATE_QP_MIN_REQ_LEN || ++ udata->outlen < IRDMA_CREATE_QP_MIN_RESP_LEN)) ++ return -EINVAL; ++ + sq_size = init_attr->cap.max_send_wr; + rq_size = init_attr->cap.max_recv_wr; + +@@ -1120,6 +1136,8 @@ static int irdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, + int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + int attr_mask, struct ib_udata *udata) + { ++#define IRDMA_MODIFY_QP_MIN_REQ_LEN offsetofend(struct irdma_modify_qp_req, rq_flush) ++#define IRDMA_MODIFY_QP_MIN_RESP_LEN offsetofend(struct irdma_modify_qp_resp, push_valid) + struct irdma_pd *iwpd = to_iwpd(ibqp->pd); + struct irdma_qp *iwqp = to_iwqp(ibqp); + struct irdma_device *iwdev = iwqp->iwdev; +@@ -1138,6 +1156,13 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + roce_info = &iwqp->roce_info; + udp_info = &iwqp->udp_info; + ++ if (udata) { ++ /* udata inlen/outlen can be 0 when supporting legacy libi40iw */ ++ if ((udata->inlen && udata->inlen < IRDMA_MODIFY_QP_MIN_REQ_LEN) || ++ (udata->outlen && udata->outlen < IRDMA_MODIFY_QP_MIN_RESP_LEN)) ++ return -EINVAL; ++ } ++ + if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS) + return -EOPNOTSUPP; + +@@ -1374,7 +1399,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + + if (iwqp->iwarp_state == IRDMA_QP_STATE_ERROR) { + spin_unlock_irqrestore(&iwqp->lock, flags); +- if (udata) { ++ if (udata && udata->inlen) { + if (ib_copy_from_udata(&ureq, udata, + min(sizeof(ureq), udata->inlen))) + return -EINVAL; +@@ -1426,7 +1451,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + } else { + iwqp->ibqp_state = attr->qp_state; + } +- if (udata && dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2) { ++ if (udata && udata->outlen && dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2) { + struct irdma_ucontext *ucontext; + + ucontext = rdma_udata_to_drv_context(udata, +@@ -1466,6 +1491,8 @@ exit: + int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask, + struct ib_udata *udata) + { ++#define IRDMA_MODIFY_QP_MIN_REQ_LEN offsetofend(struct irdma_modify_qp_req, rq_flush) ++#define IRDMA_MODIFY_QP_MIN_RESP_LEN offsetofend(struct irdma_modify_qp_resp, push_valid) + struct irdma_qp *iwqp = to_iwqp(ibqp); + struct irdma_device *iwdev = iwqp->iwdev; + struct irdma_sc_dev *dev = &iwdev->rf->sc_dev; +@@ -1480,6 +1507,13 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask, + int err; + unsigned long flags; + ++ if (udata) { ++ /* udata inlen/outlen can be 0 when supporting legacy libi40iw */ ++ if ((udata->inlen && udata->inlen < IRDMA_MODIFY_QP_MIN_REQ_LEN) || ++ (udata->outlen && udata->outlen < IRDMA_MODIFY_QP_MIN_RESP_LEN)) ++ return -EINVAL; ++ } ++ + if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS) + return -EOPNOTSUPP; + +@@ -1565,7 +1599,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask, + case IB_QPS_RESET: + if (iwqp->iwarp_state == IRDMA_QP_STATE_ERROR) { + spin_unlock_irqrestore(&iwqp->lock, flags); +- if (udata) { ++ if (udata && udata->inlen) { + if (ib_copy_from_udata(&ureq, udata, + min(sizeof(ureq), udata->inlen))) + return -EINVAL; +@@ -1662,7 +1696,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask, + } + } + } +- if (attr_mask & IB_QP_STATE && udata && ++ if (attr_mask & IB_QP_STATE && udata && udata->outlen && + dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2) { + struct irdma_ucontext *ucontext; + +@@ -1797,6 +1831,7 @@ static int irdma_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + static int irdma_resize_cq(struct ib_cq *ibcq, int entries, + struct ib_udata *udata) + { ++#define IRDMA_RESIZE_CQ_MIN_REQ_LEN offsetofend(struct irdma_resize_cq_req, user_cq_buffer) + struct irdma_cq *iwcq = to_iwcq(ibcq); + struct irdma_sc_dev *dev = iwcq->sc_cq.dev; + struct irdma_cqp_request *cqp_request; +@@ -1819,6 +1854,9 @@ static int irdma_resize_cq(struct ib_cq *ibcq, int entries, + IRDMA_FEATURE_CQ_RESIZE)) + return -EOPNOTSUPP; + ++ if (udata && udata->inlen < IRDMA_RESIZE_CQ_MIN_REQ_LEN) ++ return -EINVAL; ++ + if (entries > rf->max_cqe) + return -EINVAL; + +@@ -1951,6 +1989,8 @@ static int irdma_create_cq(struct ib_cq *ibcq, + const struct ib_cq_init_attr *attr, + struct ib_udata *udata) + { ++#define IRDMA_CREATE_CQ_MIN_REQ_LEN offsetofend(struct irdma_create_cq_req, user_cq_buf) ++#define IRDMA_CREATE_CQ_MIN_RESP_LEN offsetofend(struct irdma_create_cq_resp, cq_size) + struct ib_device *ibdev = ibcq->device; + struct irdma_device *iwdev = to_iwdev(ibdev); + struct irdma_pci_f *rf = iwdev->rf; +@@ -1969,6 +2009,11 @@ static int irdma_create_cq(struct ib_cq *ibcq, + err_code = cq_validate_flags(attr->flags, dev->hw_attrs.uk_attrs.hw_rev); + if (err_code) + return err_code; ++ ++ if (udata && (udata->inlen < IRDMA_CREATE_CQ_MIN_REQ_LEN || ++ udata->outlen < IRDMA_CREATE_CQ_MIN_RESP_LEN)) ++ return -EINVAL; ++ + err_code = irdma_alloc_rsrc(rf, rf->allocated_cqs, rf->max_cq, &cq_num, + &rf->next_cq); + if (err_code) +@@ -2738,6 +2783,7 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len, + u64 virt, int access, + struct ib_udata *udata) + { ++#define IRDMA_MEM_REG_MIN_REQ_LEN offsetofend(struct irdma_mem_reg_req, sq_pages) + struct irdma_device *iwdev = to_iwdev(pd->device); + struct irdma_ucontext *ucontext; + struct irdma_pble_alloc *palloc; +@@ -2755,6 +2801,9 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len, + if (len > iwdev->rf->sc_dev.hw_attrs.max_mr_size) + return ERR_PTR(-EINVAL); + ++ if (udata->inlen < IRDMA_MEM_REG_MIN_REQ_LEN) ++ return ERR_PTR(-EINVAL); ++ + region = ib_umem_get(pd->device, start, len, access); + + if (IS_ERR(region)) { +@@ -3307,6 +3356,8 @@ static enum ib_wc_status irdma_flush_err_to_ib_wc_status(enum irdma_flush_opcode + return IB_WC_RETRY_EXC_ERR; + case FLUSH_MW_BIND_ERR: + return IB_WC_MW_BIND_ERR; ++ case FLUSH_REM_INV_REQ_ERR: ++ return IB_WC_REM_INV_REQ_ERR; + case FLUSH_FATAL_ERR: + default: + return IB_WC_FATAL_ERR; +@@ -4288,12 +4339,16 @@ static int irdma_create_user_ah(struct ib_ah *ibah, + struct rdma_ah_init_attr *attr, + struct ib_udata *udata) + { ++#define IRDMA_CREATE_AH_MIN_RESP_LEN offsetofend(struct irdma_create_ah_resp, rsvd) + struct irdma_ah *ah = container_of(ibah, struct irdma_ah, ibah); + struct irdma_device *iwdev = to_iwdev(ibah->pd->device); + struct irdma_create_ah_resp uresp; + struct irdma_ah *parent_ah; + int err; + ++ if (udata && udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN) ++ return -EINVAL; ++ + err = irdma_setup_ah(ibah, attr); + if (err) + return err; +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 04a67b4816086..a40bf58bcdd3a 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + goto err_mr; + + mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key; +- mr->ibmr.length = length; + mr->ibmr.page_size = 1U << shift; + + return &mr->ibmr; +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index bb13164124fdb..aa4a2a9cb0d58 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1826,6 +1826,9 @@ static int set_ucontext_resp(struct ib_ucontext *uctx, + if (MLX5_CAP_GEN(dev->mdev, drain_sigerr)) + resp->comp_mask |= MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_SQD2RTS; + ++ resp->comp_mask |= ++ MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_MKEY_UPDATE_TAG; ++ + return 0; + } + +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 84da5674e1abc..9151852f04a15 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -795,7 +795,8 @@ static bool mkey_is_eq(struct mlx5_ib_mkey *mmkey, u32 key) + { + if (!mmkey) + return false; +- if (mmkey->type == MLX5_MKEY_MW) ++ if (mmkey->type == MLX5_MKEY_MW || ++ mmkey->type == MLX5_MKEY_INDIRECT_DEVX) + return mlx5_base_mkey(mmkey->key) == mlx5_base_mkey(key); + return mmkey->key == key; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index fd706dc3009de..3df2db893dd3b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -794,7 +794,9 @@ static void rxe_qp_do_cleanup(struct work_struct *work) + rxe_cleanup_task(&qp->comp.task); + + /* flush out any receive wr's or pending requests */ +- __rxe_do_task(&qp->req.task); ++ if (qp->req.task.func) ++ __rxe_do_task(&qp->req.task); ++ + if (qp->sq.queue) { + __rxe_do_task(&qp->comp.task); + __rxe_do_task(&qp->req.task); +@@ -830,8 +832,10 @@ static void rxe_qp_do_cleanup(struct work_struct *work) + + free_rd_atomic_resources(qp); + +- kernel_sock_shutdown(qp->sk, SHUT_RDWR); +- sock_release(qp->sk); ++ if (qp->sk) { ++ kernel_sock_shutdown(qp->sk, SHUT_RDWR); ++ sock_release(qp->sk); ++ } + } + + /* called when the last reference to the qp is dropped */ +diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c +index dbd4971039c0c..d6dbf5a0058dc 100644 +--- a/drivers/infiniband/sw/rxe/rxe_queue.c ++++ b/drivers/infiniband/sw/rxe/rxe_queue.c +@@ -112,23 +112,25 @@ static int resize_finish(struct rxe_queue *q, struct rxe_queue *new_q, + unsigned int num_elem) + { + enum queue_type type = q->type; ++ u32 new_prod; + u32 prod; + u32 cons; + + if (!queue_empty(q, q->type) && (num_elem < queue_count(q, type))) + return -EINVAL; + +- prod = queue_get_producer(new_q, type); ++ new_prod = queue_get_producer(new_q, type); ++ prod = queue_get_producer(q, type); + cons = queue_get_consumer(q, type); + +- while (!queue_empty(q, type)) { +- memcpy(queue_addr_from_index(new_q, prod), ++ while ((prod - cons) & q->index_mask) { ++ memcpy(queue_addr_from_index(new_q, new_prod), + queue_addr_from_index(q, cons), new_q->elem_size); +- prod = queue_next_index(new_q, prod); ++ new_prod = queue_next_index(new_q, new_prod); + cons = queue_next_index(q, cons); + } + +- new_q->buf->producer_index = prod; ++ new_q->buf->producer_index = new_prod; + q->buf->consumer_index = cons; + + /* update private index copies */ +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index e38bf958ab485..2ef21a1cba814 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -787,10 +787,8 @@ static enum resp_states read_reply(struct rxe_qp *qp, + if (!skb) + return RESPST_ERR_RNR; + +- err = rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt), +- payload, RXE_FROM_MR_OBJ); +- if (err) +- pr_err("Failed copying memory\n"); ++ rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt), ++ payload, RXE_FROM_MR_OBJ); + if (mr) + rxe_put(mr); + +@@ -801,10 +799,8 @@ static enum resp_states read_reply(struct rxe_qp *qp, + } + + err = rxe_xmit_packet(qp, &ack_pkt, skb); +- if (err) { +- pr_err("Failed sending RDMA reply.\n"); ++ if (err) + return RESPST_ERR_RNR; +- } + + res->read.va += payload; + res->read.resid -= payload; +diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h +index df03d84c6868a..2f3a9cda3850f 100644 +--- a/drivers/infiniband/sw/siw/siw.h ++++ b/drivers/infiniband/sw/siw/siw.h +@@ -418,6 +418,7 @@ struct siw_qp { + struct ib_qp base_qp; + struct siw_device *sdev; + struct kref ref; ++ struct completion qp_free; + struct list_head devq; + int tx_cpu; + struct siw_qp_attrs attrs; +diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c +index 7e01f2438afc5..e6f634971228e 100644 +--- a/drivers/infiniband/sw/siw/siw_qp.c ++++ b/drivers/infiniband/sw/siw/siw_qp.c +@@ -1342,6 +1342,6 @@ void siw_free_qp(struct kref *ref) + vfree(qp->orq); + + siw_put_tx_cpu(qp->tx_cpu); +- ++ complete(&qp->qp_free); + atomic_dec(&sdev->num_qp); + } +diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c +index 875ea6f1b04a2..fd721cc19682e 100644 +--- a/drivers/infiniband/sw/siw/siw_qp_rx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_rx.c +@@ -961,27 +961,28 @@ out: + static int siw_get_trailer(struct siw_qp *qp, struct siw_rx_stream *srx) + { + struct sk_buff *skb = srx->skb; ++ int avail = min(srx->skb_new, srx->fpdu_part_rem); + u8 *tbuf = (u8 *)&srx->trailer.crc - srx->pad; + __wsum crc_in, crc_own = 0; + + siw_dbg_qp(qp, "expected %d, available %d, pad %u\n", + srx->fpdu_part_rem, srx->skb_new, srx->pad); + +- if (srx->skb_new < srx->fpdu_part_rem) +- return -EAGAIN; +- +- skb_copy_bits(skb, srx->skb_offset, tbuf, srx->fpdu_part_rem); ++ skb_copy_bits(skb, srx->skb_offset, tbuf, avail); + +- if (srx->mpa_crc_hd && srx->pad) +- crypto_shash_update(srx->mpa_crc_hd, tbuf, srx->pad); ++ srx->skb_new -= avail; ++ srx->skb_offset += avail; ++ srx->skb_copied += avail; ++ srx->fpdu_part_rem -= avail; + +- srx->skb_new -= srx->fpdu_part_rem; +- srx->skb_offset += srx->fpdu_part_rem; +- srx->skb_copied += srx->fpdu_part_rem; ++ if (srx->fpdu_part_rem) ++ return -EAGAIN; + + if (!srx->mpa_crc_hd) + return 0; + ++ if (srx->pad) ++ crypto_shash_update(srx->mpa_crc_hd, tbuf, srx->pad); + /* + * CRC32 is computed, transmitted and received directly in NBO, + * so there's never a reason to convert byte order. +@@ -1083,10 +1084,9 @@ static int siw_get_hdr(struct siw_rx_stream *srx) + * completely received. + */ + if (iwarp_pktinfo[opcode].hdr_len > sizeof(struct iwarp_ctrl_tagged)) { +- bytes = iwarp_pktinfo[opcode].hdr_len - MIN_DDP_HDR; ++ int hdrlen = iwarp_pktinfo[opcode].hdr_len; + +- if (srx->skb_new < bytes) +- return -EAGAIN; ++ bytes = min_t(int, hdrlen - MIN_DDP_HDR, srx->skb_new); + + skb_copy_bits(skb, srx->skb_offset, + (char *)c_hdr + srx->fpdu_part_rcvd, bytes); +@@ -1096,6 +1096,9 @@ static int siw_get_hdr(struct siw_rx_stream *srx) + srx->skb_new -= bytes; + srx->skb_offset += bytes; + srx->skb_copied += bytes; ++ ++ if (srx->fpdu_part_rcvd < hdrlen) ++ return -EAGAIN; + } + + /* +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 09316072b7890..598dab44536bc 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -480,6 +480,8 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, + list_add_tail(&qp->devq, &sdev->qp_list); + spin_unlock_irqrestore(&sdev->lock, flags); + ++ init_completion(&qp->qp_free); ++ + return 0; + + err_out_xa: +@@ -624,6 +626,7 @@ int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata) + qp->scq = qp->rcq = NULL; + + siw_qp_put(qp); ++ wait_for_completion(&qp->qp_free); + + return 0; + } +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 3d9c108d73ad8..c3fa65977b3ed 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2790,7 +2790,7 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun, + static int srp_abort(struct scsi_cmnd *scmnd) + { + struct srp_target_port *target = host_to_target(scmnd->device->host); +- struct srp_request *req = (struct srp_request *) scmnd->host_scribble; ++ struct srp_request *req = scsi_cmd_priv(scmnd); + u32 tag; + u16 ch_idx; + struct srp_rdma_ch *ch; +@@ -2798,8 +2798,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) + + shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); + +- if (!req) +- return SUCCESS; + tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmnd)); + ch_idx = blk_mq_unique_tag_to_hwq(tag); + if (WARN_ON_ONCE(ch_idx >= target->ch_count)) +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 88817a3376ef0..e119ff8396c9e 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -2839,6 +2839,26 @@ static int arm_smmu_dev_disable_feature(struct device *dev, + } + } + ++/* ++ * HiSilicon PCIe tune and trace device can be used to trace TLP headers on the ++ * PCIe link and save the data to memory by DMA. The hardware is restricted to ++ * use identity mapping only. ++ */ ++#define IS_HISI_PTT_DEVICE(pdev) ((pdev)->vendor == PCI_VENDOR_ID_HUAWEI && \ ++ (pdev)->device == 0xa12e) ++ ++static int arm_smmu_def_domain_type(struct device *dev) ++{ ++ if (dev_is_pci(dev)) { ++ struct pci_dev *pdev = to_pci_dev(dev); ++ ++ if (IS_HISI_PTT_DEVICE(pdev)) ++ return IOMMU_DOMAIN_IDENTITY; ++ } ++ ++ return 0; ++} ++ + static struct iommu_ops arm_smmu_ops = { + .capable = arm_smmu_capable, + .domain_alloc = arm_smmu_domain_alloc, +@@ -2856,6 +2876,7 @@ static struct iommu_ops arm_smmu_ops = { + .sva_unbind = arm_smmu_sva_unbind, + .sva_get_pasid = arm_smmu_sva_get_pasid, + .page_response = arm_smmu_page_response, ++ .def_domain_type = arm_smmu_def_domain_type, + .pgsize_bitmap = -1UL, /* Restricted during device attach */ + .owner = THIS_MODULE, + .default_domain_ops = &(const struct iommu_domain_ops) { +diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c +index a99afb5d9011c..259f65291d909 100644 +--- a/drivers/iommu/omap-iommu-debug.c ++++ b/drivers/iommu/omap-iommu-debug.c +@@ -32,12 +32,12 @@ static inline bool is_omap_iommu_detached(struct omap_iommu *obj) + ssize_t bytes; \ + const char *str = "%20s: %08x\n"; \ + const int maxcol = 32; \ +- bytes = snprintf(p, maxcol, str, __stringify(name), \ ++ if (len < maxcol) \ ++ goto out; \ ++ bytes = scnprintf(p, maxcol, str, __stringify(name), \ + iommu_read_reg(obj, MMU_##name)); \ + p += bytes; \ + len -= bytes; \ +- if (len < maxcol) \ +- goto out; \ + } while (0) + + static ssize_t +diff --git a/drivers/isdn/mISDN/l1oip.h b/drivers/isdn/mISDN/l1oip.h +index 7ea10db20e3a6..48133d0228120 100644 +--- a/drivers/isdn/mISDN/l1oip.h ++++ b/drivers/isdn/mISDN/l1oip.h +@@ -59,6 +59,7 @@ struct l1oip { + int bundle; /* bundle channels in one frm */ + int codec; /* codec to use for transmis. */ + int limit; /* limit number of bchannels */ ++ bool shutdown; /* if card is released */ + + /* timer */ + struct timer_list keep_tl; +diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c +index 2c40412466e6f..a77195e378b7b 100644 +--- a/drivers/isdn/mISDN/l1oip_core.c ++++ b/drivers/isdn/mISDN/l1oip_core.c +@@ -275,7 +275,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask, + p = frame; + + /* restart timer */ +- if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ)) ++ if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ) && !hc->shutdown) + mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ); + else + hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ; +@@ -601,7 +601,9 @@ multiframe: + goto multiframe; + + /* restart timer */ +- if (time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || !hc->timeout_on) { ++ if ((time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || ++ !hc->timeout_on) && ++ !hc->shutdown) { + hc->timeout_on = 1; + mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ); + } else /* only adjust timer */ +@@ -1232,11 +1234,10 @@ release_card(struct l1oip *hc) + { + int ch; + +- if (timer_pending(&hc->keep_tl)) +- del_timer(&hc->keep_tl); ++ hc->shutdown = true; + +- if (timer_pending(&hc->timeout_tl)) +- del_timer(&hc->timeout_tl); ++ del_timer_sync(&hc->keep_tl); ++ del_timer_sync(&hc->timeout_tl); + + cancel_work_sync(&hc->workq); + +diff --git a/drivers/leds/flash/leds-lm3601x.c b/drivers/leds/flash/leds-lm3601x.c +index d0e1d4814042e..3d12727482017 100644 +--- a/drivers/leds/flash/leds-lm3601x.c ++++ b/drivers/leds/flash/leds-lm3601x.c +@@ -444,8 +444,6 @@ static int lm3601x_remove(struct i2c_client *client) + { + struct lm3601x_led *led = i2c_get_clientdata(client); + +- mutex_destroy(&led->lock); +- + return regmap_update_bits(led->regmap, LM3601X_ENABLE_REG, + LM3601X_ENABLE_MASK, + LM3601X_MODE_STANDBY); +diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c +index 22acb51531cb5..658e47b21933a 100644 +--- a/drivers/mailbox/bcm-flexrm-mailbox.c ++++ b/drivers/mailbox/bcm-flexrm-mailbox.c +@@ -632,15 +632,15 @@ static int flexrm_spu_dma_map(struct device *dev, struct brcm_message *msg) + + rc = dma_map_sg(dev, msg->spu.src, sg_nents(msg->spu.src), + DMA_TO_DEVICE); +- if (rc < 0) +- return rc; ++ if (!rc) ++ return -EIO; + + rc = dma_map_sg(dev, msg->spu.dst, sg_nents(msg->spu.dst), + DMA_FROM_DEVICE); +- if (rc < 0) { ++ if (!rc) { + dma_unmap_sg(dev, msg->spu.src, sg_nents(msg->spu.src), + DMA_TO_DEVICE); +- return rc; ++ return -EIO; + } + + return 0; +diff --git a/drivers/mailbox/mailbox-mpfs.c b/drivers/mailbox/mailbox-mpfs.c +index 4e34854d12389..cfacb3f320a64 100644 +--- a/drivers/mailbox/mailbox-mpfs.c ++++ b/drivers/mailbox/mailbox-mpfs.c +@@ -62,6 +62,7 @@ struct mpfs_mbox { + struct mbox_controller controller; + struct device *dev; + int irq; ++ void __iomem *ctrl_base; + void __iomem *mbox_base; + void __iomem *int_reg; + struct mbox_chan chans[1]; +@@ -73,7 +74,7 @@ static bool mpfs_mbox_busy(struct mpfs_mbox *mbox) + { + u32 status; + +- status = readl_relaxed(mbox->mbox_base + SERVICES_SR_OFFSET); ++ status = readl_relaxed(mbox->ctrl_base + SERVICES_SR_OFFSET); + + return status & SCB_STATUS_BUSY_MASK; + } +@@ -99,29 +100,27 @@ static int mpfs_mbox_send_data(struct mbox_chan *chan, void *data) + + for (index = 0; index < (msg->cmd_data_size / 4); index++) + writel_relaxed(word_buf[index], +- mbox->mbox_base + MAILBOX_REG_OFFSET + index * 0x4); ++ mbox->mbox_base + msg->mbox_offset + index * 0x4); + if (extra_bits) { + u8 i; + u8 byte_off = ALIGN_DOWN(msg->cmd_data_size, 4); + u8 *byte_buf = msg->cmd_data + byte_off; + +- val = readl_relaxed(mbox->mbox_base + +- MAILBOX_REG_OFFSET + index * 0x4); ++ val = readl_relaxed(mbox->mbox_base + msg->mbox_offset + index * 0x4); + + for (i = 0u; i < extra_bits; i++) { + val &= ~(0xffu << (i * 8u)); + val |= (byte_buf[i] << (i * 8u)); + } + +- writel_relaxed(val, +- mbox->mbox_base + MAILBOX_REG_OFFSET + index * 0x4); ++ writel_relaxed(val, mbox->mbox_base + msg->mbox_offset + index * 0x4); + } + } + + opt_sel = ((msg->mbox_offset << 7u) | (msg->cmd_opcode & 0x7fu)); + tx_trigger = (opt_sel << SCB_CTRL_POS) & SCB_CTRL_MASK; + tx_trigger |= SCB_CTRL_REQ_MASK | SCB_STATUS_NOTIFY_MASK; +- writel_relaxed(tx_trigger, mbox->mbox_base + SERVICES_CR_OFFSET); ++ writel_relaxed(tx_trigger, mbox->ctrl_base + SERVICES_CR_OFFSET); + + return 0; + } +@@ -141,7 +140,7 @@ static void mpfs_mbox_rx_data(struct mbox_chan *chan) + if (!mpfs_mbox_busy(mbox)) { + for (i = 0; i < num_words; i++) { + response->resp_msg[i] = +- readl_relaxed(mbox->mbox_base + MAILBOX_REG_OFFSET ++ readl_relaxed(mbox->mbox_base + + mbox->resp_offset + i * 0x4); + } + } +@@ -200,14 +199,18 @@ static int mpfs_mbox_probe(struct platform_device *pdev) + if (!mbox) + return -ENOMEM; + +- mbox->mbox_base = devm_platform_get_and_ioremap_resource(pdev, 0, ®s); +- if (IS_ERR(mbox->mbox_base)) +- return PTR_ERR(mbox->mbox_base); ++ mbox->ctrl_base = devm_platform_get_and_ioremap_resource(pdev, 0, ®s); ++ if (IS_ERR(mbox->ctrl_base)) ++ return PTR_ERR(mbox->ctrl_base); + + mbox->int_reg = devm_platform_get_and_ioremap_resource(pdev, 1, ®s); + if (IS_ERR(mbox->int_reg)) + return PTR_ERR(mbox->int_reg); + ++ mbox->mbox_base = devm_platform_get_and_ioremap_resource(pdev, 2, ®s); ++ if (IS_ERR(mbox->mbox_base)) // account for the old dt-binding w/ 2 regs ++ mbox->mbox_base = mbox->ctrl_base + MAILBOX_REG_OFFSET; ++ + mbox->irq = platform_get_irq(pdev, 0); + if (mbox->irq < 0) + return mbox->irq; +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index 3f0ff3aab6f23..9c227e4a84654 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -157,6 +157,53 @@ static void __update_writeback_rate(struct cached_dev *dc) + dc->writeback_rate_target = target; + } + ++static bool idle_counter_exceeded(struct cache_set *c) ++{ ++ int counter, dev_nr; ++ ++ /* ++ * If c->idle_counter is overflow (idel for really long time), ++ * reset as 0 and not set maximum rate this time for code ++ * simplicity. ++ */ ++ counter = atomic_inc_return(&c->idle_counter); ++ if (counter <= 0) { ++ atomic_set(&c->idle_counter, 0); ++ return false; ++ } ++ ++ dev_nr = atomic_read(&c->attached_dev_nr); ++ if (dev_nr == 0) ++ return false; ++ ++ /* ++ * c->idle_counter is increased by writeback thread of all ++ * attached backing devices, in order to represent a rough ++ * time period, counter should be divided by dev_nr. ++ * Otherwise the idle time cannot be larger with more backing ++ * device attached. ++ * The following calculation equals to checking ++ * (counter / dev_nr) < (dev_nr * 6) ++ */ ++ if (counter < (dev_nr * dev_nr * 6)) ++ return false; ++ ++ return true; ++} ++ ++/* ++ * Idle_counter is increased every time when update_writeback_rate() is ++ * called. If all backing devices attached to the same cache set have ++ * identical dc->writeback_rate_update_seconds values, it is about 6 ++ * rounds of update_writeback_rate() on each backing device before ++ * c->at_max_writeback_rate is set to 1, and then max wrteback rate set ++ * to each dc->writeback_rate.rate. ++ * In order to avoid extra locking cost for counting exact dirty cached ++ * devices number, c->attached_dev_nr is used to calculate the idle ++ * throushold. It might be bigger if not all cached device are in write- ++ * back mode, but it still works well with limited extra rounds of ++ * update_writeback_rate(). ++ */ + static bool set_at_max_writeback_rate(struct cache_set *c, + struct cached_dev *dc) + { +@@ -167,21 +214,8 @@ static bool set_at_max_writeback_rate(struct cache_set *c, + /* Don't set max writeback rate if gc is running */ + if (!c->gc_mark_valid) + return false; +- /* +- * Idle_counter is increased everytime when update_writeback_rate() is +- * called. If all backing devices attached to the same cache set have +- * identical dc->writeback_rate_update_seconds values, it is about 6 +- * rounds of update_writeback_rate() on each backing device before +- * c->at_max_writeback_rate is set to 1, and then max wrteback rate set +- * to each dc->writeback_rate.rate. +- * In order to avoid extra locking cost for counting exact dirty cached +- * devices number, c->attached_dev_nr is used to calculate the idle +- * throushold. It might be bigger if not all cached device are in write- +- * back mode, but it still works well with limited extra rounds of +- * update_writeback_rate(). +- */ +- if (atomic_inc_return(&c->idle_counter) < +- atomic_read(&c->attached_dev_nr) * 6) ++ ++ if (!idle_counter_exceeded(c)) + return false; + + if (atomic_read(&c->at_max_writeback_rate) != 1) +@@ -195,13 +229,10 @@ static bool set_at_max_writeback_rate(struct cache_set *c, + dc->writeback_rate_change = 0; + + /* +- * Check c->idle_counter and c->at_max_writeback_rate agagain in case +- * new I/O arrives during before set_at_max_writeback_rate() returns. +- * Then the writeback rate is set to 1, and its new value should be +- * decided via __update_writeback_rate(). ++ * In case new I/O arrives during before ++ * set_at_max_writeback_rate() returns. + */ +- if ((atomic_read(&c->idle_counter) < +- atomic_read(&c->attached_dev_nr) * 6) || ++ if (!idle_counter_exceeded(c) || + !atomic_read(&c->at_max_writeback_rate)) + return false; + +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index 78addfe4a0c92..857c49399c28e 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -47,7 +47,7 @@ static void dump_zones(struct mddev *mddev) + int len = 0; + + for (k = 0; k < conf->strip_zone[j].nb_dev; k++) +- len += snprintf(line+len, 200-len, "%s%pg", k?"/":"", ++ len += scnprintf(line+len, 200-len, "%s%pg", k?"/":"", + conf->devlist[j * raid_disks + k]->bdev); + pr_debug("md: zone%d=[%s]\n", j, line); + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 1c1310d539f2e..cdb5ae435b78b 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -36,6 +36,7 @@ + */ + + #include <linux/blkdev.h> ++#include <linux/delay.h> + #include <linux/kthread.h> + #include <linux/raid/pq.h> + #include <linux/async_tx.h> +@@ -3951,7 +3952,7 @@ static void handle_stripe_fill(struct stripe_head *sh, + * back cache (prexor with orig_page, and then xor with + * page) in the read path + */ +- if (s->injournal && s->failed) { ++ if (s->to_read && s->injournal && s->failed) { + if (test_bit(STRIPE_R5C_CACHING, &sh->state)) + r5c_make_stripe_write_out(sh); + goto out; +@@ -5446,7 +5447,6 @@ static int raid5_read_one_chunk(struct mddev *mddev, struct bio *raid_bio) + + if (is_badblock(rdev, sector, bio_sectors(raid_bio), &first_bad, + &bad_sectors)) { +- bio_put(raid_bio); + rdev_dec_pending(rdev, mddev); + return 0; + } +@@ -6553,7 +6553,18 @@ static void raid5d(struct md_thread *thread) + spin_unlock_irq(&conf->device_lock); + md_check_recovery(mddev); + spin_lock_irq(&conf->device_lock); ++ ++ /* ++ * Waiting on MD_SB_CHANGE_PENDING below may deadlock ++ * seeing md_check_recovery() is needed to clear ++ * the flag when using mdmon. ++ */ ++ continue; + } ++ ++ wait_event_lock_irq(mddev->sb_wait, ++ !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags), ++ conf->device_lock); + } + pr_debug("%d stripes handled\n", handled); + +diff --git a/drivers/media/pci/cx88/cx88-vbi.c b/drivers/media/pci/cx88/cx88-vbi.c +index a075788c64d45..469aeaa725ad9 100644 +--- a/drivers/media/pci/cx88/cx88-vbi.c ++++ b/drivers/media/pci/cx88/cx88-vbi.c +@@ -144,11 +144,10 @@ static int buffer_prepare(struct vb2_buffer *vb) + return -EINVAL; + vb2_set_plane_payload(vb, 0, size); + +- cx88_risc_buffer(dev->pci, &buf->risc, sgt->sgl, +- 0, VBI_LINE_LENGTH * lines, +- VBI_LINE_LENGTH, 0, +- lines); +- return 0; ++ return cx88_risc_buffer(dev->pci, &buf->risc, sgt->sgl, ++ 0, VBI_LINE_LENGTH * lines, ++ VBI_LINE_LENGTH, 0, ++ lines); + } + + static void buffer_finish(struct vb2_buffer *vb) +diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c +index d3729be892529..b509c2a03852b 100644 +--- a/drivers/media/pci/cx88/cx88-video.c ++++ b/drivers/media/pci/cx88/cx88-video.c +@@ -431,6 +431,7 @@ static int queue_setup(struct vb2_queue *q, + + static int buffer_prepare(struct vb2_buffer *vb) + { ++ int ret; + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); + struct cx8800_dev *dev = vb->vb2_queue->drv_priv; + struct cx88_core *core = dev->core; +@@ -445,35 +446,35 @@ static int buffer_prepare(struct vb2_buffer *vb) + + switch (core->field) { + case V4L2_FIELD_TOP: +- cx88_risc_buffer(dev->pci, &buf->risc, +- sgt->sgl, 0, UNSET, +- buf->bpl, 0, core->height); ++ ret = cx88_risc_buffer(dev->pci, &buf->risc, ++ sgt->sgl, 0, UNSET, ++ buf->bpl, 0, core->height); + break; + case V4L2_FIELD_BOTTOM: +- cx88_risc_buffer(dev->pci, &buf->risc, +- sgt->sgl, UNSET, 0, +- buf->bpl, 0, core->height); ++ ret = cx88_risc_buffer(dev->pci, &buf->risc, ++ sgt->sgl, UNSET, 0, ++ buf->bpl, 0, core->height); + break; + case V4L2_FIELD_SEQ_TB: +- cx88_risc_buffer(dev->pci, &buf->risc, +- sgt->sgl, +- 0, buf->bpl * (core->height >> 1), +- buf->bpl, 0, +- core->height >> 1); ++ ret = cx88_risc_buffer(dev->pci, &buf->risc, ++ sgt->sgl, ++ 0, buf->bpl * (core->height >> 1), ++ buf->bpl, 0, ++ core->height >> 1); + break; + case V4L2_FIELD_SEQ_BT: +- cx88_risc_buffer(dev->pci, &buf->risc, +- sgt->sgl, +- buf->bpl * (core->height >> 1), 0, +- buf->bpl, 0, +- core->height >> 1); ++ ret = cx88_risc_buffer(dev->pci, &buf->risc, ++ sgt->sgl, ++ buf->bpl * (core->height >> 1), 0, ++ buf->bpl, 0, ++ core->height >> 1); + break; + case V4L2_FIELD_INTERLACED: + default: +- cx88_risc_buffer(dev->pci, &buf->risc, +- sgt->sgl, 0, buf->bpl, +- buf->bpl, buf->bpl, +- core->height >> 1); ++ ret = cx88_risc_buffer(dev->pci, &buf->risc, ++ sgt->sgl, 0, buf->bpl, ++ buf->bpl, buf->bpl, ++ core->height >> 1); + break; + } + dprintk(2, +@@ -481,7 +482,7 @@ static int buffer_prepare(struct vb2_buffer *vb) + buf, buf->vb.vb2_buf.index, __func__, + core->width, core->height, dev->fmt->depth, dev->fmt->fourcc, + (unsigned long)buf->risc.dma); +- return 0; ++ return ret; + } + + static void buffer_finish(struct vb2_buffer *vb) +diff --git a/drivers/media/platform/amlogic/meson-ge2d/ge2d.c b/drivers/media/platform/amlogic/meson-ge2d/ge2d.c +index 5e7b319f300df..142d421a8d769 100644 +--- a/drivers/media/platform/amlogic/meson-ge2d/ge2d.c ++++ b/drivers/media/platform/amlogic/meson-ge2d/ge2d.c +@@ -1030,7 +1030,6 @@ static int ge2d_remove(struct platform_device *pdev) + + video_unregister_device(ge2d->vfd); + v4l2_m2m_release(ge2d->m2m_dev); +- video_device_release(ge2d->vfd); + v4l2_device_unregister(&ge2d->v4l2_dev); + clk_disable_unprepare(ge2d->clk); + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 44dbca0fe17f1..6d6842ff12e2a 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -808,14 +808,6 @@ static void vdec_init_fmt(struct vpu_inst *inst) + inst->cap_format.field = V4L2_FIELD_NONE; + else + inst->cap_format.field = V4L2_FIELD_SEQ_TB; +- if (vdec->codec_info.color_primaries == V4L2_COLORSPACE_DEFAULT) +- vdec->codec_info.color_primaries = V4L2_COLORSPACE_REC709; +- if (vdec->codec_info.transfer_chars == V4L2_XFER_FUNC_DEFAULT) +- vdec->codec_info.transfer_chars = V4L2_XFER_FUNC_709; +- if (vdec->codec_info.matrix_coeffs == V4L2_YCBCR_ENC_DEFAULT) +- vdec->codec_info.matrix_coeffs = V4L2_YCBCR_ENC_709; +- if (vdec->codec_info.full_range == V4L2_QUANTIZATION_DEFAULT) +- vdec->codec_info.full_range = V4L2_QUANTIZATION_LIM_RANGE; + } + + static void vdec_init_crop(struct vpu_inst *inst) +@@ -1556,6 +1548,14 @@ static int vdec_get_debug_info(struct vpu_inst *inst, char *str, u32 size, u32 i + vdec->codec_info.frame_rate.numerator, + vdec->codec_info.frame_rate.denominator); + break; ++ case 9: ++ num = scnprintf(str, size, "colorspace: %d, %d, %d, %d (%d)\n", ++ vdec->codec_info.color_primaries, ++ vdec->codec_info.transfer_chars, ++ vdec->codec_info.matrix_coeffs, ++ vdec->codec_info.full_range, ++ vdec->codec_info.vui_present); ++ break; + default: + break; + } +diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c +index 43d61d82f58c2..0f21a181c1de9 100644 +--- a/drivers/media/platform/amphion/venc.c ++++ b/drivers/media/platform/amphion/venc.c +@@ -644,7 +644,7 @@ static int venc_ctrl_init(struct vpu_inst *inst) + BITRATE_DEFAULT_PEAK); + + v4l2_ctrl_new_std(&inst->ctrl_handler, &venc_ctrl_ops, +- V4L2_CID_MPEG_VIDEO_GOP_SIZE, 0, (1 << 16) - 1, 1, 30); ++ V4L2_CID_MPEG_VIDEO_GOP_SIZE, 1, 8000, 1, 30); + + v4l2_ctrl_new_std(&inst->ctrl_handler, &venc_ctrl_ops, + V4L2_CID_MPEG_VIDEO_B_FRAMES, 0, 4, 1, 0); +diff --git a/drivers/media/platform/amphion/vpu.h b/drivers/media/platform/amphion/vpu.h +index f914de6ed81e9..beac0309ca8d9 100644 +--- a/drivers/media/platform/amphion/vpu.h ++++ b/drivers/media/platform/amphion/vpu.h +@@ -119,7 +119,6 @@ struct vpu_mbox { + enum vpu_core_state { + VPU_CORE_DEINIT = 0, + VPU_CORE_ACTIVE, +- VPU_CORE_SNAPSHOT, + VPU_CORE_HANG + }; + +diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c +index 51a764713159a..21a416b8e483d 100644 +--- a/drivers/media/platform/amphion/vpu_core.c ++++ b/drivers/media/platform/amphion/vpu_core.c +@@ -89,7 +89,7 @@ static int vpu_core_boot_done(struct vpu_core *core) + core->supported_instance_count = min(core->supported_instance_count, count); + } + core->fw_version = fw_version; +- core->state = VPU_CORE_ACTIVE; ++ vpu_core_set_state(core, VPU_CORE_ACTIVE); + + return 0; + } +@@ -172,10 +172,26 @@ int vpu_alloc_dma(struct vpu_core *core, struct vpu_buffer *buf) + return __vpu_alloc_dma(core->dev, buf); + } + +-static void vpu_core_check_hang(struct vpu_core *core) ++void vpu_core_set_state(struct vpu_core *core, enum vpu_core_state state) + { +- if (core->hang_mask) +- core->state = VPU_CORE_HANG; ++ if (state != core->state) ++ vpu_trace(core->dev, "vpu core state change from %d to %d\n", core->state, state); ++ core->state = state; ++ if (core->state == VPU_CORE_DEINIT) ++ core->hang_mask = 0; ++} ++ ++static void vpu_core_update_state(struct vpu_core *core) ++{ ++ if (!vpu_iface_get_power_state(core)) { ++ if (core->request_count) ++ vpu_core_set_state(core, VPU_CORE_HANG); ++ else ++ vpu_core_set_state(core, VPU_CORE_DEINIT); ++ ++ } else if (core->state == VPU_CORE_ACTIVE && core->hang_mask) { ++ vpu_core_set_state(core, VPU_CORE_HANG); ++ } + } + + static struct vpu_core *vpu_core_find_proper_by_type(struct vpu_dev *vpu, u32 type) +@@ -188,11 +204,13 @@ static struct vpu_core *vpu_core_find_proper_by_type(struct vpu_dev *vpu, u32 ty + dev_dbg(c->dev, "instance_mask = 0x%lx, state = %d\n", c->instance_mask, c->state); + if (c->type != type) + continue; ++ mutex_lock(&c->lock); ++ vpu_core_update_state(c); ++ mutex_unlock(&c->lock); + if (c->state == VPU_CORE_DEINIT) { + core = c; + break; + } +- vpu_core_check_hang(c); + if (c->state != VPU_CORE_ACTIVE) + continue; + if (c->request_count < request_count) { +@@ -412,6 +430,12 @@ int vpu_inst_register(struct vpu_inst *inst) + } + + mutex_lock(&core->lock); ++ if (core->state != VPU_CORE_ACTIVE) { ++ dev_err(core->dev, "vpu core is not active, state = %d\n", core->state); ++ ret = -EINVAL; ++ goto exit; ++ } ++ + if (inst->id >= 0 && inst->id < core->supported_instance_count) + goto exit; + +@@ -453,7 +477,7 @@ int vpu_inst_unregister(struct vpu_inst *inst) + vpu_core_release_instance(core, inst->id); + inst->id = VPU_INST_NULL_ID; + } +- vpu_core_check_hang(core); ++ vpu_core_update_state(core); + if (core->state == VPU_CORE_HANG && !core->instance_mask) { + int err; + +@@ -462,7 +486,7 @@ int vpu_inst_unregister(struct vpu_inst *inst) + err = vpu_core_sw_reset(core); + mutex_lock(&core->lock); + if (!err) { +- core->state = VPU_CORE_ACTIVE; ++ vpu_core_set_state(core, VPU_CORE_ACTIVE); + core->hang_mask = 0; + } + } +@@ -612,7 +636,7 @@ static int vpu_core_probe(struct platform_device *pdev) + mutex_init(&core->cmd_lock); + init_completion(&core->cmp); + init_waitqueue_head(&core->ack_wq); +- core->state = VPU_CORE_DEINIT; ++ vpu_core_set_state(core, VPU_CORE_DEINIT); + + core->res = of_device_get_match_data(dev); + if (!core->res) +@@ -761,33 +785,18 @@ static int __maybe_unused vpu_core_resume(struct device *dev) + mutex_lock(&core->lock); + pm_runtime_resume_and_get(dev); + vpu_core_get_vpu(core); +- if (core->state != VPU_CORE_SNAPSHOT) +- goto exit; + +- if (!vpu_iface_get_power_state(core)) { +- if (!list_empty(&core->instances)) { ++ if (core->request_count) { ++ if (!vpu_iface_get_power_state(core)) + ret = vpu_core_boot(core, false); +- if (ret) { +- dev_err(core->dev, "%s boot fail\n", __func__); +- core->state = VPU_CORE_DEINIT; +- goto exit; +- } +- } else { +- core->state = VPU_CORE_DEINIT; +- } +- } else { +- if (!list_empty(&core->instances)) { ++ else + ret = vpu_core_sw_reset(core); +- if (ret) { +- dev_err(core->dev, "%s sw_reset fail\n", __func__); +- core->state = VPU_CORE_HANG; +- goto exit; +- } ++ if (ret) { ++ dev_err(core->dev, "resume fail\n"); ++ vpu_core_set_state(core, VPU_CORE_HANG); + } +- core->state = VPU_CORE_ACTIVE; + } +- +-exit: ++ vpu_core_update_state(core); + pm_runtime_put_sync(dev); + mutex_unlock(&core->lock); + +@@ -801,18 +810,11 @@ static int __maybe_unused vpu_core_suspend(struct device *dev) + int ret = 0; + + mutex_lock(&core->lock); +- if (core->state == VPU_CORE_ACTIVE) { +- if (!list_empty(&core->instances)) { +- ret = vpu_core_snapshot(core); +- if (ret) { +- mutex_unlock(&core->lock); +- return ret; +- } +- } +- +- core->state = VPU_CORE_SNAPSHOT; +- } ++ if (core->request_count) ++ ret = vpu_core_snapshot(core); + mutex_unlock(&core->lock); ++ if (ret) ++ return ret; + + vpu_core_cancel_work(core); + +diff --git a/drivers/media/platform/amphion/vpu_core.h b/drivers/media/platform/amphion/vpu_core.h +index 00a662997da4f..65b562642603a 100644 +--- a/drivers/media/platform/amphion/vpu_core.h ++++ b/drivers/media/platform/amphion/vpu_core.h +@@ -11,5 +11,6 @@ u32 csr_readl(struct vpu_core *core, u32 reg); + int vpu_alloc_dma(struct vpu_core *core, struct vpu_buffer *buf); + void vpu_free_dma(struct vpu_buffer *buf); + struct vpu_inst *vpu_core_find_instance(struct vpu_core *core, u32 index); ++void vpu_core_set_state(struct vpu_core *core, enum vpu_core_state state); + + #endif +diff --git a/drivers/media/platform/amphion/vpu_dbg.c b/drivers/media/platform/amphion/vpu_dbg.c +index da62bd718fb84..ad41060ce46e5 100644 +--- a/drivers/media/platform/amphion/vpu_dbg.c ++++ b/drivers/media/platform/amphion/vpu_dbg.c +@@ -15,6 +15,7 @@ + #include <linux/debugfs.h> + #include "vpu.h" + #include "vpu_defs.h" ++#include "vpu_core.h" + #include "vpu_helpers.h" + #include "vpu_cmds.h" + #include "vpu_rpc.h" +@@ -233,6 +234,10 @@ static int vpu_dbg_core(struct seq_file *s, void *data) + if (seq_write(s, str, num)) + return 0; + ++ num = scnprintf(str, sizeof(str), "power %s\n", ++ vpu_iface_get_power_state(core) ? "on" : "off"); ++ if (seq_write(s, str, num)) ++ return 0; + num = scnprintf(str, sizeof(str), "state = %d\n", core->state); + if (seq_write(s, str, num)) + return 0; +@@ -346,10 +351,10 @@ static ssize_t vpu_dbg_core_write(struct file *file, + + pm_runtime_resume_and_get(core->dev); + mutex_lock(&core->lock); +- if (core->state != VPU_CORE_DEINIT && !core->instance_mask) { ++ if (vpu_iface_get_power_state(core) && !core->request_count) { + dev_info(core->dev, "reset\n"); + if (!vpu_core_sw_reset(core)) { +- core->state = VPU_CORE_ACTIVE; ++ vpu_core_set_state(core, VPU_CORE_ACTIVE); + core->hang_mask = 0; + } + } +diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c +index 542bbe361bd87..10553dd93c29e 100644 +--- a/drivers/media/platform/amphion/vpu_malone.c ++++ b/drivers/media/platform/amphion/vpu_malone.c +@@ -1277,7 +1277,7 @@ static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode) + vbuf = to_vb2_v4l2_buffer(scode->vb); + data = vb2_plane_vaddr(scode->vb, 0); + +- if (vbuf->sequence == 0 || vpu_vb_is_codecconfig(vbuf)) ++ if (scode->inst->total_input_count == 0 || vpu_vb_is_codecconfig(vbuf)) + return 0; + if (MALONE_VC1_CONTAIN_NAL(*data)) + return 0; +diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +index bc5b0a0168ec0..6aa73f1cde188 100644 +--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +@@ -1411,7 +1411,6 @@ static int mtk_jpeg_remove(struct platform_device *pdev) + + pm_runtime_disable(&pdev->dev); + video_unregister_device(jpeg->vdev); +- video_device_release(jpeg->vdev); + v4l2_m2m_release(jpeg->m2m_dev); + v4l2_device_unregister(&jpeg->v4l2_dev); + +diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-is.c b/drivers/media/platform/samsung/exynos4-is/fimc-is.c +index e3072d69c49fa..a7704ff069d6c 100644 +--- a/drivers/media/platform/samsung/exynos4-is/fimc-is.c ++++ b/drivers/media/platform/samsung/exynos4-is/fimc-is.c +@@ -213,6 +213,7 @@ static int fimc_is_register_subdevs(struct fimc_is *is) + + if (ret < 0 || index >= FIMC_IS_SENSORS_NUM) { + of_node_put(child); ++ of_node_put(i2c_bus); + return ret; + } + index++; +diff --git a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c +index 761341934925e..f85d1eebaface 100644 +--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c +@@ -1399,6 +1399,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) + /* Deinit MFC if probe had failed */ + err_enc_reg: + video_unregister_device(dev->vfd_dec); ++ dev->vfd_dec = NULL; + err_dec_reg: + video_device_release(dev->vfd_enc); + err_enc_alloc: +@@ -1444,8 +1445,6 @@ static int s5p_mfc_remove(struct platform_device *pdev) + + video_unregister_device(dev->vfd_enc); + video_unregister_device(dev->vfd_dec); +- video_device_release(dev->vfd_enc); +- video_device_release(dev->vfd_dec); + v4l2_device_unregister(&dev->v4l2_dev); + s5p_mfc_unconfigure_dma_memory(dev); + +diff --git a/drivers/media/platform/xilinx/xilinx-vipp.c b/drivers/media/platform/xilinx/xilinx-vipp.c +index f34f8b077e03c..0a16c218a50a7 100644 +--- a/drivers/media/platform/xilinx/xilinx-vipp.c ++++ b/drivers/media/platform/xilinx/xilinx-vipp.c +@@ -471,7 +471,7 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev) + { + struct device_node *ports; + struct device_node *port; +- int ret; ++ int ret = 0; + + ports = of_get_child_by_name(xdev->dev->of_node, "ports"); + if (ports == NULL) { +@@ -481,13 +481,14 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev) + + for_each_child_of_node(ports, port) { + ret = xvip_graph_dma_init_one(xdev, port); +- if (ret < 0) { ++ if (ret) { + of_node_put(port); +- return ret; ++ break; + } + } + +- return 0; ++ of_node_put(ports); ++ return ret; + } + + static void xvip_graph_cleanup(struct xvip_composite_device *xdev) +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 0e78233fc8a00..44071040d7643 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -963,36 +963,56 @@ static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping, + return value; + } + +-static int __uvc_ctrl_get(struct uvc_video_chain *chain, +- struct uvc_control *ctrl, struct uvc_control_mapping *mapping, +- s32 *value) ++static int __uvc_ctrl_load_cur(struct uvc_video_chain *chain, ++ struct uvc_control *ctrl) + { ++ u8 *data; + int ret; + +- if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) == 0) +- return -EACCES; ++ if (ctrl->loaded) ++ return 0; + +- if (!ctrl->loaded) { +- if (ctrl->entity->get_cur) { +- ret = ctrl->entity->get_cur(chain->dev, +- ctrl->entity, +- ctrl->info.selector, +- uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), +- ctrl->info.size); +- } else { +- ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, +- ctrl->entity->id, +- chain->dev->intfnum, +- ctrl->info.selector, +- uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), +- ctrl->info.size); +- } +- if (ret < 0) +- return ret; ++ data = uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT); + ++ if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) == 0) { ++ memset(data, 0, ctrl->info.size); + ctrl->loaded = 1; ++ ++ return 0; + } + ++ if (ctrl->entity->get_cur) ++ ret = ctrl->entity->get_cur(chain->dev, ctrl->entity, ++ ctrl->info.selector, data, ++ ctrl->info.size); ++ else ++ ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, ++ ctrl->entity->id, chain->dev->intfnum, ++ ctrl->info.selector, data, ++ ctrl->info.size); ++ ++ if (ret < 0) ++ return ret; ++ ++ ctrl->loaded = 1; ++ ++ return ret; ++} ++ ++static int __uvc_ctrl_get(struct uvc_video_chain *chain, ++ struct uvc_control *ctrl, ++ struct uvc_control_mapping *mapping, ++ s32 *value) ++{ ++ int ret; ++ ++ if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) == 0) ++ return -EACCES; ++ ++ ret = __uvc_ctrl_load_cur(chain, ctrl); ++ if (ret < 0) ++ return ret; ++ + *value = __uvc_ctrl_get_value(mapping, + uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); + +@@ -1783,21 +1803,10 @@ int uvc_ctrl_set(struct uvc_fh *handle, + * needs to be loaded from the device to perform the read-modify-write + * operation. + */ +- if (!ctrl->loaded && (ctrl->info.size * 8) != mapping->size) { +- if ((ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) == 0) { +- memset(uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), +- 0, ctrl->info.size); +- } else { +- ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, +- ctrl->entity->id, chain->dev->intfnum, +- ctrl->info.selector, +- uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), +- ctrl->info.size); +- if (ret < 0) +- return ret; +- } +- +- ctrl->loaded = 1; ++ if ((ctrl->info.size * 8) != mapping->size) { ++ ret = __uvc_ctrl_load_cur(chain, ctrl); ++ if (ret < 0) ++ return ret; + } + + /* Backup the current value in case we need to rollback later. */ +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 6c86faecbea21..28ee45e879ff1 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1538,10 +1538,6 @@ static int uvc_gpio_parse(struct uvc_device *dev) + if (IS_ERR_OR_NULL(gpio_privacy)) + return PTR_ERR_OR_ZERO(gpio_privacy); + +- unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1); +- if (!unit) +- return -ENOMEM; +- + irq = gpiod_to_irq(gpio_privacy); + if (irq < 0) { + if (irq != EPROBE_DEFER) +@@ -1550,6 +1546,10 @@ static int uvc_gpio_parse(struct uvc_device *dev) + return irq; + } + ++ unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1); ++ if (!unit) ++ return -ENOMEM; ++ + unit->gpio.gpio_privacy = gpio_privacy; + unit->gpio.irq = irq; + unit->gpio.bControlSize = 1; +diff --git a/drivers/memory/of_memory.c b/drivers/memory/of_memory.c +index dbdf87bc0b78e..fcd20d85d3857 100644 +--- a/drivers/memory/of_memory.c ++++ b/drivers/memory/of_memory.c +@@ -134,6 +134,7 @@ const struct lpddr2_timings *of_get_ddr_timings(struct device_node *np_ddr, + for_each_child_of_node(np_ddr, np_tim) { + if (of_device_is_compatible(np_tim, tim_compat)) { + if (of_do_get_timings(np_tim, &timings[i])) { ++ of_node_put(np_tim); + devm_kfree(dev, timings); + goto default_timings; + } +@@ -284,6 +285,7 @@ const struct lpddr3_timings + if (of_device_is_compatible(np_tim, tim_compat)) { + if (of_lpddr3_do_get_timings(np_tim, &timings[i])) { + devm_kfree(dev, timings); ++ of_node_put(np_tim); + goto default_timings; + } + i++; +diff --git a/drivers/memory/pl353-smc.c b/drivers/memory/pl353-smc.c +index f84b98278745c..d39ee7d06665b 100644 +--- a/drivers/memory/pl353-smc.c ++++ b/drivers/memory/pl353-smc.c +@@ -122,6 +122,7 @@ static int pl353_smc_probe(struct amba_device *adev, const struct amba_id *id) + } + + of_platform_device_create(child, NULL, &adev->dev); ++ of_node_put(child); + + return 0; + +diff --git a/drivers/mfd/da9062-core.c b/drivers/mfd/da9062-core.c +index 2774b2cbaea6d..c2acdbcd5d6b6 100644 +--- a/drivers/mfd/da9062-core.c ++++ b/drivers/mfd/da9062-core.c +@@ -453,6 +453,7 @@ static const struct regmap_range da9061_aa_writeable_ranges[] = { + regmap_reg_range(DA9062AA_VBUCK1_B, DA9062AA_VBUCK4_B), + regmap_reg_range(DA9062AA_VBUCK3_B, DA9062AA_VBUCK3_B), + regmap_reg_range(DA9062AA_VLDO1_B, DA9062AA_VLDO4_B), ++ regmap_reg_range(DA9062AA_CONFIG_J, DA9062AA_CONFIG_J), + regmap_reg_range(DA9062AA_GP_ID_0, DA9062AA_GP_ID_19), + }; + +diff --git a/drivers/mfd/fsl-imx25-tsadc.c b/drivers/mfd/fsl-imx25-tsadc.c +index 37e5e02a1d059..823595bcc9b7c 100644 +--- a/drivers/mfd/fsl-imx25-tsadc.c ++++ b/drivers/mfd/fsl-imx25-tsadc.c +@@ -69,7 +69,7 @@ static int mx25_tsadc_setup_irq(struct platform_device *pdev, + int irq; + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) ++ if (irq < 0) + return irq; + + tsadc->domain = irq_domain_add_simple(np, 2, 0, &mx25_tsadc_domain_ops, +@@ -84,6 +84,19 @@ static int mx25_tsadc_setup_irq(struct platform_device *pdev, + return 0; + } + ++static int mx25_tsadc_unset_irq(struct platform_device *pdev) ++{ ++ struct mx25_tsadc *tsadc = platform_get_drvdata(pdev); ++ int irq = platform_get_irq(pdev, 0); ++ ++ if (irq >= 0) { ++ irq_set_chained_handler_and_data(irq, NULL, NULL); ++ irq_domain_remove(tsadc->domain); ++ } ++ ++ return 0; ++} ++ + static void mx25_tsadc_setup_clk(struct platform_device *pdev, + struct mx25_tsadc *tsadc) + { +@@ -171,18 +184,21 @@ static int mx25_tsadc_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, tsadc); + +- return devm_of_platform_populate(dev); ++ ret = devm_of_platform_populate(dev); ++ if (ret) ++ goto err_irq; ++ ++ return 0; ++ ++err_irq: ++ mx25_tsadc_unset_irq(pdev); ++ ++ return ret; + } + + static int mx25_tsadc_remove(struct platform_device *pdev) + { +- struct mx25_tsadc *tsadc = platform_get_drvdata(pdev); +- int irq = platform_get_irq(pdev, 0); +- +- if (irq) { +- irq_set_chained_handler_and_data(irq, NULL, NULL); +- irq_domain_remove(tsadc->domain); +- } ++ mx25_tsadc_unset_irq(pdev); + + return 0; + } +diff --git a/drivers/mfd/intel_soc_pmic_core.c b/drivers/mfd/intel_soc_pmic_core.c +index 5e8c94e008ed1..85d070bce0e2b 100644 +--- a/drivers/mfd/intel_soc_pmic_core.c ++++ b/drivers/mfd/intel_soc_pmic_core.c +@@ -77,6 +77,7 @@ static int intel_soc_pmic_i2c_probe(struct i2c_client *i2c, + return 0; + + err_del_irq_chip: ++ pwm_remove_table(crc_pwm_lookup, ARRAY_SIZE(crc_pwm_lookup)); + regmap_del_irq_chip(pmic->irq, pmic->irq_chip_data); + return ret; + } +diff --git a/drivers/mfd/lp8788-irq.c b/drivers/mfd/lp8788-irq.c +index 348439a3fbbd4..39006297f3d27 100644 +--- a/drivers/mfd/lp8788-irq.c ++++ b/drivers/mfd/lp8788-irq.c +@@ -175,6 +175,7 @@ int lp8788_irq_init(struct lp8788 *lp, int irq) + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "lp8788-irq", irqd); + if (ret) { ++ irq_domain_remove(lp->irqdm); + dev_err(lp->dev, "failed to create a thread for IRQ_N\n"); + return ret; + } +@@ -188,4 +189,6 @@ void lp8788_irq_exit(struct lp8788 *lp) + { + if (lp->irq) + free_irq(lp->irq, lp->irqdm); ++ if (lp->irqdm) ++ irq_domain_remove(lp->irqdm); + } +diff --git a/drivers/mfd/lp8788.c b/drivers/mfd/lp8788.c +index c223d2c6a3635..998e8cc408a0e 100644 +--- a/drivers/mfd/lp8788.c ++++ b/drivers/mfd/lp8788.c +@@ -195,8 +195,16 @@ static int lp8788_probe(struct i2c_client *cl, const struct i2c_device_id *id) + if (ret) + return ret; + +- return mfd_add_devices(lp->dev, -1, lp8788_devs, +- ARRAY_SIZE(lp8788_devs), NULL, 0, NULL); ++ ret = mfd_add_devices(lp->dev, -1, lp8788_devs, ++ ARRAY_SIZE(lp8788_devs), NULL, 0, NULL); ++ if (ret) ++ goto err_exit_irq; ++ ++ return 0; ++ ++err_exit_irq: ++ lp8788_irq_exit(lp); ++ return ret; + } + + static int lp8788_remove(struct i2c_client *cl) +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c +index bc0a2c38653e5..3ac4508a6742a 100644 +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -1720,7 +1720,12 @@ static struct platform_driver sm501_plat_driver = { + + static int __init sm501_base_init(void) + { +- platform_driver_register(&sm501_plat_driver); ++ int ret; ++ ++ ret = platform_driver_register(&sm501_plat_driver); ++ if (ret < 0) ++ return ret; ++ + return pci_register_driver(&sm501_pci_driver); + } + +diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c +index 6777c419a8da2..d46dba2df5a10 100644 +--- a/drivers/misc/ocxl/file.c ++++ b/drivers/misc/ocxl/file.c +@@ -257,6 +257,8 @@ static long afu_ioctl(struct file *file, unsigned int cmd, + if (IS_ERR(ev_ctx)) + return PTR_ERR(ev_ctx); + rc = ocxl_irq_set_handler(ctx, irq_id, irq_handler, irq_free, ev_ctx); ++ if (rc) ++ eventfd_ctx_put(ev_ctx); + break; + + case OCXL_IOCTL_GET_METADATA: +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 2f89ae55c1773..b2875bee8effb 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1140,8 +1140,12 @@ static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) + { + struct mmc_blk_data *md = mq->blkdata; + struct mmc_card *card = md->queue.card; ++ unsigned int arg = card->erase_arg; + +- mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, card->erase_arg); ++ if (mmc_card_broken_sd_discard(card)) ++ arg = SD_ERASE_ARG; ++ ++ mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, arg); + } + + static void mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq, +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index 99045e138ba48..cfdd1ff40b865 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -73,6 +73,7 @@ struct mmc_fixup { + #define EXT_CSD_REV_ANY (-1u) + + #define CID_MANFID_SANDISK 0x2 ++#define CID_MANFID_SANDISK_SD 0x3 + #define CID_MANFID_ATP 0x9 + #define CID_MANFID_TOSHIBA 0x11 + #define CID_MANFID_MICRON 0x13 +@@ -258,4 +259,9 @@ static inline int mmc_card_broken_hpi(const struct mmc_card *c) + return c->quirks & MMC_QUIRK_BROKEN_HPI; + } + ++static inline int mmc_card_broken_sd_discard(const struct mmc_card *c) ++{ ++ return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD; ++} ++ + #endif +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index be43939880868..29b9497936df9 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -100,6 +100,12 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { + MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_TRIM_BROKEN), + ++ /* ++ * Some SD cards reports discard support while they don't ++ */ ++ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd, ++ MMC_QUIRK_BROKEN_SD_DISCARD), ++ + END_FIXUP + }; + +diff --git a/drivers/mmc/host/au1xmmc.c b/drivers/mmc/host/au1xmmc.c +index a9a0837153d87..c88b039dc9fbd 100644 +--- a/drivers/mmc/host/au1xmmc.c ++++ b/drivers/mmc/host/au1xmmc.c +@@ -1097,8 +1097,9 @@ out5: + if (host->platdata && host->platdata->cd_setup && + !(mmc->caps & MMC_CAP_NEEDS_POLL)) + host->platdata->cd_setup(mmc, 0); +-out_clk: ++ + clk_disable_unprepare(host->clk); ++out_clk: + clk_put(host->clk); + out_irq: + free_irq(host->irq, host); +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 6edbf5c161ab9..b970699743e0a 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -128,6 +128,7 @@ static unsigned int renesas_sdhi_clk_update(struct tmio_mmc_host *host, + struct clk *ref_clk = priv->clk; + unsigned int freq, diff, best_freq = 0, diff_min = ~0; + unsigned int new_clock, clkh_shift = 0; ++ unsigned int new_upper_limit; + int i; + + /* +@@ -153,13 +154,20 @@ static unsigned int renesas_sdhi_clk_update(struct tmio_mmc_host *host, + * greater than, new_clock. As we can divide by 1 << i for + * any i in [0, 9] we want the input clock to be as close as + * possible, but no greater than, new_clock << i. ++ * ++ * Add an upper limit of 1/1024 rate higher to the clock rate to fix ++ * clk rate jumping to lower rate due to rounding error (eg: RZ/G2L has ++ * 3 clk sources 533.333333 MHz, 400 MHz and 266.666666 MHz. The request ++ * for 533.333333 MHz will selects a slower 400 MHz due to rounding ++ * error (533333333 Hz / 4 * 4 = 533333332 Hz < 533333333 Hz)). + */ + for (i = min(9, ilog2(UINT_MAX / new_clock)); i >= 0; i--) { + freq = clk_round_rate(ref_clk, new_clock << i); +- if (freq > (new_clock << i)) { ++ new_upper_limit = (new_clock << i) + ((new_clock << i) >> 10); ++ if (freq > new_upper_limit) { + /* Too fast; look for a slightly slower option */ + freq = clk_round_rate(ref_clk, (new_clock << i) / 4 * 3); +- if (freq > (new_clock << i)) ++ if (freq > new_upper_limit) + continue; + } + +@@ -181,6 +189,7 @@ static unsigned int renesas_sdhi_clk_update(struct tmio_mmc_host *host, + static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, + unsigned int new_clock) + { ++ unsigned int clk_margin; + u32 clk = 0, clock; + + sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN & +@@ -194,7 +203,13 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, + host->mmc->actual_clock = renesas_sdhi_clk_update(host, new_clock); + clock = host->mmc->actual_clock / 512; + +- for (clk = 0x80000080; new_clock >= (clock << 1); clk >>= 1) ++ /* ++ * Add a margin of 1/1024 rate higher to the clock rate in order ++ * to avoid clk variable setting a value of 0 due to the margin ++ * provided for actual_clock in renesas_sdhi_clk_update(). ++ */ ++ clk_margin = new_clock >> 10; ++ for (clk = 0x80000080; new_clock + clk_margin >= (clock << 1); clk >>= 1) + clock <<= 1; + + /* 1/1 clock is option */ +diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c +index f33e9349e4e62..3b88c9d3ddf90 100644 +--- a/drivers/mmc/host/sdhci-sprd.c ++++ b/drivers/mmc/host/sdhci-sprd.c +@@ -309,7 +309,7 @@ static unsigned int sdhci_sprd_get_max_clock(struct sdhci_host *host) + + static unsigned int sdhci_sprd_get_min_clock(struct sdhci_host *host) + { +- return 400000; ++ return 100000; + } + + static void sdhci_sprd_set_uhs_signaling(struct sdhci_host *host, +diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c +index 2d2d8260c6814..413925bce0ca8 100644 +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -773,7 +773,7 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock) + dev_err(dev, "failed to set clk rate to %luHz: %d\n", + host_clk, err); + +- tegra_host->curr_clk_rate = host_clk; ++ tegra_host->curr_clk_rate = clk_get_rate(pltfm_host->clk); + if (tegra_host->ddr_signaling) + host->max_clk = host_clk; + else +diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c +index 163ac9df8cca0..9b5c503e3a3fc 100644 +--- a/drivers/mmc/host/wmt-sdmmc.c ++++ b/drivers/mmc/host/wmt-sdmmc.c +@@ -846,7 +846,7 @@ static int wmt_mci_probe(struct platform_device *pdev) + if (IS_ERR(priv->clk_sdmmc)) { + dev_err(&pdev->dev, "Error getting clock\n"); + ret = PTR_ERR(priv->clk_sdmmc); +- goto fail5; ++ goto fail5_and_a_half; + } + + ret = clk_prepare_enable(priv->clk_sdmmc); +@@ -863,6 +863,9 @@ static int wmt_mci_probe(struct platform_device *pdev) + return 0; + fail6: + clk_put(priv->clk_sdmmc); ++fail5_and_a_half: ++ dma_free_coherent(&pdev->dev, mmc->max_blk_count * 16, ++ priv->dma_desc_buffer, priv->dma_desc_device_addr); + fail5: + free_irq(dma_irq, priv); + fail4: +diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c +index 5b0ae5ddad745..27c08f22dec8c 100644 +--- a/drivers/mtd/devices/docg3.c ++++ b/drivers/mtd/devices/docg3.c +@@ -1974,9 +1974,14 @@ static int __init docg3_probe(struct platform_device *pdev) + dev_err(dev, "No I/O memory resource defined\n"); + return ret; + } +- base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE); + + ret = -ENOMEM; ++ base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE); ++ if (!base) { ++ dev_err(dev, "devm_ioremap dev failed\n"); ++ return ret; ++ } ++ + cascade = devm_kcalloc(dev, DOC_MAX_NBFLOORS, sizeof(*cascade), + GFP_KERNEL); + if (!cascade) +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 6ef14442c71a0..330d2dafdd2d0 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -405,6 +405,7 @@ static int atmel_nand_dma_transfer(struct atmel_nand_controller *nc, + + dma_async_issue_pending(nc->dmac); + wait_for_completion(&finished); ++ dma_unmap_single(nc->dev, buf_dma, len, dir); + + return 0; + +diff --git a/drivers/mtd/nand/raw/fsl_elbc_nand.c b/drivers/mtd/nand/raw/fsl_elbc_nand.c +index aab93b9e6052d..a18d121396aa5 100644 +--- a/drivers/mtd/nand/raw/fsl_elbc_nand.c ++++ b/drivers/mtd/nand/raw/fsl_elbc_nand.c +@@ -726,36 +726,40 @@ static int fsl_elbc_attach_chip(struct nand_chip *chip) + struct fsl_lbc_regs __iomem *lbc = ctrl->regs; + unsigned int al; + +- switch (chip->ecc.engine_type) { + /* + * if ECC was not chosen in DT, decide whether to use HW or SW ECC from + * CS Base Register + */ +- case NAND_ECC_ENGINE_TYPE_NONE: ++ if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_INVALID) { + /* If CS Base Register selects full hardware ECC then use it */ + if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) == + BR_DECC_CHK_GEN) { +- chip->ecc.read_page = fsl_elbc_read_page; +- chip->ecc.write_page = fsl_elbc_write_page; +- chip->ecc.write_subpage = fsl_elbc_write_subpage; +- + chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_ON_HOST; +- mtd_set_ooblayout(mtd, &fsl_elbc_ooblayout_ops); +- chip->ecc.size = 512; +- chip->ecc.bytes = 3; +- chip->ecc.strength = 1; + } else { + /* otherwise fall back to default software ECC */ + chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT; + chip->ecc.algo = NAND_ECC_ALGO_HAMMING; + } ++ } ++ ++ switch (chip->ecc.engine_type) { ++ /* if HW ECC was chosen, setup ecc and oob layout */ ++ case NAND_ECC_ENGINE_TYPE_ON_HOST: ++ chip->ecc.read_page = fsl_elbc_read_page; ++ chip->ecc.write_page = fsl_elbc_write_page; ++ chip->ecc.write_subpage = fsl_elbc_write_subpage; ++ mtd_set_ooblayout(mtd, &fsl_elbc_ooblayout_ops); ++ chip->ecc.size = 512; ++ chip->ecc.bytes = 3; ++ chip->ecc.strength = 1; + break; + +- /* if SW ECC was chosen in DT, we do not need to set anything here */ ++ /* if none or SW ECC was chosen, we do not need to set anything here */ ++ case NAND_ECC_ENGINE_TYPE_NONE: + case NAND_ECC_ENGINE_TYPE_SOFT: ++ case NAND_ECC_ENGINE_TYPE_ON_DIE: + break; + +- /* should we also implement *_ECC_ENGINE_CONTROLLER to do as above? */ + default: + return -EINVAL; + } +diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c +index e91b879b32bdb..056835fd45622 100644 +--- a/drivers/mtd/nand/raw/intel-nand-controller.c ++++ b/drivers/mtd/nand/raw/intel-nand-controller.c +@@ -16,6 +16,7 @@ + #include <linux/mtd/rawnand.h> + #include <linux/mtd/nand.h> + ++#include <linux/of.h> + #include <linux/platform_device.h> + #include <linux/sched.h> + #include <linux/slab.h> +@@ -580,6 +581,7 @@ static int ebu_nand_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct ebu_nand_controller *ebu_host; ++ struct device_node *chip_np; + struct nand_chip *nand; + struct mtd_info *mtd; + struct resource *res; +@@ -604,7 +606,12 @@ static int ebu_nand_probe(struct platform_device *pdev) + if (IS_ERR(ebu_host->hsnand)) + return PTR_ERR(ebu_host->hsnand); + +- ret = device_property_read_u32(dev, "reg", &cs); ++ chip_np = of_get_next_child(dev->of_node, NULL); ++ if (!chip_np) ++ return dev_err_probe(dev, -EINVAL, ++ "Could not find child node for the NAND chip\n"); ++ ++ ret = of_property_read_u32(chip_np, "reg", &cs); + if (ret) { + dev_err(dev, "failed to get chip select: %d\n", ret); + return ret; +@@ -660,7 +667,7 @@ static int ebu_nand_probe(struct platform_device *pdev) + writel(ebu_host->cs[cs].addr_sel | EBU_ADDR_MASK(5) | EBU_ADDR_SEL_REGEN, + ebu_host->ebu + EBU_ADDR_SEL(cs)); + +- nand_set_flash_node(&ebu_host->chip, dev->of_node); ++ nand_set_flash_node(&ebu_host->chip, chip_np); + + mtd = nand_to_mtd(&ebu_host->chip); + if (!mtd->name) { +@@ -716,7 +723,6 @@ static int ebu_nand_remove(struct platform_device *pdev) + } + + static const struct of_device_id ebu_nand_match[] = { +- { .compatible = "intel,nand-controller" }, + { .compatible = "intel,lgm-ebunand" }, + {} + }; +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 0321801833393..b97adeee4cc14 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -454,7 +454,7 @@ static int meson_nfc_ecc_correct(struct nand_chip *nand, u32 *bitflips, + if (ECC_ERR_CNT(*info) != ECC_UNCORRECTABLE) { + mtd->ecc_stats.corrected += ECC_ERR_CNT(*info); + *bitflips = max_t(u32, *bitflips, ECC_ERR_CNT(*info)); +- *correct_bitmap |= 1 >> i; ++ *correct_bitmap |= BIT_ULL(i); + continue; + } + if ((nand->options & NAND_NEED_SCRAMBLING) && +@@ -800,7 +800,7 @@ static int meson_nfc_read_page_hwecc(struct nand_chip *nand, u8 *buf, + u8 *data = buf + i * ecc->size; + u8 *oob = nand->oob_poi + i * (ecc->bytes + 2); + +- if (correct_bitmap & (1 << i)) ++ if (correct_bitmap & BIT_ULL(i)) + continue; + ret = nand_check_erased_ecc_chunk(data, ecc->size, + oob, ecc->bytes + 2, +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +index eefcbe3aadce7..d018cb5adf838 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +@@ -177,6 +177,8 @@ struct kvaser_usb_dev_cfg { + extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops; + extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops; + ++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv); ++ + int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len, + int *actual_len); + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index f211bfcb1d97e..bd4f7be49f39c 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -476,7 +476,7 @@ static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv) + /* This method might sleep. Do not call it in the atomic context + * of URB completions. + */ +-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv) ++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv) + { + usb_kill_anchored_urbs(&priv->tx_submitted); + kvaser_usb_reset_tx_urb_contexts(priv); +@@ -712,6 +712,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) + init_usb_anchor(&priv->tx_submitted); + init_completion(&priv->start_comp); + init_completion(&priv->stop_comp); ++ init_completion(&priv->flush_comp); + priv->can.ctrlmode_supported = 0; + + priv->dev = dev; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 404093468b2f1..5939234ce2564 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1914,7 +1914,7 @@ static int kvaser_usb_hydra_flush_queue(struct kvaser_usb_net_priv *priv) + { + int err; + +- init_completion(&priv->flush_comp); ++ reinit_completion(&priv->flush_comp); + + err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_FLUSH_QUEUE, + priv->channel); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index f551fde16a709..7dad7f2efcc9a 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -310,6 +310,38 @@ struct kvaser_cmd { + } u; + } __packed; + ++#define CMD_SIZE_ANY 0xff ++#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field) ++ ++static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { ++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo), ++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header), ++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo), ++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can), ++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can), ++ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), ++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ /* ignored events: */ ++ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, ++}; ++ ++static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { ++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo), ++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header), ++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo), ++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), ++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), ++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), ++ /* ignored events: */ ++ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, ++}; ++ + /* Summary of a kvaser error event, for a unified Leaf/Usbcan error + * handling. Some discrepancies between the two families exist: + * +@@ -397,6 +429,43 @@ static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_imx_dev_cfg_32mhz = { + .bittiming_const = &kvaser_usb_flexc_bittiming_const, + }; + ++static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ /* buffer size >= cmd->len ensured by caller */ ++ u8 min_size = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf)) ++ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id]; ++ break; ++ case KVASER_USBCAN: ++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan)) ++ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id]; ++ break; ++ } ++ ++ if (min_size == CMD_SIZE_ANY) ++ return 0; ++ ++ if (min_size) { ++ min_size += CMD_HEADER_LEN; ++ if (cmd->len >= min_size) ++ return 0; ++ ++ dev_err_ratelimited(&dev->intf->dev, ++ "Received command %u too short (size %u, needed %u)", ++ cmd->id, cmd->len, min_size); ++ return -EIO; ++ } ++ ++ dev_warn_ratelimited(&dev->intf->dev, ++ "Unhandled command (%d, size %d)\n", ++ cmd->id, cmd->len); ++ return -EINVAL; ++} ++ + static void * + kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv, + const struct sk_buff *skb, int *cmd_len, +@@ -502,6 +571,9 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id, + end: + kfree(buf); + ++ if (err == 0) ++ err = kvaser_usb_leaf_verify_size(dev, cmd); ++ + return err; + } + +@@ -1132,6 +1204,9 @@ static void kvaser_usb_leaf_stop_chip_reply(const struct kvaser_usb *dev, + static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { ++ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0) ++ return; ++ + switch (cmd->id) { + case CMD_START_CHIP_REPLY: + kvaser_usb_leaf_start_chip_reply(dev, cmd); +@@ -1350,9 +1425,13 @@ static int kvaser_usb_leaf_set_mode(struct net_device *netdev, + + switch (mode) { + case CAN_MODE_START: ++ kvaser_usb_unlink_tx_urbs(priv); ++ + err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP); + if (err) + return err; ++ ++ priv->can.state = CAN_STATE_ERROR_ACTIVE; + break; + default: + return -EOPNOTSUPP; +diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c +index a89b93cb4e26d..d5939586c82ee 100644 +--- a/drivers/net/ethernet/atheros/alx/main.c ++++ b/drivers/net/ethernet/atheros/alx/main.c +@@ -1912,11 +1912,14 @@ static int alx_suspend(struct device *dev) + + if (!netif_running(alx->dev)) + return 0; ++ ++ rtnl_lock(); + netif_device_detach(alx->dev); + + mutex_lock(&alx->mtx); + __alx_stop(alx); + mutex_unlock(&alx->mtx); ++ rtnl_unlock(); + + return 0; + } +@@ -1927,6 +1930,7 @@ static int alx_resume(struct device *dev) + struct alx_hw *hw = &alx->hw; + int err; + ++ rtnl_lock(); + mutex_lock(&alx->mtx); + alx_reset_phy(hw); + +@@ -1943,6 +1947,7 @@ static int alx_resume(struct device *dev) + + unlock: + mutex_unlock(&alx->mtx); ++ rtnl_unlock(); + return err; + } + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 5729a5ab059d7..4cbd3ba5acb97 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -789,6 +789,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, + BNX2X_ERR("skb_put is about to fail... pad %d len %d rx_buf_size %d\n", + pad, len, fp->rx_buf_size); + bnx2x_panic(); ++ bnx2x_frag_free(fp, new_data); + return; + } + #endif +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +index 8e316367f6ced..2132ce63193ce 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +@@ -505,9 +505,13 @@ static int bnxt_hwrm_ptp_cfg(struct bnxt *bp) + ptp->tstamp_filters = flags; + + if (netif_running(bp->dev)) { +- rc = bnxt_close_nic(bp, false, false); +- if (!rc) +- rc = bnxt_open_nic(bp, false, false); ++ if (ptp->rx_filter == HWTSTAMP_FILTER_ALL) { ++ rc = bnxt_close_nic(bp, false, false); ++ if (!rc) ++ rc = bnxt_open_nic(bp, false, false); ++ } else { ++ bnxt_ptp_cfg_tstamp_filters(bp); ++ } + if (!rc && !ptp->tstamp_filters) + rc = -EIO; + } +diff --git a/drivers/net/ethernet/engleder/tsnep_hw.h b/drivers/net/ethernet/engleder/tsnep_hw.h +index 916ceac3ada23..e03aaafab559f 100644 +--- a/drivers/net/ethernet/engleder/tsnep_hw.h ++++ b/drivers/net/ethernet/engleder/tsnep_hw.h +@@ -92,8 +92,7 @@ + + /* tsnep register */ + #define TSNEP_INFO 0x0100 +-#define TSNEP_INFO_RX_ASSIGN 0x00010000 +-#define TSNEP_INFO_TX_TIME 0x00020000 ++#define TSNEP_INFO_TX_TIME 0x00010000 + #define TSNEP_CONTROL 0x0108 + #define TSNEP_CONTROL_TX_RESET 0x00000001 + #define TSNEP_CONTROL_TX_ENABLE 0x00000002 +diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c +index 99fe2c210d0f6..61f4b6e50d29b 100644 +--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c ++++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c +@@ -98,7 +98,7 @@ static int do_pd_setup(struct fs_enet_private *fep) + return -EINVAL; + + fep->fec.fecp = of_iomap(ofdev->dev.of_node, 0); +- if (!fep->fcc.fccp) ++ if (!fep->fec.fecp) + return -EINVAL; + + return 0; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 981c43b204ff4..d3822c2646425 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1184,66 +1184,138 @@ static void iavf_up_complete(struct iavf_adapter *adapter) + } + + /** +- * iavf_down - Shutdown the connection processing ++ * iavf_clear_mac_vlan_filters - Remove mac and vlan filters not sent to PF ++ * yet and mark other to be removed. + * @adapter: board private structure +- * +- * Expects to be called while holding the __IAVF_IN_CRITICAL_TASK bit lock. + **/ +-void iavf_down(struct iavf_adapter *adapter) ++static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter) + { +- struct net_device *netdev = adapter->netdev; +- struct iavf_vlan_filter *vlf; +- struct iavf_cloud_filter *cf; +- struct iavf_fdir_fltr *fdir; +- struct iavf_mac_filter *f; +- struct iavf_adv_rss *rss; +- +- if (adapter->state <= __IAVF_DOWN_PENDING) +- return; +- +- netif_carrier_off(netdev); +- netif_tx_disable(netdev); +- adapter->link_up = false; +- iavf_napi_disable_all(adapter); +- iavf_irq_disable(adapter); ++ struct iavf_vlan_filter *vlf, *vlftmp; ++ struct iavf_mac_filter *f, *ftmp; + + spin_lock_bh(&adapter->mac_vlan_list_lock); +- + /* clear the sync flag on all filters */ + __dev_uc_unsync(adapter->netdev, NULL); + __dev_mc_unsync(adapter->netdev, NULL); + + /* remove all MAC filters */ +- list_for_each_entry(f, &adapter->mac_filter_list, list) { +- f->remove = true; ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, ++ list) { ++ if (f->add) { ++ list_del(&f->list); ++ kfree(f); ++ } else { ++ f->remove = true; ++ } + } + + /* remove all VLAN filters */ +- list_for_each_entry(vlf, &adapter->vlan_filter_list, list) { +- vlf->remove = true; ++ list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list, ++ list) { ++ if (vlf->add) { ++ list_del(&vlf->list); ++ kfree(vlf); ++ } else { ++ vlf->remove = true; ++ } + } +- + spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ ++/** ++ * iavf_clear_cloud_filters - Remove cloud filters not sent to PF yet and ++ * mark other to be removed. ++ * @adapter: board private structure ++ **/ ++static void iavf_clear_cloud_filters(struct iavf_adapter *adapter) ++{ ++ struct iavf_cloud_filter *cf, *cftmp; + + /* remove all cloud filters */ + spin_lock_bh(&adapter->cloud_filter_list_lock); +- list_for_each_entry(cf, &adapter->cloud_filter_list, list) { +- cf->del = true; ++ list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, ++ list) { ++ if (cf->add) { ++ list_del(&cf->list); ++ kfree(cf); ++ adapter->num_cloud_filters--; ++ } else { ++ cf->del = true; ++ } + } + spin_unlock_bh(&adapter->cloud_filter_list_lock); ++} ++ ++/** ++ * iavf_clear_fdir_filters - Remove fdir filters not sent to PF yet and mark ++ * other to be removed. ++ * @adapter: board private structure ++ **/ ++static void iavf_clear_fdir_filters(struct iavf_adapter *adapter) ++{ ++ struct iavf_fdir_fltr *fdir, *fdirtmp; + + /* remove all Flow Director filters */ + spin_lock_bh(&adapter->fdir_fltr_lock); +- list_for_each_entry(fdir, &adapter->fdir_list_head, list) { +- fdir->state = IAVF_FDIR_FLTR_DEL_REQUEST; ++ list_for_each_entry_safe(fdir, fdirtmp, &adapter->fdir_list_head, ++ list) { ++ if (fdir->state == IAVF_FDIR_FLTR_ADD_REQUEST) { ++ list_del(&fdir->list); ++ kfree(fdir); ++ adapter->fdir_active_fltr--; ++ } else { ++ fdir->state = IAVF_FDIR_FLTR_DEL_REQUEST; ++ } + } + spin_unlock_bh(&adapter->fdir_fltr_lock); ++} ++ ++/** ++ * iavf_clear_adv_rss_conf - Remove adv rss conf not sent to PF yet and mark ++ * other to be removed. ++ * @adapter: board private structure ++ **/ ++static void iavf_clear_adv_rss_conf(struct iavf_adapter *adapter) ++{ ++ struct iavf_adv_rss *rss, *rsstmp; + + /* remove all advance RSS configuration */ + spin_lock_bh(&adapter->adv_rss_lock); +- list_for_each_entry(rss, &adapter->adv_rss_list_head, list) +- rss->state = IAVF_ADV_RSS_DEL_REQUEST; ++ list_for_each_entry_safe(rss, rsstmp, &adapter->adv_rss_list_head, ++ list) { ++ if (rss->state == IAVF_ADV_RSS_ADD_REQUEST) { ++ list_del(&rss->list); ++ kfree(rss); ++ } else { ++ rss->state = IAVF_ADV_RSS_DEL_REQUEST; ++ } ++ } + spin_unlock_bh(&adapter->adv_rss_lock); ++} ++ ++/** ++ * iavf_down - Shutdown the connection processing ++ * @adapter: board private structure ++ * ++ * Expects to be called while holding the __IAVF_IN_CRITICAL_TASK bit lock. ++ **/ ++void iavf_down(struct iavf_adapter *adapter) ++{ ++ struct net_device *netdev = adapter->netdev; ++ ++ if (adapter->state <= __IAVF_DOWN_PENDING) ++ return; ++ ++ netif_carrier_off(netdev); ++ netif_tx_disable(netdev); ++ adapter->link_up = false; ++ iavf_napi_disable_all(adapter); ++ iavf_irq_disable(adapter); ++ ++ iavf_clear_mac_vlan_filters(adapter); ++ iavf_clear_cloud_filters(adapter); ++ iavf_clear_fdir_filters(adapter); ++ iavf_clear_adv_rss_conf(adapter); + + if (!(adapter->flags & IAVF_FLAG_PF_COMMS_FAILED)) { + /* cancel any current operation */ +@@ -1252,11 +1324,16 @@ void iavf_down(struct iavf_adapter *adapter) + * here for this to complete. The watchdog is still running + * and it will take care of this. + */ +- adapter->aq_required = IAVF_FLAG_AQ_DEL_MAC_FILTER; +- adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER; +- adapter->aq_required |= IAVF_FLAG_AQ_DEL_CLOUD_FILTER; +- adapter->aq_required |= IAVF_FLAG_AQ_DEL_FDIR_FILTER; +- adapter->aq_required |= IAVF_FLAG_AQ_DEL_ADV_RSS_CFG; ++ if (!list_empty(&adapter->mac_filter_list)) ++ adapter->aq_required |= IAVF_FLAG_AQ_DEL_MAC_FILTER; ++ if (!list_empty(&adapter->vlan_filter_list)) ++ adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER; ++ if (!list_empty(&adapter->cloud_filter_list)) ++ adapter->aq_required |= IAVF_FLAG_AQ_DEL_CLOUD_FILTER; ++ if (!list_empty(&adapter->fdir_list_head)) ++ adapter->aq_required |= IAVF_FLAG_AQ_DEL_FDIR_FILTER; ++ if (!list_empty(&adapter->adv_rss_list_head)) ++ adapter->aq_required |= IAVF_FLAG_AQ_DEL_ADV_RSS_CFG; + adapter->aq_required |= IAVF_FLAG_AQ_DISABLE_QUEUES; + } + +@@ -4082,6 +4159,7 @@ err_unlock: + static int iavf_close(struct net_device *netdev) + { + struct iavf_adapter *adapter = netdev_priv(netdev); ++ u64 aq_to_restore; + int status; + + mutex_lock(&adapter->crit_lock); +@@ -4094,6 +4172,29 @@ static int iavf_close(struct net_device *netdev) + set_bit(__IAVF_VSI_DOWN, adapter->vsi.state); + if (CLIENT_ENABLED(adapter)) + adapter->flags |= IAVF_FLAG_CLIENT_NEEDS_CLOSE; ++ /* We cannot send IAVF_FLAG_AQ_GET_OFFLOAD_VLAN_V2_CAPS before ++ * IAVF_FLAG_AQ_DISABLE_QUEUES because in such case there is rtnl ++ * deadlock with adminq_task() until iavf_close timeouts. We must send ++ * IAVF_FLAG_AQ_GET_CONFIG before IAVF_FLAG_AQ_DISABLE_QUEUES to make ++ * disable queues possible for vf. Give only necessary flags to ++ * iavf_down and save other to set them right before iavf_close() ++ * returns, when IAVF_FLAG_AQ_DISABLE_QUEUES will be already sent and ++ * iavf will be in DOWN state. ++ */ ++ aq_to_restore = adapter->aq_required; ++ adapter->aq_required &= IAVF_FLAG_AQ_GET_CONFIG; ++ ++ /* Remove flags which we do not want to send after close or we want to ++ * send before disable queues. ++ */ ++ aq_to_restore &= ~(IAVF_FLAG_AQ_GET_CONFIG | ++ IAVF_FLAG_AQ_ENABLE_QUEUES | ++ IAVF_FLAG_AQ_CONFIGURE_QUEUES | ++ IAVF_FLAG_AQ_ADD_VLAN_FILTER | ++ IAVF_FLAG_AQ_ADD_MAC_FILTER | ++ IAVF_FLAG_AQ_ADD_CLOUD_FILTER | ++ IAVF_FLAG_AQ_ADD_FDIR_FILTER | ++ IAVF_FLAG_AQ_ADD_ADV_RSS_CFG); + + iavf_down(adapter); + iavf_change_state(adapter, __IAVF_DOWN_PENDING); +@@ -4117,6 +4218,10 @@ static int iavf_close(struct net_device *netdev) + msecs_to_jiffies(500)); + if (!status) + netdev_warn(netdev, "Device resources not yet released\n"); ++ ++ mutex_lock(&adapter->crit_lock); ++ adapter->aq_required |= aq_to_restore; ++ mutex_unlock(&adapter->crit_lock); + return 0; + } + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 4efa5e5846e01..4dfdec11ddc10 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -2826,6 +2826,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, + tx_rings[i].count = new_tx_cnt; + tx_rings[i].desc = NULL; + tx_rings[i].tx_buf = NULL; ++ tx_rings[i].tx_tstamps = &pf->ptp.port.tx; + err = ice_setup_tx_ring(&tx_rings[i]); + if (err) { + while (i--) +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h +index ad73a488fc5fb..11e603686a276 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h +@@ -1530,6 +1530,7 @@ u32 mvpp2_read(struct mvpp2 *priv, u32 offset); + void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name); + + void mvpp2_dbgfs_cleanup(struct mvpp2 *priv); ++void mvpp2_dbgfs_exit(void); + + void mvpp23_rx_fifo_fc_en(struct mvpp2 *priv, int port, bool en); + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +index 4a3baa7e01424..75e83ea2a926e 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +@@ -691,6 +691,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent, + return 0; + } + ++static struct dentry *mvpp2_root; ++ ++void mvpp2_dbgfs_exit(void) ++{ ++ debugfs_remove(mvpp2_root); ++} ++ + void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) + { + debugfs_remove_recursive(priv->dbgfs_dir); +@@ -700,10 +707,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) + + void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) + { +- struct dentry *mvpp2_dir, *mvpp2_root; ++ struct dentry *mvpp2_dir; + int ret, i; + +- mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); + if (!mvpp2_root) + mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index b84128b549b44..eaa51cd7456b6 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -7706,7 +7706,18 @@ static struct platform_driver mvpp2_driver = { + }, + }; + +-module_platform_driver(mvpp2_driver); ++static int __init mvpp2_driver_init(void) ++{ ++ return platform_driver_register(&mvpp2_driver); ++} ++module_init(mvpp2_driver_init); ++ ++static void __exit mvpp2_driver_exit(void) ++{ ++ platform_driver_unregister(&mvpp2_driver); ++ mvpp2_dbgfs_exit(); ++} ++module_exit(mvpp2_driver_exit); + + MODULE_DESCRIPTION("Marvell PPv2 Ethernet Driver - www.marvell.com"); + MODULE_AUTHOR("Marcin Wojtas <mw@semihalf.com>"); +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_acl.c b/drivers/net/ethernet/marvell/prestera/prestera_acl.c +index 3a141f2db8126..c0d4ddc18f87f 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_acl.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_acl.c +@@ -162,10 +162,14 @@ err_rhashtable_init: + return ERR_PTR(err); + } + +-void prestera_acl_ruleset_keymask_set(struct prestera_acl_ruleset *ruleset, +- void *keymask) ++int prestera_acl_ruleset_keymask_set(struct prestera_acl_ruleset *ruleset, ++ void *keymask) + { + ruleset->keymask = kmemdup(keymask, ACL_KEYMASK_SIZE, GFP_KERNEL); ++ if (!ruleset->keymask) ++ return -ENOMEM; ++ ++ return 0; + } + + int prestera_acl_ruleset_offload(struct prestera_acl_ruleset *ruleset) +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_acl.h b/drivers/net/ethernet/marvell/prestera/prestera_acl.h +index f963e1e0c0f0b..21dbfe4fe5b8b 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_acl.h ++++ b/drivers/net/ethernet/marvell/prestera/prestera_acl.h +@@ -185,8 +185,8 @@ struct prestera_acl_ruleset * + prestera_acl_ruleset_lookup(struct prestera_acl *acl, + struct prestera_flow_block *block, + u32 chain_index); +-void prestera_acl_ruleset_keymask_set(struct prestera_acl_ruleset *ruleset, +- void *keymask); ++int prestera_acl_ruleset_keymask_set(struct prestera_acl_ruleset *ruleset, ++ void *keymask); + bool prestera_acl_ruleset_is_offload(struct prestera_acl_ruleset *ruleset); + int prestera_acl_ruleset_offload(struct prestera_acl_ruleset *ruleset); + void prestera_acl_ruleset_put(struct prestera_acl_ruleset *ruleset); +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c b/drivers/net/ethernet/marvell/prestera/prestera_flower.c +index 4d93ad6a284c0..553413248823b 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c +@@ -428,7 +428,9 @@ int prestera_flower_tmplt_create(struct prestera_flow_block *block, + } + + /* preserve keymask/template to this ruleset */ +- prestera_acl_ruleset_keymask_set(ruleset, rule.re_key.match.mask); ++ err = prestera_acl_ruleset_keymask_set(ruleset, rule.re_key.match.mask); ++ if (err) ++ goto err_ruleset_keymask_set; + + /* skip error, as it is not possible to reject template operation, + * so, keep the reference to the ruleset for rules to be added +@@ -444,6 +446,8 @@ int prestera_flower_tmplt_create(struct prestera_flow_block *block, + list_add_rcu(&template->list, &block->template_list); + return 0; + ++err_ruleset_keymask_set: ++ prestera_acl_ruleset_put(ruleset); + err_ruleset_get: + kfree(template); + err_malloc: +diff --git a/drivers/net/ethernet/microchip/lan743x_ptp.c b/drivers/net/ethernet/microchip/lan743x_ptp.c +index 6a11e2ceb013b..da3ea905adbb8 100644 +--- a/drivers/net/ethernet/microchip/lan743x_ptp.c ++++ b/drivers/net/ethernet/microchip/lan743x_ptp.c +@@ -1049,6 +1049,10 @@ static int lan743x_ptpci_verify_pin_config(struct ptp_clock_info *ptp, + enum ptp_pin_function func, + unsigned int chan) + { ++ struct lan743x_ptp *lan_ptp = ++ container_of(ptp, struct lan743x_ptp, ptp_clock_info); ++ struct lan743x_adapter *adapter = ++ container_of(lan_ptp, struct lan743x_adapter, ptp); + int result = 0; + + /* Confirm the requested function is supported. Parameter +@@ -1057,7 +1061,10 @@ static int lan743x_ptpci_verify_pin_config(struct ptp_clock_info *ptp, + switch (func) { + case PTP_PF_NONE: + case PTP_PF_PEROUT: ++ break; + case PTP_PF_EXTTS: ++ if (!adapter->is_pci11x1x) ++ result = -1; + break; + case PTP_PF_PHYSYNC: + default: +diff --git a/drivers/net/ethernet/sunplus/spl2sw_driver.c b/drivers/net/ethernet/sunplus/spl2sw_driver.c +index 3773ce5e12cc0..37711331ba0f4 100644 +--- a/drivers/net/ethernet/sunplus/spl2sw_driver.c ++++ b/drivers/net/ethernet/sunplus/spl2sw_driver.c +@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device *dev, struct device_node * + + /* Check if mac address is valid */ + if (!is_valid_ether_addr(mac)) { +- kfree(mac); + dev_info(dev, "Invalid mac address in nvmem (%pM)!\n", mac); ++ kfree(mac); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig +index fb30bc5d56cb7..fce06663e1e11 100644 +--- a/drivers/net/ethernet/ti/Kconfig ++++ b/drivers/net/ethernet/ti/Kconfig +@@ -33,6 +33,7 @@ config TI_DAVINCI_MDIO + tristate "TI DaVinci MDIO Support" + depends on ARCH_DAVINCI || ARCH_OMAP2PLUS || ARCH_KEYSTONE || ARCH_K3 || COMPILE_TEST + select PHYLIB ++ select MDIO_BITBANG + help + This driver supports TI's DaVinci MDIO module. + +diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c +index ea37726180431..946b9753ccfb3 100644 +--- a/drivers/net/ethernet/ti/davinci_mdio.c ++++ b/drivers/net/ethernet/ti/davinci_mdio.c +@@ -26,6 +26,8 @@ + #include <linux/of_device.h> + #include <linux/of_mdio.h> + #include <linux/pinctrl/consumer.h> ++#include <linux/mdio-bitbang.h> ++#include <linux/sys_soc.h> + + /* + * This timeout definition is a worst-case ultra defensive measure against +@@ -41,6 +43,7 @@ + + struct davinci_mdio_of_param { + int autosuspend_delay_ms; ++ bool manual_mode; + }; + + struct davinci_mdio_regs { +@@ -49,6 +52,15 @@ struct davinci_mdio_regs { + #define CONTROL_IDLE BIT(31) + #define CONTROL_ENABLE BIT(30) + #define CONTROL_MAX_DIV (0xffff) ++#define CONTROL_CLKDIV GENMASK(15, 0) ++ ++#define MDIO_MAN_MDCLK_O BIT(2) ++#define MDIO_MAN_OE BIT(1) ++#define MDIO_MAN_PIN BIT(0) ++#define MDIO_MANUALMODE BIT(31) ++ ++#define MDIO_PIN 0 ++ + + u32 alive; + u32 link; +@@ -59,7 +71,9 @@ struct davinci_mdio_regs { + u32 userintmasked; + u32 userintmaskset; + u32 userintmaskclr; +- u32 __reserved_1[20]; ++ u32 manualif; ++ u32 poll; ++ u32 __reserved_1[18]; + + struct { + u32 access; +@@ -79,6 +93,7 @@ static const struct mdio_platform_data default_pdata = { + + struct davinci_mdio_data { + struct mdio_platform_data pdata; ++ struct mdiobb_ctrl bb_ctrl; + struct davinci_mdio_regs __iomem *regs; + struct clk *clk; + struct device *dev; +@@ -90,6 +105,7 @@ struct davinci_mdio_data { + */ + bool skip_scan; + u32 clk_div; ++ bool manual_mode; + }; + + static void davinci_mdio_init_clk(struct davinci_mdio_data *data) +@@ -128,9 +144,122 @@ static void davinci_mdio_enable(struct davinci_mdio_data *data) + writel(data->clk_div | CONTROL_ENABLE, &data->regs->control); + } + +-static int davinci_mdio_reset(struct mii_bus *bus) ++static void davinci_mdio_disable(struct davinci_mdio_data *data) ++{ ++ u32 reg; ++ ++ /* Disable MDIO state machine */ ++ reg = readl(&data->regs->control); ++ ++ reg &= ~CONTROL_CLKDIV; ++ reg |= data->clk_div; ++ ++ reg &= ~CONTROL_ENABLE; ++ writel(reg, &data->regs->control); ++} ++ ++static void davinci_mdio_enable_manual_mode(struct davinci_mdio_data *data) ++{ ++ u32 reg; ++ /* set manual mode */ ++ reg = readl(&data->regs->poll); ++ reg |= MDIO_MANUALMODE; ++ writel(reg, &data->regs->poll); ++} ++ ++static void davinci_set_mdc(struct mdiobb_ctrl *ctrl, int level) ++{ ++ struct davinci_mdio_data *data; ++ u32 reg; ++ ++ data = container_of(ctrl, struct davinci_mdio_data, bb_ctrl); ++ reg = readl(&data->regs->manualif); ++ ++ if (level) ++ reg |= MDIO_MAN_MDCLK_O; ++ else ++ reg &= ~MDIO_MAN_MDCLK_O; ++ ++ writel(reg, &data->regs->manualif); ++} ++ ++static void davinci_set_mdio_dir(struct mdiobb_ctrl *ctrl, int output) ++{ ++ struct davinci_mdio_data *data; ++ u32 reg; ++ ++ data = container_of(ctrl, struct davinci_mdio_data, bb_ctrl); ++ reg = readl(&data->regs->manualif); ++ ++ if (output) ++ reg |= MDIO_MAN_OE; ++ else ++ reg &= ~MDIO_MAN_OE; ++ ++ writel(reg, &data->regs->manualif); ++} ++ ++static void davinci_set_mdio_data(struct mdiobb_ctrl *ctrl, int value) ++{ ++ struct davinci_mdio_data *data; ++ u32 reg; ++ ++ data = container_of(ctrl, struct davinci_mdio_data, bb_ctrl); ++ reg = readl(&data->regs->manualif); ++ ++ if (value) ++ reg |= MDIO_MAN_PIN; ++ else ++ reg &= ~MDIO_MAN_PIN; ++ ++ writel(reg, &data->regs->manualif); ++} ++ ++static int davinci_get_mdio_data(struct mdiobb_ctrl *ctrl) ++{ ++ struct davinci_mdio_data *data; ++ unsigned long reg; ++ ++ data = container_of(ctrl, struct davinci_mdio_data, bb_ctrl); ++ reg = readl(&data->regs->manualif); ++ return test_bit(MDIO_PIN, ®); ++} ++ ++static int davinci_mdiobb_read(struct mii_bus *bus, int phy, int reg) ++{ ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(bus->parent); ++ if (ret < 0) ++ return ret; ++ ++ ret = mdiobb_read(bus, phy, reg); ++ ++ pm_runtime_mark_last_busy(bus->parent); ++ pm_runtime_put_autosuspend(bus->parent); ++ ++ return ret; ++} ++ ++static int davinci_mdiobb_write(struct mii_bus *bus, int phy, int reg, ++ u16 val) ++{ ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(bus->parent); ++ if (ret < 0) ++ return ret; ++ ++ ret = mdiobb_write(bus, phy, reg, val); ++ ++ pm_runtime_mark_last_busy(bus->parent); ++ pm_runtime_put_autosuspend(bus->parent); ++ ++ return ret; ++} ++ ++static int davinci_mdio_common_reset(struct davinci_mdio_data *data) + { +- struct davinci_mdio_data *data = bus->priv; + u32 phy_mask, ver; + int ret; + +@@ -138,6 +267,11 @@ static int davinci_mdio_reset(struct mii_bus *bus) + if (ret < 0) + return ret; + ++ if (data->manual_mode) { ++ davinci_mdio_disable(data); ++ davinci_mdio_enable_manual_mode(data); ++ } ++ + /* wait for scan logic to settle */ + msleep(PHY_MAX_ADDR * data->access_time); + +@@ -171,6 +305,23 @@ done: + return 0; + } + ++static int davinci_mdio_reset(struct mii_bus *bus) ++{ ++ struct davinci_mdio_data *data = bus->priv; ++ ++ return davinci_mdio_common_reset(data); ++} ++ ++static int davinci_mdiobb_reset(struct mii_bus *bus) ++{ ++ struct mdiobb_ctrl *ctrl = bus->priv; ++ struct davinci_mdio_data *data; ++ ++ data = container_of(ctrl, struct davinci_mdio_data, bb_ctrl); ++ ++ return davinci_mdio_common_reset(data); ++} ++ + /* wait until hardware is ready for another user access */ + static inline int wait_for_user_access(struct davinci_mdio_data *data) + { +@@ -318,6 +469,28 @@ static int davinci_mdio_probe_dt(struct mdio_platform_data *data, + return 0; + } + ++struct k3_mdio_soc_data { ++ bool manual_mode; ++}; ++ ++static const struct k3_mdio_soc_data am65_mdio_soc_data = { ++ .manual_mode = true, ++}; ++ ++static const struct soc_device_attribute k3_mdio_socinfo[] = { ++ { .family = "AM62X", .revision = "SR1.0", .data = &am65_mdio_soc_data }, ++ { .family = "AM64X", .revision = "SR1.0", .data = &am65_mdio_soc_data }, ++ { .family = "AM64X", .revision = "SR2.0", .data = &am65_mdio_soc_data }, ++ { .family = "AM65X", .revision = "SR1.0", .data = &am65_mdio_soc_data }, ++ { .family = "AM65X", .revision = "SR2.0", .data = &am65_mdio_soc_data }, ++ { .family = "J7200", .revision = "SR1.0", .data = &am65_mdio_soc_data }, ++ { .family = "J7200", .revision = "SR2.0", .data = &am65_mdio_soc_data }, ++ { .family = "J721E", .revision = "SR1.0", .data = &am65_mdio_soc_data }, ++ { .family = "J721E", .revision = "SR2.0", .data = &am65_mdio_soc_data }, ++ { .family = "J721S2", .revision = "SR1.0", .data = &am65_mdio_soc_data}, ++ { /* sentinel */ }, ++}; ++ + #if IS_ENABLED(CONFIG_OF) + static const struct davinci_mdio_of_param of_cpsw_mdio_data = { + .autosuspend_delay_ms = 100, +@@ -331,6 +504,14 @@ static const struct of_device_id davinci_mdio_of_mtable[] = { + MODULE_DEVICE_TABLE(of, davinci_mdio_of_mtable); + #endif + ++static const struct mdiobb_ops davinci_mdiobb_ops = { ++ .owner = THIS_MODULE, ++ .set_mdc = davinci_set_mdc, ++ .set_mdio_dir = davinci_set_mdio_dir, ++ .set_mdio_data = davinci_set_mdio_data, ++ .get_mdio_data = davinci_get_mdio_data, ++}; ++ + static int davinci_mdio_probe(struct platform_device *pdev) + { + struct mdio_platform_data *pdata = dev_get_platdata(&pdev->dev); +@@ -345,7 +526,26 @@ static int davinci_mdio_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + +- data->bus = devm_mdiobus_alloc(dev); ++ data->manual_mode = false; ++ data->bb_ctrl.ops = &davinci_mdiobb_ops; ++ ++ if (IS_ENABLED(CONFIG_OF) && dev->of_node) { ++ const struct soc_device_attribute *soc_match_data; ++ ++ soc_match_data = soc_device_match(k3_mdio_socinfo); ++ if (soc_match_data && soc_match_data->data) { ++ const struct k3_mdio_soc_data *socdata = ++ soc_match_data->data; ++ ++ data->manual_mode = socdata->manual_mode; ++ } ++ } ++ ++ if (data->manual_mode) ++ data->bus = alloc_mdio_bitbang(&data->bb_ctrl); ++ else ++ data->bus = devm_mdiobus_alloc(dev); ++ + if (!data->bus) { + dev_err(dev, "failed to alloc mii bus\n"); + return -ENOMEM; +@@ -371,11 +571,20 @@ static int davinci_mdio_probe(struct platform_device *pdev) + } + + data->bus->name = dev_name(dev); +- data->bus->read = davinci_mdio_read; +- data->bus->write = davinci_mdio_write; +- data->bus->reset = davinci_mdio_reset; ++ ++ if (data->manual_mode) { ++ data->bus->read = davinci_mdiobb_read; ++ data->bus->write = davinci_mdiobb_write; ++ data->bus->reset = davinci_mdiobb_reset; ++ ++ dev_info(dev, "Configuring MDIO in manual mode\n"); ++ } else { ++ data->bus->read = davinci_mdio_read; ++ data->bus->write = davinci_mdio_write; ++ data->bus->reset = davinci_mdio_reset; ++ data->bus->priv = data; ++ } + data->bus->parent = dev; +- data->bus->priv = data; + + data->clk = devm_clk_get(dev, "fck"); + if (IS_ERR(data->clk)) { +@@ -433,9 +642,13 @@ static int davinci_mdio_remove(struct platform_device *pdev) + { + struct davinci_mdio_data *data = platform_get_drvdata(pdev); + +- if (data->bus) ++ if (data->bus) { + mdiobus_unregister(data->bus); + ++ if (data->manual_mode) ++ free_mdio_bitbang(data->bus); ++ } ++ + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_disable(&pdev->dev); + +@@ -452,7 +665,9 @@ static int davinci_mdio_runtime_suspend(struct device *dev) + ctrl = readl(&data->regs->control); + ctrl &= ~CONTROL_ENABLE; + writel(ctrl, &data->regs->control); +- wait_for_idle(data); ++ ++ if (!data->manual_mode) ++ wait_for_idle(data); + + return 0; + } +@@ -461,7 +676,12 @@ static int davinci_mdio_runtime_resume(struct device *dev) + { + struct davinci_mdio_data *data = dev_get_drvdata(dev); + +- davinci_mdio_enable(data); ++ if (data->manual_mode) { ++ davinci_mdio_disable(data); ++ davinci_mdio_enable_manual_mode(data); ++ } else { ++ davinci_mdio_enable(data); ++ } + return 0; + } + #endif +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h +index f2e2261b4b7d9..8ff4333de2ad9 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h +@@ -402,6 +402,9 @@ struct axidma_bd { + * @rx_bd_num: Size of RX buffer descriptor ring + * @rx_bd_ci: Stores the index of the Rx buffer descriptor in the ring being + * accessed currently. ++ * @rx_packets: RX packet count for statistics ++ * @rx_bytes: RX byte count for statistics ++ * @rx_stat_sync: Synchronization object for RX stats + * @napi_tx: NAPI TX control structure + * @tx_dma_cr: Nominal content of TX DMA control register + * @tx_bd_v: Virtual address of the TX buffer descriptor ring +@@ -411,6 +414,9 @@ struct axidma_bd { + * complete. Only updated at runtime by TX NAPI poll. + * @tx_bd_tail: Stores the index of the next Tx buffer descriptor in the ring + * to be populated. ++ * @tx_packets: TX packet count for statistics ++ * @tx_bytes: TX byte count for statistics ++ * @tx_stat_sync: Synchronization object for TX stats + * @dma_err_task: Work structure to process Axi DMA errors + * @tx_irq: Axidma TX IRQ number + * @rx_irq: Axidma RX IRQ number +@@ -458,6 +464,9 @@ struct axienet_local { + dma_addr_t rx_bd_p; + u32 rx_bd_num; + u32 rx_bd_ci; ++ u64_stats_t rx_packets; ++ u64_stats_t rx_bytes; ++ struct u64_stats_sync rx_stat_sync; + + struct napi_struct napi_tx; + u32 tx_dma_cr; +@@ -466,6 +475,9 @@ struct axienet_local { + u32 tx_bd_num; + u32 tx_bd_ci; + u32 tx_bd_tail; ++ u64_stats_t tx_packets; ++ u64_stats_t tx_bytes; ++ struct u64_stats_sync tx_stat_sync; + + struct work_struct dma_err_task; + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 1760930ec0c49..9262988d26a32 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -752,8 +752,10 @@ static int axienet_tx_poll(struct napi_struct *napi, int budget) + if (lp->tx_bd_ci >= lp->tx_bd_num) + lp->tx_bd_ci %= lp->tx_bd_num; + +- ndev->stats.tx_packets += packets; +- ndev->stats.tx_bytes += size; ++ u64_stats_update_begin(&lp->tx_stat_sync); ++ u64_stats_add(&lp->tx_packets, packets); ++ u64_stats_add(&lp->tx_bytes, size); ++ u64_stats_update_end(&lp->tx_stat_sync); + + /* Matches barrier in axienet_start_xmit */ + smp_mb(); +@@ -984,8 +986,10 @@ static int axienet_rx_poll(struct napi_struct *napi, int budget) + cur_p = &lp->rx_bd_v[lp->rx_bd_ci]; + } + +- lp->ndev->stats.rx_packets += packets; +- lp->ndev->stats.rx_bytes += size; ++ u64_stats_update_begin(&lp->rx_stat_sync); ++ u64_stats_add(&lp->rx_packets, packets); ++ u64_stats_add(&lp->rx_bytes, size); ++ u64_stats_update_end(&lp->rx_stat_sync); + + if (tail_p) + axienet_dma_out_addr(lp, XAXIDMA_RX_TDESC_OFFSET, tail_p); +@@ -1292,10 +1296,32 @@ static int axienet_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) + return phylink_mii_ioctl(lp->phylink, rq, cmd); + } + ++static void ++axienet_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats) ++{ ++ struct axienet_local *lp = netdev_priv(dev); ++ unsigned int start; ++ ++ netdev_stats_to_stats64(stats, &dev->stats); ++ ++ do { ++ start = u64_stats_fetch_begin_irq(&lp->rx_stat_sync); ++ stats->rx_packets = u64_stats_read(&lp->rx_packets); ++ stats->rx_bytes = u64_stats_read(&lp->rx_bytes); ++ } while (u64_stats_fetch_retry_irq(&lp->rx_stat_sync, start)); ++ ++ do { ++ start = u64_stats_fetch_begin_irq(&lp->tx_stat_sync); ++ stats->tx_packets = u64_stats_read(&lp->tx_packets); ++ stats->tx_bytes = u64_stats_read(&lp->tx_bytes); ++ } while (u64_stats_fetch_retry_irq(&lp->tx_stat_sync, start)); ++} ++ + static const struct net_device_ops axienet_netdev_ops = { + .ndo_open = axienet_open, + .ndo_stop = axienet_stop, + .ndo_start_xmit = axienet_start_xmit, ++ .ndo_get_stats64 = axienet_get_stats64, + .ndo_change_mtu = axienet_change_mtu, + .ndo_set_mac_address = netdev_set_mac_address, + .ndo_validate_addr = eth_validate_addr, +@@ -1850,6 +1876,9 @@ static int axienet_probe(struct platform_device *pdev) + lp->rx_bd_num = RX_BD_NUM_DEFAULT; + lp->tx_bd_num = TX_BD_NUM_DEFAULT; + ++ u64_stats_init(&lp->rx_stat_sync); ++ u64_stats_init(&lp->tx_stat_sync); ++ + netif_napi_add(ndev, &lp->napi_rx, axienet_rx_poll, NAPI_POLL_WEIGHT); + netif_napi_add(ndev, &lp->napi_tx, axienet_tx_poll, NAPI_POLL_WEIGHT); + +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index 25b38a374e3c3..dd5919ec408bf 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -1051,7 +1051,8 @@ struct net_device_context { + u32 vf_alloc; + /* Serial number of the VF to team with */ + u32 vf_serial; +- ++ /* completion variable to confirm vf association */ ++ struct completion vf_add; + /* Is the current data path through the VF NIC? */ + bool data_path_is_vf; + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 6e42cb03e226a..456db7c28a34c 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -1580,6 +1580,10 @@ static void netvsc_send_vf(struct net_device *ndev, + + net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated; + net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial; ++ ++ if (net_device_ctx->vf_alloc) ++ complete(&net_device_ctx->vf_add); ++ + netdev_info(ndev, "VF slot %u %s\n", + net_device_ctx->vf_serial, + net_device_ctx->vf_alloc ? "added" : "removed"); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 15ebd54266049..8113ac17ab70a 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -2313,6 +2313,18 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev) + + } + ++ /* Fallback path to check synthetic vf with ++ * help of mac addr ++ */ ++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) { ++ ndev = hv_get_drvdata(ndev_ctx->device_ctx); ++ if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr)) { ++ netdev_notice(vf_netdev, ++ "falling back to mac addr based matching\n"); ++ return ndev; ++ } ++ } ++ + netdev_notice(vf_netdev, + "no netdev found for vf serial:%u\n", serial); + return NULL; +@@ -2409,6 +2421,11 @@ static int netvsc_vf_changed(struct net_device *vf_netdev, unsigned long event) + if (net_device_ctx->data_path_is_vf == vf_is_up) + return NOTIFY_OK; + ++ if (vf_is_up && !net_device_ctx->vf_alloc) { ++ netdev_info(ndev, "Waiting for the VF association from host\n"); ++ wait_for_completion(&net_device_ctx->vf_add); ++ } ++ + ret = netvsc_switch_datapath(ndev, vf_is_up); + + if (ret) { +@@ -2440,6 +2457,7 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev) + + netvsc_vf_setxdp(vf_netdev, NULL); + ++ reinit_completion(&net_device_ctx->vf_add); + netdev_rx_handler_unregister(vf_netdev); + netdev_upper_dev_unlink(vf_netdev, ndev); + RCU_INIT_POINTER(net_device_ctx->vf_netdev, NULL); +@@ -2479,6 +2497,7 @@ static int netvsc_probe(struct hv_device *dev, + + INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change); + ++ init_completion(&net_device_ctx->vf_add); + spin_lock_init(&net_device_ctx->lock); + INIT_LIST_HEAD(&net_device_ctx->reconfig_events); + INIT_DELAYED_WORK(&net_device_ctx->vf_takeover, netvsc_vf_setup); +diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c +index ff5d0e98a0881..ab3f045629802 100644 +--- a/drivers/net/thunderbolt.c ++++ b/drivers/net/thunderbolt.c +@@ -612,18 +612,13 @@ static void tbnet_connected_work(struct work_struct *work) + return; + } + +- /* Both logins successful so enable the high-speed DMA paths and +- * start the network device queue. ++ /* Both logins successful so enable the rings, high-speed DMA ++ * paths and start the network device queue. ++ * ++ * Note we enable the DMA paths last to make sure we have primed ++ * the Rx ring before any incoming packets are allowed to ++ * arrive. + */ +- ret = tb_xdomain_enable_paths(net->xd, net->local_transmit_path, +- net->rx_ring.ring->hop, +- net->remote_transmit_path, +- net->tx_ring.ring->hop); +- if (ret) { +- netdev_err(net->dev, "failed to enable DMA paths\n"); +- return; +- } +- + tb_ring_start(net->tx_ring.ring); + tb_ring_start(net->rx_ring.ring); + +@@ -635,10 +630,21 @@ static void tbnet_connected_work(struct work_struct *work) + if (ret) + goto err_free_rx_buffers; + ++ ret = tb_xdomain_enable_paths(net->xd, net->local_transmit_path, ++ net->rx_ring.ring->hop, ++ net->remote_transmit_path, ++ net->tx_ring.ring->hop); ++ if (ret) { ++ netdev_err(net->dev, "failed to enable DMA paths\n"); ++ goto err_free_tx_buffers; ++ } ++ + netif_carrier_on(net->dev); + netif_start_queue(net->dev); + return; + ++err_free_tx_buffers: ++ tbnet_free_buffers(&net->tx_ring); + err_free_rx_buffers: + tbnet_free_buffers(&net->rx_ring); + err_stop_rings: +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 688905ea0a6d3..e7b0b59e2bc8c 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -1874,7 +1874,9 @@ static void intr_callback(struct urb *urb) + "Stop submitting intr, status %d\n", status); + return; + case -EOVERFLOW: +- netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n"); ++ if (net_ratelimit()) ++ netif_info(tp, intr, tp->netdev, ++ "intr status -EOVERFLOW\n"); + goto resubmit; + /* -EPIPE: should clear the halt */ + default: +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 688177453b072..07c4a4f0ed33d 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -95,6 +95,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = true, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA988X_HW_2_0_VERSION, +@@ -133,6 +134,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = true, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA9887_HW_1_0_VERSION, +@@ -172,6 +174,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA6174_HW_3_2_VERSION, +@@ -206,6 +209,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .supports_peer_stats_info = true, + .dynamic_sar_support = true, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA6174_HW_2_1_VERSION, +@@ -244,6 +248,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA6174_HW_2_1_VERSION, +@@ -282,6 +287,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA6174_HW_3_0_VERSION, +@@ -320,6 +326,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA6174_HW_3_2_VERSION, +@@ -362,6 +369,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .supports_peer_stats_info = true, + .dynamic_sar_support = true, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA99X0_HW_2_0_DEV_VERSION, +@@ -406,6 +414,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA9984_HW_1_0_DEV_VERSION, +@@ -457,6 +466,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA9888_HW_2_0_DEV_VERSION, +@@ -505,6 +515,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA9377_HW_1_0_DEV_VERSION, +@@ -543,6 +554,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA9377_HW_1_1_DEV_VERSION, +@@ -583,6 +595,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA9377_HW_1_1_DEV_VERSION, +@@ -614,6 +627,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .credit_size_workaround = true, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = QCA4019_HW_1_0_DEV_VERSION, +@@ -659,6 +673,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = false, + .hw_restart_disconnect = false, ++ .use_fw_tx_credits = true, + }, + { + .id = WCN3990_HW_1_0_DEV_VERSION, +@@ -690,6 +705,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .tx_stats_over_pktlog = false, + .dynamic_sar_support = true, + .hw_restart_disconnect = true, ++ .use_fw_tx_credits = false, + }, + }; + +diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c +index fab398046a3f2..6d1784f74bea4 100644 +--- a/drivers/net/wireless/ath/ath10k/htc.c ++++ b/drivers/net/wireless/ath/ath10k/htc.c +@@ -947,13 +947,18 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc) + return -ECOMM; + } + +- htc->total_transmit_credits = __le16_to_cpu(msg->ready.credit_count); ++ if (ar->hw_params.use_fw_tx_credits) ++ htc->total_transmit_credits = __le16_to_cpu(msg->ready.credit_count); ++ else ++ htc->total_transmit_credits = 1; ++ + htc->target_credit_size = __le16_to_cpu(msg->ready.credit_size); + + ath10k_dbg(ar, ATH10K_DBG_HTC, +- "Target ready! transmit resources: %d size:%d\n", ++ "Target ready! transmit resources: %d size:%d actual credits:%d\n", + htc->total_transmit_credits, +- htc->target_credit_size); ++ htc->target_credit_size, ++ msg->ready.credit_count); + + if ((htc->total_transmit_credits == 0) || + (htc->target_credit_size == 0)) { +diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h +index 93acf0dd580a6..1b99f3a39a113 100644 +--- a/drivers/net/wireless/ath/ath10k/hw.h ++++ b/drivers/net/wireless/ath/ath10k/hw.h +@@ -635,6 +635,8 @@ struct ath10k_hw_params { + bool dynamic_sar_support; + + bool hw_restart_disconnect; ++ ++ bool use_fw_tx_credits; + }; + + struct htt_resp; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 6407f509e91b8..9a1c970f8f55e 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -864,11 +864,36 @@ static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr) + return 0; + } + ++static void ath10k_peer_map_cleanup(struct ath10k *ar, struct ath10k_peer *peer) ++{ ++ int peer_id, i; ++ ++ lockdep_assert_held(&ar->conf_mutex); ++ ++ for_each_set_bit(peer_id, peer->peer_ids, ++ ATH10K_MAX_NUM_PEER_IDS) { ++ ar->peer_map[peer_id] = NULL; ++ } ++ ++ /* Double check that peer is properly un-referenced from ++ * the peer_map ++ */ ++ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) { ++ if (ar->peer_map[i] == peer) { ++ ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %pK idx %d)\n", ++ peer->addr, peer, i); ++ ar->peer_map[i] = NULL; ++ } ++ } ++ ++ list_del(&peer->list); ++ kfree(peer); ++ ar->num_peers--; ++} ++ + static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id) + { + struct ath10k_peer *peer, *tmp; +- int peer_id; +- int i; + + lockdep_assert_held(&ar->conf_mutex); + +@@ -880,25 +905,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id) + ath10k_warn(ar, "removing stale peer %pM from vdev_id %d\n", + peer->addr, vdev_id); + +- for_each_set_bit(peer_id, peer->peer_ids, +- ATH10K_MAX_NUM_PEER_IDS) { +- ar->peer_map[peer_id] = NULL; +- } +- +- /* Double check that peer is properly un-referenced from +- * the peer_map +- */ +- for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) { +- if (ar->peer_map[i] == peer) { +- ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %pK idx %d)\n", +- peer->addr, peer, i); +- ar->peer_map[i] = NULL; +- } +- } +- +- list_del(&peer->list); +- kfree(peer); +- ar->num_peers--; ++ ath10k_peer_map_cleanup(ar, peer); + } + spin_unlock_bh(&ar->data_lock); + } +@@ -7586,10 +7593,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + /* Clean up the peer object as well since we + * must have failed to do this above. + */ +- list_del(&peer->list); +- ar->peer_map[i] = NULL; +- kfree(peer); +- ar->num_peers--; ++ ath10k_peer_map_cleanup(ar, peer); + } + } + spin_unlock_bh(&ar->data_lock); +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index c474147101382..911eee9646a45 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -1088,20 +1088,10 @@ err_core_free: + return ret; + } + +-static int ath11k_ahb_remove(struct platform_device *pdev) ++static void ath11k_ahb_remove_prepare(struct ath11k_base *ab) + { +- struct ath11k_base *ab = platform_get_drvdata(pdev); + unsigned long left; + +- if (test_bit(ATH11K_FLAG_QMI_FAIL, &ab->dev_flags)) { +- ath11k_ahb_power_down(ab); +- ath11k_debugfs_soc_destroy(ab); +- ath11k_qmi_deinit_service(ab); +- goto qmi_fail; +- } +- +- reinit_completion(&ab->driver_recovery); +- + if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags)) { + left = wait_for_completion_timeout(&ab->driver_recovery, + ATH11K_AHB_RECOVERY_TIMEOUT); +@@ -1111,19 +1101,60 @@ static int ath11k_ahb_remove(struct platform_device *pdev) + + set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags); + cancel_work_sync(&ab->restart_work); ++ cancel_work_sync(&ab->qmi.event_work); ++} ++ ++static void ath11k_ahb_free_resources(struct ath11k_base *ab) ++{ ++ struct platform_device *pdev = ab->pdev; + +- ath11k_core_deinit(ab); +-qmi_fail: + ath11k_ahb_free_irq(ab); + ath11k_hal_srng_deinit(ab); + ath11k_ahb_fw_resource_deinit(ab); + ath11k_ce_free_pipes(ab); + ath11k_core_free(ab); + platform_set_drvdata(pdev, NULL); ++} ++ ++static int ath11k_ahb_remove(struct platform_device *pdev) ++{ ++ struct ath11k_base *ab = platform_get_drvdata(pdev); ++ ++ if (test_bit(ATH11K_FLAG_QMI_FAIL, &ab->dev_flags)) { ++ ath11k_ahb_power_down(ab); ++ ath11k_debugfs_soc_destroy(ab); ++ ath11k_qmi_deinit_service(ab); ++ goto qmi_fail; ++ } ++ ++ ath11k_ahb_remove_prepare(ab); ++ ath11k_core_deinit(ab); ++ ++qmi_fail: ++ ath11k_ahb_free_resources(ab); + + return 0; + } + ++static void ath11k_ahb_shutdown(struct platform_device *pdev) ++{ ++ struct ath11k_base *ab = platform_get_drvdata(pdev); ++ ++ /* platform shutdown() & remove() are mutually exclusive. ++ * remove() is invoked during rmmod & shutdown() during ++ * system reboot/shutdown. ++ */ ++ ath11k_ahb_remove_prepare(ab); ++ ++ if (!(test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))) ++ goto free_resources; ++ ++ ath11k_core_deinit(ab); ++ ++free_resources: ++ ath11k_ahb_free_resources(ab); ++} ++ + static struct platform_driver ath11k_ahb_driver = { + .driver = { + .name = "ath11k", +@@ -1131,6 +1162,7 @@ static struct platform_driver ath11k_ahb_driver = { + }, + .probe = ath11k_ahb_probe, + .remove = ath11k_ahb_remove, ++ .shutdown = ath11k_ahb_shutdown, + }; + + static int ath11k_ahb_init(void) +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 6ddc698f4a2dc..209345bedd09b 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -1635,6 +1635,8 @@ static void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab) + + wake_up(&ab->wmi_ab.tx_credits_wq); + wake_up(&ab->peer_mapping_wq); ++ ++ reinit_completion(&ab->driver_recovery); + } + + static void ath11k_core_post_reconfigure_recovery(struct ath11k_base *ab) +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index b3e133add1ce5..1459e3b1c4f50 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -5194,7 +5194,8 @@ int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id, + if (log_type != ATH11K_PKTLOG_TYPE_INVALID) + trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz); + +- memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info)); ++ memset(ppdu_info, 0, sizeof(*ppdu_info)); ++ ppdu_info->peer_id = HAL_INVALID_PEERID; + hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb); + + if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) && +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 06b86dcc3826b..94d9a7190953b 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -4949,6 +4949,8 @@ static int ath11k_mac_set_txbf_conf(struct ath11k_vif *arvif) + if (vht_cap & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)) { + nsts = vht_cap & IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK; + nsts >>= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT; ++ if (nsts > (ar->num_rx_chains - 1)) ++ nsts = ar->num_rx_chains - 1; + value |= SM(nsts, WMI_TXBF_STS_CAP_OFFSET); + } + +@@ -4989,7 +4991,7 @@ static int ath11k_mac_set_txbf_conf(struct ath11k_vif *arvif) + static void ath11k_set_vht_txbf_cap(struct ath11k *ar, u32 *vht_cap) + { + bool subfer, subfee; +- int sound_dim = 0; ++ int sound_dim = 0, nsts = 0; + + subfer = !!(*vht_cap & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)); + subfee = !!(*vht_cap & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)); +@@ -4999,6 +5001,11 @@ static void ath11k_set_vht_txbf_cap(struct ath11k *ar, u32 *vht_cap) + subfer = false; + } + ++ if (ar->num_rx_chains < 2) { ++ *vht_cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE); ++ subfee = false; ++ } ++ + /* If SU Beaformer is not set, then disable MU Beamformer Capability */ + if (!subfer) + *vht_cap &= ~(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE); +@@ -5011,7 +5018,9 @@ static void ath11k_set_vht_txbf_cap(struct ath11k *ar, u32 *vht_cap) + sound_dim >>= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT; + *vht_cap &= ~IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK; + +- /* TODO: Need to check invalid STS and Sound_dim values set by FW? */ ++ nsts = (*vht_cap & IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK); ++ nsts >>= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT; ++ *vht_cap &= ~IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK; + + /* Enable Sounding Dimension Field only if SU BF is enabled */ + if (subfer) { +@@ -5023,9 +5032,15 @@ static void ath11k_set_vht_txbf_cap(struct ath11k *ar, u32 *vht_cap) + *vht_cap |= sound_dim; + } + +- /* Use the STS advertised by FW unless SU Beamformee is not supported*/ +- if (!subfee) +- *vht_cap &= ~(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK); ++ /* Enable Beamformee STS Field only if SU BF is enabled */ ++ if (subfee) { ++ if (nsts > (ar->num_rx_chains - 1)) ++ nsts = ar->num_rx_chains - 1; ++ ++ nsts <<= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT; ++ nsts &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK; ++ *vht_cap |= nsts; ++ } + } + + static struct ieee80211_sta_vht_cap +diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c +index c44df17719f64..86995e8dc9135 100644 +--- a/drivers/net/wireless/ath/ath11k/mhi.c ++++ b/drivers/net/wireless/ath/ath11k/mhi.c +@@ -402,8 +402,7 @@ int ath11k_mhi_register(struct ath11k_pci *ab_pci) + ret = ath11k_mhi_get_msi(ab_pci); + if (ret) { + ath11k_err(ab, "failed to get msi for mhi\n"); +- mhi_free_controller(mhi_ctrl); +- return ret; ++ goto free_controller; + } + + if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, &ab->dev_flags)) +@@ -412,7 +411,7 @@ int ath11k_mhi_register(struct ath11k_pci *ab_pci) + if (test_bit(ATH11K_FLAG_FIXED_MEM_RGN, &ab->dev_flags)) { + ret = ath11k_mhi_read_addr_from_dt(mhi_ctrl); + if (ret < 0) +- return ret; ++ goto free_controller; + } else { + mhi_ctrl->iova_start = 0; + mhi_ctrl->iova_stop = 0xFFFFFFFF; +@@ -440,18 +439,22 @@ int ath11k_mhi_register(struct ath11k_pci *ab_pci) + default: + ath11k_err(ab, "failed assign mhi_config for unknown hw rev %d\n", + ab->hw_rev); +- mhi_free_controller(mhi_ctrl); +- return -EINVAL; ++ ret = -EINVAL; ++ goto free_controller; + } + + ret = mhi_register_controller(mhi_ctrl, ath11k_mhi_config); + if (ret) { + ath11k_err(ab, "failed to register to mhi bus, err = %d\n", ret); +- mhi_free_controller(mhi_ctrl); +- return ret; ++ goto free_controller; + } + + return 0; ++ ++free_controller: ++ mhi_free_controller(mhi_ctrl); ++ ab_pci->mhi_ctrl = NULL; ++ return ret; + } + + void ath11k_mhi_unregister(struct ath11k_pci *ab_pci) +diff --git a/drivers/net/wireless/ath/ath11k/peer.c b/drivers/net/wireless/ath/ath11k/peer.c +index 9e22aaf34b88c..1ae7af02c364e 100644 +--- a/drivers/net/wireless/ath/ath11k/peer.c ++++ b/drivers/net/wireless/ath/ath11k/peer.c +@@ -302,6 +302,21 @@ static int __ath11k_peer_delete(struct ath11k *ar, u32 vdev_id, const u8 *addr) + spin_lock_bh(&ab->base_lock); + + peer = ath11k_peer_find_by_addr(ab, addr); ++ /* Check if the found peer is what we want to remove. ++ * While the sta is transitioning to another band we may ++ * have 2 peer with the same addr assigned to different ++ * vdev_id. Make sure we are deleting the correct peer. ++ */ ++ if (peer && peer->vdev_id == vdev_id) ++ ath11k_peer_rhash_delete(ab, peer); ++ ++ /* Fallback to peer list search if the correct peer can't be found. ++ * Skip the deletion of the peer from the rhash since it has already ++ * been deleted in peer add. ++ */ ++ if (!peer) ++ peer = ath11k_peer_find(ab, vdev_id, addr); ++ + if (!peer) { + spin_unlock_bh(&ab->base_lock); + mutex_unlock(&ab->tbl_mtx_lock); +@@ -312,8 +327,6 @@ static int __ath11k_peer_delete(struct ath11k *ar, u32 vdev_id, const u8 *addr) + return -EINVAL; + } + +- ath11k_peer_rhash_delete(ab, peer); +- + spin_unlock_bh(&ab->base_lock); + mutex_unlock(&ab->tbl_mtx_lock); + +@@ -372,8 +385,17 @@ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif, + spin_lock_bh(&ar->ab->base_lock); + peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr); + if (peer) { +- spin_unlock_bh(&ar->ab->base_lock); +- return -EINVAL; ++ if (peer->vdev_id == param->vdev_id) { ++ spin_unlock_bh(&ar->ab->base_lock); ++ return -EINVAL; ++ } ++ ++ /* Assume sta is transitioning to another band. ++ * Remove here the peer from rhash. ++ */ ++ mutex_lock(&ar->ab->tbl_mtx_lock); ++ ath11k_peer_rhash_delete(ar->ab, peer); ++ mutex_unlock(&ar->ab->tbl_mtx_lock); + } + spin_unlock_bh(&ar->ab->base_lock); + +diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c +index 61ead37a944a8..109f4b618428e 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.c ++++ b/drivers/net/wireless/ath/ath11k/qmi.c +@@ -1696,6 +1696,13 @@ static struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = { + }, + }; + ++static struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = { ++ { ++ .data_type = QMI_EOTI, ++ .array_type = NO_ARRAY, ++ }, ++}; ++ + static int ath11k_qmi_host_cap_send(struct ath11k_base *ab) + { + struct qmi_wlanfw_host_cap_req_msg_v01 req; +@@ -3006,6 +3013,10 @@ static void ath11k_qmi_msg_fw_ready_cb(struct qmi_handle *qmi_hdl, + struct ath11k_base *ab = qmi->ab; + + ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi firmware ready\n"); ++ ++ ab->qmi.cal_done = 1; ++ wake_up(&ab->qmi.cold_boot_waitq); ++ + ath11k_qmi_driver_event_post(qmi, ATH11K_QMI_EVENT_FW_READY, NULL); + } + +@@ -3018,11 +3029,22 @@ static void ath11k_qmi_msg_cold_boot_cal_done_cb(struct qmi_handle *qmi_hdl, + struct ath11k_qmi, handle); + struct ath11k_base *ab = qmi->ab; + +- ab->qmi.cal_done = 1; +- wake_up(&ab->qmi.cold_boot_waitq); + ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi cold boot calibration done\n"); + } + ++static void ath11k_qmi_msg_fw_init_done_cb(struct qmi_handle *qmi_hdl, ++ struct sockaddr_qrtr *sq, ++ struct qmi_txn *txn, ++ const void *decoded) ++{ ++ struct ath11k_qmi *qmi = container_of(qmi_hdl, ++ struct ath11k_qmi, handle); ++ struct ath11k_base *ab = qmi->ab; ++ ++ ath11k_qmi_driver_event_post(qmi, ATH11K_QMI_EVENT_FW_INIT_DONE, NULL); ++ ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi firmware init done\n"); ++} ++ + static const struct qmi_msg_handler ath11k_qmi_msg_handlers[] = { + { + .type = QMI_INDICATION, +@@ -3053,6 +3075,14 @@ static const struct qmi_msg_handler ath11k_qmi_msg_handlers[] = { + sizeof(struct qmi_wlanfw_fw_cold_cal_done_ind_msg_v01), + .fn = ath11k_qmi_msg_cold_boot_cal_done_cb, + }, ++ { ++ .type = QMI_INDICATION, ++ .msg_id = QMI_WLFW_FW_INIT_DONE_IND_V01, ++ .ei = qmi_wlfw_fw_init_done_ind_msg_v01_ei, ++ .decoded_size = ++ sizeof(struct qmi_wlfw_fw_init_done_ind_msg_v01), ++ .fn = ath11k_qmi_msg_fw_init_done_cb, ++ }, + }; + + static int ath11k_qmi_ops_new_server(struct qmi_handle *qmi_hdl, +@@ -3145,7 +3175,7 @@ static void ath11k_qmi_driver_event_work(struct work_struct *work) + } + + break; +- case ATH11K_QMI_EVENT_FW_READY: ++ case ATH11K_QMI_EVENT_FW_INIT_DONE: + clear_bit(ATH11K_FLAG_QMI_FAIL, &ab->dev_flags); + if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) { + ath11k_hal_dump_srng_stats(ab); +@@ -3168,6 +3198,8 @@ static void ath11k_qmi_driver_event_work(struct work_struct *work) + set_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags); + } + ++ break; ++ case ATH11K_QMI_EVENT_FW_READY: + break; + case ATH11K_QMI_EVENT_COLD_BOOT_CAL_DONE: + break; +diff --git a/drivers/net/wireless/ath/ath11k/qmi.h b/drivers/net/wireless/ath/ath11k/qmi.h +index c83cf822be81a..2ec56a34fa810 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.h ++++ b/drivers/net/wireless/ath/ath11k/qmi.h +@@ -31,8 +31,9 @@ + + #define QMI_WLFW_REQUEST_MEM_IND_V01 0x0035 + #define QMI_WLFW_FW_MEM_READY_IND_V01 0x0037 +-#define QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01 0x0021 +-#define QMI_WLFW_FW_READY_IND_V01 0x0038 ++#define QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01 0x003E ++#define QMI_WLFW_FW_READY_IND_V01 0x0021 ++#define QMI_WLFW_FW_INIT_DONE_IND_V01 0x0038 + + #define QMI_WLANFW_MAX_DATA_SIZE_V01 6144 + #define ATH11K_FIRMWARE_MODE_OFF 4 +@@ -69,6 +70,7 @@ enum ath11k_qmi_event_type { + ATH11K_QMI_EVENT_FORCE_FW_ASSERT, + ATH11K_QMI_EVENT_POWER_UP, + ATH11K_QMI_EVENT_POWER_DOWN, ++ ATH11K_QMI_EVENT_FW_INIT_DONE, + ATH11K_QMI_EVENT_MAX, + }; + +@@ -291,6 +293,10 @@ struct qmi_wlanfw_fw_cold_cal_done_ind_msg_v01 { + char placeholder; + }; + ++struct qmi_wlfw_fw_init_done_ind_msg_v01 { ++ char placeholder; ++}; ++ + #define QMI_WLANFW_CAP_REQ_MSG_V01_MAX_LEN 0 + #define QMI_WLANFW_CAP_RESP_MSG_V01_MAX_LEN 235 + #define QMI_WLANFW_CAP_REQ_V01 0x0024 +diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c +index cc84bd53ddae9..1c8aa503e6144 100644 +--- a/drivers/net/wireless/ath/ath11k/wmi.c ++++ b/drivers/net/wireless/ath/ath11k/wmi.c +@@ -9003,12 +9003,13 @@ int ath11k_wmi_sta_keepalive(struct ath11k *ar, + cmd->interval = arg->interval; + cmd->method = arg->method; + ++ arp = (struct wmi_sta_keepalive_arp_resp *)(cmd + 1); ++ arp->tlv_header = FIELD_PREP(WMI_TLV_TAG, ++ WMI_TAG_STA_KEEPALIVE_ARP_RESPONSE) | ++ FIELD_PREP(WMI_TLV_LEN, sizeof(*arp) - TLV_HDR_SIZE); ++ + if (arg->method == WMI_STA_KEEPALIVE_METHOD_UNSOLICITED_ARP_RESPONSE || + arg->method == WMI_STA_KEEPALIVE_METHOD_GRATUITOUS_ARP_REQUEST) { +- arp = (struct wmi_sta_keepalive_arp_resp *)(cmd + 1); +- arp->tlv_header = FIELD_PREP(WMI_TLV_TAG, +- WMI_TAG_STA_KEEPALVE_ARP_RESPONSE) | +- FIELD_PREP(WMI_TLV_LEN, sizeof(*arp) - TLV_HDR_SIZE); + arp->src_ip4_addr = arg->src_ip4_addr; + arp->dest_ip4_addr = arg->dest_ip4_addr; + ether_addr_copy(arp->dest_mac_addr.addr, arg->dest_mac_addr); +diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h +index b1fad4707dc60..ca3b9a384d605 100644 +--- a/drivers/net/wireless/ath/ath11k/wmi.h ++++ b/drivers/net/wireless/ath/ath11k/wmi.h +@@ -1214,7 +1214,7 @@ enum wmi_tlv_tag { + WMI_TAG_NS_OFFLOAD_TUPLE, + WMI_TAG_FTM_INTG_CMD, + WMI_TAG_STA_KEEPALIVE_CMD, +- WMI_TAG_STA_KEEPALVE_ARP_RESPONSE, ++ WMI_TAG_STA_KEEPALIVE_ARP_RESPONSE, + WMI_TAG_P2P_SET_VENDOR_IE_DATA_CMD, + WMI_TAG_AP_PS_PEER_CMD, + WMI_TAG_PEER_RATE_RETRY_SCHED_CMD, +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 994ec48b2f669..ca05b07a45e67 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -364,33 +364,27 @@ ret: + } + + static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle, +- struct sk_buff *skb) ++ struct sk_buff *skb, u32 len) + { + uint32_t *pattern = (uint32_t *)skb->data; + +- switch (*pattern) { +- case 0x33221199: +- { ++ if (*pattern == 0x33221199 && len >= sizeof(struct htc_panic_bad_vaddr)) { + struct htc_panic_bad_vaddr *htc_panic; + htc_panic = (struct htc_panic_bad_vaddr *) skb->data; + dev_err(htc_handle->dev, "ath: firmware panic! " + "exccause: 0x%08x; pc: 0x%08x; badvaddr: 0x%08x.\n", + htc_panic->exccause, htc_panic->pc, + htc_panic->badvaddr); +- break; +- } +- case 0x33221299: +- { ++ return; ++ } ++ if (*pattern == 0x33221299) { + struct htc_panic_bad_epid *htc_panic; + htc_panic = (struct htc_panic_bad_epid *) skb->data; + dev_err(htc_handle->dev, "ath: firmware panic! " + "bad epid: 0x%08x\n", htc_panic->epid); +- break; +- } +- default: +- dev_err(htc_handle->dev, "ath: unknown panic pattern!\n"); +- break; ++ return; + } ++ dev_err(htc_handle->dev, "ath: unknown panic pattern!\n"); + } + + /* +@@ -411,16 +405,26 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, + if (!htc_handle || !skb) + return; + ++ /* A valid message requires len >= 8. ++ * ++ * sizeof(struct htc_frame_hdr) == 8 ++ * sizeof(struct htc_ready_msg) == 8 ++ * sizeof(struct htc_panic_bad_vaddr) == 16 ++ * sizeof(struct htc_panic_bad_epid) == 8 ++ */ ++ if (unlikely(len < sizeof(struct htc_frame_hdr))) ++ goto invalid; + htc_hdr = (struct htc_frame_hdr *) skb->data; + epid = htc_hdr->endpoint_id; + + if (epid == 0x99) { +- ath9k_htc_fw_panic_report(htc_handle, skb); ++ ath9k_htc_fw_panic_report(htc_handle, skb, len); + kfree_skb(skb); + return; + } + + if (epid < 0 || epid >= ENDPOINT_MAX) { ++invalid: + if (pipe_id != USB_REG_IN_PIPE) + dev_kfree_skb_any(skb); + else +@@ -432,21 +436,30 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, + + /* Handle trailer */ + if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER) { +- if (be32_to_cpu(*(__be32 *) skb->data) == 0x00C60000) ++ if (be32_to_cpu(*(__be32 *) skb->data) == 0x00C60000) { + /* Move past the Watchdog pattern */ + htc_hdr = (struct htc_frame_hdr *)(skb->data + 4); ++ len -= 4; ++ } + } + + /* Get the message ID */ ++ if (unlikely(len < sizeof(struct htc_frame_hdr) + sizeof(__be16))) ++ goto invalid; + msg_id = (__be16 *) ((void *) htc_hdr + + sizeof(struct htc_frame_hdr)); + + /* Now process HTC messages */ + switch (be16_to_cpu(*msg_id)) { + case HTC_MSG_READY_ID: ++ if (unlikely(len < sizeof(struct htc_ready_msg))) ++ goto invalid; + htc_process_target_rdy(htc_handle, htc_hdr); + break; + case HTC_MSG_CONNECT_SERVICE_RESPONSE_ID: ++ if (unlikely(len < sizeof(struct htc_frame_hdr) + ++ sizeof(struct htc_conn_svc_rspmsg))) ++ goto invalid; + htc_process_conn_rsp(htc_handle, htc_hdr); + break; + default: +diff --git a/drivers/net/wireless/ath/ath9k/rng.c b/drivers/net/wireless/ath/ath9k/rng.c +index cb5414265a9b5..58c0ab01771b0 100644 +--- a/drivers/net/wireless/ath/ath9k/rng.c ++++ b/drivers/net/wireless/ath/ath9k/rng.c +@@ -83,7 +83,8 @@ static int ath9k_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait) + if (!wait || !max || likely(bytes_read) || fail_stats > 110) + break; + +- msleep_interruptible(ath9k_rng_delay_get(++fail_stats)); ++ if (hwrng_msleep(rng, ath9k_rng_delay_get(++fail_stats))) ++ break; + } + + if (wait && !bytes_read && max) +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index 87aef211b35f3..12ee8b7163fd6 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -296,6 +296,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, + struct brcmf_pub *drvr = ifp->drvr; + struct ethhdr *eh; + int head_delta; ++ unsigned int tx_bytes = skb->len; + + brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); + +@@ -370,7 +371,7 @@ done: + ndev->stats.tx_dropped++; + } else { + ndev->stats.tx_packets++; +- ndev->stats.tx_bytes += skb->len; ++ ndev->stats.tx_bytes += tx_bytes; + } + + /* Return ok: we always eat the packet */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c +index fabfbb0b40b0c..d0a7465be586d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c +@@ -158,12 +158,12 @@ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi) + struct brcmf_pno_macaddr_le pfn_mac; + u8 *mac_addr = NULL; + u8 *mac_mask = NULL; +- int err, i; ++ int err, i, ri; + +- for (i = 0; i < pi->n_reqs; i++) +- if (pi->reqs[i]->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { +- mac_addr = pi->reqs[i]->mac_addr; +- mac_mask = pi->reqs[i]->mac_addr_mask; ++ for (ri = 0; ri < pi->n_reqs; ri++) ++ if (pi->reqs[ri]->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { ++ mac_addr = pi->reqs[ri]->mac_addr; ++ mac_mask = pi->reqs[ri]->mac_addr_mask; + break; + } + +@@ -185,7 +185,7 @@ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi) + pfn_mac.mac[0] |= 0x02; + + brcmf_dbg(SCAN, "enabling random mac: reqid=%llu mac=%pM\n", +- pi->reqs[i]->reqid, pfn_mac.mac); ++ pi->reqs[ri]->reqid, pfn_mac.mac); + err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac, + sizeof(pfn_mac)); + if (err) +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +index d722c3c177bee..4a1e6b92ff734 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +@@ -1194,12 +1194,16 @@ static void mt7615_sta_set_decap_offload(struct ieee80211_hw *hw, + struct mt7615_dev *dev = mt7615_hw_dev(hw); + struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv; + ++ mt7615_mutex_acquire(dev); ++ + if (enabled) + set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags); + else + clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags); + + mt7615_mcu_set_sta_decap_offload(dev, vif, sta); ++ ++ mt7615_mutex_release(dev); + } + + #ifdef CONFIG_PM +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index 7eb23805aa942..d10b441eac4f8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -258,8 +258,10 @@ mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len, + ntlv = le16_to_cpu(ntlv_hdr->tlv_num); + ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1); + +- if (sta_hdr) +- le16_add_cpu(&sta_hdr->len, len); ++ if (sta_hdr) { ++ len += le16_to_cpu(sta_hdr->len); ++ sta_hdr->len = cpu_to_le16(len); ++ } + + return ptlv; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +index fd76db8f5269c..6ef3431cad648 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +@@ -23,9 +23,9 @@ mt7915_implicit_txbf_set(void *data, u64 val) + { + struct mt7915_dev *dev = data; + +- if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) +- return -EBUSY; +- ++ /* The existing connected stations shall reconnect to apply ++ * new implicit txbf configuration. ++ */ + dev->ibf = !!val; + + return mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index 89f10bf885ba8..4f3a3a88f0863 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -2536,8 +2536,9 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw, + } + + flowid = ffs(~msta->twt.flowid_mask) - 1; +- le16p_replace_bits(&twt_agrt->req_type, flowid, +- IEEE80211_TWT_REQTYPE_FLOWID); ++ twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID); ++ twt_agrt->req_type |= le16_encode_bits(flowid, ++ IEEE80211_TWT_REQTYPE_FLOWID); + + table_id = ffs(~dev->twt.table_mask) - 1; + exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type); +@@ -2587,8 +2588,9 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw, + unlock: + mutex_unlock(&dev->mt76.mutex); + out: +- le16p_replace_bits(&twt_agrt->req_type, setup_cmd, +- IEEE80211_TWT_REQTYPE_SETUP_CMD); ++ twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_SETUP_CMD); ++ twt_agrt->req_type |= ++ le16_encode_bits(setup_cmd, IEEE80211_TWT_REQTYPE_SETUP_CMD); + twt->control = (twt->control & IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT) | + (twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 17fa2acc0d070..ec8a5083466f7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -1460,7 +1460,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev, + struct sta_phy phy = {}; + int ret, nrates = 0; + +-#define __sta_phy_bitrate_mask_check(_mcs, _gi, _he) \ ++#define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he) \ + do { \ + u8 i, gi = mask->control[band]._gi; \ + gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI; \ +@@ -1473,15 +1473,17 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev, + continue; \ + nrates += hweight16(mask->control[band]._mcs[i]); \ + phy.mcs = ffs(mask->control[band]._mcs[i]) - 1; \ ++ if (_ht) \ ++ phy.mcs += 8 * i; \ + } \ + } while (0) + + if (sta->deflink.he_cap.has_he) { +- __sta_phy_bitrate_mask_check(he_mcs, he_gi, 1); ++ __sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1); + } else if (sta->deflink.vht_cap.vht_supported) { +- __sta_phy_bitrate_mask_check(vht_mcs, gi, 0); ++ __sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0); + } else if (sta->deflink.ht_cap.ht_supported) { +- __sta_phy_bitrate_mask_check(ht_mcs, gi, 0); ++ __sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0); + } else { + nrates = hweight32(mask->control[band].legacy); + phy.mcs = ffs(mask->control[band].legacy) - 1; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +index 2a2ea7b9977a4..7e0cddc2aeab5 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +@@ -1215,6 +1215,7 @@ void mt7921_mac_reset_work(struct work_struct *work) + void mt7921_reset(struct mt76_dev *mdev) + { + struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76); ++ struct mt76_connac_pm *pm = &dev->pm; + + if (!dev->hw_init_done) + return; +@@ -1222,8 +1223,12 @@ void mt7921_reset(struct mt76_dev *mdev) + if (dev->hw_full_reset) + return; + ++ if (pm->suspended) ++ return; ++ + queue_work(dev->mt76.wq, &dev->reset_work); + } ++EXPORT_SYMBOL_GPL(mt7921_reset); + + void mt7921_mac_update_mib_stats(struct mt7921_phy *phy) + { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index d3f310877248b..94dd0c1d4cb8b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -738,6 +738,7 @@ void mt7921_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif, + + mt7921_mac_wtbl_update(dev, msta->wcid.idx, + MT_WTBL_UPDATE_ADM_COUNT_CLEAR); ++ memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac)); + + mt7921_mcu_sta_update(dev, sta, vif, true, MT76_STA_INFO_STATE_ASSOC); + +@@ -1390,6 +1391,8 @@ static void mt7921_sta_set_decap_offload(struct ieee80211_hw *hw, + struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv; + struct mt7921_dev *dev = mt7921_hw_dev(hw); + ++ mt7921_mutex_acquire(dev); ++ + if (enabled) + set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags); + else +@@ -1397,6 +1400,8 @@ static void mt7921_sta_set_decap_offload(struct ieee80211_hw *hw, + + mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76, vif, &msta->wcid, + MCU_UNI_CMD(STA_REC_UPDATE)); ++ ++ mt7921_mutex_release(dev); + } + + #if IS_ENABLED(CONFIG_IPV6) +@@ -1499,17 +1504,23 @@ mt7921_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + struct mt7921_dev *dev = mt7921_hw_dev(hw); + int err; + ++ mt7921_mutex_acquire(dev); ++ + err = mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid, + true); + if (err) +- return err; ++ goto out; + + err = mt7921_mcu_set_bss_pm(dev, vif, true); + if (err) +- return err; ++ goto out; ++ ++ err = mt7921_mcu_sta_update(dev, NULL, vif, true, ++ MT76_STA_INFO_STATE_NONE); ++out: ++ mt7921_mutex_release(dev); + +- return mt7921_mcu_sta_update(dev, NULL, vif, true, +- MT76_STA_INFO_STATE_NONE); ++ return err; + } + + static void +@@ -1520,11 +1531,16 @@ mt7921_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + struct mt7921_dev *dev = mt7921_hw_dev(hw); + int err; + ++ mt7921_mutex_acquire(dev); ++ + err = mt7921_mcu_set_bss_pm(dev, vif, false); + if (err) +- return; ++ goto out; + + mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid, false); ++ ++out: ++ mt7921_mutex_release(dev); + } + + const struct ieee80211_ops mt7921_ops = { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +index b5fb22b8e0869..d8347b33641ee 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +@@ -289,6 +289,8 @@ static int mt7921_pci_probe(struct pci_dev *pdev, + goto err_free_pci_vec; + } + ++ pci_set_drvdata(pdev, mdev); ++ + dev = container_of(mdev, struct mt7921_dev, mt76); + dev->hif_ops = &mt7921_pcie_ops; + +@@ -368,6 +370,7 @@ static int mt7921_pci_suspend(struct pci_dev *pdev, pm_message_t state) + int i, err; + + pm->suspended = true; ++ flush_work(&dev->reset_work); + cancel_delayed_work_sync(&pm->ps_work); + cancel_work_sync(&pm->wake_work); + +@@ -433,6 +436,9 @@ restore_napi: + restore_suspend: + pm->suspended = false; + ++ if (err < 0) ++ mt7921_reset(&dev->mt76); ++ + return err; + } + +@@ -451,7 +457,7 @@ static int mt7921_pci_resume(struct pci_dev *pdev) + + err = mt7921_mcu_drv_pmctrl(dev); + if (err < 0) +- return err; ++ goto failed; + + mt7921_wpdma_reinit_cond(dev); + +@@ -481,11 +487,12 @@ static int mt7921_pci_resume(struct pci_dev *pdev) + mt76_connac_mcu_set_deep_sleep(&dev->mt76, false); + + err = mt76_connac_mcu_set_hif_suspend(mdev, false); +- if (err) +- return err; +- ++failed: + pm->suspended = false; + ++ if (err < 0) ++ mt7921_reset(&dev->mt76); ++ + return err; + } + #endif /* CONFIG_PM */ +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c +index af26d59fa2f04..5610c63fe1e60 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c +@@ -206,6 +206,7 @@ static int mt7921s_suspend(struct device *__dev) + pm->suspended = true; + set_bit(MT76_STATE_SUSPEND, &mdev->phy.state); + ++ flush_work(&dev->reset_work); + cancel_delayed_work_sync(&pm->ps_work); + cancel_work_sync(&pm->wake_work); + +@@ -261,6 +262,9 @@ restore_suspend: + clear_bit(MT76_STATE_SUSPEND, &mdev->phy.state); + pm->suspended = false; + ++ if (err < 0) ++ mt7921_reset(&dev->mt76); ++ + return err; + } + +@@ -276,7 +280,7 @@ static int mt7921s_resume(struct device *__dev) + + err = mt7921_mcu_drv_pmctrl(dev); + if (err < 0) +- return err; ++ goto failed; + + mt76_worker_enable(&mdev->tx_worker); + mt76_worker_enable(&mdev->sdio.txrx_worker); +@@ -288,11 +292,12 @@ static int mt7921s_resume(struct device *__dev) + mt76_connac_mcu_set_deep_sleep(mdev, false); + + err = mt76_connac_mcu_set_hif_suspend(mdev, false); +- if (err) +- return err; +- ++failed: + pm->suspended = false; + ++ if (err < 0) ++ mt7921_reset(&dev->mt76); ++ + return err; + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c +index dc38baef273a7..25b4a8001b9e5 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c +@@ -292,11 +292,15 @@ static void mt7921u_disconnect(struct usb_interface *usb_intf) + static int mt7921u_suspend(struct usb_interface *intf, pm_message_t state) + { + struct mt7921_dev *dev = usb_get_intfdata(intf); ++ struct mt76_connac_pm *pm = &dev->pm; + int err; + ++ pm->suspended = true; ++ flush_work(&dev->reset_work); ++ + err = mt76_connac_mcu_set_hif_suspend(&dev->mt76, true); + if (err) +- return err; ++ goto failed; + + mt76u_stop_rx(&dev->mt76); + mt76u_stop_tx(&dev->mt76); +@@ -304,11 +308,20 @@ static int mt7921u_suspend(struct usb_interface *intf, pm_message_t state) + set_bit(MT76_STATE_SUSPEND, &dev->mphy.state); + + return 0; ++ ++failed: ++ pm->suspended = false; ++ ++ if (err < 0) ++ mt7921_reset(&dev->mt76); ++ ++ return err; + } + + static int mt7921u_resume(struct usb_interface *intf) + { + struct mt7921_dev *dev = usb_get_intfdata(intf); ++ struct mt76_connac_pm *pm = &dev->pm; + bool reinit = true; + int err, i; + +@@ -330,16 +343,23 @@ static int mt7921u_resume(struct usb_interface *intf) + if (reinit || mt7921_dma_need_reinit(dev)) { + err = mt7921u_dma_init(dev, true); + if (err) +- return err; ++ goto failed; + } + + clear_bit(MT76_STATE_SUSPEND, &dev->mphy.state); + + err = mt76u_resume_rx(&dev->mt76); + if (err < 0) +- return err; ++ goto failed; ++ ++ err = mt76_connac_mcu_set_hif_suspend(&dev->mt76, false); ++failed: ++ pm->suspended = false; ++ ++ if (err < 0) ++ mt7921_reset(&dev->mt76); + +- return mt76_connac_mcu_set_hif_suspend(&dev->mt76, false); ++ return err; + } + #endif /* CONFIG_PM */ + +diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c +index def7f325f5c54..140145e03f12c 100644 +--- a/drivers/net/wireless/mediatek/mt76/sdio.c ++++ b/drivers/net/wireless/mediatek/mt76/sdio.c +@@ -480,14 +480,14 @@ static void mt76s_status_worker(struct mt76_worker *w) + if (ndata_frames > 0) + resched = true; + +- if (dev->drv->tx_status_data && ++ if (dev->drv->tx_status_data && ndata_frames > 0 && + !test_and_set_bit(MT76_READING_STATS, &dev->phy.state) && + !test_bit(MT76_STATE_SUSPEND, &dev->phy.state)) +- queue_work(dev->wq, &dev->sdio.stat_work); ++ ieee80211_queue_work(dev->hw, &dev->sdio.stat_work); + } while (nframes > 0); + + if (resched) +- mt76_worker_schedule(&dev->sdio.txrx_worker); ++ mt76_worker_schedule(&dev->tx_worker); + } + + static void mt76s_tx_status_data(struct work_struct *work) +@@ -510,7 +510,7 @@ static void mt76s_tx_status_data(struct work_struct *work) + } + + if (count && test_bit(MT76_STATE_RUNNING, &dev->phy.state)) +- queue_work(dev->wq, &sdio->stat_work); ++ ieee80211_queue_work(dev->hw, &sdio->stat_work); + else + clear_bit(MT76_READING_STATS, &dev->phy.state); + } +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +index cbdaf7992f98a..cf3ef44f18f25 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +@@ -4164,7 +4164,10 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, + rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain); + rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain); + rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain); +- rt2800_bbp_write(rt2x00dev, 86, 0); ++ if (rt2x00_rt(rt2x00dev, RT6352)) ++ rt2800_bbp_write(rt2x00dev, 86, 0x38); ++ else ++ rt2800_bbp_write(rt2x00dev, 86, 0); + } + + if (rf->channel <= 14) { +@@ -4365,7 +4368,8 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, + reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2*rt2x00dev->lna_gain; + rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg); + +- rt2800_iq_calibrate(rt2x00dev, rf->channel); ++ if (rt2x00_rt(rt2x00dev, RT5592)) ++ rt2800_iq_calibrate(rt2x00dev, rf->channel); + } + + bbp = rt2800_bbp_read(rt2x00dev, 4); +@@ -5644,7 +5648,8 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev, + if (qual->vgc_level != vgc_level) { + if (rt2x00_rt(rt2x00dev, RT3572) || + rt2x00_rt(rt2x00dev, RT3593) || +- rt2x00_rt(rt2x00dev, RT3883)) { ++ rt2x00_rt(rt2x00dev, RT3883) || ++ rt2x00_rt(rt2x00dev, RT6352)) { + rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, + vgc_level); + } else if (rt2x00_rt(rt2x00dev, RT5592)) { +@@ -5867,7 +5872,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev) + rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404); + } else if (rt2x00_rt(rt2x00dev, RT6352)) { + rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401); +- rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000); ++ rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001); + rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000); + rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000); + rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0); +@@ -6129,6 +6134,27 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev) + reg = rt2800_register_read(rt2x00dev, US_CYC_CNT); + rt2x00_set_field32(®, US_CYC_CNT_CLOCK_CYCLE, 125); + rt2800_register_write(rt2x00dev, US_CYC_CNT, reg); ++ } else if (rt2x00_is_soc(rt2x00dev)) { ++ struct clk *clk = clk_get_sys("bus", NULL); ++ int rate; ++ ++ if (IS_ERR(clk)) { ++ clk = clk_get_sys("cpu", NULL); ++ ++ if (IS_ERR(clk)) { ++ rate = 125; ++ } else { ++ rate = clk_get_rate(clk) / 3000000; ++ clk_put(clk); ++ } ++ } else { ++ rate = clk_get_rate(clk) / 1000000; ++ clk_put(clk); ++ } ++ ++ reg = rt2800_register_read(rt2x00dev, US_CYC_CNT); ++ rt2x00_set_field32(®, US_CYC_CNT_CLOCK_CYCLE, rate); ++ rt2800_register_write(rt2x00dev, US_CYC_CNT, reg); + } + + reg = rt2800_register_read(rt2x00dev, HT_FBK_CFG0); +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 7ddce3c3f0c48..782b089a2e1ba 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1425,7 +1425,7 @@ struct rtl8xxxu_fileops { + void (*set_tx_power) (struct rtl8xxxu_priv *priv, int channel, + bool ht40); + void (*update_rate_mask) (struct rtl8xxxu_priv *priv, +- u32 ramask, u8 rateid, int sgi); ++ u32 ramask, u8 rateid, int sgi, int txbw_40mhz); + void (*report_connect) (struct rtl8xxxu_priv *priv, + u8 macid, bool connect); + void (*fill_txdesc) (struct ieee80211_hw *hw, struct ieee80211_hdr *hdr, +@@ -1511,9 +1511,9 @@ void rtl8xxxu_gen2_config_channel(struct ieee80211_hw *hw); + void rtl8xxxu_gen1_usb_quirks(struct rtl8xxxu_priv *priv); + void rtl8xxxu_gen2_usb_quirks(struct rtl8xxxu_priv *priv); + void rtl8xxxu_update_rate_mask(struct rtl8xxxu_priv *priv, +- u32 ramask, u8 rateid, int sgi); ++ u32 ramask, u8 rateid, int sgi, int txbw_40mhz); + void rtl8xxxu_gen2_update_rate_mask(struct rtl8xxxu_priv *priv, +- u32 ramask, u8 rateid, int sgi); ++ u32 ramask, u8 rateid, int sgi, int txbw_40mhz); + void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv, + u8 macid, bool connect); + void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 8b2ca9e8eac6b..57b5370a256b1 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -1878,13 +1878,6 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv) + + /* We have 8 bits to indicate validity */ + map_addr = offset * 8; +- if (map_addr >= EFUSE_MAP_LEN) { +- dev_warn(dev, "%s: Illegal map_addr (%04x), " +- "efuse corrupt!\n", +- __func__, map_addr); +- ret = -EINVAL; +- goto exit; +- } + for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++) { + /* Check word enable condition in the section */ + if (word_mask & BIT(i)) { +@@ -1895,6 +1888,13 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv) + ret = rtl8xxxu_read_efuse8(priv, efuse_addr++, &val8); + if (ret) + goto exit; ++ if (map_addr >= EFUSE_MAP_LEN - 1) { ++ dev_warn(dev, "%s: Illegal map_addr (%04x), " ++ "efuse corrupt!\n", ++ __func__, map_addr); ++ ret = -EINVAL; ++ goto exit; ++ } + priv->efuse_wifi.raw[map_addr++] = val8; + + ret = rtl8xxxu_read_efuse8(priv, efuse_addr++, &val8); +@@ -2929,12 +2929,12 @@ bool rtl8xxxu_gen2_simularity_compare(struct rtl8xxxu_priv *priv, + } + + if (!(simubitmap & 0x30) && priv->tx_paths > 1) { +- /* path B RX OK */ ++ /* path B TX OK */ + for (i = 4; i < 6; i++) + result[3][i] = result[c1][i]; + } + +- if (!(simubitmap & 0x30) && priv->tx_paths > 1) { ++ if (!(simubitmap & 0xc0) && priv->tx_paths > 1) { + /* path B RX OK */ + for (i = 6; i < 8; i++) + result[3][i] = result[c1][i]; +@@ -4320,7 +4320,7 @@ static void rtl8xxxu_sw_scan_complete(struct ieee80211_hw *hw, + } + + void rtl8xxxu_update_rate_mask(struct rtl8xxxu_priv *priv, +- u32 ramask, u8 rateid, int sgi) ++ u32 ramask, u8 rateid, int sgi, int txbw_40mhz) + { + struct h2c_cmd h2c; + +@@ -4340,10 +4340,15 @@ void rtl8xxxu_update_rate_mask(struct rtl8xxxu_priv *priv, + } + + void rtl8xxxu_gen2_update_rate_mask(struct rtl8xxxu_priv *priv, +- u32 ramask, u8 rateid, int sgi) ++ u32 ramask, u8 rateid, int sgi, int txbw_40mhz) + { + struct h2c_cmd h2c; +- u8 bw = RTL8XXXU_CHANNEL_WIDTH_20; ++ u8 bw; ++ ++ if (txbw_40mhz) ++ bw = RTL8XXXU_CHANNEL_WIDTH_40; ++ else ++ bw = RTL8XXXU_CHANNEL_WIDTH_20; + + memset(&h2c, 0, sizeof(struct h2c_cmd)); + +@@ -4353,15 +4358,14 @@ void rtl8xxxu_gen2_update_rate_mask(struct rtl8xxxu_priv *priv, + h2c.b_macid_cfg.ramask2 = (ramask >> 16) & 0xff; + h2c.b_macid_cfg.ramask3 = (ramask >> 24) & 0xff; + +- h2c.ramask.arg = 0x80; + h2c.b_macid_cfg.data1 = rateid; + if (sgi) + h2c.b_macid_cfg.data1 |= BIT(7); + + h2c.b_macid_cfg.data2 = bw; + +- dev_dbg(&priv->udev->dev, "%s: rate mask %08x, arg %02x, size %zi\n", +- __func__, ramask, h2c.ramask.arg, sizeof(h2c.b_macid_cfg)); ++ dev_dbg(&priv->udev->dev, "%s: rate mask %08x, rateid %02x, sgi %d, size %zi\n", ++ __func__, ramask, rateid, sgi, sizeof(h2c.b_macid_cfg)); + rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.b_macid_cfg)); + } + +@@ -4556,6 +4560,53 @@ rtl8xxxu_wireless_mode(struct ieee80211_hw *hw, struct ieee80211_sta *sta) + return network_type; + } + ++static void rtl8xxxu_set_aifs(struct rtl8xxxu_priv *priv, u8 slot_time) ++{ ++ u32 reg_edca_param[IEEE80211_NUM_ACS] = { ++ [IEEE80211_AC_VO] = REG_EDCA_VO_PARAM, ++ [IEEE80211_AC_VI] = REG_EDCA_VI_PARAM, ++ [IEEE80211_AC_BE] = REG_EDCA_BE_PARAM, ++ [IEEE80211_AC_BK] = REG_EDCA_BK_PARAM, ++ }; ++ u32 val32; ++ u16 wireless_mode = 0; ++ u8 aifs, aifsn, sifs; ++ int i; ++ ++ if (priv->vif) { ++ struct ieee80211_sta *sta; ++ ++ rcu_read_lock(); ++ sta = ieee80211_find_sta(priv->vif, priv->vif->bss_conf.bssid); ++ if (sta) ++ wireless_mode = rtl8xxxu_wireless_mode(priv->hw, sta); ++ rcu_read_unlock(); ++ } ++ ++ if (priv->hw->conf.chandef.chan->band == NL80211_BAND_5GHZ || ++ (wireless_mode & WIRELESS_MODE_N_24G)) ++ sifs = 16; ++ else ++ sifs = 10; ++ ++ for (i = 0; i < IEEE80211_NUM_ACS; i++) { ++ val32 = rtl8xxxu_read32(priv, reg_edca_param[i]); ++ ++ /* It was set in conf_tx. */ ++ aifsn = val32 & 0xff; ++ ++ /* aifsn not set yet or already fixed */ ++ if (aifsn < 2 || aifsn > 15) ++ continue; ++ ++ aifs = aifsn * slot_time + sifs; ++ ++ val32 &= ~0xff; ++ val32 |= aifs; ++ rtl8xxxu_write32(priv, reg_edca_param[i], val32); ++ } ++} ++ + static void + rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + struct ieee80211_bss_conf *bss_conf, u32 changed) +@@ -4622,7 +4673,11 @@ rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + RATE_INFO_FLAGS_SHORT_GI; + } + +- rarpt->txrate.bw |= RATE_INFO_BW_20; ++ if (rtl8xxxu_ht40_2g && ++ (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) ++ rarpt->txrate.bw = RATE_INFO_BW_40; ++ else ++ rarpt->txrate.bw = RATE_INFO_BW_20; + } + bit_rate = cfg80211_calculate_bitrate(&rarpt->txrate); + rarpt->bit_rate = bit_rate; +@@ -4631,7 +4686,7 @@ rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + priv->vif = vif; + priv->rssi_level = RTL8XXXU_RATR_STA_INIT; + +- priv->fops->update_rate_mask(priv, ramask, 0, sgi); ++ priv->fops->update_rate_mask(priv, ramask, 0, sgi, rarpt->txrate.bw == RATE_INFO_BW_40); + + rtl8xxxu_write8(priv, REG_BCN_MAX_ERR, 0xff); + +@@ -4671,6 +4726,8 @@ rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + else + val8 = 20; + rtl8xxxu_write8(priv, REG_SLOT, val8); ++ ++ rtl8xxxu_set_aifs(priv, val8); + } + + if (changed & BSS_CHANGED_BSSID) { +@@ -5062,6 +5119,8 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw, + if (control && control->sta) + sta = control->sta; + ++ queue = rtl8xxxu_queue_select(hw, skb); ++ + tx_desc = skb_push(skb, tx_desc_size); + + memset(tx_desc, 0, tx_desc_size); +@@ -5074,7 +5133,6 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw, + is_broadcast_ether_addr(ieee80211_get_DA(hdr))) + tx_desc->txdw0 |= TXDESC_BROADMULTICAST; + +- queue = rtl8xxxu_queue_select(hw, skb); + tx_desc->txdw1 = cpu_to_le32(queue << TXDESC_QUEUE_SHIFT); + + if (tx_info->control.hw_key) { +@@ -6343,7 +6401,7 @@ static void rtl8xxxu_refresh_rate_mask(struct rtl8xxxu_priv *priv, + } + + priv->rssi_level = rssi_level; +- priv->fops->update_rate_mask(priv, rate_bitmap, ratr_idx, sgi); ++ priv->fops->update_rate_mask(priv, rate_bitmap, ratr_idx, sgi, txbw_40mhz); + } + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +index 15e6a6aded319..d18c092b61426 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +@@ -2386,11 +2386,10 @@ void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel) + rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, + "Just Read IQK Matrix reg for channel:%d....\n", + channel); +- _rtl92d_phy_patha_fill_iqk_matrix(hw, true, +- rtlphy->iqk_matrix[ +- indexforchannel].value, 0, +- (rtlphy->iqk_matrix[ +- indexforchannel].value[0][2] == 0)); ++ if (rtlphy->iqk_matrix[indexforchannel].value[0][0] != 0) ++ _rtl92d_phy_patha_fill_iqk_matrix(hw, true, ++ rtlphy->iqk_matrix[indexforchannel].value, 0, ++ rtlphy->iqk_matrix[indexforchannel].value[0][2] == 0); + if (IS_92D_SINGLEPHY(rtlhal->version)) { + if ((rtlphy->iqk_matrix[ + indexforchannel].value[0][4] != 0) +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 645ef1d018953..c364482ab331d 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -2037,7 +2037,7 @@ int rtw_core_init(struct rtw_dev *rtwdev) + ret = rtw_load_firmware(rtwdev, RTW_NORMAL_FW); + if (ret) { + rtw_warn(rtwdev, "no firmware loaded\n"); +- return ret; ++ goto out; + } + + if (chip->wow_fw_name) { +@@ -2047,11 +2047,15 @@ int rtw_core_init(struct rtw_dev *rtwdev) + wait_for_completion(&rtwdev->fw.completion); + if (rtwdev->fw.firmware) + release_firmware(rtwdev->fw.firmware); +- return ret; ++ goto out; + } + } + + return 0; ++ ++out: ++ destroy_workqueue(rtwdev->tx_wq); ++ return ret; + } + EXPORT_SYMBOL(rtw_core_init); + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index a6a90572e74bf..7313eb80fb1e3 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -860,6 +860,7 @@ int rtw89_h2c_tx(struct rtw89_dev *rtwdev, + rtw89_debug(rtwdev, RTW89_DBG_FW, + "ignore h2c due to power is off with firmware state=%d\n", + test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags)); ++ dev_kfree_skb(skb); + return 0; + } + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index 4718aced1428a..e7f86d84d91d7 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -2288,6 +2288,7 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, + { + struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv; + struct cfg80211_scan_request *req = &scan_req->req; ++ u32 rx_fltr = rtwdev->hal.rx_fltr; + u8 mac_addr[ETH_ALEN]; + + rtwdev->scan_info.scanning_vif = vif; +@@ -2302,13 +2303,13 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, + ether_addr_copy(mac_addr, vif->addr); + rtw89_core_scan_start(rtwdev, rtwvif, mac_addr, true); + +- rtwdev->hal.rx_fltr &= ~B_AX_A_BCN_CHK_EN; +- rtwdev->hal.rx_fltr &= ~B_AX_A_BC; +- rtwdev->hal.rx_fltr &= ~B_AX_A_A1_MATCH; ++ rx_fltr &= ~B_AX_A_BCN_CHK_EN; ++ rx_fltr &= ~B_AX_A_BC; ++ rx_fltr &= ~B_AX_A_A1_MATCH; + rtw89_write32_mask(rtwdev, + rtw89_mac_reg_by_idx(R_AX_RX_FLTR_OPT, RTW89_MAC_0), + B_AX_RX_FLTR_CFG_MASK, +- rtwdev->hal.rx_fltr); ++ rx_fltr); + } + + void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, +@@ -2322,9 +2323,6 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, + if (!vif) + return; + +- rtwdev->hal.rx_fltr |= B_AX_A_BCN_CHK_EN; +- rtwdev->hal.rx_fltr |= B_AX_A_BC; +- rtwdev->hal.rx_fltr |= B_AX_A_A1_MATCH; + rtw89_write32_mask(rtwdev, + rtw89_mac_reg_by_idx(R_AX_RX_FLTR_OPT, RTW89_MAC_0), + B_AX_RX_FLTR_CFG_MASK, +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 0ef7821b2e0fc..bc8132e919928 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -756,7 +756,8 @@ static irqreturn_t rtw89_pci_interrupt_threadfn(int irq, void *dev) + + enable_intr: + spin_lock_irqsave(&rtwpci->irq_lock, flags); +- rtw89_chip_enable_intr(rtwdev, rtwpci); ++ if (likely(rtwpci->running)) ++ rtw89_chip_enable_intr(rtwdev, rtwpci); + spin_unlock_irqrestore(&rtwpci->irq_lock, flags); + return IRQ_HANDLED; + } +@@ -921,10 +922,12 @@ u32 __rtw89_pci_check_and_reclaim_tx_resource_noio(struct rtw89_dev *rtwdev, + { + struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; + struct rtw89_pci_tx_ring *tx_ring = &rtwpci->tx_rings[txch]; ++ struct rtw89_pci_tx_wd_ring *wd_ring = &tx_ring->wd_ring; + u32 cnt; + + spin_lock_bh(&rtwpci->trx_lock); + cnt = rtw89_pci_get_avail_txbd_num(tx_ring); ++ cnt = min(cnt, wd_ring->curr_num); + spin_unlock_bh(&rtwpci->trx_lock); + + return cnt; +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index 9e95ed9727108..5d88200cbd3e5 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -152,7 +152,10 @@ static void ser_state_run(struct rtw89_ser *ser, u8 evt) + rtw89_debug(rtwdev, RTW89_DBG_SER, "ser: %s receive %s\n", + ser_st_name(ser), ser_ev_name(ser, evt)); + ++ mutex_lock(&rtwdev->mutex); + rtw89_leave_lps(rtwdev); ++ mutex_unlock(&rtwdev->mutex); ++ + ser->st_tbl[ser->state].st_func(ser, evt); + } + +diff --git a/drivers/net/wireless/silabs/wfx/main.c b/drivers/net/wireless/silabs/wfx/main.c +index e015bfb8d221f..84d82ddded567 100644 +--- a/drivers/net/wireless/silabs/wfx/main.c ++++ b/drivers/net/wireless/silabs/wfx/main.c +@@ -181,7 +181,7 @@ int wfx_send_pds(struct wfx_dev *wdev, u8 *buf, size_t len) + while (len > 0) { + chunk_type = get_unaligned_le16(buf + 0); + chunk_len = get_unaligned_le16(buf + 2); +- if (chunk_len > len) { ++ if (chunk_len < 4 || chunk_len > len) { + dev_err(wdev->dev, "PDS:%d: corrupted file\n", chunk_num); + return -EINVAL; + } +diff --git a/drivers/net/wireless/st/cw1200/queue.c b/drivers/net/wireless/st/cw1200/queue.c +index e06da4b3b0d46..805a3c1bf8fe2 100644 +--- a/drivers/net/wireless/st/cw1200/queue.c ++++ b/drivers/net/wireless/st/cw1200/queue.c +@@ -91,23 +91,25 @@ static void __cw1200_queue_gc(struct cw1200_queue *queue, + bool unlock) + { + struct cw1200_queue_stats *stats = queue->stats; +- struct cw1200_queue_item *item = NULL, *tmp; ++ struct cw1200_queue_item *item = NULL, *iter, *tmp; + bool wakeup_stats = false; + +- list_for_each_entry_safe(item, tmp, &queue->queue, head) { +- if (time_is_after_jiffies(item->queue_timestamp + queue->ttl)) ++ list_for_each_entry_safe(iter, tmp, &queue->queue, head) { ++ if (time_is_after_jiffies(iter->queue_timestamp + queue->ttl)) { ++ item = iter; + break; ++ } + --queue->num_queued; +- --queue->link_map_cache[item->txpriv.link_id]; ++ --queue->link_map_cache[iter->txpriv.link_id]; + spin_lock_bh(&stats->lock); + --stats->num_queued; +- if (!--stats->link_map_cache[item->txpriv.link_id]) ++ if (!--stats->link_map_cache[iter->txpriv.link_id]) + wakeup_stats = true; + spin_unlock_bh(&stats->lock); + cw1200_debug_tx_ttl(stats->priv); +- cw1200_queue_register_post_gc(head, item); +- item->skb = NULL; +- list_move_tail(&item->head, &queue->free_pool); ++ cw1200_queue_register_post_gc(head, iter); ++ iter->skb = NULL; ++ list_move_tail(&iter->head, &queue->free_pool); + } + + if (wakeup_stats) +diff --git a/drivers/net/wwan/iosm/iosm_ipc_wwan.c b/drivers/net/wwan/iosm/iosm_ipc_wwan.c +index 27151148c782c..4712f01a7e33e 100644 +--- a/drivers/net/wwan/iosm/iosm_ipc_wwan.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_wwan.c +@@ -323,15 +323,16 @@ struct iosm_wwan *ipc_wwan_init(struct iosm_imem *ipc_imem, struct device *dev) + ipc_wwan->dev = dev; + ipc_wwan->ipc_imem = ipc_imem; + ++ mutex_init(&ipc_wwan->if_mutex); ++ + /* WWAN core will create a netdev for the default IP MUX channel */ + if (wwan_register_ops(ipc_wwan->dev, &iosm_wwan_ops, ipc_wwan, + IP_MUX_SESSION_DEFAULT)) { ++ mutex_destroy(&ipc_wwan->if_mutex); + kfree(ipc_wwan); + return NULL; + } + +- mutex_init(&ipc_wwan->if_mutex); +- + return ipc_wwan; + } + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 326ad33537ede..698e65883d822 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1089,8 +1089,8 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + return effects; + } + +-static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects, +- struct nvme_command *cmd, int status) ++void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects, ++ struct nvme_command *cmd, int status) + { + if (effects & NVME_CMD_EFFECTS_CSE_MASK) { + nvme_unfreeze(ctrl); +@@ -1126,21 +1126,16 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects, + break; + } + } ++EXPORT_SYMBOL_NS_GPL(nvme_passthru_end, NVME_TARGET_PASSTHRU); + +-int nvme_execute_passthru_rq(struct request *rq) ++int nvme_execute_passthru_rq(struct request *rq, u32 *effects) + { + struct nvme_command *cmd = nvme_req(rq)->cmd; + struct nvme_ctrl *ctrl = nvme_req(rq)->ctrl; + struct nvme_ns *ns = rq->q->queuedata; +- u32 effects; +- int ret; + +- effects = nvme_passthru_start(ctrl, ns, cmd->common.opcode); +- ret = nvme_execute_rq(rq, false); +- if (effects) /* nothing to be done for zero cmd effects */ +- nvme_passthru_end(ctrl, effects, cmd, ret); +- +- return ret; ++ *effects = nvme_passthru_start(ctrl, ns, cmd->common.opcode); ++ return nvme_execute_rq(rq, false); + } + EXPORT_SYMBOL_NS_GPL(nvme_execute_passthru_rq, NVME_TARGET_PASSTHRU); + +@@ -2801,7 +2796,6 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + nvme_init_subnqn(subsys, ctrl, id); + memcpy(subsys->serial, id->sn, sizeof(subsys->serial)); + memcpy(subsys->model, id->mn, sizeof(subsys->model)); +- memcpy(subsys->firmware_rev, id->fr, sizeof(subsys->firmware_rev)); + subsys->vendor_id = le16_to_cpu(id->vid); + subsys->cmic = id->cmic; + +@@ -3020,6 +3014,8 @@ static int nvme_init_identify(struct nvme_ctrl *ctrl) + ctrl->quirks |= core_quirks[i].quirks; + } + } ++ memcpy(ctrl->subsys->firmware_rev, id->fr, ++ sizeof(ctrl->subsys->firmware_rev)); + + if (force_apst && (ctrl->quirks & NVME_QUIRK_NO_DEEPEST_PS)) { + dev_warn(ctrl->device, "forcibly allowing all power states due to nvme_core.force_apst -- use at your own risk\n"); +diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c +index a2e89db1cd639..15a60e1f290a0 100644 +--- a/drivers/nvme/host/ioctl.c ++++ b/drivers/nvme/host/ioctl.c +@@ -136,9 +136,11 @@ static int nvme_submit_user_cmd(struct request_queue *q, + unsigned bufflen, void __user *meta_buffer, unsigned meta_len, + u32 meta_seed, u64 *result, unsigned timeout, bool vec) + { ++ struct nvme_ctrl *ctrl; + struct request *req; + void *meta = NULL; + struct bio *bio; ++ u32 effects; + int ret; + + req = nvme_alloc_user_request(q, cmd, ubuffer, bufflen, meta_buffer, +@@ -147,8 +149,9 @@ static int nvme_submit_user_cmd(struct request_queue *q, + return PTR_ERR(req); + + bio = req->bio; ++ ctrl = nvme_req(req)->ctrl; + +- ret = nvme_execute_passthru_rq(req); ++ ret = nvme_execute_passthru_rq(req, &effects); + + if (result) + *result = le64_to_cpu(nvme_req(req)->result.u64); +@@ -158,6 +161,10 @@ static int nvme_submit_user_cmd(struct request_queue *q, + if (bio) + blk_rq_unmap_user(bio); + blk_mq_free_request(req); ++ ++ if (effects) ++ nvme_passthru_end(ctrl, effects, cmd, ret); ++ + return ret; + } + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 432ea9793a849..3046d49855811 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -182,6 +182,7 @@ void nvme_mpath_revalidate_paths(struct nvme_ns *ns) + + for_each_node(node) + rcu_assign_pointer(head->current_path[node], NULL); ++ kblockd_schedule_work(&head->requeue_work); + } + + static bool nvme_path_is_disabled(struct nvme_ns *ns) +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 5558f88121579..e154e23042037 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -994,7 +994,9 @@ static inline bool nvme_ctrl_sgl_supported(struct nvme_ctrl *ctrl) + + u32 nvme_command_effects(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + u8 opcode); +-int nvme_execute_passthru_rq(struct request *rq); ++int nvme_execute_passthru_rq(struct request *rq, u32 *effects); ++void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects, ++ struct nvme_command *cmd, int status); + struct nvme_ctrl *nvme_ctrl_from_file(struct file *file); + struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid); + void nvme_put_ns(struct nvme_ns *ns); +diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c +index 6f39a29828b12..94d3153bae54d 100644 +--- a/drivers/nvme/target/passthru.c ++++ b/drivers/nvme/target/passthru.c +@@ -215,9 +215,11 @@ static void nvmet_passthru_execute_cmd_work(struct work_struct *w) + { + struct nvmet_req *req = container_of(w, struct nvmet_req, p.work); + struct request *rq = req->p.rq; ++ struct nvme_ctrl *ctrl = nvme_req(rq)->ctrl; ++ u32 effects; + int status; + +- status = nvme_execute_passthru_rq(rq); ++ status = nvme_execute_passthru_rq(rq, &effects); + + if (status == NVME_SC_SUCCESS && + req->cmd->common.opcode == nvme_admin_identify) { +@@ -238,6 +240,9 @@ static void nvmet_passthru_execute_cmd_work(struct work_struct *w) + req->cqe->result = nvme_req(rq)->result; + nvmet_req_complete(req, status); + blk_mq_free_request(rq); ++ ++ if (effects) ++ nvme_passthru_end(ctrl, effects, req->cmd, status); + } + + static void nvmet_passthru_req_done(struct request *rq, +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index a3694a32f6d52..7dcf88cde1893 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -935,10 +935,17 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) + struct nvme_tcp_data_pdu *data = &queue->pdu.data; + struct nvmet_tcp_cmd *cmd; + +- if (likely(queue->nr_cmds)) ++ if (likely(queue->nr_cmds)) { ++ if (unlikely(data->ttag >= queue->nr_cmds)) { ++ pr_err("queue %d: received out of bound ttag %u, nr_cmds %u\n", ++ queue->idx, data->ttag, queue->nr_cmds); ++ nvmet_tcp_fatal_error(queue); ++ return -EPROTO; ++ } + cmd = &queue->cmds[data->ttag]; +- else ++ } else { + cmd = &queue->connect; ++ } + + if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) { + pr_err("ttag %u unexpected data offset %u (expected %u)\n", +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 1e3c754efd0d8..2164efd12ba9b 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -829,21 +829,18 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + nvmem->dev.groups = nvmem_dev_groups; + #endif + +- if (nvmem->nkeepout) { +- rval = nvmem_validate_keepouts(nvmem); +- if (rval) { +- ida_free(&nvmem_ida, nvmem->id); +- kfree(nvmem); +- return ERR_PTR(rval); +- } +- } +- + dev_dbg(&nvmem->dev, "Registering nvmem device %s\n", config->name); + + rval = device_register(&nvmem->dev); + if (rval) + goto err_put_device; + ++ if (nvmem->nkeepout) { ++ rval = nvmem_validate_keepouts(nvmem); ++ if (rval) ++ goto err_device_del; ++ } ++ + if (config->compat) { + rval = nvmem_sysfs_setup_compat(nvmem, config); + if (rval) +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index 439ac5f5907a6..b492e67c3d871 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -214,6 +214,17 @@ static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev, + + root = pci_find_parent_resource(dev, res); + if (!root) { ++ /* ++ * If dev is behind a bridge, accesses will only reach it ++ * if res is inside the relevant bridge window. ++ */ ++ if (pci_upstream_bridge(dev)) ++ return -ENXIO; ++ ++ /* ++ * On the root bus, assume the host bridge will forward ++ * everything. ++ */ + if (res->flags & IORESOURCE_IO) + root = &ioport_resource; + else +diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c +index 1ec5baa673f92..54be0b37e01ef 100644 +--- a/drivers/perf/riscv_pmu_sbi.c ++++ b/drivers/perf/riscv_pmu_sbi.c +@@ -639,8 +639,11 @@ static int pmu_sbi_starting_cpu(unsigned int cpu, struct hlist_node *node) + struct riscv_pmu *pmu = hlist_entry_safe(node, struct riscv_pmu, node); + struct cpu_hw_events *cpu_hw_evt = this_cpu_ptr(pmu->hw_events); + +- /* Enable the access for TIME csr only from the user mode now */ +- csr_write(CSR_SCOUNTEREN, 0x2); ++ /* ++ * Enable the access for CYCLE, TIME, and INSTRET CSRs from userspace, ++ * as is necessary to maintain uABI compatibility. ++ */ ++ csr_write(CSR_SCOUNTEREN, 0x7); + + /* Stop all the counters so that they can be enabled from perf */ + pmu_sbi_stop_all(pmu); +diff --git a/drivers/phy/amlogic/phy-meson-axg-mipi-pcie-analog.c b/drivers/phy/amlogic/phy-meson-axg-mipi-pcie-analog.c +index 1027ece6ca123..a3e1108b736d6 100644 +--- a/drivers/phy/amlogic/phy-meson-axg-mipi-pcie-analog.c ++++ b/drivers/phy/amlogic/phy-meson-axg-mipi-pcie-analog.c +@@ -197,7 +197,7 @@ static int phy_axg_mipi_pcie_analog_probe(struct platform_device *pdev) + struct phy_provider *phy; + struct device *dev = &pdev->dev; + struct phy_axg_mipi_pcie_analog_priv *priv; +- struct device_node *np = dev->of_node; ++ struct device_node *np = dev->of_node, *parent_np; + struct regmap *map; + int ret; + +@@ -206,7 +206,9 @@ static int phy_axg_mipi_pcie_analog_probe(struct platform_device *pdev) + return -ENOMEM; + + /* Get the hhi system controller node */ +- map = syscon_node_to_regmap(of_get_parent(dev->of_node)); ++ parent_np = of_get_parent(dev->of_node); ++ map = syscon_node_to_regmap(parent_np); ++ of_node_put(parent_np); + if (IS_ERR(map)) { + dev_err(dev, + "failed to get HHI regmap\n"); +diff --git a/drivers/phy/mediatek/phy-mtk-tphy.c b/drivers/phy/mediatek/phy-mtk-tphy.c +index 8ee7682b8e93e..bdffc21858f6b 100644 +--- a/drivers/phy/mediatek/phy-mtk-tphy.c ++++ b/drivers/phy/mediatek/phy-mtk-tphy.c +@@ -906,7 +906,7 @@ static int phy_type_syscon_get(struct mtk_phy_instance *instance, + static int phy_type_set(struct mtk_phy_instance *instance) + { + int type; +- u32 mask; ++ u32 offset; + + if (!instance->type_sw) + return 0; +@@ -929,8 +929,9 @@ static int phy_type_set(struct mtk_phy_instance *instance) + return 0; + } + +- mask = RG_PHY_SW_TYPE << (instance->type_sw_index * BITS_PER_BYTE); +- regmap_update_bits(instance->type_sw, instance->type_sw_reg, mask, type); ++ offset = instance->type_sw_index * BITS_PER_BYTE; ++ regmap_update_bits(instance->type_sw, instance->type_sw_reg, ++ RG_PHY_SW_TYPE << offset, type << offset); + + return 0; + } +diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hsic.c b/drivers/phy/qualcomm/phy-qcom-usb-hsic.c +index 716a77748ed83..20f6dd37c7c10 100644 +--- a/drivers/phy/qualcomm/phy-qcom-usb-hsic.c ++++ b/drivers/phy/qualcomm/phy-qcom-usb-hsic.c +@@ -54,8 +54,10 @@ static int qcom_usb_hsic_phy_power_on(struct phy *phy) + + /* Configure pins for HSIC functionality */ + pins_default = pinctrl_lookup_state(uphy->pctl, PINCTRL_STATE_DEFAULT); +- if (IS_ERR(pins_default)) +- return PTR_ERR(pins_default); ++ if (IS_ERR(pins_default)) { ++ ret = PTR_ERR(pins_default); ++ goto err_ulpi; ++ } + + ret = pinctrl_select_state(uphy->pctl, pins_default); + if (ret) +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +index 5223d4c9afdfc..39f14a5b78cdc 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +@@ -1124,7 +1124,7 @@ static int rockchip_usb2phy_otg_port_init(struct rockchip_usb2phy *rphy, + struct rockchip_usb2phy_port *rport, + struct device_node *child_np) + { +- int ret; ++ int ret, id; + + rport->port_id = USB2PHY_PORT_OTG; + rport->port_cfg = &rphy->phy_cfg->port_cfgs[USB2PHY_PORT_OTG]; +@@ -1162,13 +1162,15 @@ static int rockchip_usb2phy_otg_port_init(struct rockchip_usb2phy *rphy, + + ret = devm_extcon_register_notifier(rphy->dev, rphy->edev, + EXTCON_USB_HOST, &rport->event_nb); +- if (ret) ++ if (ret) { + dev_err(rphy->dev, "register USB HOST notifier failed\n"); ++ goto out; ++ } + + if (!of_property_read_bool(rphy->dev->of_node, "extcon")) { + /* do initial sync of usb state */ +- ret = property_enabled(rphy->grf, &rport->port_cfg->utmi_id); +- extcon_set_state_sync(rphy->edev, EXTCON_USB_HOST, !ret); ++ id = property_enabled(rphy->grf, &rport->port_cfg->utmi_id); ++ extcon_set_state_sync(rphy->edev, EXTCON_USB_HOST, !id); + } + } + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 32e41395fc768..c84bd0e1ce5a6 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -2393,11 +2393,24 @@ static int rockchip_pmx_set(struct pinctrl_dev *pctldev, unsigned selector, + return 0; + } + ++static int rockchip_pmx_gpio_set_direction(struct pinctrl_dev *pctldev, ++ struct pinctrl_gpio_range *range, ++ unsigned offset, ++ bool input) ++{ ++ struct rockchip_pinctrl *info = pinctrl_dev_get_drvdata(pctldev); ++ struct rockchip_pin_bank *bank; ++ ++ bank = pin_to_bank(info, offset); ++ return rockchip_set_mux(bank, offset - bank->pin_base, RK_FUNC_GPIO); ++} ++ + static const struct pinmux_ops rockchip_pmx_ops = { + .get_functions_count = rockchip_pmx_get_funcs_count, + .get_function_name = rockchip_pmx_get_func_name, + .get_function_groups = rockchip_pmx_get_groups, + .set_mux = rockchip_pmx_set, ++ .gpio_set_direction = rockchip_pmx_gpio_set_direction, + }; + + /* +diff --git a/drivers/platform/chrome/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c +index 4e14b4d6635d7..a2cdbfbaeae6b 100644 +--- a/drivers/platform/chrome/chromeos_laptop.c ++++ b/drivers/platform/chrome/chromeos_laptop.c +@@ -740,6 +740,7 @@ static int __init + chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, + const struct chromeos_laptop *src) + { ++ struct i2c_peripheral *i2c_peripherals; + struct i2c_peripheral *i2c_dev; + struct i2c_board_info *info; + int i; +@@ -748,17 +749,15 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, + if (!src->num_i2c_peripherals) + return 0; + +- cros_laptop->i2c_peripherals = kmemdup(src->i2c_peripherals, +- src->num_i2c_peripherals * +- sizeof(*src->i2c_peripherals), +- GFP_KERNEL); +- if (!cros_laptop->i2c_peripherals) ++ i2c_peripherals = kmemdup(src->i2c_peripherals, ++ src->num_i2c_peripherals * ++ sizeof(*src->i2c_peripherals), ++ GFP_KERNEL); ++ if (!i2c_peripherals) + return -ENOMEM; + +- cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals; +- +- for (i = 0; i < cros_laptop->num_i2c_peripherals; i++) { +- i2c_dev = &cros_laptop->i2c_peripherals[i]; ++ for (i = 0; i < src->num_i2c_peripherals; i++) { ++ i2c_dev = &i2c_peripherals[i]; + info = &i2c_dev->board_info; + + error = chromeos_laptop_setup_irq(i2c_dev); +@@ -775,16 +774,19 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, + } + } + ++ cros_laptop->i2c_peripherals = i2c_peripherals; ++ cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals; ++ + return 0; + + err_out: + while (--i >= 0) { +- i2c_dev = &cros_laptop->i2c_peripherals[i]; ++ i2c_dev = &i2c_peripherals[i]; + info = &i2c_dev->board_info; + if (!IS_ERR_OR_NULL(info->fwnode)) + fwnode_remove_software_node(info->fwnode); + } +- kfree(cros_laptop->i2c_peripherals); ++ kfree(i2c_peripherals); + return error; + } + +diff --git a/drivers/platform/chrome/cros_ec.c b/drivers/platform/chrome/cros_ec.c +index 00381490dd3e3..4b0934ef77142 100644 +--- a/drivers/platform/chrome/cros_ec.c ++++ b/drivers/platform/chrome/cros_ec.c +@@ -352,10 +352,16 @@ EXPORT_SYMBOL(cros_ec_suspend); + + static void cros_ec_report_events_during_suspend(struct cros_ec_device *ec_dev) + { ++ bool wake_event; ++ + while (ec_dev->mkbp_event_supported && +- cros_ec_get_next_event(ec_dev, NULL, NULL) > 0) ++ cros_ec_get_next_event(ec_dev, &wake_event, NULL) > 0) { + blocking_notifier_call_chain(&ec_dev->event_notifier, + 1, ec_dev); ++ ++ if (wake_event && device_may_wakeup(ec_dev->dev)) ++ pm_wakeup_event(ec_dev->dev, 0); ++ } + } + + /** +diff --git a/drivers/platform/chrome/cros_ec_chardev.c b/drivers/platform/chrome/cros_ec_chardev.c +index fd33de546aee0..0de7c255254e0 100644 +--- a/drivers/platform/chrome/cros_ec_chardev.c ++++ b/drivers/platform/chrome/cros_ec_chardev.c +@@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec, + if (copy_from_user(&s_mem, arg, sizeof(s_mem))) + return -EFAULT; + ++ if (s_mem.bytes > sizeof(s_mem.buffer)) ++ return -EINVAL; ++ + num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes, + s_mem.buffer); + if (num <= 0) +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index 40dc048d18ad3..6a3aa15630c1a 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -750,6 +750,7 @@ int cros_ec_get_next_event(struct cros_ec_device *ec_dev, + u8 event_type; + u32 host_event; + int ret; ++ u32 ver_mask; + + /* + * Default value for wake_event. +@@ -771,6 +772,37 @@ int cros_ec_get_next_event(struct cros_ec_device *ec_dev, + return get_keyboard_state_event(ec_dev); + + ret = get_next_event(ec_dev); ++ /* ++ * -ENOPROTOOPT is returned when EC returns EC_RES_INVALID_VERSION. ++ * This can occur when EC based device (e.g. Fingerprint MCU) jumps to ++ * the RO image which doesn't support newer version of the command. In ++ * this case we will attempt to update maximum supported version of the ++ * EC_CMD_GET_NEXT_EVENT. ++ */ ++ if (ret == -ENOPROTOOPT) { ++ dev_dbg(ec_dev->dev, ++ "GET_NEXT_EVENT returned invalid version error.\n"); ++ ret = cros_ec_get_host_command_version_mask(ec_dev, ++ EC_CMD_GET_NEXT_EVENT, ++ &ver_mask); ++ if (ret < 0 || ver_mask == 0) ++ /* ++ * Do not change the MKBP supported version if we can't ++ * obtain supported version correctly. Please note that ++ * calling EC_CMD_GET_NEXT_EVENT returned ++ * EC_RES_INVALID_VERSION which means that the command ++ * is present. ++ */ ++ return -ENOPROTOOPT; ++ ++ ec_dev->mkbp_event_supported = fls(ver_mask); ++ dev_dbg(ec_dev->dev, "MKBP support version changed to %u\n", ++ ec_dev->mkbp_event_supported - 1); ++ ++ /* Try to get next event with new MKBP support version set. */ ++ ret = get_next_event(ec_dev); ++ } ++ + if (ret <= 0) + return ret; + +diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c +index 7cb2e35c4dede..1305a22a88313 100644 +--- a/drivers/platform/chrome/cros_ec_typec.c ++++ b/drivers/platform/chrome/cros_ec_typec.c +@@ -669,7 +669,7 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_ + for (j = 0; j < sop_disc->svids[i].mode_count; j++) { + memset(&desc, 0, sizeof(desc)); + desc.svid = sop_disc->svids[i].svid; +- desc.mode = j; ++ desc.mode = j + 1; + desc.vdo = sop_disc->svids[i].mode_vdo[j]; + + if (is_partner) +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index bc7020e9df9e8..fc8dbbd6fc7c2 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -177,7 +177,8 @@ enum hp_thermal_profile_omen_v1 { + enum hp_thermal_profile { + HP_THERMAL_PROFILE_PERFORMANCE = 0x00, + HP_THERMAL_PROFILE_DEFAULT = 0x01, +- HP_THERMAL_PROFILE_COOL = 0x02 ++ HP_THERMAL_PROFILE_COOL = 0x02, ++ HP_THERMAL_PROFILE_QUIET = 0x03, + }; + + #define IS_HWBLOCKED(x) ((x & HPWMI_POWER_FW_OR_HW) != HPWMI_POWER_FW_OR_HW) +@@ -1194,6 +1195,9 @@ static int hp_wmi_platform_profile_get(struct platform_profile_handler *pprof, + case HP_THERMAL_PROFILE_COOL: + *profile = PLATFORM_PROFILE_COOL; + break; ++ case HP_THERMAL_PROFILE_QUIET: ++ *profile = PLATFORM_PROFILE_QUIET; ++ break; + default: + return -EINVAL; + } +@@ -1216,6 +1220,9 @@ static int hp_wmi_platform_profile_set(struct platform_profile_handler *pprof, + case PLATFORM_PROFILE_COOL: + tp = HP_THERMAL_PROFILE_COOL; + break; ++ case PLATFORM_PROFILE_QUIET: ++ tp = HP_THERMAL_PROFILE_QUIET; ++ break; + default: + return -EOPNOTSUPP; + } +@@ -1263,6 +1270,8 @@ static int thermal_profile_setup(void) + + platform_profile_handler.profile_get = hp_wmi_platform_profile_get; + platform_profile_handler.profile_set = hp_wmi_platform_profile_set; ++ ++ set_bit(PLATFORM_PROFILE_QUIET, platform_profile_handler.choices); + } + + set_bit(PLATFORM_PROFILE_COOL, platform_profile_handler.choices); +diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c +index 24ffc8e2d2d1e..0e804b6c2d242 100644 +--- a/drivers/platform/x86/msi-laptop.c ++++ b/drivers/platform/x86/msi-laptop.c +@@ -596,11 +596,10 @@ static const struct dmi_system_id msi_dmi_table[] __initconst = { + { + .ident = "MSI S270", + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD"), ++ DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT"), + DMI_MATCH(DMI_PRODUCT_NAME, "MS-1013"), + DMI_MATCH(DMI_PRODUCT_VERSION, "0131"), +- DMI_MATCH(DMI_CHASSIS_VENDOR, +- "MICRO-STAR INT'L CO.,LTD") ++ DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR INT") + }, + .driver_data = &quirk_old_ec_model, + .callback = dmi_check_cb +@@ -633,8 +632,7 @@ static const struct dmi_system_id msi_dmi_table[] __initconst = { + DMI_MATCH(DMI_SYS_VENDOR, "NOTEBOOK"), + DMI_MATCH(DMI_PRODUCT_NAME, "SAM2000"), + DMI_MATCH(DMI_PRODUCT_VERSION, "0131"), +- DMI_MATCH(DMI_CHASSIS_VENDOR, +- "MICRO-STAR INT'L CO.,LTD") ++ DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR INT") + }, + .driver_data = &quirk_old_ec_model, + .callback = dmi_check_cb +@@ -1048,8 +1046,7 @@ static int __init msi_init(void) + return -EINVAL; + + /* Register backlight stuff */ +- +- if (quirks->old_ec_model || ++ if (quirks->old_ec_model && + acpi_video_get_backlight_type() == acpi_backlight_vendor) { + struct backlight_properties props; + memset(&props, 0, sizeof(struct backlight_properties)); +@@ -1117,6 +1114,8 @@ fail_create_attr: + fail_create_group: + if (quirks->load_scm_model) { + i8042_remove_filter(msi_laptop_i8042_filter); ++ cancel_delayed_work_sync(&msi_touchpad_dwork); ++ input_unregister_device(msi_laptop_input_dev); + cancel_delayed_work_sync(&msi_rfkill_dwork); + cancel_work_sync(&msi_rfkill_work); + rfkill_cleanup(); +@@ -1137,6 +1136,7 @@ static void __exit msi_cleanup(void) + { + if (quirks->load_scm_model) { + i8042_remove_filter(msi_laptop_i8042_filter); ++ cancel_delayed_work_sync(&msi_touchpad_dwork); + input_unregister_device(msi_laptop_input_dev); + cancel_delayed_work_sync(&msi_rfkill_dwork); + cancel_work_sync(&msi_rfkill_work); +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index 5c757c7f64dee..f4046572a9fe5 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -354,7 +354,7 @@ static bool pmc_clk_is_critical = true; + + static int dmi_callback(const struct dmi_system_id *d) + { +- pr_info("%s critclks quirk enabled\n", d->ident); ++ pr_info("%s: PMC critical clocks quirk enabled\n", d->ident); + + return 1; + } +diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c +index 003557043ab3a..daee1161c3059 100644 +--- a/drivers/power/supply/adp5061.c ++++ b/drivers/power/supply/adp5061.c +@@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st, + if (ret < 0) + return ret; + +- chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)]; +- if (chg_type > ADP5061_CHG_FAST_CV) ++ chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1); ++ if (chg_type >= ARRAY_SIZE(adp5061_chg_type)) + val->intval = POWER_SUPPLY_STATUS_UNKNOWN; + else +- val->intval = chg_type; ++ val->intval = adp5061_chg_type[chg_type]; + + return ret; + } +diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c +index a9c99d9e8b428..c053fac05cc24 100644 +--- a/drivers/powercap/intel_rapl_common.c ++++ b/drivers/powercap/intel_rapl_common.c +@@ -994,6 +994,9 @@ static u64 rapl_compute_time_window_core(struct rapl_package *rp, u64 value, + y = value & 0x1f; + value = (1 << y) * (4 + f) * rp->time_unit / 4; + } else { ++ if (value < rp->time_unit) ++ return 0; ++ + do_div(value, rp->time_unit); + y = ilog2(value); + f = div64_u64(4 * (value - (1 << y)), 1 << y); +@@ -1035,7 +1038,6 @@ static const struct rapl_defaults rapl_defaults_spr_server = { + .check_unit = rapl_check_unit_core, + .set_floor_freq = set_floor_freq_default, + .compute_time_window = rapl_compute_time_window_core, +- .dram_domain_energy_unit = 15300, + .psys_domain_energy_unit = 1000000000, + .spr_psys_bits = true, + }; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index a9daaf4d5aaab..9567d2fc3f00c 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -2680,7 +2680,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev) + * return -ETIMEDOUT. + */ + if (rdev->desc->poll_enabled_time) { +- unsigned int time_remaining = delay; ++ int time_remaining = delay; + + while (time_remaining > 0) { + _regulator_delay_helper(rdev->desc->poll_enabled_time); +diff --git a/drivers/regulator/qcom_rpm-regulator.c b/drivers/regulator/qcom_rpm-regulator.c +index 7f9d66ac37ff8..3c41b71a1f529 100644 +--- a/drivers/regulator/qcom_rpm-regulator.c ++++ b/drivers/regulator/qcom_rpm-regulator.c +@@ -802,6 +802,12 @@ static const struct rpm_regulator_data rpm_pm8018_regulators[] = { + }; + + static const struct rpm_regulator_data rpm_pm8058_regulators[] = { ++ { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" }, ++ { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" }, ++ { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" }, ++ { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" }, ++ { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" }, ++ + { "l0", QCOM_RPM_PM8058_LDO0, &pm8058_nldo, "vdd_l0_l1_lvs" }, + { "l1", QCOM_RPM_PM8058_LDO1, &pm8058_nldo, "vdd_l0_l1_lvs" }, + { "l2", QCOM_RPM_PM8058_LDO2, &pm8058_pldo, "vdd_l2_l11_l12" }, +@@ -829,12 +835,6 @@ static const struct rpm_regulator_data rpm_pm8058_regulators[] = { + { "l24", QCOM_RPM_PM8058_LDO24, &pm8058_nldo, "vdd_l23_l24_l25" }, + { "l25", QCOM_RPM_PM8058_LDO25, &pm8058_nldo, "vdd_l23_l24_l25" }, + +- { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" }, +- { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" }, +- { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" }, +- { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" }, +- { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" }, +- + { "lvs0", QCOM_RPM_PM8058_LVS0, &pm8058_switch, "vdd_l0_l1_lvs" }, + { "lvs1", QCOM_RPM_PM8058_LVS1, &pm8058_switch, "vdd_l0_l1_lvs" }, + +@@ -843,6 +843,12 @@ static const struct rpm_regulator_data rpm_pm8058_regulators[] = { + }; + + static const struct rpm_regulator_data rpm_pm8901_regulators[] = { ++ { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" }, ++ { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" }, ++ { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" }, ++ { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" }, ++ { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" }, ++ + { "l0", QCOM_RPM_PM8901_LDO0, &pm8901_nldo, "vdd_l0" }, + { "l1", QCOM_RPM_PM8901_LDO1, &pm8901_pldo, "vdd_l1" }, + { "l2", QCOM_RPM_PM8901_LDO2, &pm8901_pldo, "vdd_l2" }, +@@ -851,12 +857,6 @@ static const struct rpm_regulator_data rpm_pm8901_regulators[] = { + { "l5", QCOM_RPM_PM8901_LDO5, &pm8901_pldo, "vdd_l5" }, + { "l6", QCOM_RPM_PM8901_LDO6, &pm8901_pldo, "vdd_l6" }, + +- { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" }, +- { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" }, +- { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" }, +- { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" }, +- { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" }, +- + { "lvs0", QCOM_RPM_PM8901_LVS0, &pm8901_switch, "lvs0_in" }, + { "lvs1", QCOM_RPM_PM8901_LVS1, &pm8901_switch, "lvs1_in" }, + { "lvs2", QCOM_RPM_PM8901_LVS2, &pm8901_switch, "lvs2_in" }, +diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c +index 02a04ab34a230..9d86470df79bb 100644 +--- a/drivers/remoteproc/remoteproc_core.c ++++ b/drivers/remoteproc/remoteproc_core.c +@@ -518,12 +518,13 @@ static int rproc_handle_vdev(struct rproc *rproc, void *ptr, + struct fw_rsc_vdev *rsc = ptr; + struct device *dev = &rproc->dev; + struct rproc_vdev *rvdev; ++ size_t rsc_size; + int i, ret; + char name[16]; + + /* make sure resource isn't truncated */ +- if (struct_size(rsc, vring, rsc->num_of_vrings) + rsc->config_len > +- avail) { ++ rsc_size = struct_size(rsc, vring, rsc->num_of_vrings); ++ if (size_add(rsc_size, rsc->config_len) > avail) { + dev_err(dev, "vdev rsc is truncated\n"); + return -EINVAL; + } +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index 4f2189111494a..0408ce58183c1 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -76,7 +76,9 @@ int rpmsg_chrdev_eptdev_destroy(struct device *dev, void *data) + + mutex_lock(&eptdev->ept_lock); + if (eptdev->ept) { +- rpmsg_destroy_ept(eptdev->ept); ++ /* The default endpoint is released by the rpmsg core */ ++ if (!eptdev->default_ept) ++ rpmsg_destroy_ept(eptdev->ept); + eptdev->ept = NULL; + } + mutex_unlock(&eptdev->ept_lock); +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index cd823ff5deab2..6cb9cca9565b9 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -2006,7 +2006,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + retval = pci_enable_device(pdev); + if (retval) { + TW_PRINTK(host, TW_DRIVER, 0x34, "Failed to enable pci device"); +- goto out_disable_device; ++ return -ENODEV; + } + + pci_set_master(pdev); +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index 32abdf0fa9aab..af281e271f886 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -1455,7 +1455,7 @@ void cxgbi_conn_tx_open(struct cxgbi_sock *csk) + if (conn) { + log_debug(1 << CXGBI_DBG_SOCK, + "csk 0x%p, cid %d.\n", csk, conn->id); +- iscsi_conn_queue_work(conn); ++ iscsi_conn_queue_xmit(conn); + } + } + EXPORT_SYMBOL_GPL(cxgbi_conn_tx_open); +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 52c6f70d60ec4..7e99070ea6118 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -52,6 +52,10 @@ static struct iscsi_transport iscsi_sw_tcp_transport; + static unsigned int iscsi_max_lun = ~0; + module_param_named(max_lun, iscsi_max_lun, uint, S_IRUGO); + ++static bool iscsi_recv_from_iscsi_q; ++module_param_named(recv_from_iscsi_q, iscsi_recv_from_iscsi_q, bool, 0644); ++MODULE_PARM_DESC(recv_from_iscsi_q, "Set to true to read iSCSI data/headers from the iscsi_q workqueue. The default is false which will perform reads from the network softirq context."); ++ + static int iscsi_sw_tcp_dbg; + module_param_named(debug_iscsi_tcp, iscsi_sw_tcp_dbg, int, + S_IRUGO | S_IWUSR); +@@ -122,20 +126,13 @@ static inline int iscsi_sw_sk_state_check(struct sock *sk) + return 0; + } + +-static void iscsi_sw_tcp_data_ready(struct sock *sk) ++static void iscsi_sw_tcp_recv_data(struct iscsi_conn *conn) + { +- struct iscsi_conn *conn; +- struct iscsi_tcp_conn *tcp_conn; ++ struct iscsi_tcp_conn *tcp_conn = conn->dd_data; ++ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; ++ struct sock *sk = tcp_sw_conn->sock->sk; + read_descriptor_t rd_desc; + +- read_lock_bh(&sk->sk_callback_lock); +- conn = sk->sk_user_data; +- if (!conn) { +- read_unlock_bh(&sk->sk_callback_lock); +- return; +- } +- tcp_conn = conn->dd_data; +- + /* + * Use rd_desc to pass 'conn' to iscsi_tcp_recv. + * We set count to 1 because we want the network layer to +@@ -144,13 +141,48 @@ static void iscsi_sw_tcp_data_ready(struct sock *sk) + */ + rd_desc.arg.data = conn; + rd_desc.count = 1; +- tcp_read_sock(sk, &rd_desc, iscsi_sw_tcp_recv); + +- iscsi_sw_sk_state_check(sk); ++ tcp_read_sock(sk, &rd_desc, iscsi_sw_tcp_recv); + + /* If we had to (atomically) map a highmem page, + * unmap it now. */ + iscsi_tcp_segment_unmap(&tcp_conn->in.segment); ++ ++ iscsi_sw_sk_state_check(sk); ++} ++ ++static void iscsi_sw_tcp_recv_data_work(struct work_struct *work) ++{ ++ struct iscsi_conn *conn = container_of(work, struct iscsi_conn, ++ recvwork); ++ struct iscsi_tcp_conn *tcp_conn = conn->dd_data; ++ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; ++ struct sock *sk = tcp_sw_conn->sock->sk; ++ ++ lock_sock(sk); ++ iscsi_sw_tcp_recv_data(conn); ++ release_sock(sk); ++} ++ ++static void iscsi_sw_tcp_data_ready(struct sock *sk) ++{ ++ struct iscsi_sw_tcp_conn *tcp_sw_conn; ++ struct iscsi_tcp_conn *tcp_conn; ++ struct iscsi_conn *conn; ++ ++ read_lock_bh(&sk->sk_callback_lock); ++ conn = sk->sk_user_data; ++ if (!conn) { ++ read_unlock_bh(&sk->sk_callback_lock); ++ return; ++ } ++ tcp_conn = conn->dd_data; ++ tcp_sw_conn = tcp_conn->dd_data; ++ ++ if (tcp_sw_conn->queue_recv) ++ iscsi_conn_queue_recv(conn); ++ else ++ iscsi_sw_tcp_recv_data(conn); + read_unlock_bh(&sk->sk_callback_lock); + } + +@@ -205,7 +237,7 @@ static void iscsi_sw_tcp_write_space(struct sock *sk) + old_write_space(sk); + + ISCSI_SW_TCP_DBG(conn, "iscsi_write_space\n"); +- iscsi_conn_queue_work(conn); ++ iscsi_conn_queue_xmit(conn); + } + + static void iscsi_sw_tcp_conn_set_callbacks(struct iscsi_conn *conn) +@@ -276,6 +308,9 @@ static int iscsi_sw_tcp_xmit_segment(struct iscsi_tcp_conn *tcp_conn, + if (segment->total_copied + segment->size < segment->total_size) + flags |= MSG_MORE; + ++ if (tcp_sw_conn->queue_recv) ++ flags |= MSG_DONTWAIT; ++ + /* Use sendpage if we can; else fall back to sendmsg */ + if (!segment->data) { + sg = segment->sg; +@@ -557,6 +592,10 @@ iscsi_sw_tcp_conn_create(struct iscsi_cls_session *cls_session, + conn = cls_conn->dd_data; + tcp_conn = conn->dd_data; + tcp_sw_conn = tcp_conn->dd_data; ++ INIT_WORK(&conn->recvwork, iscsi_sw_tcp_recv_data_work); ++ tcp_sw_conn->queue_recv = iscsi_recv_from_iscsi_q; ++ ++ mutex_init(&tcp_sw_conn->sock_lock); + + tfm = crypto_alloc_ahash("crc32c", 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(tfm)) +@@ -592,11 +631,15 @@ free_conn: + + static void iscsi_sw_tcp_release_conn(struct iscsi_conn *conn) + { +- struct iscsi_session *session = conn->session; + struct iscsi_tcp_conn *tcp_conn = conn->dd_data; + struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; + struct socket *sock = tcp_sw_conn->sock; + ++ /* ++ * The iscsi transport class will make sure we are not called in ++ * parallel with start, stop, bind and destroys. However, this can be ++ * called twice if userspace does a stop then a destroy. ++ */ + if (!sock) + return; + +@@ -610,9 +653,11 @@ static void iscsi_sw_tcp_release_conn(struct iscsi_conn *conn) + iscsi_sw_tcp_conn_restore_callbacks(conn); + sock_put(sock->sk); + +- spin_lock_bh(&session->frwd_lock); ++ iscsi_suspend_rx(conn); ++ ++ mutex_lock(&tcp_sw_conn->sock_lock); + tcp_sw_conn->sock = NULL; +- spin_unlock_bh(&session->frwd_lock); ++ mutex_unlock(&tcp_sw_conn->sock_lock); + sockfd_put(sock); + } + +@@ -664,7 +709,6 @@ iscsi_sw_tcp_conn_bind(struct iscsi_cls_session *cls_session, + struct iscsi_cls_conn *cls_conn, uint64_t transport_eph, + int is_leading) + { +- struct iscsi_session *session = cls_session->dd_data; + struct iscsi_conn *conn = cls_conn->dd_data; + struct iscsi_tcp_conn *tcp_conn = conn->dd_data; + struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; +@@ -684,10 +728,10 @@ iscsi_sw_tcp_conn_bind(struct iscsi_cls_session *cls_session, + if (err) + goto free_socket; + +- spin_lock_bh(&session->frwd_lock); ++ mutex_lock(&tcp_sw_conn->sock_lock); + /* bind iSCSI connection and socket */ + tcp_sw_conn->sock = sock; +- spin_unlock_bh(&session->frwd_lock); ++ mutex_unlock(&tcp_sw_conn->sock_lock); + + /* setup Socket parameters */ + sk = sock->sk; +@@ -724,8 +768,15 @@ static int iscsi_sw_tcp_conn_set_param(struct iscsi_cls_conn *cls_conn, + break; + case ISCSI_PARAM_DATADGST_EN: + iscsi_set_param(cls_conn, param, buf, buflen); ++ ++ mutex_lock(&tcp_sw_conn->sock_lock); ++ if (!tcp_sw_conn->sock) { ++ mutex_unlock(&tcp_sw_conn->sock_lock); ++ return -ENOTCONN; ++ } + tcp_sw_conn->sendpage = conn->datadgst_en ? + sock_no_sendpage : tcp_sw_conn->sock->ops->sendpage; ++ mutex_unlock(&tcp_sw_conn->sock_lock); + break; + case ISCSI_PARAM_MAX_R2T: + return iscsi_tcp_set_max_r2t(conn, buf); +@@ -740,8 +791,8 @@ static int iscsi_sw_tcp_conn_get_param(struct iscsi_cls_conn *cls_conn, + enum iscsi_param param, char *buf) + { + struct iscsi_conn *conn = cls_conn->dd_data; +- struct iscsi_tcp_conn *tcp_conn = conn->dd_data; +- struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; ++ struct iscsi_sw_tcp_conn *tcp_sw_conn; ++ struct iscsi_tcp_conn *tcp_conn; + struct sockaddr_in6 addr; + struct socket *sock; + int rc; +@@ -751,21 +802,36 @@ static int iscsi_sw_tcp_conn_get_param(struct iscsi_cls_conn *cls_conn, + case ISCSI_PARAM_CONN_ADDRESS: + case ISCSI_PARAM_LOCAL_PORT: + spin_lock_bh(&conn->session->frwd_lock); +- if (!tcp_sw_conn || !tcp_sw_conn->sock) { ++ if (!conn->session->leadconn) { + spin_unlock_bh(&conn->session->frwd_lock); + return -ENOTCONN; + } +- sock = tcp_sw_conn->sock; +- sock_hold(sock->sk); ++ /* ++ * The conn has been setup and bound, so just grab a ref ++ * incase a destroy runs while we are in the net layer. ++ */ ++ iscsi_get_conn(conn->cls_conn); + spin_unlock_bh(&conn->session->frwd_lock); + ++ tcp_conn = conn->dd_data; ++ tcp_sw_conn = tcp_conn->dd_data; ++ ++ mutex_lock(&tcp_sw_conn->sock_lock); ++ sock = tcp_sw_conn->sock; ++ if (!sock) { ++ rc = -ENOTCONN; ++ goto sock_unlock; ++ } ++ + if (param == ISCSI_PARAM_LOCAL_PORT) + rc = kernel_getsockname(sock, + (struct sockaddr *)&addr); + else + rc = kernel_getpeername(sock, + (struct sockaddr *)&addr); +- sock_put(sock->sk); ++sock_unlock: ++ mutex_unlock(&tcp_sw_conn->sock_lock); ++ iscsi_put_conn(conn->cls_conn); + if (rc < 0) + return rc; + +@@ -803,17 +869,21 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, + } + tcp_conn = conn->dd_data; + tcp_sw_conn = tcp_conn->dd_data; +- sock = tcp_sw_conn->sock; +- if (!sock) { +- spin_unlock_bh(&session->frwd_lock); +- return -ENOTCONN; +- } +- sock_hold(sock->sk); ++ /* ++ * The conn has been setup and bound, so just grab a ref ++ * incase a destroy runs while we are in the net layer. ++ */ ++ iscsi_get_conn(conn->cls_conn); + spin_unlock_bh(&session->frwd_lock); + +- rc = kernel_getsockname(sock, +- (struct sockaddr *)&addr); +- sock_put(sock->sk); ++ mutex_lock(&tcp_sw_conn->sock_lock); ++ sock = tcp_sw_conn->sock; ++ if (!sock) ++ rc = -ENOTCONN; ++ else ++ rc = kernel_getsockname(sock, (struct sockaddr *)&addr); ++ mutex_unlock(&tcp_sw_conn->sock_lock); ++ iscsi_put_conn(conn->cls_conn); + if (rc < 0) + return rc; + +diff --git a/drivers/scsi/iscsi_tcp.h b/drivers/scsi/iscsi_tcp.h +index 791453195099c..68e14a344904f 100644 +--- a/drivers/scsi/iscsi_tcp.h ++++ b/drivers/scsi/iscsi_tcp.h +@@ -28,6 +28,11 @@ struct iscsi_sw_tcp_send { + + struct iscsi_sw_tcp_conn { + struct socket *sock; ++ /* Taken when accessing the sock from the netlink/sysfs interface */ ++ struct mutex sock_lock; ++ ++ struct work_struct recvwork; ++ bool queue_recv; + + struct iscsi_sw_tcp_send out; + /* old values for socket callbacks */ +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 3ddb701cd29c7..8f73c8d6ef222 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -83,7 +83,7 @@ MODULE_PARM_DESC(debug_libiscsi_eh, + "%s " dbg_fmt, __func__, ##arg); \ + } while (0); + +-inline void iscsi_conn_queue_work(struct iscsi_conn *conn) ++inline void iscsi_conn_queue_xmit(struct iscsi_conn *conn) + { + struct Scsi_Host *shost = conn->session->host; + struct iscsi_host *ihost = shost_priv(shost); +@@ -91,7 +91,17 @@ inline void iscsi_conn_queue_work(struct iscsi_conn *conn) + if (ihost->workq) + queue_work(ihost->workq, &conn->xmitwork); + } +-EXPORT_SYMBOL_GPL(iscsi_conn_queue_work); ++EXPORT_SYMBOL_GPL(iscsi_conn_queue_xmit); ++ ++inline void iscsi_conn_queue_recv(struct iscsi_conn *conn) ++{ ++ struct Scsi_Host *shost = conn->session->host; ++ struct iscsi_host *ihost = shost_priv(shost); ++ ++ if (ihost->workq && !test_bit(ISCSI_CONN_FLAG_SUSPEND_RX, &conn->flags)) ++ queue_work(ihost->workq, &conn->recvwork); ++} ++EXPORT_SYMBOL_GPL(iscsi_conn_queue_recv); + + static void __iscsi_update_cmdsn(struct iscsi_session *session, + uint32_t exp_cmdsn, uint32_t max_cmdsn) +@@ -765,7 +775,7 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + goto free_task; + } else { + list_add_tail(&task->running, &conn->mgmtqueue); +- iscsi_conn_queue_work(conn); ++ iscsi_conn_queue_xmit(conn); + } + + return task; +@@ -1513,7 +1523,7 @@ void iscsi_requeue_task(struct iscsi_task *task) + */ + iscsi_put_task(task); + } +- iscsi_conn_queue_work(conn); ++ iscsi_conn_queue_xmit(conn); + spin_unlock_bh(&conn->session->frwd_lock); + } + EXPORT_SYMBOL_GPL(iscsi_requeue_task); +@@ -1782,7 +1792,7 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc) + } + } else { + list_add_tail(&task->running, &conn->cmdqueue); +- iscsi_conn_queue_work(conn); ++ iscsi_conn_queue_xmit(conn); + } + + session->queued_cmdsn++; +@@ -1943,7 +1953,7 @@ EXPORT_SYMBOL_GPL(iscsi_suspend_queue); + + /** + * iscsi_suspend_tx - suspend iscsi_data_xmit +- * @conn: iscsi conn tp stop processing IO on. ++ * @conn: iscsi conn to stop processing IO on. + * + * This function sets the suspend bit to prevent iscsi_data_xmit + * from sending new IO, and if work is queued on the xmit thread +@@ -1956,15 +1966,30 @@ void iscsi_suspend_tx(struct iscsi_conn *conn) + + set_bit(ISCSI_CONN_FLAG_SUSPEND_TX, &conn->flags); + if (ihost->workq) +- flush_workqueue(ihost->workq); ++ flush_work(&conn->xmitwork); + } + EXPORT_SYMBOL_GPL(iscsi_suspend_tx); + + static void iscsi_start_tx(struct iscsi_conn *conn) + { + clear_bit(ISCSI_CONN_FLAG_SUSPEND_TX, &conn->flags); +- iscsi_conn_queue_work(conn); ++ iscsi_conn_queue_xmit(conn); ++} ++ ++/** ++ * iscsi_suspend_rx - Prevent recvwork from running again. ++ * @conn: iscsi conn to stop. ++ */ ++void iscsi_suspend_rx(struct iscsi_conn *conn) ++{ ++ struct Scsi_Host *shost = conn->session->host; ++ struct iscsi_host *ihost = shost_priv(shost); ++ ++ set_bit(ISCSI_CONN_FLAG_SUSPEND_RX, &conn->flags); ++ if (ihost->workq) ++ flush_work(&conn->recvwork); + } ++EXPORT_SYMBOL_GPL(iscsi_suspend_rx); + + /* + * We want to make sure a ping is in flight. It has timed out. +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 260e735d06fa4..1ec5f4c8e4301 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -67,7 +67,7 @@ static int smp_execute_task_sg(struct domain_device *dev, + res = i->dft->lldd_execute_task(task, GFP_KERNEL); + + if (res) { +- del_timer(&task->slow_task->timer); ++ del_timer_sync(&task->slow_task->timer); + pr_notice("executing SMP task failed:%d\n", res); + break; + } +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index 212f9b9621878..c9fb075952e79 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -1576,10 +1576,7 @@ struct lpfc_hba { + u32 cgn_acqe_cnt; + + /* RX monitor handling for CMF */ +- struct rxtable_entry *rxtable; /* RX_monitor information */ +- atomic_t rxtable_idx_head; +-#define LPFC_RXMONITOR_TABLE_IN_USE (LPFC_MAX_RXMONITOR_ENTRY + 73) +- atomic_t rxtable_idx_tail; ++ struct lpfc_rx_info_monitor *rx_monitor; + atomic_t rx_max_read_cnt; /* Maximum read bytes */ + uint64_t rx_block_cnt; + +@@ -1628,7 +1625,7 @@ struct lpfc_hba { + + #define LPFC_MAX_RXMONITOR_ENTRY 800 + #define LPFC_MAX_RXMONITOR_DUMP 32 +-struct rxtable_entry { ++struct rx_info_entry { + uint64_t cmf_bytes; /* Total no of read bytes for CMF_SYNC_WQE */ + uint64_t total_bytes; /* Total no of read bytes requested */ + uint64_t rcv_bytes; /* Total no of read bytes completed */ +@@ -1643,6 +1640,13 @@ struct rxtable_entry { + uint32_t timer_interval; + }; + ++struct lpfc_rx_info_monitor { ++ struct rx_info_entry *ring; /* info organized in a circular buffer */ ++ u32 head_idx, tail_idx; /* index to head/tail of ring */ ++ spinlock_t lock; /* spinlock for ring */ ++ u32 entries; /* storing number entries/size of ring */ ++}; ++ + static inline struct Scsi_Host * + lpfc_shost_from_vport(struct lpfc_vport *vport) + { +diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h +index f5d74958b6643..27389e055398c 100644 +--- a/drivers/scsi/lpfc/lpfc_crtn.h ++++ b/drivers/scsi/lpfc/lpfc_crtn.h +@@ -92,6 +92,14 @@ void lpfc_cgn_dump_rxmonitor(struct lpfc_hba *phba); + void lpfc_cgn_update_stat(struct lpfc_hba *phba, uint32_t dtag); + void lpfc_unblock_requests(struct lpfc_hba *phba); + void lpfc_block_requests(struct lpfc_hba *phba); ++int lpfc_rx_monitor_create_ring(struct lpfc_rx_info_monitor *rx_monitor, ++ u32 entries); ++void lpfc_rx_monitor_destroy_ring(struct lpfc_rx_info_monitor *rx_monitor); ++void lpfc_rx_monitor_record(struct lpfc_rx_info_monitor *rx_monitor, ++ struct rx_info_entry *entry); ++u32 lpfc_rx_monitor_report(struct lpfc_hba *phba, ++ struct lpfc_rx_info_monitor *rx_monitor, char *buf, ++ u32 buf_len, u32 max_read_entries); + + void lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *, LPFC_MBOXQ_t *); + void lpfc_mbx_cmpl_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *); +diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c +index 13dfe285493d1..b555ccb5ae345 100644 +--- a/drivers/scsi/lpfc/lpfc_ct.c ++++ b/drivers/scsi/lpfc/lpfc_ct.c +@@ -1509,7 +1509,7 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + struct lpfc_sli_ct_request *CTrsp; + int did; + struct lpfc_nodelist *ndlp = NULL; +- struct lpfc_nodelist *ns_ndlp = NULL; ++ struct lpfc_nodelist *ns_ndlp = cmdiocb->ndlp; + uint32_t fc4_data_0, fc4_data_1; + u32 ulp_status = get_job_ulpstatus(phba, rspiocb); + u32 ulp_word4 = get_job_word4(phba, rspiocb); +@@ -1522,15 +1522,12 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + ulp_status, ulp_word4, did); + + /* Ignore response if link flipped after this request was made */ +- if ((uint32_t) cmdiocb->event_tag != phba->fc_eventTag) { ++ if ((uint32_t)cmdiocb->event_tag != phba->fc_eventTag) { + lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, + "9046 Event tag mismatch. Ignoring NS rsp\n"); + goto out; + } + +- /* Preserve the nameserver node to release the reference. */ +- ns_ndlp = cmdiocb->ndlp; +- + if (ulp_status == IOSTAT_SUCCESS) { + /* Good status, continue checking */ + CTrsp = (struct lpfc_sli_ct_request *)outp->virt; +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index 25deacc92b020..24fbf21ea051b 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -5531,7 +5531,7 @@ lpfc_rx_monitor_open(struct inode *inode, struct file *file) + if (!debug) + goto out; + +- debug->buffer = vmalloc(MAX_DEBUGFS_RX_TABLE_SIZE); ++ debug->buffer = vmalloc(MAX_DEBUGFS_RX_INFO_SIZE); + if (!debug->buffer) { + kfree(debug); + goto out; +@@ -5552,57 +5552,18 @@ lpfc_rx_monitor_read(struct file *file, char __user *buf, size_t nbytes, + struct lpfc_rx_monitor_debug *debug = file->private_data; + struct lpfc_hba *phba = (struct lpfc_hba *)debug->i_private; + char *buffer = debug->buffer; +- struct rxtable_entry *entry; +- int i, len = 0, head, tail, last, start; +- +- head = atomic_read(&phba->rxtable_idx_head); +- while (head == LPFC_RXMONITOR_TABLE_IN_USE) { +- /* Table is getting updated */ +- msleep(20); +- head = atomic_read(&phba->rxtable_idx_head); +- } + +- tail = atomic_xchg(&phba->rxtable_idx_tail, head); +- if (!phba->rxtable || head == tail) { +- len += scnprintf(buffer + len, MAX_DEBUGFS_RX_TABLE_SIZE - len, +- "Rxtable is empty\n"); +- goto out; +- } +- last = (head > tail) ? head : LPFC_MAX_RXMONITOR_ENTRY; +- start = tail; +- +- len += scnprintf(buffer + len, MAX_DEBUGFS_RX_TABLE_SIZE - len, +- " MaxBPI Tot_Data_CMF Tot_Data_Cmd " +- "Tot_Data_Cmpl Lat(us) Avg_IO Max_IO " +- "Bsy IO_cnt Info BWutil(ms)\n"); +-get_table: +- for (i = start; i < last; i++) { +- entry = &phba->rxtable[i]; +- len += scnprintf(buffer + len, MAX_DEBUGFS_RX_TABLE_SIZE - len, +- "%3d:%12lld %12lld %12lld %12lld " +- "%7lldus %8lld %7lld " +- "%2d %4d %2d %2d(%2d)\n", +- i, entry->max_bytes_per_interval, +- entry->cmf_bytes, +- entry->total_bytes, +- entry->rcv_bytes, +- entry->avg_io_latency, +- entry->avg_io_size, +- entry->max_read_cnt, +- entry->cmf_busy, +- entry->io_cnt, +- entry->cmf_info, +- entry->timer_utilization, +- entry->timer_interval); ++ if (!phba->rx_monitor) { ++ scnprintf(buffer, MAX_DEBUGFS_RX_INFO_SIZE, ++ "Rx Monitor Info is empty.\n"); ++ } else { ++ lpfc_rx_monitor_report(phba, phba->rx_monitor, buffer, ++ MAX_DEBUGFS_RX_INFO_SIZE, ++ LPFC_MAX_RXMONITOR_ENTRY); + } + +- if (head != last) { +- start = 0; +- last = head; +- goto get_table; +- } +-out: +- return simple_read_from_buffer(buf, nbytes, ppos, buffer, len); ++ return simple_read_from_buffer(buf, nbytes, ppos, buffer, ++ strlen(buffer)); + } + + static int +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h +index 6dd361c1fd318..f71e5b6311ac0 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.h ++++ b/drivers/scsi/lpfc/lpfc_debugfs.h +@@ -282,7 +282,7 @@ struct lpfc_idiag { + void *ptr_private; + }; + +-#define MAX_DEBUGFS_RX_TABLE_SIZE (128 * LPFC_MAX_RXMONITOR_ENTRY) ++#define MAX_DEBUGFS_RX_INFO_SIZE (128 * LPFC_MAX_RXMONITOR_ENTRY) + struct lpfc_rx_monitor_debug { + char *i_private; + char *buffer; +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 2ddc431cbd337..df8216a07d9b7 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -5571,38 +5571,12 @@ lpfc_async_link_speed_to_read_top(struct lpfc_hba *phba, uint8_t speed_code) + void + lpfc_cgn_dump_rxmonitor(struct lpfc_hba *phba) + { +- struct rxtable_entry *entry; +- int cnt = 0, head, tail, last, start; +- +- head = atomic_read(&phba->rxtable_idx_head); +- tail = atomic_read(&phba->rxtable_idx_tail); +- if (!phba->rxtable || head == tail) { +- lpfc_printf_log(phba, KERN_ERR, LOG_CGN_MGMT, +- "4411 Rxtable is empty\n"); +- return; +- } +- last = tail; +- start = head; +- +- /* Display the last LPFC_MAX_RXMONITOR_DUMP entries from the rxtable */ +- while (start != last) { +- if (start) +- start--; +- else +- start = LPFC_MAX_RXMONITOR_ENTRY - 1; +- entry = &phba->rxtable[start]; ++ if (!phba->rx_monitor) { + lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, +- "4410 %02d: MBPI %lld Xmit %lld Cmpl %lld " +- "Lat %lld ASz %lld Info %02d BWUtil %d " +- "Int %d slot %d\n", +- cnt, entry->max_bytes_per_interval, +- entry->total_bytes, entry->rcv_bytes, +- entry->avg_io_latency, entry->avg_io_size, +- entry->cmf_info, entry->timer_utilization, +- entry->timer_interval, start); +- cnt++; +- if (cnt >= LPFC_MAX_RXMONITOR_DUMP) +- return; ++ "4411 Rx Monitor Info is empty.\n"); ++ } else { ++ lpfc_rx_monitor_report(phba, phba->rx_monitor, NULL, 0, ++ LPFC_MAX_RXMONITOR_DUMP); + } + } + +@@ -6009,9 +5983,8 @@ lpfc_cmf_timer(struct hrtimer *timer) + { + struct lpfc_hba *phba = container_of(timer, struct lpfc_hba, + cmf_timer); +- struct rxtable_entry *entry; ++ struct rx_info_entry entry; + uint32_t io_cnt; +- uint32_t head, tail; + uint32_t busy, max_read; + uint64_t total, rcv, lat, mbpi, extra, cnt; + int timer_interval = LPFC_CMF_INTERVAL; +@@ -6131,40 +6104,30 @@ lpfc_cmf_timer(struct hrtimer *timer) + } + + /* Save rxmonitor information for debug */ +- if (phba->rxtable) { +- head = atomic_xchg(&phba->rxtable_idx_head, +- LPFC_RXMONITOR_TABLE_IN_USE); +- entry = &phba->rxtable[head]; +- entry->total_bytes = total; +- entry->cmf_bytes = total + extra; +- entry->rcv_bytes = rcv; +- entry->cmf_busy = busy; +- entry->cmf_info = phba->cmf_active_info; ++ if (phba->rx_monitor) { ++ entry.total_bytes = total; ++ entry.cmf_bytes = total + extra; ++ entry.rcv_bytes = rcv; ++ entry.cmf_busy = busy; ++ entry.cmf_info = phba->cmf_active_info; + if (io_cnt) { +- entry->avg_io_latency = div_u64(lat, io_cnt); +- entry->avg_io_size = div_u64(rcv, io_cnt); ++ entry.avg_io_latency = div_u64(lat, io_cnt); ++ entry.avg_io_size = div_u64(rcv, io_cnt); + } else { +- entry->avg_io_latency = 0; +- entry->avg_io_size = 0; ++ entry.avg_io_latency = 0; ++ entry.avg_io_size = 0; + } +- entry->max_read_cnt = max_read; +- entry->io_cnt = io_cnt; +- entry->max_bytes_per_interval = mbpi; ++ entry.max_read_cnt = max_read; ++ entry.io_cnt = io_cnt; ++ entry.max_bytes_per_interval = mbpi; + if (phba->cmf_active_mode == LPFC_CFG_MANAGED) +- entry->timer_utilization = phba->cmf_last_ts; ++ entry.timer_utilization = phba->cmf_last_ts; + else +- entry->timer_utilization = ms; +- entry->timer_interval = ms; ++ entry.timer_utilization = ms; ++ entry.timer_interval = ms; + phba->cmf_last_ts = 0; + +- /* Increment rxtable index */ +- head = (head + 1) % LPFC_MAX_RXMONITOR_ENTRY; +- tail = atomic_read(&phba->rxtable_idx_tail); +- if (head == tail) { +- tail = (tail + 1) % LPFC_MAX_RXMONITOR_ENTRY; +- atomic_set(&phba->rxtable_idx_tail, tail); +- } +- atomic_set(&phba->rxtable_idx_head, head); ++ lpfc_rx_monitor_record(phba->rx_monitor, &entry); + } + + if (phba->cmf_active_mode == LPFC_CFG_MONITOR) { +diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c +index 870e53b8f81dd..5d36b35148646 100644 +--- a/drivers/scsi/lpfc/lpfc_mem.c ++++ b/drivers/scsi/lpfc/lpfc_mem.c +@@ -344,9 +344,12 @@ lpfc_mem_free_all(struct lpfc_hba *phba) + phba->cgn_i = NULL; + } + +- /* Free RX table */ +- kfree(phba->rxtable); +- phba->rxtable = NULL; ++ /* Free RX Monitor */ ++ if (phba->rx_monitor) { ++ lpfc_rx_monitor_destroy_ring(phba->rx_monitor); ++ kfree(phba->rx_monitor); ++ phba->rx_monitor = NULL; ++ } + + /* Free the iocb lookup array */ + kfree(psli->iocbq_lookup); +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index e2127e85ff325..2269253aeb3df 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -7954,6 +7954,172 @@ static void lpfc_sli4_dip(struct lpfc_hba *phba) + } + } + ++/** ++ * lpfc_rx_monitor_create_ring - Initialize ring buffer for rx_monitor ++ * @rx_monitor: Pointer to lpfc_rx_info_monitor object ++ * @entries: Number of rx_info_entry objects to allocate in ring ++ * ++ * Return: ++ * 0 - Success ++ * ENOMEM - Failure to kmalloc ++ **/ ++int lpfc_rx_monitor_create_ring(struct lpfc_rx_info_monitor *rx_monitor, ++ u32 entries) ++{ ++ rx_monitor->ring = kmalloc_array(entries, sizeof(struct rx_info_entry), ++ GFP_KERNEL); ++ if (!rx_monitor->ring) ++ return -ENOMEM; ++ ++ rx_monitor->head_idx = 0; ++ rx_monitor->tail_idx = 0; ++ spin_lock_init(&rx_monitor->lock); ++ rx_monitor->entries = entries; ++ ++ return 0; ++} ++ ++/** ++ * lpfc_rx_monitor_destroy_ring - Free ring buffer for rx_monitor ++ * @rx_monitor: Pointer to lpfc_rx_info_monitor object ++ **/ ++void lpfc_rx_monitor_destroy_ring(struct lpfc_rx_info_monitor *rx_monitor) ++{ ++ spin_lock(&rx_monitor->lock); ++ kfree(rx_monitor->ring); ++ rx_monitor->ring = NULL; ++ rx_monitor->entries = 0; ++ rx_monitor->head_idx = 0; ++ rx_monitor->tail_idx = 0; ++ spin_unlock(&rx_monitor->lock); ++} ++ ++/** ++ * lpfc_rx_monitor_record - Insert an entry into rx_monitor's ring ++ * @rx_monitor: Pointer to lpfc_rx_info_monitor object ++ * @entry: Pointer to rx_info_entry ++ * ++ * Used to insert an rx_info_entry into rx_monitor's ring. Note that this is a ++ * deep copy of rx_info_entry not a shallow copy of the rx_info_entry ptr. ++ * ++ * This is called from lpfc_cmf_timer, which is in timer/softirq context. ++ * ++ * In cases of old data overflow, we do a best effort of FIFO order. ++ **/ ++void lpfc_rx_monitor_record(struct lpfc_rx_info_monitor *rx_monitor, ++ struct rx_info_entry *entry) ++{ ++ struct rx_info_entry *ring = rx_monitor->ring; ++ u32 *head_idx = &rx_monitor->head_idx; ++ u32 *tail_idx = &rx_monitor->tail_idx; ++ spinlock_t *ring_lock = &rx_monitor->lock; ++ u32 ring_size = rx_monitor->entries; ++ ++ spin_lock(ring_lock); ++ memcpy(&ring[*tail_idx], entry, sizeof(*entry)); ++ *tail_idx = (*tail_idx + 1) % ring_size; ++ ++ /* Best effort of FIFO saved data */ ++ if (*tail_idx == *head_idx) ++ *head_idx = (*head_idx + 1) % ring_size; ++ ++ spin_unlock(ring_lock); ++} ++ ++/** ++ * lpfc_rx_monitor_report - Read out rx_monitor's ring ++ * @phba: Pointer to lpfc_hba object ++ * @rx_monitor: Pointer to lpfc_rx_info_monitor object ++ * @buf: Pointer to char buffer that will contain rx monitor info data ++ * @buf_len: Length buf including null char ++ * @max_read_entries: Maximum number of entries to read out of ring ++ * ++ * Used to dump/read what's in rx_monitor's ring buffer. ++ * ++ * If buf is NULL || buf_len == 0, then it is implied that we want to log the ++ * information to kmsg instead of filling out buf. ++ * ++ * Return: ++ * Number of entries read out of the ring ++ **/ ++u32 lpfc_rx_monitor_report(struct lpfc_hba *phba, ++ struct lpfc_rx_info_monitor *rx_monitor, char *buf, ++ u32 buf_len, u32 max_read_entries) ++{ ++ struct rx_info_entry *ring = rx_monitor->ring; ++ struct rx_info_entry *entry; ++ u32 *head_idx = &rx_monitor->head_idx; ++ u32 *tail_idx = &rx_monitor->tail_idx; ++ spinlock_t *ring_lock = &rx_monitor->lock; ++ u32 ring_size = rx_monitor->entries; ++ u32 cnt = 0; ++ char tmp[DBG_LOG_STR_SZ] = {0}; ++ bool log_to_kmsg = (!buf || !buf_len) ? true : false; ++ ++ if (!log_to_kmsg) { ++ /* clear the buffer to be sure */ ++ memset(buf, 0, buf_len); ++ ++ scnprintf(buf, buf_len, "\t%-16s%-16s%-16s%-16s%-8s%-8s%-8s" ++ "%-8s%-8s%-8s%-16s\n", ++ "MaxBPI", "Tot_Data_CMF", ++ "Tot_Data_Cmd", "Tot_Data_Cmpl", ++ "Lat(us)", "Avg_IO", "Max_IO", "Bsy", ++ "IO_cnt", "Info", "BWutil(ms)"); ++ } ++ ++ /* Needs to be _bh because record is called from timer interrupt ++ * context ++ */ ++ spin_lock_bh(ring_lock); ++ while (*head_idx != *tail_idx) { ++ entry = &ring[*head_idx]; ++ ++ /* Read out this entry's data. */ ++ if (!log_to_kmsg) { ++ /* If !log_to_kmsg, then store to buf. */ ++ scnprintf(tmp, sizeof(tmp), ++ "%03d:\t%-16llu%-16llu%-16llu%-16llu%-8llu" ++ "%-8llu%-8llu%-8u%-8u%-8u%u(%u)\n", ++ *head_idx, entry->max_bytes_per_interval, ++ entry->cmf_bytes, entry->total_bytes, ++ entry->rcv_bytes, entry->avg_io_latency, ++ entry->avg_io_size, entry->max_read_cnt, ++ entry->cmf_busy, entry->io_cnt, ++ entry->cmf_info, entry->timer_utilization, ++ entry->timer_interval); ++ ++ /* Check for buffer overflow */ ++ if ((strlen(buf) + strlen(tmp)) >= buf_len) ++ break; ++ ++ /* Append entry's data to buffer */ ++ strlcat(buf, tmp, buf_len); ++ } else { ++ lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, ++ "4410 %02u: MBPI %llu Xmit %llu " ++ "Cmpl %llu Lat %llu ASz %llu Info %02u " ++ "BWUtil %u Int %u slot %u\n", ++ cnt, entry->max_bytes_per_interval, ++ entry->total_bytes, entry->rcv_bytes, ++ entry->avg_io_latency, ++ entry->avg_io_size, entry->cmf_info, ++ entry->timer_utilization, ++ entry->timer_interval, *head_idx); ++ } ++ ++ *head_idx = (*head_idx + 1) % ring_size; ++ ++ /* Don't feed more than max_read_entries */ ++ cnt++; ++ if (cnt >= max_read_entries) ++ break; ++ } ++ spin_unlock_bh(ring_lock); ++ ++ return cnt; ++} ++ + /** + * lpfc_cmf_setup - Initialize idle_stat tracking + * @phba: Pointer to HBA context object. +@@ -8128,19 +8294,29 @@ no_cmf: + phba->cmf_interval_rate = LPFC_CMF_INTERVAL; + + /* Allocate RX Monitor Buffer */ +- if (!phba->rxtable) { +- phba->rxtable = kmalloc_array(LPFC_MAX_RXMONITOR_ENTRY, +- sizeof(struct rxtable_entry), +- GFP_KERNEL); +- if (!phba->rxtable) { ++ if (!phba->rx_monitor) { ++ phba->rx_monitor = kzalloc(sizeof(*phba->rx_monitor), ++ GFP_KERNEL); ++ ++ if (!phba->rx_monitor) { + lpfc_printf_log(phba, KERN_ERR, LOG_INIT, + "2644 Failed to alloc memory " + "for RX Monitor Buffer\n"); + return -ENOMEM; + } ++ ++ /* Instruct the rx_monitor object to instantiate its ring */ ++ if (lpfc_rx_monitor_create_ring(phba->rx_monitor, ++ LPFC_MAX_RXMONITOR_ENTRY)) { ++ kfree(phba->rx_monitor); ++ phba->rx_monitor = NULL; ++ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, ++ "2645 Failed to alloc memory " ++ "for RX Monitor's Ring\n"); ++ return -ENOMEM; ++ } + } +- atomic_set(&phba->rxtable_idx_head, 0); +- atomic_set(&phba->rxtable_idx_tail, 0); ++ + return 0; + } + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 991eb01bb1e08..0ccaefc35d6b4 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -3608,6 +3608,10 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) + pm8001_dbg(pm8001_ha, FAIL, " TASK NULL. RETURNING !!!\n"); + return -1; + } ++ ++ if (t->task_proto == SAS_PROTOCOL_INTERNAL_ABORT) ++ atomic_dec(&pm8001_dev->running_req); ++ + ts = &t->task_status; + if (status != 0) + pm8001_dbg(pm8001_ha, FAIL, "task abort failed status 0x%x ,tag = 0x%x, scp= 0x%x\n", +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index bbc4d5890ae6a..e045c6e250902 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -1921,6 +1921,27 @@ static int qedf_vport_create(struct fc_vport *vport, bool disabled) + fc_vport_setlink(vn_port); + } + ++ /* Set symbolic node name */ ++ if (base_qedf->pdev->device == QL45xxx) ++ snprintf(fc_host_symbolic_name(vn_port->host), 256, ++ "Marvell FastLinQ 45xxx FCoE v%s", QEDF_VERSION); ++ ++ if (base_qedf->pdev->device == QL41xxx) ++ snprintf(fc_host_symbolic_name(vn_port->host), 256, ++ "Marvell FastLinQ 41xxx FCoE v%s", QEDF_VERSION); ++ ++ /* Set supported speed */ ++ fc_host_supported_speeds(vn_port->host) = n_port->link_supported_speeds; ++ ++ /* Set speed */ ++ vn_port->link_speed = n_port->link_speed; ++ ++ /* Set port type */ ++ fc_host_port_type(vn_port->host) = FC_PORTTYPE_NPIV; ++ ++ /* Set maxframe size */ ++ fc_host_maxframe_size(vn_port->host) = n_port->mfs; ++ + QEDF_INFO(&(base_qedf->dbg_ctx), QEDF_LOG_NPIV, "vn_port=%p.\n", + vn_port); + +diff --git a/drivers/slimbus/Kconfig b/drivers/slimbus/Kconfig +index 1235b7dc8496c..2ed821f75816c 100644 +--- a/drivers/slimbus/Kconfig ++++ b/drivers/slimbus/Kconfig +@@ -22,7 +22,8 @@ config SLIM_QCOM_CTRL + + config SLIM_QCOM_NGD_CTRL + tristate "Qualcomm SLIMbus Satellite Non-Generic Device Component" +- depends on HAS_IOMEM && DMA_ENGINE && NET && QCOM_RPROC_COMMON ++ depends on HAS_IOMEM && DMA_ENGINE && NET ++ depends on QCOM_RPROC_COMMON || COMPILE_TEST + depends on ARCH_QCOM || COMPILE_TEST + select QCOM_QMI_HELPERS + select QCOM_PDR_HELPERS +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 0aa8408464add..d29a1a9cf12fa 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1470,7 +1470,13 @@ static int of_qcom_slim_ngd_register(struct device *parent, + ngd->pdev->dev.of_node = node; + ctrl->ngd = ngd; + +- platform_device_add(ngd->pdev); ++ ret = platform_device_add(ngd->pdev); ++ if (ret) { ++ platform_device_put(ngd->pdev); ++ kfree(ngd); ++ of_node_put(node); ++ return ret; ++ } + ngd->base = ctrl->base + ngd->id * data->offset + + (ngd->id - 1) * data->size; + +@@ -1576,17 +1582,27 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl); + if (IS_ERR(ctrl->pdr)) { + dev_err(dev, "Failed to init PDR handle\n"); +- return PTR_ERR(ctrl->pdr); ++ ret = PTR_ERR(ctrl->pdr); ++ goto err_pdr_alloc; + } + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { ++ ret = PTR_ERR(pds); + dev_err(dev, "pdr add lookup failed: %d\n", ret); +- return PTR_ERR(pds); ++ goto err_pdr_lookup; + } + + platform_driver_register(&qcom_slim_ngd_driver); + return of_qcom_slim_ngd_register(dev, ctrl); ++ ++err_pdr_alloc: ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); ++ ++err_pdr_lookup: ++ pdr_handle_release(ctrl->pdr); ++ ++ return ret; + } + + static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) +diff --git a/drivers/soc/qcom/smem_state.c b/drivers/soc/qcom/smem_state.c +index 31faf4aa868e6..e848cc9a3cf80 100644 +--- a/drivers/soc/qcom/smem_state.c ++++ b/drivers/soc/qcom/smem_state.c +@@ -136,6 +136,7 @@ static void qcom_smem_state_release(struct kref *ref) + struct qcom_smem_state *state = container_of(ref, struct qcom_smem_state, refcount); + + list_del(&state->list); ++ of_node_put(state->of_node); + kfree(state); + } + +@@ -205,7 +206,7 @@ struct qcom_smem_state *qcom_smem_state_register(struct device_node *of_node, + + kref_init(&state->refcount); + +- state->of_node = of_node; ++ state->of_node = of_node_get(of_node); + state->ops = *ops; + state->priv = priv; + +diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c +index 9df9bba242f3e..3e8994d6110e6 100644 +--- a/drivers/soc/qcom/smsm.c ++++ b/drivers/soc/qcom/smsm.c +@@ -526,7 +526,7 @@ static int qcom_smsm_probe(struct platform_device *pdev) + for (id = 0; id < smsm->num_hosts; id++) { + ret = smsm_parse_ipc(smsm, id); + if (ret < 0) +- return ret; ++ goto out_put; + } + + /* Acquire the main SMSM state vector */ +@@ -534,13 +534,14 @@ static int qcom_smsm_probe(struct platform_device *pdev) + smsm->num_entries * sizeof(u32)); + if (ret < 0 && ret != -EEXIST) { + dev_err(&pdev->dev, "unable to allocate shared state entry\n"); +- return ret; ++ goto out_put; + } + + states = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_SHARED_STATE, NULL); + if (IS_ERR(states)) { + dev_err(&pdev->dev, "Unable to acquire shared state entry\n"); +- return PTR_ERR(states); ++ ret = PTR_ERR(states); ++ goto out_put; + } + + /* Acquire the list of interrupt mask vectors */ +@@ -548,13 +549,14 @@ static int qcom_smsm_probe(struct platform_device *pdev) + ret = qcom_smem_alloc(QCOM_SMEM_HOST_ANY, SMEM_SMSM_CPU_INTR_MASK, size); + if (ret < 0 && ret != -EEXIST) { + dev_err(&pdev->dev, "unable to allocate smsm interrupt mask\n"); +- return ret; ++ goto out_put; + } + + intr_mask = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_CPU_INTR_MASK, NULL); + if (IS_ERR(intr_mask)) { + dev_err(&pdev->dev, "unable to acquire shared memory interrupt mask\n"); +- return PTR_ERR(intr_mask); ++ ret = PTR_ERR(intr_mask); ++ goto out_put; + } + + /* Setup the reference to the local state bits */ +@@ -565,7 +567,8 @@ static int qcom_smsm_probe(struct platform_device *pdev) + smsm->state = qcom_smem_state_register(local_node, &smsm_state_ops, smsm); + if (IS_ERR(smsm->state)) { + dev_err(smsm->dev, "failed to register qcom_smem_state\n"); +- return PTR_ERR(smsm->state); ++ ret = PTR_ERR(smsm->state); ++ goto out_put; + } + + /* Register handlers for remote processor entries of interest. */ +@@ -595,16 +598,19 @@ static int qcom_smsm_probe(struct platform_device *pdev) + } + + platform_set_drvdata(pdev, smsm); ++ of_node_put(local_node); + + return 0; + + unwind_interfaces: ++ of_node_put(node); + for (id = 0; id < smsm->num_entries; id++) + if (smsm->entries[id].domain) + irq_domain_remove(smsm->entries[id].domain); + + qcom_smem_state_unregister(smsm->state); +- ++out_put: ++ of_node_put(local_node); + return ret; + } + +diff --git a/drivers/soc/tegra/Kconfig b/drivers/soc/tegra/Kconfig +index 5725c8ef0406a..6f601227da3cb 100644 +--- a/drivers/soc/tegra/Kconfig ++++ b/drivers/soc/tegra/Kconfig +@@ -136,7 +136,6 @@ config SOC_TEGRA_FUSE + def_bool y + depends on ARCH_TEGRA + select SOC_BUS +- select TEGRA20_APB_DMA if ARCH_TEGRA_2x_SOC + + config SOC_TEGRA_FLOWCTRL + bool +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index 4fbb19557f5ed..42c5fae80efbf 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -544,9 +544,12 @@ cdns_fill_msg_resp(struct sdw_cdns *cdns, + return SDW_CMD_IGNORED; + } + +- /* fill response */ +- for (i = 0; i < count; i++) +- msg->buf[i + offset] = FIELD_GET(CDNS_MCP_RESP_RDATA, cdns->response_buf[i]); ++ if (msg->flags == SDW_MSG_FLAG_READ) { ++ /* fill response */ ++ for (i = 0; i < count; i++) ++ msg->buf[i + offset] = FIELD_GET(CDNS_MCP_RESP_RDATA, ++ cdns->response_buf[i]); ++ } + + return SDW_CMD_OK; + } +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index 505c5ef061e3f..865d91ecb8627 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -1401,7 +1401,6 @@ int intel_link_startup(struct auxiliary_device *auxdev) + ret = intel_register_dai(sdw); + if (ret) { + dev_err(dev, "DAI registration failed: %d\n", ret); +- snd_soc_unregister_component(dev); + goto err_interrupt; + } + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 72b1a5a2298c5..106c09ffa4251 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1619,7 +1619,7 @@ static int cqspi_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) +- return ret; ++ goto probe_pm_failed; + + ret = clk_prepare_enable(cqspi->clk); + if (ret) { +@@ -1712,6 +1712,7 @@ probe_reset_failed: + clk_disable_unprepare(cqspi->clk); + probe_clk_failed: + pm_runtime_put_sync(dev); ++probe_pm_failed: + pm_runtime_disable(dev); + return ret; + } +diff --git a/drivers/spi/spi-dw-bt1.c b/drivers/spi/spi-dw-bt1.c +index c065534161237..3fb89dee595e7 100644 +--- a/drivers/spi/spi-dw-bt1.c ++++ b/drivers/spi/spi-dw-bt1.c +@@ -293,8 +293,10 @@ static int dw_spi_bt1_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + ret = dw_spi_add_host(&pdev->dev, dws); +- if (ret) ++ if (ret) { ++ pm_runtime_disable(&pdev->dev); + goto err_disable_clk; ++ } + + platform_set_drvdata(pdev, dwsbt1); + +diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c +index e4cb52e1fe261..6974a1c947aad 100644 +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -537,7 +537,7 @@ static unsigned long meson_spicc_pow2_recalc_rate(struct clk_hw *hw, + struct clk_divider *divider = to_clk_divider(hw); + struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider); + +- if (!spicc->master->cur_msg || !spicc->master->busy) ++ if (!spicc->master->cur_msg) + return 0; + + return clk_divider_ops.recalc_rate(hw, parent_rate); +@@ -549,7 +549,7 @@ static int meson_spicc_pow2_determine_rate(struct clk_hw *hw, + struct clk_divider *divider = to_clk_divider(hw); + struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider); + +- if (!spicc->master->cur_msg || !spicc->master->busy) ++ if (!spicc->master->cur_msg) + return -EINVAL; + + return clk_divider_ops.determine_rate(hw, req); +@@ -561,7 +561,7 @@ static int meson_spicc_pow2_set_rate(struct clk_hw *hw, unsigned long rate, + struct clk_divider *divider = to_clk_divider(hw); + struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider); + +- if (!spicc->master->cur_msg || !spicc->master->busy) ++ if (!spicc->master->cur_msg) + return -EINVAL; + + return clk_divider_ops.set_rate(hw, rate, parent_rate); +diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c +index b4b9b7309b5e9..351b0ef52bbc8 100644 +--- a/drivers/spi/spi-mt7621.c ++++ b/drivers/spi/spi-mt7621.c +@@ -340,11 +340,9 @@ static int mt7621_spi_probe(struct platform_device *pdev) + return PTR_ERR(base); + + clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(clk)) { +- dev_err(&pdev->dev, "unable to get SYS clock, err=%d\n", +- status); +- return PTR_ERR(clk); +- } ++ if (IS_ERR(clk)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(clk), ++ "unable to get SYS clock\n"); + + status = clk_prepare_enable(clk); + if (status) +diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c +index 20b0471729651..061f7394e5b9b 100644 +--- a/drivers/spi/spi-omap-100k.c ++++ b/drivers/spi/spi-omap-100k.c +@@ -412,6 +412,7 @@ static int omap1_spi100k_probe(struct platform_device *pdev) + return status; + + err_fck: ++ pm_runtime_disable(&pdev->dev); + clk_disable_unprepare(spi100k->fck); + err_ick: + clk_disable_unprepare(spi100k->ick); +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 00d6084306b4a..7d89510dc3f00 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1198,8 +1198,10 @@ static int spi_qup_pm_resume_runtime(struct device *device) + return ret; + + ret = clk_prepare_enable(controller->cclk); +- if (ret) ++ if (ret) { ++ clk_disable_unprepare(controller->iclk); + return ret; ++ } + + /* Disable clocks auto gaiting */ + config = readl_relaxed(controller->base + QUP_CONFIG); +@@ -1245,14 +1247,25 @@ static int spi_qup_resume(struct device *device) + return ret; + + ret = clk_prepare_enable(controller->cclk); +- if (ret) ++ if (ret) { ++ clk_disable_unprepare(controller->iclk); + return ret; ++ } + + ret = spi_qup_set_state(controller, QUP_STATE_RESET); + if (ret) +- return ret; ++ goto disable_clk; + +- return spi_master_resume(master); ++ ret = spi_master_resume(master); ++ if (ret) ++ goto disable_clk; ++ ++ return 0; ++ ++disable_clk: ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); ++ return ret; + } + #endif /* CONFIG_PM_SLEEP */ + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 8fa21afc6a35b..b77c98bcf93f0 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -83,6 +83,7 @@ + #define S3C64XX_SPI_ST_TX_FIFORDY (1<<0) + + #define S3C64XX_SPI_PACKET_CNT_EN (1<<16) ++#define S3C64XX_SPI_PACKET_CNT_MASK GENMASK(15, 0) + + #define S3C64XX_SPI_PND_TX_UNDERRUN_CLR (1<<4) + #define S3C64XX_SPI_PND_TX_OVERRUN_CLR (1<<3) +@@ -663,6 +664,13 @@ static int s3c64xx_spi_prepare_message(struct spi_master *master, + return 0; + } + ++static size_t s3c64xx_spi_max_transfer_size(struct spi_device *spi) ++{ ++ struct spi_controller *ctlr = spi->controller; ++ ++ return ctlr->can_dma ? S3C64XX_SPI_PACKET_CNT_MASK : SIZE_MAX; ++} ++ + static int s3c64xx_spi_transfer_one(struct spi_master *master, + struct spi_device *spi, + struct spi_transfer *xfer) +@@ -1100,6 +1108,7 @@ static int s3c64xx_spi_probe(struct platform_device *pdev) + master->prepare_transfer_hardware = s3c64xx_spi_prepare_transfer; + master->prepare_message = s3c64xx_spi_prepare_message; + master->transfer_one = s3c64xx_spi_transfer_one; ++ master->max_transfer_size = s3c64xx_spi_max_transfer_size; + master->num_chipselect = sci->num_cs; + master->use_gpio_descriptors = true; + master->dma_alignment = 8; +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 2c616024f7c02..f595e516058c2 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1047,6 +1047,8 @@ void spi_unmap_buf(struct spi_controller *ctlr, struct device *dev, + if (sgt->orig_nents) { + dma_unmap_sg(dev, sgt->sgl, sgt->orig_nents, dir); + sg_free_table(sgt); ++ sgt->orig_nents = 0; ++ sgt->nents = 0; + } + } + +diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c +index 2113be40b5a97..58f580e7aacc5 100644 +--- a/drivers/spmi/spmi-pmic-arb.c ++++ b/drivers/spmi/spmi-pmic-arb.c +@@ -992,7 +992,8 @@ static int pmic_arb_read_apid_map_v5(struct spmi_pmic_arb *pmic_arb) + * version 5, there is more than one APID mapped to each PPID. + * The owner field for each of these mappings specifies the EE which is + * allowed to write to the APID. The owner of the last (highest) APID +- * for a given PPID will receive interrupts from the PPID. ++ * which has the IRQ owner bit set for a given PPID will receive ++ * interrupts from the PPID. + */ + for (i = 0; ; i++, apidd++) { + offset = pmic_arb->ver_ops->apid_map_offset(i); +@@ -1015,16 +1016,16 @@ static int pmic_arb_read_apid_map_v5(struct spmi_pmic_arb *pmic_arb) + apid = pmic_arb->ppid_to_apid[ppid] & ~PMIC_ARB_APID_VALID; + prev_apidd = &pmic_arb->apid_data[apid]; + +- if (valid && is_irq_ee && +- prev_apidd->write_ee == pmic_arb->ee) { ++ if (!valid || apidd->write_ee == pmic_arb->ee) { ++ /* First PPID mapping or one for this EE */ ++ pmic_arb->ppid_to_apid[ppid] = i | PMIC_ARB_APID_VALID; ++ } else if (valid && is_irq_ee && ++ prev_apidd->write_ee == pmic_arb->ee) { + /* + * Duplicate PPID mapping after the one for this EE; + * override the irq owner + */ + prev_apidd->irq_ee = apidd->irq_ee; +- } else if (!valid || is_irq_ee) { +- /* First PPID mapping or duplicate for another EE */ +- pmic_arb->ppid_to_apid[ppid] = i | PMIC_ARB_APID_VALID; + } + + apidd->ppid = ppid; +diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c +index 843760675876a..79bb2bd8e0007 100644 +--- a/drivers/staging/greybus/audio_helper.c ++++ b/drivers/staging/greybus/audio_helper.c +@@ -3,7 +3,6 @@ + * Greybus Audio Sound SoC helper APIs + */ + +-#include <linux/debugfs.h> + #include <sound/core.h> + #include <sound/soc.h> + #include <sound/soc-dapm.h> +@@ -116,10 +115,6 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm, + { + int i; + struct snd_soc_dapm_widget *w, *next_w; +-#ifdef CONFIG_DEBUG_FS +- struct dentry *parent = dapm->debugfs_dapm; +- struct dentry *debugfs_w = NULL; +-#endif + + mutex_lock(&dapm->card->dapm_mutex); + for (i = 0; i < num; i++) { +@@ -139,12 +134,6 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm, + continue; + } + widget++; +-#ifdef CONFIG_DEBUG_FS +- if (!parent) +- debugfs_w = debugfs_lookup(w->name, parent); +- debugfs_remove(debugfs_w); +- debugfs_w = NULL; +-#endif + gbaudio_dapm_free_widget(w); + } + mutex_unlock(&dapm->card->dapm_mutex); +diff --git a/drivers/staging/media/meson/vdec/vdec_hevc.c b/drivers/staging/media/meson/vdec/vdec_hevc.c +index 9530e580e57a2..afced435c9070 100644 +--- a/drivers/staging/media/meson/vdec/vdec_hevc.c ++++ b/drivers/staging/media/meson/vdec/vdec_hevc.c +@@ -167,8 +167,12 @@ static int vdec_hevc_start(struct amvdec_session *sess) + + clk_set_rate(core->vdec_hevc_clk, 666666666); + ret = clk_prepare_enable(core->vdec_hevc_clk); +- if (ret) ++ if (ret) { ++ if (core->platform->revision == VDEC_REVISION_G12A || ++ core->platform->revision == VDEC_REVISION_SM1) ++ clk_disable_unprepare(core->vdec_hevcf_clk); + return ret; ++ } + + if (core->platform->revision == VDEC_REVISION_SM1) + regmap_update_bits(core->regmap_ao, AO_RTI_GEN_PWR_SLEEP0, +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c +index 68b3dcdb5df38..e88a1fe1315cd 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -422,6 +422,8 @@ static int cedrus_probe(struct platform_device *pdev) + if (!dev) + return -ENOMEM; + ++ platform_set_drvdata(pdev, dev); ++ + dev->vfd = cedrus_video_device; + dev->dev = &pdev->dev; + dev->pdev = pdev; +@@ -495,8 +497,6 @@ static int cedrus_probe(struct platform_device *pdev) + goto err_m2m_mc; + } + +- platform_set_drvdata(pdev, dev); +- + return 0; + + err_m2m_mc: +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +index 04419381ea56b..9b6c2eff35af1 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +@@ -234,8 +234,9 @@ static void cedrus_h265_skip_bits(struct cedrus_dev *dev, int num) + cedrus_write(dev, VE_DEC_H265_TRIGGER, + VE_DEC_H265_TRIGGER_FLUSH_BITS | + VE_DEC_H265_TRIGGER_TYPE_N_BITS(tmp)); +- while (cedrus_read(dev, VE_DEC_H265_STATUS) & VE_DEC_H265_STATUS_VLD_BUSY) +- udelay(1); ++ ++ if (cedrus_wait_for(dev, VE_DEC_H265_STATUS, VE_DEC_H265_STATUS_VLD_BUSY)) ++ dev_err_ratelimited(dev->dev, "timed out waiting to skip bits\n"); + + count += tmp; + } +diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c +index b4170f64d1186..03c2c66dbf665 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_cmd.c ++++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c +@@ -161,8 +161,6 @@ static struct cmd_hdl wlancmds[] = { + + int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv) + { +- int res = 0; +- + init_completion(&pcmdpriv->cmd_queue_comp); + init_completion(&pcmdpriv->terminate_cmdthread_comp); + +@@ -175,18 +173,16 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv) + + pcmdpriv->cmd_allocated_buf = rtw_zmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ); + +- if (!pcmdpriv->cmd_allocated_buf) { +- res = -ENOMEM; +- goto exit; +- } ++ if (!pcmdpriv->cmd_allocated_buf) ++ return -ENOMEM; + + pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf + CMDBUFF_ALIGN_SZ - ((SIZE_PTR)(pcmdpriv->cmd_allocated_buf) & (CMDBUFF_ALIGN_SZ-1)); + + pcmdpriv->rsp_allocated_buf = rtw_zmalloc(MAX_RSPSZ + 4); + + if (!pcmdpriv->rsp_allocated_buf) { +- res = -ENOMEM; +- goto exit; ++ kfree(pcmdpriv->cmd_allocated_buf); ++ return -ENOMEM; + } + + pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf + 4 - ((SIZE_PTR)(pcmdpriv->rsp_allocated_buf) & 3); +@@ -196,8 +192,8 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv) + pcmdpriv->rsp_cnt = 0; + + mutex_init(&pcmdpriv->sctx_mutex); +-exit: +- return res; ++ ++ return 0; + } + + static void c2h_wk_callback(struct work_struct *work); +diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c +index 380d8c9e1239e..68bba3c0e757a 100644 +--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c ++++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c +@@ -664,51 +664,36 @@ void rtw_reset_drv_sw(struct adapter *padapter) + + u8 rtw_init_drv_sw(struct adapter *padapter) + { +- u8 ret8 = _SUCCESS; +- + rtw_init_default_value(padapter); + + rtw_init_hal_com_default_value(padapter); + +- if (rtw_init_cmd_priv(&padapter->cmdpriv)) { +- ret8 = _FAIL; +- goto exit; +- } ++ if (rtw_init_cmd_priv(&padapter->cmdpriv)) ++ return _FAIL; + + padapter->cmdpriv.padapter = padapter; + +- if (rtw_init_evt_priv(&padapter->evtpriv)) { +- ret8 = _FAIL; +- goto exit; +- } ++ if (rtw_init_evt_priv(&padapter->evtpriv)) ++ goto free_cmd_priv; + +- +- if (rtw_init_mlme_priv(padapter) == _FAIL) { +- ret8 = _FAIL; +- goto exit; +- } ++ if (rtw_init_mlme_priv(padapter) == _FAIL) ++ goto free_evt_priv; + + init_mlme_ext_priv(padapter); + +- if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL) { +- ret8 = _FAIL; +- goto exit; +- } ++ if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL) ++ goto free_mlme_ext; + +- if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL) { +- ret8 = _FAIL; +- goto exit; +- } ++ if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL) ++ goto free_xmit_priv; + /* add for CONFIG_IEEE80211W, none 11w also can use */ + spin_lock_init(&padapter->security_key_mutex); + + /* We don't need to memset padapter->XXX to zero, because adapter is allocated by vzalloc(). */ + /* memset((unsigned char *)&padapter->securitypriv, 0, sizeof (struct security_priv)); */ + +- if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL) { +- ret8 = _FAIL; +- goto exit; +- } ++ if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL) ++ goto free_recv_priv; + + padapter->stapriv.padapter = padapter; + padapter->setband = GHZ24_50; +@@ -719,9 +704,26 @@ u8 rtw_init_drv_sw(struct adapter *padapter) + + rtw_hal_dm_init(padapter); + +-exit: ++ return _SUCCESS; ++ ++free_recv_priv: ++ _rtw_free_recv_priv(&padapter->recvpriv); ++ ++free_xmit_priv: ++ _rtw_free_xmit_priv(&padapter->xmitpriv); ++ ++free_mlme_ext: ++ free_mlme_ext_priv(&padapter->mlmeextpriv); + +- return ret8; ++ rtw_free_mlme_priv(&padapter->mlmepriv); ++ ++free_evt_priv: ++ rtw_free_evt_priv(&padapter->evtpriv); ++ ++free_cmd_priv: ++ rtw_free_cmd_priv(&padapter->cmdpriv); ++ ++ return _FAIL; + } + + void rtw_cancel_all_timer(struct adapter *padapter) +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c +index afaf331fe125d..a91c834c96c08 100644 +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -564,7 +564,7 @@ err_free_rd: + kfree(desc->rd_info); + + err_free_desc: +- while (--i) { ++ while (i--) { + desc = &priv->aRD0Ring[i]; + device_free_rx_buf(priv, desc); + kfree(desc->rd_info); +@@ -610,7 +610,7 @@ err_free_rd: + kfree(desc->rd_info); + + err_free_desc: +- while (--i) { ++ while (i--) { + desc = &priv->aRD1Ring[i]; + device_free_rx_buf(priv, desc); + kfree(desc->rd_info); +@@ -675,7 +675,7 @@ static int device_init_td0_ring(struct vnt_private *priv) + return 0; + + err_free_desc: +- while (--i) { ++ while (i--) { + desc = &priv->apTD0Rings[i]; + kfree(desc->td_info); + } +@@ -715,7 +715,7 @@ static int device_init_td1_ring(struct vnt_private *priv) + return 0; + + err_free_desc: +- while (--i) { ++ while (i--) { + desc = &priv->apTD1Rings[i]; + kfree(desc->td_info); + } +diff --git a/drivers/thermal/cpufreq_cooling.c b/drivers/thermal/cpufreq_cooling.c +index dc19e7c80751a..ca5746f53d9ea 100644 +--- a/drivers/thermal/cpufreq_cooling.c ++++ b/drivers/thermal/cpufreq_cooling.c +@@ -530,17 +530,17 @@ __cpufreq_cooling_register(struct device_node *np, + struct thermal_cooling_device_ops *cooling_ops; + char *name; + ++ if (IS_ERR_OR_NULL(policy)) { ++ pr_err("%s: cpufreq policy isn't valid: %p\n", __func__, policy); ++ return ERR_PTR(-EINVAL); ++ } ++ + dev = get_cpu_device(policy->cpu); + if (unlikely(!dev)) { + pr_warn("No cpu device for cpu %d\n", policy->cpu); + return ERR_PTR(-ENODEV); + } + +- if (IS_ERR_OR_NULL(policy)) { +- pr_err("%s: cpufreq policy isn't valid: %p\n", __func__, policy); +- return ERR_PTR(-EINVAL); +- } +- + i = cpufreq_table_count_valid_entries(policy); + if (!i) { + pr_debug("%s: CPUFreq table not found or has no valid entries\n", +diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c +index c841ab37e7c6d..46cd799af148d 100644 +--- a/drivers/thermal/intel/intel_powerclamp.c ++++ b/drivers/thermal/intel/intel_powerclamp.c +@@ -532,8 +532,10 @@ static int start_power_clamp(void) + + /* prefer BSP */ + control_cpu = 0; +- if (!cpu_online(control_cpu)) +- control_cpu = smp_processor_id(); ++ if (!cpu_online(control_cpu)) { ++ control_cpu = get_cpu(); ++ put_cpu(); ++ } + + clamping = true; + schedule_delayed_work(&poll_pkg_cstate_work, 0); +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index f136cb3502384..327f37202c69f 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -604,7 +604,7 @@ static const struct tsens_ops ops_8939 = { + struct tsens_plat_data data_8939 = { + .num_sensors = 10, + .ops = &ops_8939, +- .hw_ids = (unsigned int []){ 0, 1, 2, 4, 5, 6, 7, 8, 9, 10 }, ++ .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 }, + + .feat = &tsens_v0_1_feat, + .fields = tsens_v0_1_regfields, +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 1333b158a95eb..407a89047473b 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -28,7 +28,11 @@ + #define RING_TYPE(ring) ((ring)->is_tx ? "TX ring" : "RX ring") + + #define RING_FIRST_USABLE_HOPID 1 +- ++/* ++ * Used with QUIRK_E2E to specify an unused HopID the Rx credits are ++ * transferred. ++ */ ++#define RING_E2E_RESERVED_HOPID RING_FIRST_USABLE_HOPID + /* + * Minimal number of vectors when we use MSI-X. Two for control channel + * Rx/Tx and the rest four are for cross domain DMA paths. +@@ -38,7 +42,9 @@ + + #define NHI_MAILBOX_TIMEOUT 500 /* ms */ + ++/* Host interface quirks */ + #define QUIRK_AUTO_CLEAR_INT BIT(0) ++#define QUIRK_E2E BIT(1) + + static int ring_interrupt_index(struct tb_ring *ring) + { +@@ -458,8 +464,18 @@ static void ring_release_msix(struct tb_ring *ring) + + static int nhi_alloc_hop(struct tb_nhi *nhi, struct tb_ring *ring) + { ++ unsigned int start_hop = RING_FIRST_USABLE_HOPID; + int ret = 0; + ++ if (nhi->quirks & QUIRK_E2E) { ++ start_hop = RING_FIRST_USABLE_HOPID + 1; ++ if (ring->flags & RING_FLAG_E2E && !ring->is_tx) { ++ dev_dbg(&nhi->pdev->dev, "quirking E2E TX HopID %u -> %u\n", ++ ring->e2e_tx_hop, RING_E2E_RESERVED_HOPID); ++ ring->e2e_tx_hop = RING_E2E_RESERVED_HOPID; ++ } ++ } ++ + spin_lock_irq(&nhi->lock); + + if (ring->hop < 0) { +@@ -469,7 +485,7 @@ static int nhi_alloc_hop(struct tb_nhi *nhi, struct tb_ring *ring) + * Automatically allocate HopID from the non-reserved + * range 1 .. hop_count - 1. + */ +- for (i = RING_FIRST_USABLE_HOPID; i < nhi->hop_count; i++) { ++ for (i = start_hop; i < nhi->hop_count; i++) { + if (ring->is_tx) { + if (!nhi->tx_rings[i]) { + ring->hop = i; +@@ -484,6 +500,11 @@ static int nhi_alloc_hop(struct tb_nhi *nhi, struct tb_ring *ring) + } + } + ++ if (ring->hop > 0 && ring->hop < start_hop) { ++ dev_warn(&nhi->pdev->dev, "invalid hop: %d\n", ring->hop); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + if (ring->hop < 0 || ring->hop >= nhi->hop_count) { + dev_warn(&nhi->pdev->dev, "invalid hop: %d\n", ring->hop); + ret = -EINVAL; +@@ -1097,12 +1118,26 @@ static void nhi_shutdown(struct tb_nhi *nhi) + + static void nhi_check_quirks(struct tb_nhi *nhi) + { +- /* +- * Intel hardware supports auto clear of the interrupt status +- * reqister right after interrupt is being issued. +- */ +- if (nhi->pdev->vendor == PCI_VENDOR_ID_INTEL) ++ if (nhi->pdev->vendor == PCI_VENDOR_ID_INTEL) { ++ /* ++ * Intel hardware supports auto clear of the interrupt ++ * status register right after interrupt is being ++ * issued. ++ */ + nhi->quirks |= QUIRK_AUTO_CLEAR_INT; ++ ++ switch (nhi->pdev->device) { ++ case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI: ++ case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI: ++ /* ++ * Falcon Ridge controller needs the end-to-end ++ * flow control workaround to avoid losing Rx ++ * packets when RING_FLAG_E2E is set. ++ */ ++ nhi->quirks |= QUIRK_E2E; ++ break; ++ } ++ } + } + + static int nhi_check_iommu_pdev(struct pci_dev *pdev, void *data) +diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c +index 0508da6f63d9e..744a274d108b0 100644 +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -2822,6 +2822,26 @@ static void tb_switch_credits_init(struct tb_switch *sw) + tb_sw_info(sw, "failed to determine preferred buffer allocation, using defaults\n"); + } + ++static int tb_switch_port_hotplug_enable(struct tb_switch *sw) ++{ ++ struct tb_port *port; ++ ++ if (tb_switch_is_icm(sw)) ++ return 0; ++ ++ tb_switch_for_each_port(sw, port) { ++ int res; ++ ++ if (!port->cap_usb4) ++ continue; ++ ++ res = usb4_port_hotplug_enable(port); ++ if (res) ++ return res; ++ } ++ return 0; ++} ++ + /** + * tb_switch_add() - Add a switch to the domain + * @sw: Switch to add +@@ -2891,6 +2911,10 @@ int tb_switch_add(struct tb_switch *sw) + return ret; + } + ++ ret = tb_switch_port_hotplug_enable(sw); ++ if (ret) ++ return ret; ++ + ret = device_add(&sw->dev); + if (ret) { + dev_err(&sw->dev, "failed to add device: %d\n", ret); +diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h +index 4602c69913fa0..eef6336bd1663 100644 +--- a/drivers/thunderbolt/tb.h ++++ b/drivers/thunderbolt/tb.h +@@ -1170,6 +1170,7 @@ int usb4_switch_add_ports(struct tb_switch *sw); + void usb4_switch_remove_ports(struct tb_switch *sw); + + int usb4_port_unlock(struct tb_port *port); ++int usb4_port_hotplug_enable(struct tb_port *port); + int usb4_port_configure(struct tb_port *port); + void usb4_port_unconfigure(struct tb_port *port); + int usb4_port_configure_xdomain(struct tb_port *port); +diff --git a/drivers/thunderbolt/tb_regs.h b/drivers/thunderbolt/tb_regs.h +index 6a16f61a72a1b..4e0c2a1ccab0c 100644 +--- a/drivers/thunderbolt/tb_regs.h ++++ b/drivers/thunderbolt/tb_regs.h +@@ -302,6 +302,7 @@ struct tb_regs_port_header { + #define ADP_CS_5 0x05 + #define ADP_CS_5_LCA_MASK GENMASK(28, 22) + #define ADP_CS_5_LCA_SHIFT 22 ++#define ADP_CS_5_DHP BIT(31) + + /* TMU adapter registers */ + #define TMU_ADP_CS_3 0x03 +diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c +index 3a2e7126db9dc..f0b5a8f1ed3a3 100644 +--- a/drivers/thunderbolt/usb4.c ++++ b/drivers/thunderbolt/usb4.c +@@ -1046,6 +1046,26 @@ int usb4_port_unlock(struct tb_port *port) + return tb_port_write(port, &val, TB_CFG_PORT, ADP_CS_4, 1); + } + ++/** ++ * usb4_port_hotplug_enable() - Enables hotplug for a port ++ * @port: USB4 port to operate on ++ * ++ * Enables hot plug events on a given port. This is only intended ++ * to be used on lane, DP-IN, and DP-OUT adapters. ++ */ ++int usb4_port_hotplug_enable(struct tb_port *port) ++{ ++ int ret; ++ u32 val; ++ ++ ret = tb_port_read(port, &val, TB_CFG_PORT, ADP_CS_5, 1); ++ if (ret) ++ return ret; ++ ++ val &= ~ADP_CS_5_DHP; ++ return tb_port_write(port, &val, TB_CFG_PORT, ADP_CS_5, 1); ++} ++ + static int usb4_port_set_configured(struct tb_port *port, bool configured) + { + int ret; +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index 82726cda60663..f05544e93eae1 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -298,10 +298,9 @@ static void serial8250_backup_timeout(struct timer_list *t) + jiffies + uart_poll_timeout(&up->port) + HZ / 5); + } + +-static int univ8250_setup_irq(struct uart_8250_port *up) ++static void univ8250_setup_timer(struct uart_8250_port *up) + { + struct uart_port *port = &up->port; +- int retval = 0; + + /* + * The above check will only give an accurate result the first time +@@ -322,10 +321,16 @@ static int univ8250_setup_irq(struct uart_8250_port *up) + */ + if (!port->irq) + mod_timer(&up->timer, jiffies + uart_poll_timeout(port)); +- else +- retval = serial_link_irq_chain(up); ++} + +- return retval; ++static int univ8250_setup_irq(struct uart_8250_port *up) ++{ ++ struct uart_port *port = &up->port; ++ ++ if (port->irq) ++ return serial_link_irq_chain(up); ++ ++ return 0; + } + + static void univ8250_release_irq(struct uart_8250_port *up) +@@ -381,6 +386,7 @@ static struct uart_ops univ8250_port_ops; + static const struct uart_8250_ops univ8250_driver_ops = { + .setup_irq = univ8250_setup_irq, + .release_irq = univ8250_release_irq, ++ .setup_timer = univ8250_setup_timer, + }; + + static struct uart_8250_port serial8250_ports[UART_NR]; +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index f6732c1ed2385..defb293958f2a 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1232,6 +1232,10 @@ static void pci_oxsemi_tornado_set_mctrl(struct uart_port *port, + serial8250_do_set_mctrl(port, mctrl); + } + ++/* ++ * We require EFR features for clock programming, so set UPF_FULL_PROBE ++ * for full probing regardless of CONFIG_SERIAL_8250_16550A_VARIANTS setting. ++ */ + static int pci_oxsemi_tornado_setup(struct serial_private *priv, + const struct pciserial_board *board, + struct uart_8250_port *up, int idx) +@@ -1239,6 +1243,7 @@ static int pci_oxsemi_tornado_setup(struct serial_private *priv, + struct pci_dev *dev = priv->dev; + + if (pci_oxsemi_tornado_p(dev)) { ++ up->port.flags |= UPF_FULL_PROBE; + up->port.get_divisor = pci_oxsemi_tornado_get_divisor; + up->port.set_divisor = pci_oxsemi_tornado_set_divisor; + up->port.set_mctrl = pci_oxsemi_tornado_set_mctrl; +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 2b86c55ed374e..c66a029882e6b 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1029,7 +1029,8 @@ static void autoconfig_16550a(struct uart_8250_port *up) + up->port.type = PORT_16550A; + up->capabilities |= UART_CAP_FIFO; + +- if (!IS_ENABLED(CONFIG_SERIAL_8250_16550A_VARIANTS)) ++ if (!IS_ENABLED(CONFIG_SERIAL_8250_16550A_VARIANTS) && ++ !(up->port.flags & UPF_FULL_PROBE)) + return; + + /* +@@ -2302,6 +2303,10 @@ int serial8250_do_startup(struct uart_port *port) + if (port->irq && (up->port.flags & UPF_SHARE_IRQ)) + up->port.irqflags |= IRQF_SHARED; + ++ retval = up->ops->setup_irq(up); ++ if (retval) ++ goto out; ++ + if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) { + unsigned char iir1; + +@@ -2344,9 +2349,7 @@ int serial8250_do_startup(struct uart_port *port) + } + } + +- retval = up->ops->setup_irq(up); +- if (retval) +- goto out; ++ up->ops->setup_timer(up); + + /* + * Now, initialize the UART +@@ -3322,8 +3325,13 @@ static void serial8250_console_restore(struct uart_8250_port *up) + unsigned int baud, quot, frac = 0; + + termios.c_cflag = port->cons->cflag; +- if (port->state->port.tty && termios.c_cflag == 0) ++ termios.c_ispeed = port->cons->ispeed; ++ termios.c_ospeed = port->cons->ospeed; ++ if (port->state->port.tty && termios.c_cflag == 0) { + termios.c_cflag = port->state->port.tty->termios.c_cflag; ++ termios.c_ispeed = port->state->port.tty->termios.c_ispeed; ++ termios.c_ospeed = port->state->port.tty->termios.c_ospeed; ++ } + + baud = serial8250_get_baud_rate(port, &termios, NULL); + quot = serial8250_get_divisor(port, baud, &frac); +diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +index db07d6a5d764d..fa5c4633086e6 100644 +--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c ++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +@@ -1214,12 +1214,6 @@ static int cpm_uart_init_port(struct device_node *np, + pinfo->port.fifosize = pinfo->tx_nrfifos * pinfo->tx_fifosize; + spin_lock_init(&pinfo->port.lock); + +- pinfo->port.irq = irq_of_parse_and_map(np, 0); +- if (pinfo->port.irq == NO_IRQ) { +- ret = -EINVAL; +- goto out_pram; +- } +- + for (i = 0; i < NUM_GPIOS; i++) { + struct gpio_desc *gpiod; + +@@ -1229,7 +1223,7 @@ static int cpm_uart_init_port(struct device_node *np, + + if (IS_ERR(gpiod)) { + ret = PTR_ERR(gpiod); +- goto out_irq; ++ goto out_pram; + } + + if (gpiod) { +@@ -1255,8 +1249,6 @@ static int cpm_uart_init_port(struct device_node *np, + + return cpm_uart_request_port(&pinfo->port); + +-out_irq: +- irq_dispose_mapping(pinfo->port.irq); + out_pram: + cpm_uart_unmap_pram(pinfo, pram); + out_mem: +@@ -1436,11 +1428,17 @@ static int cpm_uart_probe(struct platform_device *ofdev) + /* initialize the device pointer for the port */ + pinfo->port.dev = &ofdev->dev; + ++ pinfo->port.irq = irq_of_parse_and_map(ofdev->dev.of_node, 0); ++ if (!pinfo->port.irq) ++ return -EINVAL; ++ + ret = cpm_uart_init_port(ofdev->dev.of_node, pinfo); +- if (ret) +- return ret; ++ if (!ret) ++ return uart_add_one_port(&cpm_reg, &pinfo->port); + +- return uart_add_one_port(&cpm_reg, &pinfo->port); ++ irq_dispose_mapping(pinfo->port.irq); ++ ++ return ret; + } + + static int cpm_uart_remove(struct platform_device *ofdev) +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index cb83c66bd8a82..a6471af9653c9 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1768,6 +1768,7 @@ static void lpuart_dma_shutdown(struct lpuart_port *sport) + if (sport->lpuart_dma_rx_use) { + del_timer_sync(&sport->lpuart_timer); + lpuart_dma_rx_free(&sport->port); ++ sport->lpuart_dma_rx_use = false; + } + + if (sport->lpuart_dma_tx_use) { +@@ -1776,6 +1777,7 @@ static void lpuart_dma_shutdown(struct lpuart_port *sport) + sport->dma_tx_in_progress = false; + dmaengine_terminate_all(sport->dma_tx_chan); + } ++ sport->lpuart_dma_tx_use = false; + } + + if (sport->dma_tx_chan) +diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c +index 0ea799bf8dbb1..417a5b6bffc34 100644 +--- a/drivers/tty/serial/jsm/jsm_driver.c ++++ b/drivers/tty/serial/jsm/jsm_driver.c +@@ -211,7 +211,8 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + break; + default: +- return -ENXIO; ++ rc = -ENXIO; ++ goto out_kfree_brd; + } + + rc = request_irq(brd->irq, brd->bd_ops->intr, IRQF_SHARED, "JSM", brd); +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 0973b03eeeaa4..aa2d141760b6e 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -62,6 +62,53 @@ static void stm32_usart_clr_bits(struct uart_port *port, u32 reg, u32 bits) + writel_relaxed(val, port->membase + reg); + } + ++static unsigned int stm32_usart_tx_empty(struct uart_port *port) ++{ ++ struct stm32_port *stm32_port = to_stm32_port(port); ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ ++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC) ++ return TIOCSER_TEMT; ++ ++ return 0; ++} ++ ++static void stm32_usart_rs485_rts_enable(struct uart_port *port) ++{ ++ struct stm32_port *stm32_port = to_stm32_port(port); ++ struct serial_rs485 *rs485conf = &port->rs485; ++ ++ if (stm32_port->hw_flow_control || ++ !(rs485conf->flags & SER_RS485_ENABLED)) ++ return; ++ ++ if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { ++ mctrl_gpio_set(stm32_port->gpios, ++ stm32_port->port.mctrl | TIOCM_RTS); ++ } else { ++ mctrl_gpio_set(stm32_port->gpios, ++ stm32_port->port.mctrl & ~TIOCM_RTS); ++ } ++} ++ ++static void stm32_usart_rs485_rts_disable(struct uart_port *port) ++{ ++ struct stm32_port *stm32_port = to_stm32_port(port); ++ struct serial_rs485 *rs485conf = &port->rs485; ++ ++ if (stm32_port->hw_flow_control || ++ !(rs485conf->flags & SER_RS485_ENABLED)) ++ return; ++ ++ if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { ++ mctrl_gpio_set(stm32_port->gpios, ++ stm32_port->port.mctrl & ~TIOCM_RTS); ++ } else { ++ mctrl_gpio_set(stm32_port->gpios, ++ stm32_port->port.mctrl | TIOCM_RTS); ++ } ++} ++ + static void stm32_usart_config_reg_rs485(u32 *cr1, u32 *cr3, u32 delay_ADE, + u32 delay_DDE, u32 baud) + { +@@ -145,6 +192,12 @@ static int stm32_usart_config_rs485(struct uart_port *port, + + stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + ++ /* Adjust RTS polarity in case it's driven in software */ ++ if (stm32_usart_tx_empty(port)) ++ stm32_usart_rs485_rts_disable(port); ++ else ++ stm32_usart_rs485_rts_enable(port); ++ + return 0; + } + +@@ -460,42 +513,6 @@ static void stm32_usart_tc_interrupt_disable(struct uart_port *port) + stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_TCIE); + } + +-static void stm32_usart_rs485_rts_enable(struct uart_port *port) +-{ +- struct stm32_port *stm32_port = to_stm32_port(port); +- struct serial_rs485 *rs485conf = &port->rs485; +- +- if (stm32_port->hw_flow_control || +- !(rs485conf->flags & SER_RS485_ENABLED)) +- return; +- +- if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { +- mctrl_gpio_set(stm32_port->gpios, +- stm32_port->port.mctrl | TIOCM_RTS); +- } else { +- mctrl_gpio_set(stm32_port->gpios, +- stm32_port->port.mctrl & ~TIOCM_RTS); +- } +-} +- +-static void stm32_usart_rs485_rts_disable(struct uart_port *port) +-{ +- struct stm32_port *stm32_port = to_stm32_port(port); +- struct serial_rs485 *rs485conf = &port->rs485; +- +- if (stm32_port->hw_flow_control || +- !(rs485conf->flags & SER_RS485_ENABLED)) +- return; +- +- if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { +- mctrl_gpio_set(stm32_port->gpios, +- stm32_port->port.mctrl & ~TIOCM_RTS); +- } else { +- mctrl_gpio_set(stm32_port->gpios, +- stm32_port->port.mctrl | TIOCM_RTS); +- } +-} +- + static void stm32_usart_transmit_chars_pio(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -738,17 +755,6 @@ static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) + return IRQ_HANDLED; + } + +-static unsigned int stm32_usart_tx_empty(struct uart_port *port) +-{ +- struct stm32_port *stm32_port = to_stm32_port(port); +- const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- +- if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC) +- return TIOCSER_TEMT; +- +- return 0; +-} +- + static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl) + { + struct stm32_port *stm32_port = to_stm32_port(port); +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index 9e01fe6c0ab8c..e08d2c3305ba9 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -361,6 +361,8 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) + isrstatus &= ~CDNS_UART_IXR_TXEMPTY; + } + ++ isrstatus &= port->read_status_mask; ++ isrstatus &= ~port->ignore_status_mask; + /* + * Skip RX processing if RX is disabled as RXEMPTY will never be set + * as read bytes will not be removed from the FIFO. +diff --git a/drivers/usb/common/debug.c b/drivers/usb/common/debug.c +index 075f6b1b2a1a1..f204cec8d380a 100644 +--- a/drivers/usb/common/debug.c ++++ b/drivers/usb/common/debug.c +@@ -208,30 +208,28 @@ static void usb_decode_set_isoch_delay(__u8 wValue, char *str, size_t size) + snprintf(str, size, "Set Isochronous Delay(Delay = %d ns)", wValue); + } + +-/** +- * usb_decode_ctrl - Returns human readable representation of control request. +- * @str: buffer to return a human-readable representation of control request. +- * This buffer should have about 200 bytes. +- * @size: size of str buffer. +- * @bRequestType: matches the USB bmRequestType field +- * @bRequest: matches the USB bRequest field +- * @wValue: matches the USB wValue field (CPU byte order) +- * @wIndex: matches the USB wIndex field (CPU byte order) +- * @wLength: matches the USB wLength field (CPU byte order) +- * +- * Function returns decoded, formatted and human-readable description of +- * control request packet. +- * +- * The usage scenario for this is for tracepoints, so function as a return +- * use the same value as in parameters. This approach allows to use this +- * function in TP_printk +- * +- * Important: wValue, wIndex, wLength parameters before invoking this function +- * should be processed by le16_to_cpu macro. +- */ +-const char *usb_decode_ctrl(char *str, size_t size, __u8 bRequestType, +- __u8 bRequest, __u16 wValue, __u16 wIndex, +- __u16 wLength) ++static void usb_decode_ctrl_generic(char *str, size_t size, __u8 bRequestType, ++ __u8 bRequest, __u16 wValue, __u16 wIndex, ++ __u16 wLength) ++{ ++ u8 recip = bRequestType & USB_RECIP_MASK; ++ u8 type = bRequestType & USB_TYPE_MASK; ++ ++ snprintf(str, size, ++ "Type=%s Recipient=%s Dir=%s bRequest=%u wValue=%u wIndex=%u wLength=%u", ++ (type == USB_TYPE_STANDARD) ? "Standard" : ++ (type == USB_TYPE_VENDOR) ? "Vendor" : ++ (type == USB_TYPE_CLASS) ? "Class" : "Unknown", ++ (recip == USB_RECIP_DEVICE) ? "Device" : ++ (recip == USB_RECIP_INTERFACE) ? "Interface" : ++ (recip == USB_RECIP_ENDPOINT) ? "Endpoint" : "Unknown", ++ (bRequestType & USB_DIR_IN) ? "IN" : "OUT", ++ bRequest, wValue, wIndex, wLength); ++} ++ ++static void usb_decode_ctrl_standard(char *str, size_t size, __u8 bRequestType, ++ __u8 bRequest, __u16 wValue, __u16 wIndex, ++ __u16 wLength) + { + switch (bRequest) { + case USB_REQ_GET_STATUS: +@@ -272,14 +270,48 @@ const char *usb_decode_ctrl(char *str, size_t size, __u8 bRequestType, + usb_decode_set_isoch_delay(wValue, str, size); + break; + default: +- snprintf(str, size, "%02x %02x %02x %02x %02x %02x %02x %02x", +- bRequestType, bRequest, +- (u8)(cpu_to_le16(wValue) & 0xff), +- (u8)(cpu_to_le16(wValue) >> 8), +- (u8)(cpu_to_le16(wIndex) & 0xff), +- (u8)(cpu_to_le16(wIndex) >> 8), +- (u8)(cpu_to_le16(wLength) & 0xff), +- (u8)(cpu_to_le16(wLength) >> 8)); ++ usb_decode_ctrl_generic(str, size, bRequestType, bRequest, ++ wValue, wIndex, wLength); ++ break; ++ } ++} ++ ++/** ++ * usb_decode_ctrl - Returns human readable representation of control request. ++ * @str: buffer to return a human-readable representation of control request. ++ * This buffer should have about 200 bytes. ++ * @size: size of str buffer. ++ * @bRequestType: matches the USB bmRequestType field ++ * @bRequest: matches the USB bRequest field ++ * @wValue: matches the USB wValue field (CPU byte order) ++ * @wIndex: matches the USB wIndex field (CPU byte order) ++ * @wLength: matches the USB wLength field (CPU byte order) ++ * ++ * Function returns decoded, formatted and human-readable description of ++ * control request packet. ++ * ++ * The usage scenario for this is for tracepoints, so function as a return ++ * use the same value as in parameters. This approach allows to use this ++ * function in TP_printk ++ * ++ * Important: wValue, wIndex, wLength parameters before invoking this function ++ * should be processed by le16_to_cpu macro. ++ */ ++const char *usb_decode_ctrl(char *str, size_t size, __u8 bRequestType, ++ __u8 bRequest, __u16 wValue, __u16 wIndex, ++ __u16 wLength) ++{ ++ switch (bRequestType & USB_TYPE_MASK) { ++ case USB_TYPE_STANDARD: ++ usb_decode_ctrl_standard(str, size, bRequestType, bRequest, ++ wValue, wIndex, wLength); ++ break; ++ case USB_TYPE_VENDOR: ++ case USB_TYPE_CLASS: ++ default: ++ usb_decode_ctrl_generic(str, size, bRequestType, bRequest, ++ wValue, wIndex, wLength); ++ break; + } + + return str; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index f99a65a64588f..999b7c9697fcd 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -437,6 +437,10 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ ++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ + { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM }, + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index ebf3afad378ba..21fa2e2795d84 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -407,6 +407,10 @@ static void dwc3_ref_clk_period(struct dwc3 *dwc) + reg |= FIELD_PREP(DWC3_GFLADJ_REFCLK_FLADJ_MASK, fladj) + | FIELD_PREP(DWC3_GFLADJ_240MHZDECR, decr >> 1) + | FIELD_PREP(DWC3_GFLADJ_240MHZDECR_PLS1, decr & 1); ++ ++ if (dwc->gfladj_refclk_lpm_sel) ++ reg |= DWC3_GFLADJ_REFCLK_LPM_SEL; ++ + dwc3_writel(dwc->regs, DWC3_GFLADJ, reg); + } + +@@ -788,7 +792,7 @@ static int dwc3_phy_setup(struct dwc3 *dwc) + else + reg |= DWC3_GUSB2PHYCFG_ENBLSLPM; + +- if (dwc->dis_u2_freeclk_exists_quirk) ++ if (dwc->dis_u2_freeclk_exists_quirk || dwc->gfladj_refclk_lpm_sel) + reg &= ~DWC3_GUSB2PHYCFG_U2_FREECLK_EXISTS; + + dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); +@@ -1145,6 +1149,21 @@ static int dwc3_core_init(struct dwc3 *dwc) + dwc3_writel(dwc->regs, DWC3_GUCTL2, reg); + } + ++ /* ++ * When configured in HOST mode, after issuing U3/L2 exit controller ++ * fails to send proper CRC checksum in CRC5 feild. Because of this ++ * behaviour Transaction Error is generated, resulting in reset and ++ * re-enumeration of usb device attached. All the termsel, xcvrsel, ++ * opmode becomes 0 during end of resume. Enabling bit 10 of GUCTL1 ++ * will correct this problem. This option is to support certain ++ * legacy ULPI PHYs. ++ */ ++ if (dwc->resume_hs_terminations) { ++ reg = dwc3_readl(dwc->regs, DWC3_GUCTL1); ++ reg |= DWC3_GUCTL1_RESUME_OPMODE_HS_HOST; ++ dwc3_writel(dwc->regs, DWC3_GUCTL1, reg); ++ } ++ + if (!DWC3_VER_IS_PRIOR(DWC3, 250A)) { + reg = dwc3_readl(dwc->regs, DWC3_GUCTL1); + +@@ -1488,8 +1507,12 @@ static void dwc3_get_properties(struct dwc3 *dwc) + "snps,dis-del-phy-power-chg-quirk"); + dwc->dis_tx_ipgap_linecheck_quirk = device_property_read_bool(dev, + "snps,dis-tx-ipgap-linecheck-quirk"); ++ dwc->resume_hs_terminations = device_property_read_bool(dev, ++ "snps,resume-hs-terminations"); + dwc->parkmode_disable_ss_quirk = device_property_read_bool(dev, + "snps,parkmode-disable-ss-quirk"); ++ dwc->gfladj_refclk_lpm_sel = device_property_read_bool(dev, ++ "snps,gfladj-refclk-lpm-sel-quirk"); + + dwc->tx_de_emphasis_quirk = device_property_read_bool(dev, + "snps,tx_de_emphasis_quirk"); +@@ -1678,8 +1701,10 @@ static int dwc3_probe(struct platform_device *pdev) + dwc3_get_properties(dwc); + + dwc->reset = devm_reset_control_array_get_optional_shared(dev); +- if (IS_ERR(dwc->reset)) +- return PTR_ERR(dwc->reset); ++ if (IS_ERR(dwc->reset)) { ++ ret = PTR_ERR(dwc->reset); ++ goto put_usb_psy; ++ } + + if (dev->of_node) { + /* +@@ -1689,45 +1714,57 @@ static int dwc3_probe(struct platform_device *pdev) + * check for them to retain backwards compatibility. + */ + dwc->bus_clk = devm_clk_get_optional(dev, "bus_early"); +- if (IS_ERR(dwc->bus_clk)) +- return dev_err_probe(dev, PTR_ERR(dwc->bus_clk), +- "could not get bus clock\n"); ++ if (IS_ERR(dwc->bus_clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(dwc->bus_clk), ++ "could not get bus clock\n"); ++ goto put_usb_psy; ++ } + + if (dwc->bus_clk == NULL) { + dwc->bus_clk = devm_clk_get_optional(dev, "bus_clk"); +- if (IS_ERR(dwc->bus_clk)) +- return dev_err_probe(dev, PTR_ERR(dwc->bus_clk), +- "could not get bus clock\n"); ++ if (IS_ERR(dwc->bus_clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(dwc->bus_clk), ++ "could not get bus clock\n"); ++ goto put_usb_psy; ++ } + } + + dwc->ref_clk = devm_clk_get_optional(dev, "ref"); +- if (IS_ERR(dwc->ref_clk)) +- return dev_err_probe(dev, PTR_ERR(dwc->ref_clk), +- "could not get ref clock\n"); ++ if (IS_ERR(dwc->ref_clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(dwc->ref_clk), ++ "could not get ref clock\n"); ++ goto put_usb_psy; ++ } + + if (dwc->ref_clk == NULL) { + dwc->ref_clk = devm_clk_get_optional(dev, "ref_clk"); +- if (IS_ERR(dwc->ref_clk)) +- return dev_err_probe(dev, PTR_ERR(dwc->ref_clk), +- "could not get ref clock\n"); ++ if (IS_ERR(dwc->ref_clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(dwc->ref_clk), ++ "could not get ref clock\n"); ++ goto put_usb_psy; ++ } + } + + dwc->susp_clk = devm_clk_get_optional(dev, "suspend"); +- if (IS_ERR(dwc->susp_clk)) +- return dev_err_probe(dev, PTR_ERR(dwc->susp_clk), +- "could not get suspend clock\n"); ++ if (IS_ERR(dwc->susp_clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(dwc->susp_clk), ++ "could not get suspend clock\n"); ++ goto put_usb_psy; ++ } + + if (dwc->susp_clk == NULL) { + dwc->susp_clk = devm_clk_get_optional(dev, "suspend_clk"); +- if (IS_ERR(dwc->susp_clk)) +- return dev_err_probe(dev, PTR_ERR(dwc->susp_clk), +- "could not get suspend clock\n"); ++ if (IS_ERR(dwc->susp_clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(dwc->susp_clk), ++ "could not get suspend clock\n"); ++ goto put_usb_psy; ++ } + } + } + + ret = reset_control_deassert(dwc->reset); + if (ret) +- return ret; ++ goto put_usb_psy; + + ret = dwc3_clk_enable(dwc); + if (ret) +@@ -1827,7 +1864,7 @@ disable_clks: + dwc3_clk_disable(dwc); + assert_reset: + reset_control_assert(dwc->reset); +- ++put_usb_psy: + if (dwc->usb_psy) + power_supply_put(dwc->usb_psy); + +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 81c486b3941ce..b9fa0fa5ba7c0 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -262,6 +262,7 @@ + #define DWC3_GUCTL1_DEV_FORCE_20_CLK_FOR_30_CLK BIT(26) + #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24) + #define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17) ++#define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST BIT(10) + + /* Global Status Register */ + #define DWC3_GSTS_OTG_IP BIT(10) +@@ -390,6 +391,7 @@ + #define DWC3_GFLADJ_30MHZ_SDBND_SEL BIT(7) + #define DWC3_GFLADJ_30MHZ_MASK 0x3f + #define DWC3_GFLADJ_REFCLK_FLADJ_MASK GENMASK(21, 8) ++#define DWC3_GFLADJ_REFCLK_LPM_SEL BIT(23) + #define DWC3_GFLADJ_240MHZDECR GENMASK(30, 24) + #define DWC3_GFLADJ_240MHZDECR_PLS1 BIT(31) + +@@ -1093,6 +1095,8 @@ struct dwc3_scratchpad_array { + * change quirk. + * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate + * check during HS transmit. ++ * @resume-hs-terminations: Set if we enable quirk for fixing improper crc ++ * generation after resume from suspend. + * @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed + * instances in park mode. + * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk +@@ -1308,7 +1312,9 @@ struct dwc3 { + unsigned dis_u2_freeclk_exists_quirk:1; + unsigned dis_del_phy_power_chg_quirk:1; + unsigned dis_tx_ipgap_linecheck_quirk:1; ++ unsigned resume_hs_terminations:1; + unsigned parkmode_disable_ss_quirk:1; ++ unsigned gfladj_refclk_lpm_sel:1; + + unsigned tx_de_emphasis_quirk:1; + unsigned tx_de_emphasis:2; +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index e0fa4b186ec6d..36184a7625273 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -2645,10 +2645,10 @@ static int __ffs_data_got_strings(struct ffs_data *ffs, + unsigned i = 0; + vla_group(d); + vla_item(d, struct usb_gadget_strings *, stringtabs, +- lang_count + 1); ++ size_add(lang_count, 1)); + vla_item(d, struct usb_gadget_strings, stringtab, lang_count); + vla_item(d, struct usb_string, strings, +- lang_count*(needed_count+1)); ++ size_mul(lang_count, (needed_count + 1))); + + char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL); + +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index abec5c58f5251..a881c69b1f2bf 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -89,7 +89,7 @@ struct printer_dev { + u8 printer_cdev_open; + wait_queue_head_t wait; + unsigned q_len; +- char *pnp_string; /* We don't own memory! */ ++ char **pnp_string; /* We don't own memory! */ + struct usb_function function; + }; + +@@ -1000,16 +1000,16 @@ static int printer_func_setup(struct usb_function *f, + if ((wIndex>>8) != dev->interface) + break; + +- if (!dev->pnp_string) { ++ if (!*dev->pnp_string) { + value = 0; + break; + } +- value = strlen(dev->pnp_string); ++ value = strlen(*dev->pnp_string); + buf[0] = (value >> 8) & 0xFF; + buf[1] = value & 0xFF; +- memcpy(buf + 2, dev->pnp_string, value); ++ memcpy(buf + 2, *dev->pnp_string, value); + DBG(dev, "1284 PNP String: %x %s\n", value, +- dev->pnp_string); ++ *dev->pnp_string); + break; + + case GET_PORT_STATUS: /* Get Port Status */ +@@ -1475,7 +1475,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) + kref_init(&dev->kref); + ++opts->refcnt; + dev->minor = opts->minor; +- dev->pnp_string = opts->pnp_string; ++ dev->pnp_string = &opts->pnp_string; + dev->q_len = opts->q_len; + mutex_unlock(&opts->lock); + +diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c +index 71669e0e4d007..7ec223849d949 100644 +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -421,7 +421,7 @@ uvc_register_video(struct uvc_device *uvc) + int ret; + + /* TODO reference counting. */ +- memset(&uvc->vdev, 0, sizeof(uvc->video)); ++ memset(&uvc->vdev, 0, sizeof(uvc->vdev)); + uvc->vdev.v4l2_dev = &uvc->v4l2_dev; + uvc->vdev.v4l2_dev->dev = &cdev->gadget->dev; + uvc->vdev.fops = &uvc_v4l2_fops; +@@ -897,10 +897,14 @@ static void uvc_function_unbind(struct usb_configuration *c, + { + struct usb_composite_dev *cdev = c->cdev; + struct uvc_device *uvc = to_uvc(f); ++ struct uvc_video *video = &uvc->video; + long wait_ret = 1; + + uvcg_info(f, "%s()\n", __func__); + ++ if (video->async_wq) ++ destroy_workqueue(video->async_wq); ++ + /* + * If we know we're connected via v4l2, then there should be a cleanup + * of the device from userspace either via UVC_EVENT_DISCONNECT or +diff --git a/drivers/usb/gadget/function/uvc.h b/drivers/usb/gadget/function/uvc.h +index 58e383afdd440..1a31e6c6a5ffb 100644 +--- a/drivers/usb/gadget/function/uvc.h ++++ b/drivers/usb/gadget/function/uvc.h +@@ -88,6 +88,7 @@ struct uvc_video { + struct usb_ep *ep; + + struct work_struct pump; ++ struct workqueue_struct *async_wq; + + /* Frame parameters */ + u8 bpp; +diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c +index fd8f73bb726dd..fddc392b8ab95 100644 +--- a/drivers/usb/gadget/function/uvc_v4l2.c ++++ b/drivers/usb/gadget/function/uvc_v4l2.c +@@ -170,7 +170,7 @@ uvc_v4l2_qbuf(struct file *file, void *fh, struct v4l2_buffer *b) + return ret; + + if (uvc->state == UVC_STATE_STREAMING) +- schedule_work(&video->pump); ++ queue_work(video->async_wq, &video->pump); + + return ret; + } +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index c00ce0e91f5d5..bb037fcc90e69 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -277,7 +277,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + spin_unlock_irqrestore(&video->req_lock, flags); + + if (uvc->state == UVC_STATE_STREAMING) +- schedule_work(&video->pump); ++ queue_work(video->async_wq, &video->pump); + } + + static int +@@ -485,7 +485,7 @@ int uvcg_video_enable(struct uvc_video *video, int enable) + + video->req_int_count = 0; + +- schedule_work(&video->pump); ++ queue_work(video->async_wq, &video->pump); + + return ret; + } +@@ -499,6 +499,11 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc) + spin_lock_init(&video->req_lock); + INIT_WORK(&video->pump, uvcg_video_pump); + ++ /* Allocate a work queue for asynchronous video pump handler. */ ++ video->async_wq = alloc_workqueue("uvcgadget", WQ_UNBOUND | WQ_HIGHPRI, 0); ++ if (!video->async_wq) ++ return -EINVAL; ++ + video->uvc = uvc; + video->fcc = V4L2_PIX_FMT_YUYV; + video->bpp = 16; +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index e61155fa63796..f1367b53b2600 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -988,7 +988,7 @@ xhci_alloc_dbc(struct device *dev, void __iomem *base, const struct dbc_driver * + dbc->driver = driver; + + if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE) +- return NULL; ++ goto err; + + INIT_DELAYED_WORK(&dbc->event_work, xhci_dbc_handle_events); + spin_lock_init(&dbc->lock); +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 8c19e151a9454..9e56aa28efcd4 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -641,7 +641,7 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci, + num_stream_ctxs, &stream_info->ctx_array_dma, + mem_flags); + if (!stream_info->stream_ctx_array) +- goto cleanup_ctx; ++ goto cleanup_ring_array; + memset(stream_info->stream_ctx_array, 0, + sizeof(struct xhci_stream_ctx)*num_stream_ctxs); + +@@ -702,6 +702,11 @@ cleanup_rings: + } + xhci_free_command(xhci, stream_info->free_streams_command); + cleanup_ctx: ++ xhci_free_stream_ctx(xhci, ++ stream_info->num_stream_ctxs, ++ stream_info->stream_ctx_array, ++ stream_info->ctx_array_dma); ++cleanup_ring_array: + kfree(stream_info->stream_rings); + cleanup_info: + kfree(stream_info); +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index a8641b6536eea..5fb55bf194931 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -123,7 +123,7 @@ static const struct xhci_plat_priv xhci_plat_renesas_rcar_gen3 = { + }; + + static const struct xhci_plat_priv xhci_plat_brcm = { +- .quirks = XHCI_RESET_ON_RESUME, ++ .quirks = XHCI_RESET_ON_RESUME | XHCI_SUSPEND_RESUME_CLKS, + }; + + static const struct of_device_id usb_xhci_of_match[] = { +@@ -437,7 +437,16 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev) + * xhci_suspend() needs `do_wakeup` to know whether host is allowed + * to do wakeup during suspend. + */ +- return xhci_suspend(xhci, device_may_wakeup(dev)); ++ ret = xhci_suspend(xhci, device_may_wakeup(dev)); ++ if (ret) ++ return ret; ++ ++ if (!device_may_wakeup(dev) && (xhci->quirks & XHCI_SUSPEND_RESUME_CLKS)) { ++ clk_disable_unprepare(xhci->clk); ++ clk_disable_unprepare(xhci->reg_clk); ++ } ++ ++ return 0; + } + + static int __maybe_unused xhci_plat_resume(struct device *dev) +@@ -446,6 +455,11 @@ static int __maybe_unused xhci_plat_resume(struct device *dev) + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + int ret; + ++ if (!device_may_wakeup(dev) && (xhci->quirks & XHCI_SUSPEND_RESUME_CLKS)) { ++ clk_prepare_enable(xhci->clk); ++ clk_prepare_enable(xhci->reg_clk); ++ } ++ + ret = xhci_priv_resume_quirk(hcd); + if (ret) + return ret; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 38649284ff889..a7ef675f00fdd 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1183,7 +1183,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + /* re-initialize the HC on Restore Error, or Host Controller Error */ + if (temp & (STS_SRE | STS_HCE)) { + reinit_xhc = true; +- xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp); ++ if (!xhci->broken_suspend) ++ xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp); + } + + if (reinit_xhc) { +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 7caa0db5e826d..6dfbf73ee840d 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1899,6 +1899,7 @@ struct xhci_hcd { + #define XHCI_NO_SOFT_RETRY BIT_ULL(40) + #define XHCI_BROKEN_D3COLD BIT_ULL(41) + #define XHCI_EP_CTX_BROKEN_DCS BIT_ULL(42) ++#define XHCI_SUSPEND_RESUME_CLKS BIT_ULL(43) + + unsigned int num_active_eps; + unsigned int limit_active_eps; +diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c +index e9437a176518a..ea39243efee39 100644 +--- a/drivers/usb/misc/idmouse.c ++++ b/drivers/usb/misc/idmouse.c +@@ -177,10 +177,6 @@ static int idmouse_create_image(struct usb_idmouse *dev) + bytes_read += bulk_read; + } + +- /* reset the device */ +-reset: +- ftip_command(dev, FTIP_RELEASE, 0, 0); +- + /* check for valid image */ + /* right border should be black (0x00) */ + for (bytes_read = sizeof(HEADER)-1 + WIDTH-1; bytes_read < IMGSIZE; bytes_read += WIDTH) +@@ -192,6 +188,10 @@ reset: + if (dev->bulk_in_buffer[bytes_read] != 0xFF) + return -EAGAIN; + ++ /* reset the device */ ++reset: ++ ftip_command(dev, FTIP_RELEASE, 0, 0); ++ + /* should be IMGSIZE == 65040 */ + dev_dbg(&dev->interface->dev, "read %d bytes fingerprint data\n", + bytes_read); +diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c +index c4a2c37abf628..3ea5145a842b1 100644 +--- a/drivers/usb/mtu3/mtu3_core.c ++++ b/drivers/usb/mtu3/mtu3_core.c +@@ -971,8 +971,6 @@ int ssusb_gadget_init(struct ssusb_mtk *ssusb) + goto irq_err; + } + +- device_init_wakeup(dev, true); +- + /* power down device IP for power saving by default */ + mtu3_stop(mtu); + +diff --git a/drivers/usb/mtu3/mtu3_plat.c b/drivers/usb/mtu3/mtu3_plat.c +index 4309ed939178a..845b25320fd28 100644 +--- a/drivers/usb/mtu3/mtu3_plat.c ++++ b/drivers/usb/mtu3/mtu3_plat.c +@@ -332,6 +332,8 @@ static int mtu3_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + pm_runtime_get_sync(dev); + ++ device_init_wakeup(dev, true); ++ + ret = ssusb_rscs_init(ssusb); + if (ret) + goto comm_init_err; +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index 51274b87f46c9..dc67fff8e9418 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -760,6 +760,9 @@ static void rxstate(struct musb *musb, struct musb_request *req) + musb_writew(epio, MUSB_RXCSR, csr); + + buffer_aint_mapped: ++ fifo_count = min_t(unsigned int, ++ request->length - request->actual, ++ (unsigned int)fifo_count); + musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *) + (request->buf + request->actual)); + request->actual += fifo_count; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 4993227ab2930..20dcbccb290b3 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1275,12 +1275,6 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999, + USB_SC_RBC, USB_PR_BULK, NULL, + 0 ), + +-UNUSUAL_DEV(0x090c, 0x1000, 0x1100, 0x1100, +- "Samsung", +- "Flash Drive FIT", +- USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_MAX_SECTORS_64), +- + /* aeb */ + UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, + "Feiya", +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 6364f0d467ea3..74fb5a4c6f21b 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1067,11 +1067,9 @@ static int ucsi_register_port(struct ucsi *ucsi, int index) + + cap->fwnode = ucsi_find_fwnode(con); + con->usb_role_sw = fwnode_usb_role_switch_get(cap->fwnode); +- if (IS_ERR(con->usb_role_sw)) { +- dev_err(ucsi->dev, "con%d: failed to get usb role switch\n", +- con->num); +- return PTR_ERR(con->usb_role_sw); +- } ++ if (IS_ERR(con->usb_role_sw)) ++ return dev_err_probe(ucsi->dev, PTR_ERR(con->usb_role_sw), ++ "con%d: failed to get usb role switch\n", con->num); + + /* Delay other interactions with the con until registration is complete */ + mutex_lock(&con->lock); +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 368330417bde2..5703775af1297 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -393,7 +393,7 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq, + return NULL; + } + +- pkt->buf = kmalloc(pkt->len, GFP_KERNEL); ++ pkt->buf = kvmalloc(pkt->len, GFP_KERNEL); + if (!pkt->buf) { + kfree(pkt); + return NULL; +diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c +index d7aa5511c3617..e65bdc499c236 100644 +--- a/drivers/video/fbdev/smscufx.c ++++ b/drivers/video/fbdev/smscufx.c +@@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len); + static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size); + static void ufx_free_urb_list(struct ufx_data *dev); + ++static DEFINE_MUTEX(disconnect_mutex); ++ + /* reads a control register */ + static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data) + { +@@ -1071,9 +1073,13 @@ static int ufx_ops_open(struct fb_info *info, int user) + if (user == 0 && !console) + return -EBUSY; + ++ mutex_lock(&disconnect_mutex); ++ + /* If the USB device is gone, we don't accept new opens */ +- if (dev->virtualized) ++ if (dev->virtualized) { ++ mutex_unlock(&disconnect_mutex); + return -ENODEV; ++ } + + dev->fb_count++; + +@@ -1097,6 +1103,8 @@ static int ufx_ops_open(struct fb_info *info, int user) + pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d", + info->node, user, info, dev->fb_count); + ++ mutex_unlock(&disconnect_mutex); ++ + return 0; + } + +@@ -1741,6 +1749,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) + { + struct ufx_data *dev; + ++ mutex_lock(&disconnect_mutex); ++ + dev = usb_get_intfdata(interface); + + pr_debug("USB disconnect starting\n"); +@@ -1761,6 +1771,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) + kref_put(&dev->kref, ufx_free); + + /* consider ufx_data freed */ ++ ++ mutex_unlock(&disconnect_mutex); + } + + static struct usb_driver ufx_driver = { +diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c +index 38a861e22c339..7753e586e65a0 100644 +--- a/drivers/video/fbdev/stifb.c ++++ b/drivers/video/fbdev/stifb.c +@@ -1298,7 +1298,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref) + + /* limit fbsize to max visible screen size */ + if (fix->smem_len > yres*fix->line_length) +- fix->smem_len = yres*fix->line_length; ++ fix->smem_len = ALIGN(yres*fix->line_length, 4*1024*1024); + + fix->accel = FB_ACCEL_NONE; + +diff --git a/drivers/xen/gntdev-common.h b/drivers/xen/gntdev-common.h +index 40ef379c28ab0..9c286b2a19001 100644 +--- a/drivers/xen/gntdev-common.h ++++ b/drivers/xen/gntdev-common.h +@@ -44,9 +44,10 @@ struct gntdev_unmap_notify { + }; + + struct gntdev_grant_map { ++ atomic_t in_use; + struct mmu_interval_notifier notifier; ++ bool notifier_init; + struct list_head next; +- struct vm_area_struct *vma; + int index; + int count; + int flags; +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 84b143eef395b..4d9a3050de6a3 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -286,6 +286,9 @@ void gntdev_put_map(struct gntdev_priv *priv, struct gntdev_grant_map *map) + */ + } + ++ if (use_ptemod && map->notifier_init) ++ mmu_interval_notifier_remove(&map->notifier); ++ + if (map->notify.flags & UNMAP_NOTIFY_SEND_EVENT) { + notify_remote_via_evtchn(map->notify.event); + evtchn_put(map->notify.event); +@@ -298,7 +301,7 @@ void gntdev_put_map(struct gntdev_priv *priv, struct gntdev_grant_map *map) + static int find_grant_ptes(pte_t *pte, unsigned long addr, void *data) + { + struct gntdev_grant_map *map = data; +- unsigned int pgnr = (addr - map->vma->vm_start) >> PAGE_SHIFT; ++ unsigned int pgnr = (addr - map->pages_vm_start) >> PAGE_SHIFT; + int flags = map->flags | GNTMAP_application_map | GNTMAP_contains_pte | + (1 << _GNTMAP_guest_avail0); + u64 pte_maddr; +@@ -367,8 +370,7 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map) + for (i = 0; i < map->count; i++) { + if (map->map_ops[i].status == GNTST_okay) { + map->unmap_ops[i].handle = map->map_ops[i].handle; +- if (!use_ptemod) +- alloced++; ++ alloced++; + } else if (!err) + err = -EINVAL; + +@@ -377,8 +379,7 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map) + + if (use_ptemod) { + if (map->kmap_ops[i].status == GNTST_okay) { +- if (map->map_ops[i].status == GNTST_okay) +- alloced++; ++ alloced++; + map->kunmap_ops[i].handle = map->kmap_ops[i].handle; + } else if (!err) + err = -EINVAL; +@@ -394,8 +395,14 @@ static void __unmap_grant_pages_done(int result, + unsigned int i; + struct gntdev_grant_map *map = data->data; + unsigned int offset = data->unmap_ops - map->unmap_ops; ++ int successful_unmaps = 0; ++ int live_grants; + + for (i = 0; i < data->count; i++) { ++ if (map->unmap_ops[offset + i].status == GNTST_okay && ++ map->unmap_ops[offset + i].handle != INVALID_GRANT_HANDLE) ++ successful_unmaps++; ++ + WARN_ON(map->unmap_ops[offset + i].status != GNTST_okay && + map->unmap_ops[offset + i].handle != INVALID_GRANT_HANDLE); + pr_debug("unmap handle=%d st=%d\n", +@@ -403,6 +410,10 @@ static void __unmap_grant_pages_done(int result, + map->unmap_ops[offset+i].status); + map->unmap_ops[offset+i].handle = INVALID_GRANT_HANDLE; + if (use_ptemod) { ++ if (map->kunmap_ops[offset + i].status == GNTST_okay && ++ map->kunmap_ops[offset + i].handle != INVALID_GRANT_HANDLE) ++ successful_unmaps++; ++ + WARN_ON(map->kunmap_ops[offset + i].status != GNTST_okay && + map->kunmap_ops[offset + i].handle != INVALID_GRANT_HANDLE); + pr_debug("kunmap handle=%u st=%d\n", +@@ -411,11 +422,15 @@ static void __unmap_grant_pages_done(int result, + map->kunmap_ops[offset+i].handle = INVALID_GRANT_HANDLE; + } + } ++ + /* + * Decrease the live-grant counter. This must happen after the loop to + * prevent premature reuse of the grants by gnttab_mmap(). + */ +- atomic_sub(data->count, &map->live_grants); ++ live_grants = atomic_sub_return(successful_unmaps, &map->live_grants); ++ if (WARN_ON(live_grants < 0)) ++ pr_err("%s: live_grants became negative (%d) after unmapping %d pages!\n", ++ __func__, live_grants, successful_unmaps); + + /* Release reference taken by __unmap_grant_pages */ + gntdev_put_map(NULL, map); +@@ -496,11 +511,7 @@ static void gntdev_vma_close(struct vm_area_struct *vma) + struct gntdev_priv *priv = file->private_data; + + pr_debug("gntdev_vma_close %p\n", vma); +- if (use_ptemod) { +- WARN_ON(map->vma != vma); +- mmu_interval_notifier_remove(&map->notifier); +- map->vma = NULL; +- } ++ + vma->vm_private_data = NULL; + gntdev_put_map(priv, map); + } +@@ -528,29 +539,30 @@ static bool gntdev_invalidate(struct mmu_interval_notifier *mn, + struct gntdev_grant_map *map = + container_of(mn, struct gntdev_grant_map, notifier); + unsigned long mstart, mend; ++ unsigned long map_start, map_end; + + if (!mmu_notifier_range_blockable(range)) + return false; + ++ map_start = map->pages_vm_start; ++ map_end = map->pages_vm_start + (map->count << PAGE_SHIFT); ++ + /* + * If the VMA is split or otherwise changed the notifier is not + * updated, but we don't want to process VA's outside the modified + * VMA. FIXME: It would be much more understandable to just prevent + * modifying the VMA in the first place. + */ +- if (map->vma->vm_start >= range->end || +- map->vma->vm_end <= range->start) ++ if (map_start >= range->end || map_end <= range->start) + return true; + +- mstart = max(range->start, map->vma->vm_start); +- mend = min(range->end, map->vma->vm_end); ++ mstart = max(range->start, map_start); ++ mend = min(range->end, map_end); + pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n", +- map->index, map->count, +- map->vma->vm_start, map->vma->vm_end, +- range->start, range->end, mstart, mend); +- unmap_grant_pages(map, +- (mstart - map->vma->vm_start) >> PAGE_SHIFT, +- (mend - mstart) >> PAGE_SHIFT); ++ map->index, map->count, map_start, map_end, ++ range->start, range->end, mstart, mend); ++ unmap_grant_pages(map, (mstart - map_start) >> PAGE_SHIFT, ++ (mend - mstart) >> PAGE_SHIFT); + + return true; + } +@@ -1030,18 +1042,15 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + return -EINVAL; + + pr_debug("map %d+%d at %lx (pgoff %lx)\n", +- index, count, vma->vm_start, vma->vm_pgoff); ++ index, count, vma->vm_start, vma->vm_pgoff); + + mutex_lock(&priv->lock); + map = gntdev_find_map_index(priv, index, count); + if (!map) + goto unlock_out; +- if (use_ptemod && map->vma) ++ if (!atomic_add_unless(&map->in_use, 1, 1)) + goto unlock_out; +- if (atomic_read(&map->live_grants)) { +- err = -EAGAIN; +- goto unlock_out; +- } ++ + refcount_inc(&map->users); + + vma->vm_ops = &gntdev_vmops; +@@ -1062,15 +1071,16 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + map->flags |= GNTMAP_readonly; + } + ++ map->pages_vm_start = vma->vm_start; ++ + if (use_ptemod) { +- map->vma = vma; + err = mmu_interval_notifier_insert_locked( + &map->notifier, vma->vm_mm, vma->vm_start, + vma->vm_end - vma->vm_start, &gntdev_mmu_ops); +- if (err) { +- map->vma = NULL; ++ if (err) + goto out_unlock_put; +- } ++ ++ map->notifier_init = true; + } + mutex_unlock(&priv->lock); + +@@ -1087,7 +1097,6 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + */ + mmu_interval_read_begin(&map->notifier); + +- map->pages_vm_start = vma->vm_start; + err = apply_to_page_range(vma->vm_mm, vma->vm_start, + vma->vm_end - vma->vm_start, + find_grant_ptes, map); +@@ -1116,13 +1125,8 @@ unlock_out: + out_unlock_put: + mutex_unlock(&priv->lock); + out_put_map: +- if (use_ptemod) { ++ if (use_ptemod) + unmap_grant_pages(map, 0, map->count); +- if (map->vma) { +- mmu_interval_notifier_remove(&map->notifier); +- map->vma = NULL; +- } +- } + gntdev_put_map(priv, map); + return err; + } +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index a8ecd83abb11e..bcf9952813d48 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -2191,7 +2191,16 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info) + int need_clear = 0; + u64 cache_gen; + +- if (!root) ++ /* ++ * Either no extent root (with ibadroots rescue option) or we have ++ * unsupported RO options. The fs can never be mounted read-write, so no ++ * need to waste time searching block group items. ++ * ++ * This also allows new extent tree related changes to be RO compat, ++ * no need for a full incompat flag. ++ */ ++ if (!root || (btrfs_super_compat_ro_flags(info->super_copy) & ++ ~BTRFS_FEATURE_COMPAT_RO_SUPP)) + return fill_dummy_bgs(info); + + key.objectid = 0; +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 92f3f5ed8bf1e..7ce39983dc8ab 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -4904,6 +4904,9 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root, + !test_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &root->state)) + lockdep_owner = BTRFS_FS_TREE_OBJECTID; + ++ /* btrfs_clean_tree_block() accesses generation field. */ ++ btrfs_set_header_generation(buf, trans->transid); ++ + /* + * This needs to stay, because we could allocate a freed block from an + * old tree into a new tree, so we need to make sure this new block is +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 78df9b8557ddd..51da01074bb07 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -523,6 +523,7 @@ void btrfs_drop_extent_cache(struct btrfs_inode *inode, u64 start, u64 end, + testend = 0; + } + while (1) { ++ bool ends_after_range = false; + int no_splits = 0; + + modified = false; +@@ -539,10 +540,12 @@ void btrfs_drop_extent_cache(struct btrfs_inode *inode, u64 start, u64 end, + write_unlock(&em_tree->lock); + break; + } ++ if (testend && em->start + em->len > start + len) ++ ends_after_range = true; + flags = em->flags; + gen = em->generation; + if (skip_pinned && test_bit(EXTENT_FLAG_PINNED, &em->flags)) { +- if (testend && em->start + em->len >= start + len) { ++ if (ends_after_range) { + free_extent_map(em); + write_unlock(&em_tree->lock); + break; +@@ -592,7 +595,7 @@ void btrfs_drop_extent_cache(struct btrfs_inode *inode, u64 start, u64 end, + split = split2; + split2 = NULL; + } +- if (testend && em->start + em->len > start + len) { ++ if (ends_after_range) { + u64 diff = start + len - em->start; + + split->start = start + len; +@@ -630,14 +633,42 @@ void btrfs_drop_extent_cache(struct btrfs_inode *inode, u64 start, u64 end, + } else { + ret = add_extent_mapping(em_tree, split, + modified); +- ASSERT(ret == 0); /* Logic error */ ++ /* Logic error, shouldn't happen. */ ++ ASSERT(ret == 0); ++ if (WARN_ON(ret != 0) && modified) ++ btrfs_set_inode_full_sync(inode); + } + free_extent_map(split); + split = NULL; + } + next: +- if (extent_map_in_tree(em)) ++ if (extent_map_in_tree(em)) { ++ /* ++ * If the extent map is still in the tree it means that ++ * either of the following is true: ++ * ++ * 1) It fits entirely in our range (doesn't end beyond ++ * it or starts before it); ++ * ++ * 2) It starts before our range and/or ends after our ++ * range, and we were not able to allocate the extent ++ * maps for split operations, @split and @split2. ++ * ++ * If we are at case 2) then we just remove the entire ++ * extent map - this is fine since if anyone needs it to ++ * access the subranges outside our range, will just ++ * load it again from the subvolume tree's file extent ++ * item. However if the extent map was in the list of ++ * modified extents, then we must mark the inode for a ++ * full fsync, otherwise a fast fsync will miss this ++ * extent if it's new and needs to be logged. ++ */ ++ if ((em->start < start || ends_after_range) && modified) { ++ ASSERT(no_splits); ++ btrfs_set_inode_full_sync(inode); ++ } + remove_extent_mapping(em_tree, em); ++ } + write_unlock(&em_tree->lock); + + /* once for us */ +@@ -2201,14 +2232,6 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + + atomic_inc(&root->log_batch); + +- /* +- * Always check for the full sync flag while holding the inode's lock, +- * to avoid races with other tasks. The flag must be either set all the +- * time during logging or always off all the time while logging. +- */ +- full_sync = test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, +- &BTRFS_I(inode)->runtime_flags); +- + /* + * Before we acquired the inode's lock and the mmap lock, someone may + * have dirtied more pages in the target range. We need to make sure +@@ -2233,6 +2256,17 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + goto out; + } + ++ /* ++ * Always check for the full sync flag while holding the inode's lock, ++ * to avoid races with other tasks. The flag must be either set all the ++ * time during logging or always off all the time while logging. ++ * We check the flag here after starting delalloc above, because when ++ * running delalloc the full sync flag may be set if we need to drop ++ * extra extent map ranges due to temporary memory allocation failures. ++ */ ++ full_sync = test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, ++ &BTRFS_I(inode)->runtime_flags); ++ + /* + * We have to do this here to avoid the priority inversion of waiting on + * IO of a lower priority task while holding a transaction open. +@@ -3810,6 +3844,7 @@ const struct file_operations btrfs_file_operations = { + .mmap = btrfs_file_mmap, + .open = btrfs_file_open, + .release = btrfs_release_file, ++ .get_unmapped_area = thp_get_unmapped_area, + .fsync = btrfs_sync_file, + .fallocate = btrfs_fallocate, + .unlocked_ioctl = btrfs_ioctl, +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index b1ae3ba2ca2c3..5bdfc47eb6dd5 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -48,6 +48,25 @@ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl, + struct btrfs_free_space *info, u64 offset, + u64 bytes, bool update_stats); + ++static void __btrfs_remove_free_space_cache_locked( ++ struct btrfs_free_space_ctl *ctl) ++{ ++ struct btrfs_free_space *info; ++ struct rb_node *node; ++ ++ while ((node = rb_last(&ctl->free_space_offset)) != NULL) { ++ info = rb_entry(node, struct btrfs_free_space, offset_index); ++ if (!info->bitmap) { ++ unlink_free_space(ctl, info, true); ++ kmem_cache_free(btrfs_free_space_cachep, info); ++ } else { ++ free_bitmap(ctl, info); ++ } ++ ++ cond_resched_lock(&ctl->tree_lock); ++ } ++} ++ + static struct inode *__lookup_free_space_inode(struct btrfs_root *root, + struct btrfs_path *path, + u64 offset) +@@ -693,6 +712,12 @@ static void recalculate_thresholds(struct btrfs_free_space_ctl *ctl) + + max_bitmaps = max_t(u64, max_bitmaps, 1); + ++ if (ctl->total_bitmaps > max_bitmaps) ++ btrfs_err(block_group->fs_info, ++"invalid free space control: bg start=%llu len=%llu total_bitmaps=%u unit=%u max_bitmaps=%llu bytes_per_bg=%llu", ++ block_group->start, block_group->length, ++ ctl->total_bitmaps, ctl->unit, max_bitmaps, ++ bytes_per_bg); + ASSERT(ctl->total_bitmaps <= max_bitmaps); + + /* +@@ -875,7 +900,14 @@ out: + return ret; + free_cache: + io_ctl_drop_pages(&io_ctl); +- __btrfs_remove_free_space_cache(ctl); ++ ++ /* ++ * We need to call the _locked variant so we don't try to update the ++ * discard counters. ++ */ ++ spin_lock(&ctl->tree_lock); ++ __btrfs_remove_free_space_cache_locked(ctl); ++ spin_unlock(&ctl->tree_lock); + goto out; + } + +@@ -1001,7 +1033,13 @@ int load_free_space_cache(struct btrfs_block_group *block_group) + if (ret == 0) + ret = 1; + } else { ++ /* ++ * We need to call the _locked variant so we don't try to update ++ * the discard counters. ++ */ ++ spin_lock(&tmp_ctl.tree_lock); + __btrfs_remove_free_space_cache(&tmp_ctl); ++ spin_unlock(&tmp_ctl.tree_lock); + btrfs_warn(fs_info, + "block group %llu has wrong amount of free space", + block_group->start); +@@ -2964,25 +3002,6 @@ static void __btrfs_return_cluster_to_free_space( + btrfs_put_block_group(block_group); + } + +-static void __btrfs_remove_free_space_cache_locked( +- struct btrfs_free_space_ctl *ctl) +-{ +- struct btrfs_free_space *info; +- struct rb_node *node; +- +- while ((node = rb_last(&ctl->free_space_offset)) != NULL) { +- info = rb_entry(node, struct btrfs_free_space, offset_index); +- if (!info->bitmap) { +- unlink_free_space(ctl, info, true); +- kmem_cache_free(btrfs_free_space_cachep, info); +- } else { +- free_bitmap(ctl, info); +- } +- +- cond_resched_lock(&ctl->tree_lock); +- } +-} +- + void __btrfs_remove_free_space_cache(struct btrfs_free_space_ctl *ctl) + { + spin_lock(&ctl->tree_lock); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index db723c0026bd2..ba323dcb0a0b8 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1174,6 +1174,21 @@ out_add_root: + fs_info->qgroup_rescan_running = true; + btrfs_queue_work(fs_info->qgroup_rescan_workers, + &fs_info->qgroup_rescan_work); ++ } else { ++ /* ++ * We have set both BTRFS_FS_QUOTA_ENABLED and ++ * BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with ++ * -EINPROGRESS. That can happen because someone started the ++ * rescan worker by calling quota rescan ioctl before we ++ * attempted to initialize the rescan worker. Failure due to ++ * quotas disabled in the meanwhile is not possible, because ++ * we are holding a write lock on fs_info->subvol_sem, which ++ * is also acquired when disabling quotas. ++ * Ignore such error, and any other error would need to undo ++ * everything we did in the transaction we just committed. ++ */ ++ ASSERT(ret == -EINPROGRESS); ++ ret = 0; + } + + out_free_path: +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index e7b0323e6efd8..a14f97bf2a408 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -731,6 +731,13 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock) + dev = sblock->sectors[0]->dev; + fs_info = sblock->sctx->fs_info; + ++ /* Super block error, no need to search extent tree. */ ++ if (sblock->sectors[0]->flags & BTRFS_EXTENT_FLAG_SUPER) { ++ btrfs_warn_in_rcu(fs_info, "%s on device %s, physical %llu", ++ errstr, rcu_str_deref(dev->name), ++ sblock->sectors[0]->physical); ++ return; ++ } + path = btrfs_alloc_path(); + if (!path) + return; +@@ -806,7 +813,7 @@ static inline void scrub_put_recover(struct btrfs_fs_info *fs_info, + static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + { + struct scrub_ctx *sctx = sblock_to_check->sctx; +- struct btrfs_device *dev; ++ struct btrfs_device *dev = sblock_to_check->sectors[0]->dev; + struct btrfs_fs_info *fs_info; + u64 logical; + unsigned int failed_mirror_index; +@@ -827,13 +834,15 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + fs_info = sctx->fs_info; + if (sblock_to_check->sectors[0]->flags & BTRFS_EXTENT_FLAG_SUPER) { + /* +- * if we find an error in a super block, we just report it. ++ * If we find an error in a super block, we just report it. + * They will get written with the next transaction commit + * anyway + */ ++ scrub_print_warning("super block error", sblock_to_check); + spin_lock(&sctx->stat_lock); + ++sctx->stat.super_errors; + spin_unlock(&sctx->stat_lock); ++ btrfs_dev_stat_inc_and_print(dev, BTRFS_DEV_STAT_CORRUPTION_ERRS); + return 0; + } + logical = sblock_to_check->sectors[0]->logical; +@@ -842,7 +851,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + is_metadata = !(sblock_to_check->sectors[0]->flags & + BTRFS_EXTENT_FLAG_DATA); + have_csum = sblock_to_check->sectors[0]->have_csum; +- dev = sblock_to_check->sectors[0]->dev; + + if (!sctx->is_dev_replace && btrfs_repair_one_zone(fs_info, logical)) + return 0; +@@ -1773,7 +1781,7 @@ static int scrub_checksum(struct scrub_block *sblock) + else if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) + ret = scrub_checksum_tree_block(sblock); + else if (flags & BTRFS_EXTENT_FLAG_SUPER) +- (void)scrub_checksum_super(sblock); ++ ret = scrub_checksum_super(sblock); + else + WARN_ON(1); + if (ret) +@@ -1912,23 +1920,6 @@ static int scrub_checksum_super(struct scrub_block *sblock) + if (memcmp(calculated_csum, s->csum, sctx->fs_info->csum_size)) + ++fail_cor; + +- if (fail_cor + fail_gen) { +- /* +- * if we find an error in a super block, we just report it. +- * They will get written with the next transaction commit +- * anyway +- */ +- spin_lock(&sctx->stat_lock); +- ++sctx->stat.super_errors; +- spin_unlock(&sctx->stat_lock); +- if (fail_cor) +- btrfs_dev_stat_inc_and_print(sector->dev, +- BTRFS_DEV_STAT_CORRUPTION_ERRS); +- else +- btrfs_dev_stat_inc_and_print(sector->dev, +- BTRFS_DEV_STAT_GENERATION_ERRS); +- } +- + return fail_cor + fail_gen; + } + +@@ -4121,6 +4112,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, + int ret; + struct btrfs_device *dev; + unsigned int nofs_flag; ++ bool need_commit = false; + + if (btrfs_fs_closing(fs_info)) + return -EAGAIN; +@@ -4224,6 +4216,12 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, + */ + nofs_flag = memalloc_nofs_save(); + if (!is_dev_replace) { ++ u64 old_super_errors; ++ ++ spin_lock(&sctx->stat_lock); ++ old_super_errors = sctx->stat.super_errors; ++ spin_unlock(&sctx->stat_lock); ++ + btrfs_info(fs_info, "scrub: started on devid %llu", devid); + /* + * by holding device list mutex, we can +@@ -4232,6 +4230,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, + mutex_lock(&fs_info->fs_devices->device_list_mutex); + ret = scrub_supers(sctx, dev); + mutex_unlock(&fs_info->fs_devices->device_list_mutex); ++ ++ spin_lock(&sctx->stat_lock); ++ /* ++ * Super block errors found, but we can not commit transaction ++ * at current context, since btrfs_commit_transaction() needs ++ * to pause the current running scrub (hold by ourselves). ++ */ ++ if (sctx->stat.super_errors > old_super_errors && !sctx->readonly) ++ need_commit = true; ++ spin_unlock(&sctx->stat_lock); + } + + if (!ret) +@@ -4258,6 +4266,25 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, + scrub_workers_put(fs_info); + scrub_put_ctx(sctx); + ++ /* ++ * We found some super block errors before, now try to force a ++ * transaction commit, as scrub has finished. ++ */ ++ if (need_commit) { ++ struct btrfs_trans_handle *trans; ++ ++ trans = btrfs_start_transaction(fs_info->tree_root, 0); ++ if (IS_ERR(trans)) { ++ ret = PTR_ERR(trans); ++ btrfs_err(fs_info, ++ "scrub: failed to start transaction to fix super block errors: %d", ret); ++ return ret; ++ } ++ ret = btrfs_commit_transaction(trans); ++ if (ret < 0) ++ btrfs_err(fs_info, ++ "scrub: failed to commit transaction to fix super block errors: %d", ret); ++ } + return ret; + out: + scrub_workers_put(fs_info); +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 6627dd7875ee0..b2a5291e5e4b2 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -625,6 +625,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + int saved_compress_level; + bool saved_compress_force; + int no_compress = 0; ++ const bool remounting = test_bit(BTRFS_FS_STATE_REMOUNTING, &info->fs_state); + + if (btrfs_fs_compat_ro(info, FREE_SPACE_TREE)) + btrfs_set_opt(info->mount_opt, FREE_SPACE_TREE); +@@ -1136,10 +1137,12 @@ out: + } + if (!ret) + ret = btrfs_check_mountopts_zoned(info); +- if (!ret && btrfs_test_opt(info, SPACE_CACHE)) +- btrfs_info(info, "disk space caching is enabled"); +- if (!ret && btrfs_test_opt(info, FREE_SPACE_TREE)) +- btrfs_info(info, "using free space tree"); ++ if (!ret && !remounting) { ++ if (btrfs_test_opt(info, SPACE_CACHE)) ++ btrfs_info(info, "disk space caching is enabled"); ++ if (btrfs_test_opt(info, FREE_SPACE_TREE)) ++ btrfs_info(info, "using free space tree"); ++ } + return ret; + } + +@@ -2113,6 +2116,15 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) + ret = -EINVAL; + goto restore; + } ++ if (btrfs_super_compat_ro_flags(fs_info->super_copy) & ++ ~BTRFS_FEATURE_COMPAT_RO_SUPP) { ++ btrfs_err(fs_info, ++ "can not remount read-write due to unsupported optional flags 0x%llx", ++ btrfs_super_compat_ro_flags(fs_info->super_copy) & ++ ~BTRFS_FEATURE_COMPAT_RO_SUPP); ++ ret = -EINVAL; ++ goto restore; ++ } + if (fs_info->fs_devices->rw_devices == 0) { + ret = -EACCES; + goto restore; +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index d59aebefa71cd..66305d11cd6d0 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -642,7 +642,7 @@ cifs_chan_is_iface_active(struct cifs_ses *ses, + int + cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server); + int +-SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon); ++SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_mount); + + void extract_unc_hostname(const char *unc, const char **h, size_t *len); + int copy_path_name(char *dst, const char *src); +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index bdc3efdb12219..999d6fd31ac9a 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -155,7 +155,7 @@ static void smb2_query_server_interfaces(struct work_struct *work) + /* + * query server network interfaces, in case they change + */ +- rc = SMB3_request_interfaces(0, tcon); ++ rc = SMB3_request_interfaces(0, tcon, false); + if (rc) { + cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", + __func__, rc); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 02dd591acabb3..34739cf0c25df 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -4024,6 +4024,15 @@ static ssize_t __cifs_readv( + len = ctx->len; + } + ++ if (direct) { ++ rc = filemap_write_and_wait_range(file->f_inode->i_mapping, ++ offset, offset + len - 1); ++ if (rc) { ++ kref_put(&ctx->refcount, cifs_aio_ctx_release); ++ return -EAGAIN; ++ } ++ } ++ + /* grab a lock here due to read response handlers can access ctx */ + mutex_lock(&ctx->aio_mutex); + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index cc180d37b8ce1..60b006d982c25 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -511,8 +511,7 @@ smb3_negotiate_rsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) + + static int + parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, +- size_t buf_len, +- struct cifs_ses *ses) ++ size_t buf_len, struct cifs_ses *ses, bool in_mount) + { + struct network_interface_info_ioctl_rsp *p; + struct sockaddr_in *addr4; +@@ -542,6 +541,20 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + } + spin_unlock(&ses->iface_lock); + ++ /* ++ * Samba server e.g. can return an empty interface list in some cases, ++ * which would only be a problem if we were requesting multichannel ++ */ ++ if (bytes_left == 0) { ++ /* avoid spamming logs every 10 minutes, so log only in mount */ ++ if ((ses->chan_max > 1) && in_mount) ++ cifs_dbg(VFS, ++ "empty network interface list returned by server %s\n", ++ ses->server->hostname); ++ rc = -EINVAL; ++ goto out; ++ } ++ + while (bytes_left >= sizeof(*p)) { + memset(&tmp_iface, 0, sizeof(tmp_iface)); + tmp_iface.speed = le64_to_cpu(p->LinkSpeed); +@@ -672,7 +685,7 @@ out: + } + + int +-SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon) ++SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_mount) + { + int rc; + unsigned int ret_data_len = 0; +@@ -692,7 +705,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon) + goto out; + } + +- rc = parse_server_interfaces(out_buf, ret_data_len, ses); ++ rc = parse_server_interfaces(out_buf, ret_data_len, ses, in_mount); + if (rc) + goto out; + +@@ -1022,7 +1035,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + if (rc) + return; + +- SMB3_request_interfaces(xid, tcon); ++ SMB3_request_interfaces(xid, tcon, true /* called during mount */); + + SMB2_QFS_attr(xid, tcon, fid.persistent_fid, fid.volatile_fid, + FS_ATTRIBUTE_INFORMATION); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 31d37afae741f..816ae63d795a3 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1168,9 +1168,9 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + pneg_inbuf->Dialects[0] = + cpu_to_le16(server->vals->protocol_id); + pneg_inbuf->DialectCount = cpu_to_le16(1); +- /* structure is big enough for 3 dialects, sending only 1 */ ++ /* structure is big enough for 4 dialects, sending only 1 */ + inbuflen = sizeof(*pneg_inbuf) - +- sizeof(pneg_inbuf->Dialects[0]) * 2; ++ sizeof(pneg_inbuf->Dialects[0]) * 3; + } + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, +@@ -2410,7 +2410,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) + unsigned int acelen, acl_size, ace_count; + unsigned int owner_offset = 0; + unsigned int group_offset = 0; +- struct smb3_acl acl; ++ struct smb3_acl acl = {}; + + *len = roundup(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); + +@@ -2483,6 +2483,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) + acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ + acl.AclSize = cpu_to_le16(acl_size); + acl.AceCount = cpu_to_le16(ace_count); ++ /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ + memcpy(aclptr, &acl, sizeof(struct smb3_acl)); + + buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index 55e79f6ee78d1..334d8471346ff 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -225,9 +225,9 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, + struct smb_rqst drqst; + + ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId)); +- if (!ses) { ++ if (unlikely(!ses)) { + cifs_server_dbg(VFS, "%s: Could not find session\n", __func__); +- return 0; ++ return -ENOENT; + } + + memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE); +@@ -557,8 +557,10 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, + u8 key[SMB3_SIGN_KEY_SIZE]; + + rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); +- if (rc) +- return 0; ++ if (unlikely(rc)) { ++ cifs_server_dbg(VFS, "%s: Could not get signing key\n", __func__); ++ return rc; ++ } + + if (allocate_crypto) { + rc = cifs_alloc_hash("cmac(aes)", &hash, &sdesc); +diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c +index bfac462dd3e8f..730739869ba02 100644 +--- a/fs/dlm/ast.c ++++ b/fs/dlm/ast.c +@@ -200,13 +200,13 @@ void dlm_add_cb(struct dlm_lkb *lkb, uint32_t flags, int mode, int status, + if (!prev_seq) { + kref_get(&lkb->lkb_ref); + ++ mutex_lock(&ls->ls_cb_mutex); + if (test_bit(LSFL_CB_DELAY, &ls->ls_flags)) { +- mutex_lock(&ls->ls_cb_mutex); + list_add(&lkb->lkb_cb_list, &ls->ls_cb_delay); +- mutex_unlock(&ls->ls_cb_mutex); + } else { + queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work); + } ++ mutex_unlock(&ls->ls_cb_mutex); + } + out: + mutex_unlock(&lkb->lkb_cb_mutex); +@@ -288,7 +288,9 @@ void dlm_callback_stop(struct dlm_ls *ls) + + void dlm_callback_suspend(struct dlm_ls *ls) + { ++ mutex_lock(&ls->ls_cb_mutex); + set_bit(LSFL_CB_DELAY, &ls->ls_flags); ++ mutex_unlock(&ls->ls_cb_mutex); + + if (ls->ls_callback_wq) + flush_workqueue(ls->ls_callback_wq); +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index 226822f49d309..86aa37ab0e79f 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -2920,17 +2920,9 @@ static int set_unlock_args(uint32_t flags, void *astarg, struct dlm_args *args) + static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb, + struct dlm_args *args) + { +- int rv = -EINVAL; ++ int rv = -EBUSY; + + if (args->flags & DLM_LKF_CONVERT) { +- if (lkb->lkb_flags & DLM_IFL_MSTCPY) +- goto out; +- +- if (args->flags & DLM_LKF_QUECVT && +- !__quecvt_compat_matrix[lkb->lkb_grmode+1][args->mode+1]) +- goto out; +- +- rv = -EBUSY; + if (lkb->lkb_status != DLM_LKSTS_GRANTED) + goto out; + +@@ -2940,6 +2932,14 @@ static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb, + + if (is_overlap(lkb)) + goto out; ++ ++ rv = -EINVAL; ++ if (lkb->lkb_flags & DLM_IFL_MSTCPY) ++ goto out; ++ ++ if (args->flags & DLM_LKF_QUECVT && ++ !__quecvt_compat_matrix[lkb->lkb_grmode+1][args->mode+1]) ++ goto out; + } + + lkb->lkb_exflags = args->flags; +@@ -3672,7 +3672,7 @@ static void send_args(struct dlm_rsb *r, struct dlm_lkb *lkb, + case cpu_to_le32(DLM_MSG_REQUEST_REPLY): + case cpu_to_le32(DLM_MSG_CONVERT_REPLY): + case cpu_to_le32(DLM_MSG_GRANT): +- if (!lkb->lkb_lvbptr) ++ if (!lkb->lkb_lvbptr || !(lkb->lkb_exflags & DLM_LKF_VALBLK)) + break; + memcpy(ms->m_extra, lkb->lkb_lvbptr, r->res_ls->ls_lvblen); + break; +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index 19e82f08c0e0c..c80ee6a95d171 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -1336,6 +1336,8 @@ struct dlm_msg *dlm_lowcomms_new_msg(int nodeid, int len, gfp_t allocation, + return NULL; + } + ++ /* for dlm_lowcomms_commit_msg() */ ++ kref_get(&msg->ref); + /* we assume if successful commit must called */ + msg->idx = idx; + return msg; +@@ -1375,6 +1377,8 @@ void dlm_lowcomms_commit_msg(struct dlm_msg *msg) + { + _dlm_lowcomms_commit_msg(msg); + srcu_read_unlock(&connections_srcu, msg->idx); ++ /* because dlm_lowcomms_new_msg() */ ++ kref_put(&msg->ref, dlm_msg_release); + } + #endif + +diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c +index 95a403720e8c7..16cf9a2835574 100644 +--- a/fs/erofs/inode.c ++++ b/fs/erofs/inode.c +@@ -214,7 +214,7 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr, + + /* if it cannot be handled with fast symlink scheme */ + if (vi->datalayout != EROFS_INODE_FLAT_INLINE || +- inode->i_size >= EROFS_BLKSIZ) { ++ inode->i_size >= EROFS_BLKSIZ || inode->i_size < 0) { + inode->i_op = &erofs_symlink_iops; + return 0; + } +diff --git a/fs/erofs/super.c b/fs/erofs/super.c +index 95addc5c9d34d..ddf8f737cfb58 100644 +--- a/fs/erofs/super.c ++++ b/fs/erofs/super.c +@@ -877,7 +877,7 @@ static void erofs_kill_sb(struct super_block *sb) + WARN_ON(sb->s_magic != EROFS_SUPER_MAGIC); + + if (erofs_is_fscache_mode(sb)) +- generic_shutdown_super(sb); ++ kill_anon_super(sb); + else + kill_block_super(sb); + +diff --git a/fs/eventfd.c b/fs/eventfd.c +index 3627dd7d25db8..c0ffee99ad238 100644 +--- a/fs/eventfd.c ++++ b/fs/eventfd.c +@@ -69,17 +69,17 @@ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n) + * it returns false, the eventfd_signal() call should be deferred to a + * safe context. + */ +- if (WARN_ON_ONCE(current->in_eventfd_signal)) ++ if (WARN_ON_ONCE(current->in_eventfd)) + return 0; + + spin_lock_irqsave(&ctx->wqh.lock, flags); +- current->in_eventfd_signal = 1; ++ current->in_eventfd = 1; + if (ULLONG_MAX - ctx->count < n) + n = ULLONG_MAX - ctx->count; + ctx->count += n; + if (waitqueue_active(&ctx->wqh)) + wake_up_locked_poll(&ctx->wqh, EPOLLIN); +- current->in_eventfd_signal = 0; ++ current->in_eventfd = 0; + spin_unlock_irqrestore(&ctx->wqh.lock, flags); + + return n; +@@ -253,8 +253,10 @@ static ssize_t eventfd_read(struct kiocb *iocb, struct iov_iter *to) + __set_current_state(TASK_RUNNING); + } + eventfd_ctx_do_read(ctx, &ucnt); ++ current->in_eventfd = 1; + if (waitqueue_active(&ctx->wqh)) + wake_up_locked_poll(&ctx->wqh, EPOLLOUT); ++ current->in_eventfd = 0; + spin_unlock_irq(&ctx->wqh.lock); + if (unlikely(copy_to_iter(&ucnt, sizeof(ucnt), to) != sizeof(ucnt))) + return -EFAULT; +@@ -301,8 +303,10 @@ static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t c + } + if (likely(res > 0)) { + ctx->count += ucnt; ++ current->in_eventfd = 1; + if (waitqueue_active(&ctx->wqh)) + wake_up_locked_poll(&ctx->wqh, EPOLLIN); ++ current->in_eventfd = 0; + } + spin_unlock_irq(&ctx->wqh.lock); + +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index cdffa2a041af8..f53ab39bb8e87 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -163,7 +163,7 @@ static void ext2_put_super (struct super_block * sb) + db_count = sbi->s_gdb_count; + for (i = 0; i < db_count; i++) + brelse(sbi->s_group_desc[i]); +- kfree(sbi->s_group_desc); ++ kvfree(sbi->s_group_desc); + kfree(sbi->s_debts); + percpu_counter_destroy(&sbi->s_freeblocks_counter); + percpu_counter_destroy(&sbi->s_freeinodes_counter); +@@ -1053,6 +1053,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_blocks_per_group); + goto failed_mount; + } ++ /* At least inode table, bitmaps, and sb have to fit in one group */ ++ if (sbi->s_blocks_per_group <= sbi->s_itb_per_group + 3) { ++ ext2_msg(sb, KERN_ERR, ++ "error: #blocks per group smaller than metadata size: %lu <= %lu", ++ sbi->s_blocks_per_group, sbi->s_inodes_per_group + 3); ++ goto failed_mount; ++ } + if (sbi->s_frags_per_group > sb->s_blocksize * 8) { + ext2_msg(sb, KERN_ERR, + "error: #fragments per group too big: %lu", +@@ -1066,9 +1073,14 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_inodes_per_group); + goto failed_mount; + } ++ if (sb_bdev_nr_blocks(sb) < le32_to_cpu(es->s_blocks_count)) { ++ ext2_msg(sb, KERN_ERR, ++ "bad geometry: block count %u exceeds size of device (%u blocks)", ++ le32_to_cpu(es->s_blocks_count), ++ (unsigned)sb_bdev_nr_blocks(sb)); ++ goto failed_mount; ++ } + +- if (EXT2_BLOCKS_PER_GROUP(sb) == 0) +- goto cantfind_ext2; + sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - + le32_to_cpu(es->s_first_data_block) - 1) + / EXT2_BLOCKS_PER_GROUP(sb)) + 1; +@@ -1081,7 +1093,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + } + db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / + EXT2_DESC_PER_BLOCK(sb); +- sbi->s_group_desc = kmalloc_array(db_count, ++ sbi->s_group_desc = kvmalloc_array(db_count, + sizeof(struct buffer_head *), + GFP_KERNEL); + if (sbi->s_group_desc == NULL) { +@@ -1207,7 +1219,7 @@ failed_mount2: + for (i = 0; i < db_count; i++) + brelse(sbi->s_group_desc[i]); + failed_mount_group_desc: +- kfree(sbi->s_group_desc); ++ kvfree(sbi->s_group_desc); + kfree(sbi->s_debts); + failed_mount: + brelse(bh); +diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c +index 795a60ad18978..a25a3af139521 100644 +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -874,22 +874,25 @@ static int ext4_fc_write_inode(struct inode *inode, u32 *crc) + tl.fc_tag = cpu_to_le16(EXT4_FC_TAG_INODE); + tl.fc_len = cpu_to_le16(inode_len + sizeof(fc_inode.fc_ino)); + ++ ret = -ECANCELED; + dst = ext4_fc_reserve_space(inode->i_sb, + sizeof(tl) + inode_len + sizeof(fc_inode.fc_ino), crc); + if (!dst) +- return -ECANCELED; ++ goto err; + + if (!ext4_fc_memcpy(inode->i_sb, dst, &tl, sizeof(tl), crc)) +- return -ECANCELED; ++ goto err; + dst += sizeof(tl); + if (!ext4_fc_memcpy(inode->i_sb, dst, &fc_inode, sizeof(fc_inode), crc)) +- return -ECANCELED; ++ goto err; + dst += sizeof(fc_inode); + if (!ext4_fc_memcpy(inode->i_sb, dst, (u8 *)ext4_raw_inode(&iloc), + inode_len, crc)) +- return -ECANCELED; +- +- return 0; ++ goto err; ++ ret = 0; ++err: ++ brelse(iloc.bh); ++ return ret; + } + + /* +@@ -1491,13 +1494,15 @@ static int ext4_fc_record_modified_inode(struct super_block *sb, int ino) + if (state->fc_modified_inodes[i] == ino) + return 0; + if (state->fc_modified_inodes_used == state->fc_modified_inodes_size) { +- state->fc_modified_inodes = krealloc( +- state->fc_modified_inodes, ++ int *fc_modified_inodes; ++ ++ fc_modified_inodes = krealloc(state->fc_modified_inodes, + sizeof(int) * (state->fc_modified_inodes_size + + EXT4_FC_REPLAY_REALLOC_INCREMENT), + GFP_KERNEL); +- if (!state->fc_modified_inodes) ++ if (!fc_modified_inodes) + return -ENOMEM; ++ state->fc_modified_inodes = fc_modified_inodes; + state->fc_modified_inodes_size += + EXT4_FC_REPLAY_REALLOC_INCREMENT; + } +@@ -1682,15 +1687,18 @@ int ext4_fc_record_regions(struct super_block *sb, int ino, + if (replay && state->fc_regions_used != state->fc_regions_valid) + state->fc_regions_used = state->fc_regions_valid; + if (state->fc_regions_used == state->fc_regions_size) { ++ struct ext4_fc_alloc_region *fc_regions; ++ ++ fc_regions = krealloc(state->fc_regions, ++ sizeof(struct ext4_fc_alloc_region) * ++ (state->fc_regions_size + ++ EXT4_FC_REPLAY_REALLOC_INCREMENT), ++ GFP_KERNEL); ++ if (!fc_regions) ++ return -ENOMEM; + state->fc_regions_size += + EXT4_FC_REPLAY_REALLOC_INCREMENT; +- state->fc_regions = krealloc( +- state->fc_regions, +- state->fc_regions_size * +- sizeof(struct ext4_fc_alloc_region), +- GFP_KERNEL); +- if (!state->fc_regions) +- return -ENOMEM; ++ state->fc_regions = fc_regions; + } + region = &state->fc_regions[state->fc_regions_used++]; + region->ino = ino; +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 109d07629f81f..847a2f806b8f6 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -528,6 +528,12 @@ static ssize_t ext4_dio_write_iter(struct kiocb *iocb, struct iov_iter *from) + ret = -EAGAIN; + goto out; + } ++ /* ++ * Make sure inline data cannot be created anymore since we are going ++ * to allocate blocks for DIO. We know the inode does not have any ++ * inline data now because ext4_dio_supported() checked for that. ++ */ ++ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); + + offset = iocb->ki_pos; + count = ret; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 560cf8dc59359..7e5e8457026a1 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1188,6 +1188,13 @@ retry_grab: + page = grab_cache_page_write_begin(mapping, index); + if (!page) + return -ENOMEM; ++ /* ++ * The same as page allocation, we prealloc buffer heads before ++ * starting the handle. ++ */ ++ if (!page_has_buffers(page)) ++ create_empty_buffers(page, inode->i_sb->s_blocksize, 0); ++ + unlock_page(page); + + retry_journal: +@@ -5340,6 +5347,7 @@ int ext4_setattr(struct user_namespace *mnt_userns, struct dentry *dentry, + int error, rc = 0; + int orphan = 0; + const unsigned int ia_valid = attr->ia_valid; ++ bool inc_ivers = true; + + if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) + return -EIO; +@@ -5425,8 +5433,8 @@ int ext4_setattr(struct user_namespace *mnt_userns, struct dentry *dentry, + return -EINVAL; + } + +- if (IS_I_VERSION(inode) && attr->ia_size != inode->i_size) +- inode_inc_iversion(inode); ++ if (attr->ia_size == inode->i_size) ++ inc_ivers = false; + + if (shrink) { + if (ext4_should_order_data(inode)) { +@@ -5528,6 +5536,8 @@ out_mmap_sem: + } + + if (!error) { ++ if (inc_ivers) ++ inode_inc_iversion(inode); + setattr_copy(mnt_userns, inode, attr); + mark_inode_dirty(inode); + } +@@ -5731,9 +5741,6 @@ int ext4_mark_iloc_dirty(handle_t *handle, + } + ext4_fc_track_inode(handle, inode); + +- if (IS_I_VERSION(inode)) +- inode_inc_iversion(inode); +- + /* the do_update_inode consumes one bh->b_count */ + get_bh(iloc->bh); + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index cb01c1da0f9d5..b6f694d195997 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -442,6 +442,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + swap_inode_data(inode, inode_bl); + + inode->i_ctime = inode_bl->i_ctime = current_time(inode); ++ inode_inc_iversion(inode); + + inode->i_generation = prandom_u32(); + inode_bl->i_generation = prandom_u32(); +@@ -655,6 +656,7 @@ static int ext4_ioctl_setflags(struct inode *inode, + ext4_set_inode_flags(inode, false); + + inode->i_ctime = current_time(inode); ++ inode_inc_iversion(inode); + + err = ext4_mark_iloc_dirty(handle, inode, &iloc); + flags_err: +@@ -765,6 +767,7 @@ static int ext4_ioctl_setproject(struct inode *inode, __u32 projid) + + EXT4_I(inode)->i_projid = kprojid; + inode->i_ctime = current_time(inode); ++ inode_inc_iversion(inode); + out_dirty: + rc = ext4_mark_iloc_dirty(handle, inode, &iloc); + if (!err) +@@ -1178,6 +1181,7 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + err = ext4_reserve_inode_write(handle, inode, &iloc); + if (err == 0) { + inode->i_ctime = current_time(inode); ++ inode_inc_iversion(inode); + inode->i_generation = generation; + err = ext4_mark_iloc_dirty(handle, inode, &iloc); + } +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 3a31b662f6619..4183a4cb4a21e 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -85,15 +85,20 @@ static struct buffer_head *ext4_append(handle_t *handle, + return bh; + inode->i_size += inode->i_sb->s_blocksize; + EXT4_I(inode)->i_disksize = inode->i_size; ++ err = ext4_mark_inode_dirty(handle, inode); ++ if (err) ++ goto out; + BUFFER_TRACE(bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, inode->i_sb, bh, + EXT4_JTR_NONE); +- if (err) { +- brelse(bh); +- ext4_std_error(inode->i_sb, err); +- return ERR_PTR(err); +- } ++ if (err) ++ goto out; + return bh; ++ ++out: ++ brelse(bh); ++ ext4_std_error(inode->i_sb, err); ++ return ERR_PTR(err); + } + + static int ext4_dx_csum_verify(struct inode *inode, +@@ -126,7 +131,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, + struct ext4_dir_entry *dirent; + int is_dx_block = 0; + +- if (block >= inode->i_size) { ++ if (block >= inode->i_size >> inode->i_blkbits) { + ext4_error_inode(inode, func, line, block, + "Attempting to read directory block (%u) that is past i_size (%llu)", + block, inode->i_size); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index cb5a64293881e..b2d84bd112a4a 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -2100,7 +2100,7 @@ retry: + goto out; + } + +- if (ext4_blocks_count(es) == n_blocks_count) ++ if (ext4_blocks_count(es) == n_blocks_count && n_blocks_count_retry == 0) + goto out; + + err = ext4_alloc_flex_bg_array(sb, n_group + 1); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 845f2f8aee5f9..5cacd513d0dff 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -205,19 +205,12 @@ int ext4_read_bh(struct buffer_head *bh, int op_flags, bh_end_io_t *end_io) + + int ext4_read_bh_lock(struct buffer_head *bh, int op_flags, bool wait) + { +- if (trylock_buffer(bh)) { +- if (wait) +- return ext4_read_bh(bh, op_flags, NULL); ++ lock_buffer(bh); ++ if (!wait) { + ext4_read_bh_nowait(bh, op_flags, NULL); + return 0; + } +- if (wait) { +- wait_on_buffer(bh); +- if (buffer_uptodate(bh)) +- return 0; +- return -EIO; +- } +- return 0; ++ return ext4_read_bh(bh, op_flags, NULL); + } + + /* +@@ -264,7 +257,8 @@ void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block) + struct buffer_head *bh = sb_getblk_gfp(sb, block, 0); + + if (likely(bh)) { +- ext4_read_bh_lock(bh, REQ_RAHEAD, false); ++ if (trylock_buffer(bh)) ++ ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL); + brelse(bh); + } + } +@@ -1585,7 +1579,7 @@ enum { + Opt_inlinecrypt, + Opt_usrjquota, Opt_grpjquota, Opt_quota, + Opt_noquota, Opt_barrier, Opt_nobarrier, Opt_err, +- Opt_usrquota, Opt_grpquota, Opt_prjquota, Opt_i_version, ++ Opt_usrquota, Opt_grpquota, Opt_prjquota, + Opt_dax, Opt_dax_always, Opt_dax_inode, Opt_dax_never, + Opt_stripe, Opt_delalloc, Opt_nodelalloc, Opt_warn_on_error, + Opt_nowarn_on_error, Opt_mblk_io_submit, Opt_debug_want_extra_isize, +@@ -1694,7 +1688,7 @@ static const struct fs_parameter_spec ext4_param_specs[] = { + fsparam_flag ("barrier", Opt_barrier), + fsparam_u32 ("barrier", Opt_barrier), + fsparam_flag ("nobarrier", Opt_nobarrier), +- fsparam_flag ("i_version", Opt_i_version), ++ fsparam_flag ("i_version", Opt_removed), + fsparam_flag ("dax", Opt_dax), + fsparam_enum ("dax", Opt_dax_type, ext4_param_dax), + fsparam_u32 ("stripe", Opt_stripe), +@@ -2140,11 +2134,6 @@ static int ext4_parse_param(struct fs_context *fc, struct fs_parameter *param) + case Opt_abort: + ctx_set_mount_flag(ctx, EXT4_MF_FS_ABORTED); + return 0; +- case Opt_i_version: +- ext4_msg(NULL, KERN_WARNING, deprecated_msg, param->key, "5.20"); +- ext4_msg(NULL, KERN_WARNING, "Use iversion instead\n"); +- ctx_set_flags(ctx, SB_I_VERSION); +- return 0; + case Opt_inlinecrypt: + #ifdef CONFIG_FS_ENCRYPTION_INLINE_CRYPT + ctx_set_flags(ctx, SB_INLINECRYPT); +@@ -2814,14 +2803,6 @@ static void ext4_apply_options(struct fs_context *fc, struct super_block *sb) + sb->s_flags &= ~ctx->mask_s_flags; + sb->s_flags |= ctx->vals_s_flags; + +- /* +- * i_version differs from common mount option iversion so we have +- * to let vfs know that it was set, otherwise it would get cleared +- * on remount +- */ +- if (ctx->mask_s_flags & SB_I_VERSION) +- fc->sb_flags |= SB_I_VERSION; +- + #define APPLY(X) ({ if (ctx->spec & EXT4_SPEC_##X) sbi->X = ctx->X; }) + APPLY(s_commit_interval); + APPLY(s_stripe); +@@ -2970,8 +2951,6 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, + SEQ_OPTS_PRINT("min_batch_time=%u", sbi->s_min_batch_time); + if (nodefs || sbi->s_max_batch_time != EXT4_DEF_MAX_BATCH_TIME) + SEQ_OPTS_PRINT("max_batch_time=%u", sbi->s_max_batch_time); +- if (sb->s_flags & SB_I_VERSION) +- SEQ_OPTS_PUTS("i_version"); + if (nodefs || sbi->s_stripe) + SEQ_OPTS_PRINT("stripe=%lu", sbi->s_stripe); + if (nodefs || EXT4_MOUNT_DATA_FLAGS & +@@ -3758,6 +3737,7 @@ static int ext4_lazyinit_thread(void *arg) + unsigned long next_wakeup, cur; + + BUG_ON(NULL == eli); ++ set_freezable(); + + cont_thread: + while (true) { +@@ -3973,9 +3953,9 @@ int ext4_register_li_request(struct super_block *sb, + goto out; + } + +- if (test_opt(sb, NO_PREFETCH_BLOCK_BITMAPS) && +- (first_not_zeroed == ngroups || sb_rdonly(sb) || +- !test_opt(sb, INIT_INODE_TABLE))) ++ if (sb_rdonly(sb) || ++ (test_opt(sb, NO_PREFETCH_BLOCK_BITMAPS) && ++ (first_not_zeroed == ngroups || !test_opt(sb, INIT_INODE_TABLE)))) + goto out; + + elr = ext4_li_request_new(sb, first_not_zeroed); +@@ -4630,6 +4610,9 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) + sb->s_flags = (sb->s_flags & ~SB_POSIXACL) | + (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0); + ++ /* i_version is always enabled now */ ++ sb->s_flags |= SB_I_VERSION; ++ + if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV && + (ext4_has_compat_features(sb) || + ext4_has_ro_compat_features(sb) || +@@ -6643,7 +6626,7 @@ static int ext4_write_info(struct super_block *sb, int type) + handle_t *handle; + + /* Data block + inode block */ +- handle = ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2); ++ handle = ext4_journal_start_sb(sb, EXT4_HT_QUOTA, 2); + if (IS_ERR(handle)) + return PTR_ERR(handle); + ret = dquot_commit_info(sb, type); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 533216e80fa2b..36d6ba7190b6d 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -2412,6 +2412,7 @@ retry_inode: + if (!error) { + ext4_xattr_update_super_block(handle, inode->i_sb); + inode->i_ctime = current_time(inode); ++ inode_inc_iversion(inode); + if (!value) + no_expand = 0; + error = ext4_mark_iloc_dirty(handle, inode, &is.iloc); +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 6d8b2bf14de0f..5c77ae07150d3 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -140,7 +140,7 @@ static bool __is_bitmap_valid(struct f2fs_sb_info *sbi, block_t blkaddr, + unsigned int segno, offset; + bool exist; + +- if (type != DATA_GENERIC_ENHANCE && type != DATA_GENERIC_ENHANCE_READ) ++ if (type == DATA_GENERIC) + return true; + + segno = GET_SEGNO(sbi, blkaddr); +@@ -148,6 +148,13 @@ static bool __is_bitmap_valid(struct f2fs_sb_info *sbi, block_t blkaddr, + se = get_seg_entry(sbi, segno); + + exist = f2fs_test_bit(offset, se->cur_valid_map); ++ if (exist && type == DATA_GENERIC_ENHANCE_UPDATE) { ++ f2fs_err(sbi, "Inconsistent error blkaddr:%u, sit bitmap:%d", ++ blkaddr, exist); ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ return exist; ++ } ++ + if (!exist && type == DATA_GENERIC_ENHANCE) { + f2fs_err(sbi, "Inconsistent error blkaddr:%u, sit bitmap:%d", + blkaddr, exist); +@@ -185,6 +192,7 @@ bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi, + case DATA_GENERIC: + case DATA_GENERIC_ENHANCE: + case DATA_GENERIC_ENHANCE_READ: ++ case DATA_GENERIC_ENHANCE_UPDATE: + if (unlikely(blkaddr >= MAX_BLKADDR(sbi) || + blkaddr < MAIN_BLKADDR(sbi))) { + f2fs_warn(sbi, "access invalid blkaddr:%u", +@@ -1055,7 +1063,8 @@ void f2fs_remove_dirty_inode(struct inode *inode) + spin_unlock(&sbi->inode_lock[type]); + } + +-int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type) ++int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type, ++ bool from_cp) + { + struct list_head *head; + struct inode *inode; +@@ -1090,11 +1099,15 @@ retry: + if (inode) { + unsigned long cur_ino = inode->i_ino; + +- F2FS_I(inode)->cp_task = current; ++ if (from_cp) ++ F2FS_I(inode)->cp_task = current; ++ F2FS_I(inode)->wb_task = current; + + filemap_fdatawrite(inode->i_mapping); + +- F2FS_I(inode)->cp_task = NULL; ++ F2FS_I(inode)->wb_task = NULL; ++ if (from_cp) ++ F2FS_I(inode)->cp_task = NULL; + + iput(inode); + /* We need to give cpu to another writers. */ +@@ -1223,7 +1236,7 @@ retry_flush_dents: + /* write all the dirty dentry pages */ + if (get_pages(sbi, F2FS_DIRTY_DENTS)) { + f2fs_unlock_all(sbi); +- err = f2fs_sync_dirty_inodes(sbi, DIR_INODE); ++ err = f2fs_sync_dirty_inodes(sbi, DIR_INODE, true); + if (err) + return err; + cond_resched(); +@@ -1894,15 +1907,27 @@ int f2fs_start_ckpt_thread(struct f2fs_sb_info *sbi) + void f2fs_stop_ckpt_thread(struct f2fs_sb_info *sbi) + { + struct ckpt_req_control *cprc = &sbi->cprc_info; ++ struct task_struct *ckpt_task; + +- if (cprc->f2fs_issue_ckpt) { +- struct task_struct *ckpt_task = cprc->f2fs_issue_ckpt; ++ if (!cprc->f2fs_issue_ckpt) ++ return; + +- cprc->f2fs_issue_ckpt = NULL; +- kthread_stop(ckpt_task); ++ ckpt_task = cprc->f2fs_issue_ckpt; ++ cprc->f2fs_issue_ckpt = NULL; ++ kthread_stop(ckpt_task); + +- flush_remained_ckpt_reqs(sbi, NULL); +- } ++ f2fs_flush_ckpt_thread(sbi); ++} ++ ++void f2fs_flush_ckpt_thread(struct f2fs_sb_info *sbi) ++{ ++ struct ckpt_req_control *cprc = &sbi->cprc_info; ++ ++ flush_remained_ckpt_reqs(sbi, NULL); ++ ++ /* Let's wait for the previous dispatched checkpoint. */ ++ while (atomic_read(&cprc->queued_ckpt)) ++ io_schedule_timeout(DEFAULT_IO_TIMEOUT); + } + + void f2fs_init_ckpt_req_control(struct f2fs_sb_info *sbi) +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index f2a2726134779..d3768115e3b8d 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2843,7 +2843,7 @@ out: + } + unlock_page(page); + if (!S_ISDIR(inode->i_mode) && !IS_NOQUOTA(inode) && +- !F2FS_I(inode)->cp_task && allow_balance) ++ !F2FS_I(inode)->wb_task && allow_balance) + f2fs_balance_fs(sbi, need_balance_fs); + + if (unlikely(f2fs_cp_error(sbi))) { +@@ -3141,7 +3141,7 @@ static inline bool __should_serialize_io(struct inode *inode, + struct writeback_control *wbc) + { + /* to avoid deadlock in path of data flush */ +- if (F2FS_I(inode)->cp_task) ++ if (F2FS_I(inode)->wb_task) + return false; + + if (!S_ISREG(inode->i_mode)) +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c +index 866e72b29bd5a..761fd42c93f23 100644 +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -804,9 +804,8 @@ void f2fs_drop_extent_tree(struct inode *inode) + if (!f2fs_may_extent_tree(inode)) + return; + +- set_inode_flag(inode, FI_NO_EXTENT); +- + write_lock(&et->lock); ++ set_inode_flag(inode, FI_NO_EXTENT); + __free_extent_tree(sbi, et); + if (et->largest.len) { + et->largest.len = 0; +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 7006fa7dd5cb8..7896cbadbcd75 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -266,6 +266,10 @@ enum { + * condition of read on truncated area + * by extent_cache + */ ++ DATA_GENERIC_ENHANCE_UPDATE, /* ++ * strong check on range and segment ++ * bitmap for update case ++ */ + META_GENERIC, + }; + +@@ -780,6 +784,7 @@ struct f2fs_inode_info { + unsigned int clevel; /* maximum level of given file name */ + struct task_struct *task; /* lookup and create consistency */ + struct task_struct *cp_task; /* separate cp/wb IO stats*/ ++ struct task_struct *wb_task; /* indicate inode is in context of writeback */ + nid_t i_xattr_nid; /* node id that contains xattrs */ + loff_t last_disk_size; /* lastly written file size */ + spinlock_t i_size_lock; /* protect last_disk_size */ +@@ -3676,6 +3681,7 @@ static inline bool f2fs_need_rand_seg(struct f2fs_sb_info *sbi) + * checkpoint.c + */ + void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io); ++void f2fs_flush_ckpt_thread(struct f2fs_sb_info *sbi); + struct page *f2fs_grab_meta_page(struct f2fs_sb_info *sbi, pgoff_t index); + struct page *f2fs_get_meta_page(struct f2fs_sb_info *sbi, pgoff_t index); + struct page *f2fs_get_meta_page_retry(struct f2fs_sb_info *sbi, pgoff_t index); +@@ -3705,7 +3711,8 @@ int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi); + int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi); + void f2fs_update_dirty_folio(struct inode *inode, struct folio *folio); + void f2fs_remove_dirty_inode(struct inode *inode); +-int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type); ++int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type, ++ bool from_cp); + void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type); + u64 f2fs_get_sectors_written(struct f2fs_sb_info *sbi); + int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc); +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index d5fb426e07474..e88ed284e05c0 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -97,14 +97,10 @@ static int gc_thread_func(void *data) + */ + if (sbi->gc_mode == GC_URGENT_HIGH) { + spin_lock(&sbi->gc_urgent_high_lock); +- if (sbi->gc_urgent_high_limited) { +- if (!sbi->gc_urgent_high_remaining) { +- sbi->gc_urgent_high_limited = false; +- spin_unlock(&sbi->gc_urgent_high_lock); +- sbi->gc_mode = GC_NORMAL; +- continue; +- } +- sbi->gc_urgent_high_remaining--; ++ if (sbi->gc_urgent_high_limited && ++ !sbi->gc_urgent_high_remaining--) { ++ sbi->gc_urgent_high_limited = false; ++ sbi->gc_mode = GC_NORMAL; + } + spin_unlock(&sbi->gc_urgent_high_lock); + } +@@ -1079,7 +1075,7 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + { + struct page *node_page; + nid_t nid; +- unsigned int ofs_in_node; ++ unsigned int ofs_in_node, max_addrs; + block_t source_blkaddr; + + nid = le32_to_cpu(sum->nid); +@@ -1105,6 +1101,14 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + return false; + } + ++ max_addrs = IS_INODE(node_page) ? DEF_ADDRS_PER_INODE : ++ DEF_ADDRS_PER_BLOCK; ++ if (ofs_in_node >= max_addrs) { ++ f2fs_err(sbi, "Inconsistent ofs_in_node:%u in summary, ino:%u, nid:%u, max:%u", ++ ofs_in_node, dni->ino, dni->nid, max_addrs); ++ return false; ++ } ++ + *nofs = ofs_of_node(node_page); + source_blkaddr = data_blkaddr(NULL, node_page, ofs_in_node); + f2fs_put_page(node_page, 1); +diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c +index 3cb7f8a43b4d7..4907bb084fd66 100644 +--- a/fs/f2fs/recovery.c ++++ b/fs/f2fs/recovery.c +@@ -474,7 +474,7 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi, + struct dnode_of_data tdn = *dn; + nid_t ino, nid; + struct inode *inode; +- unsigned int offset; ++ unsigned int offset, ofs_in_node, max_addrs; + block_t bidx; + int i; + +@@ -501,15 +501,24 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi, + got_it: + /* Use the locked dnode page and inode */ + nid = le32_to_cpu(sum.nid); ++ ofs_in_node = le16_to_cpu(sum.ofs_in_node); ++ ++ max_addrs = ADDRS_PER_PAGE(dn->node_page, dn->inode); ++ if (ofs_in_node >= max_addrs) { ++ f2fs_err(sbi, "Inconsistent ofs_in_node:%u in summary, ino:%lu, nid:%u, max:%u", ++ ofs_in_node, dn->inode->i_ino, nid, max_addrs); ++ return -EFSCORRUPTED; ++ } ++ + if (dn->inode->i_ino == nid) { + tdn.nid = nid; + if (!dn->inode_page_locked) + lock_page(dn->inode_page); + tdn.node_page = dn->inode_page; +- tdn.ofs_in_node = le16_to_cpu(sum.ofs_in_node); ++ tdn.ofs_in_node = ofs_in_node; + goto truncate_out; + } else if (dn->nid == nid) { +- tdn.ofs_in_node = le16_to_cpu(sum.ofs_in_node); ++ tdn.ofs_in_node = ofs_in_node; + goto truncate_out; + } + +@@ -698,6 +707,14 @@ retry_prev: + goto err; + } + ++ if (f2fs_is_valid_blkaddr(sbi, dest, ++ DATA_GENERIC_ENHANCE_UPDATE)) { ++ f2fs_err(sbi, "Inconsistent dest blkaddr:%u, ino:%lu, ofs:%u", ++ dest, inode->i_ino, dn.ofs_in_node); ++ err = -EFSCORRUPTED; ++ goto err; ++ } ++ + /* write dummy data page */ + f2fs_replace_block(sbi, &dn, src, dest, + ni.version, false, false); +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 52df19a0638b1..b740ff81024e4 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -469,7 +469,7 @@ do_sync: + mutex_lock(&sbi->flush_lock); + + blk_start_plug(&plug); +- f2fs_sync_dirty_inodes(sbi, FILE_INODE); ++ f2fs_sync_dirty_inodes(sbi, FILE_INODE, false); + blk_finish_plug(&plug); + + mutex_unlock(&sbi->flush_lock); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 37221e94e5eff..77e190a52565c 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -298,10 +298,10 @@ static void f2fs_destroy_casefold_cache(void) { } + + static inline void limit_reserve_root(struct f2fs_sb_info *sbi) + { +- block_t limit = min((sbi->user_block_count << 1) / 1000, ++ block_t limit = min((sbi->user_block_count >> 3), + sbi->user_block_count - sbi->reserved_blocks); + +- /* limit is 0.2% */ ++ /* limit is 12.5% */ + if (test_opt(sbi, RESERVE_ROOT) && + F2FS_OPTION(sbi).root_reserved_blocks > limit) { + F2FS_OPTION(sbi).root_reserved_blocks = limit; +@@ -1637,9 +1637,8 @@ static int f2fs_freeze(struct super_block *sb) + if (is_sbi_flag_set(F2FS_SB(sb), SBI_IS_DIRTY)) + return -EINVAL; + +- /* ensure no checkpoint required */ +- if (!llist_empty(&F2FS_SB(sb)->cprc_info.issue_list)) +- return -EINVAL; ++ /* Let's flush checkpoints and stop the thread. */ ++ f2fs_flush_ckpt_thread(F2FS_SB(sb)); + + /* to avoid deadlock on f2fs_evict_inode->SB_FREEZE_FS */ + set_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING); +@@ -2146,6 +2145,9 @@ static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi) + f2fs_up_write(&sbi->gc_lock); + + f2fs_sync_fs(sbi->sb, 1); ++ ++ /* Let's ensure there's no pending checkpoint anymore */ ++ f2fs_flush_ckpt_thread(sbi); + } + + static int f2fs_remount(struct super_block *sb, int *flags, char *data) +@@ -2311,6 +2313,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data) + f2fs_stop_ckpt_thread(sbi); + need_restart_ckpt = true; + } else { ++ /* Flush if the prevous checkpoint, if exists. */ ++ f2fs_flush_ckpt_thread(sbi); ++ + err = f2fs_start_ckpt_thread(sbi); + if (err) { + f2fs_err(sbi, +diff --git a/fs/file_table.c b/fs/file_table.c +index 5424e3a8df5fa..543a501b02470 100644 +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -321,12 +321,7 @@ static void __fput(struct file *file) + } + fops_put(file->f_op); + put_pid(file->f_owner.pid); +- if ((mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) +- i_readcount_dec(inode); +- if (mode & FMODE_WRITER) { +- put_write_access(inode); +- __mnt_drop_write(mnt); +- } ++ put_file_access(file); + dput(dentry); + if (unlikely(mode & FMODE_NEED_UNMOUNT)) + dissolve_on_fput(mnt); +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 08a1993ab7fd3..443f83382b9bd 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -1718,9 +1718,14 @@ static int writeback_single_inode(struct inode *inode, + */ + if (!(inode->i_state & I_DIRTY_ALL)) + inode_cgwb_move_to_attached(inode, wb); +- else if (!(inode->i_state & I_SYNC_QUEUED) && +- (inode->i_state & I_DIRTY)) +- redirty_tail_locked(inode, wb); ++ else if (!(inode->i_state & I_SYNC_QUEUED)) { ++ if ((inode->i_state & I_DIRTY)) ++ redirty_tail_locked(inode, wb); ++ else if (inode->i_state & I_DIRTY_TIME) { ++ inode->dirtied_when = jiffies; ++ inode_io_list_move_locked(inode, wb, &wb->b_dirty_time); ++ } ++ } + + spin_unlock(&wb->list_lock); + inode_sync_complete(inode); +@@ -2369,6 +2374,20 @@ void __mark_inode_dirty(struct inode *inode, int flags) + trace_writeback_mark_inode_dirty(inode, flags); + + if (flags & I_DIRTY_INODE) { ++ /* ++ * Inode timestamp update will piggback on this dirtying. ++ * We tell ->dirty_inode callback that timestamps need to ++ * be updated by setting I_DIRTY_TIME in flags. ++ */ ++ if (inode->i_state & I_DIRTY_TIME) { ++ spin_lock(&inode->i_lock); ++ if (inode->i_state & I_DIRTY_TIME) { ++ inode->i_state &= ~I_DIRTY_TIME; ++ flags |= I_DIRTY_TIME; ++ } ++ spin_unlock(&inode->i_lock); ++ } ++ + /* + * Notify the filesystem about the inode being dirtied, so that + * (if needed) it can update on-disk fields and journal the +@@ -2378,7 +2397,8 @@ void __mark_inode_dirty(struct inode *inode, int flags) + */ + trace_writeback_dirty_inode_start(inode, flags); + if (sb->s_op->dirty_inode) +- sb->s_op->dirty_inode(inode, flags & I_DIRTY_INODE); ++ sb->s_op->dirty_inode(inode, ++ flags & (I_DIRTY_INODE | I_DIRTY_TIME)); + trace_writeback_dirty_inode(inode, flags); + + /* I_DIRTY_INODE supersedes I_DIRTY_TIME. */ +@@ -2399,21 +2419,15 @@ void __mark_inode_dirty(struct inode *inode, int flags) + */ + smp_mb(); + +- if (((inode->i_state & flags) == flags) || +- (dirtytime && (inode->i_state & I_DIRTY_INODE))) ++ if ((inode->i_state & flags) == flags) + return; + + spin_lock(&inode->i_lock); +- if (dirtytime && (inode->i_state & I_DIRTY_INODE)) +- goto out_unlock_inode; + if ((inode->i_state & flags) != flags) { + const int was_dirty = inode->i_state & I_DIRTY; + + inode_attach_wb(inode, NULL); + +- /* I_DIRTY_INODE supersedes I_DIRTY_TIME. */ +- if (flags & I_DIRTY_INODE) +- inode->i_state &= ~I_DIRTY_TIME; + inode->i_state |= flags; + + /* +@@ -2486,7 +2500,6 @@ void __mark_inode_dirty(struct inode *inode, int flags) + out_unlock: + if (wb) + spin_unlock(&wb->list_lock); +-out_unlock_inode: + spin_unlock(&inode->i_lock); + } + EXPORT_SYMBOL(__mark_inode_dirty); +diff --git a/fs/internal.h b/fs/internal.h +index 3e206d3e317c4..4372d67a37533 100644 +--- a/fs/internal.h ++++ b/fs/internal.h +@@ -102,6 +102,16 @@ extern void chroot_fs_refs(const struct path *, const struct path *); + extern struct file *alloc_empty_file(int, const struct cred *); + extern struct file *alloc_empty_file_noaccount(int, const struct cred *); + ++static inline void put_file_access(struct file *file) ++{ ++ if ((file->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { ++ i_readcount_dec(file->f_inode); ++ } else if (file->f_mode & FMODE_WRITER) { ++ put_write_access(file->f_inode); ++ __mnt_drop_write(file->f_path.mnt); ++ } ++} ++ + /* + * super.c + */ +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index d2a9f699e17ed..f2f102dd5e6b3 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -1412,7 +1412,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, + if (!count) + folio_end_writeback(folio); + done: +- mapping_set_error(folio->mapping, error); ++ mapping_set_error(inode->i_mapping, error); + return error; + } + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index af1a9191368cb..56057682402be 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -570,7 +570,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + journal->j_running_transaction = NULL; + start_time = ktime_get(); + commit_transaction->t_log_start = journal->j_head; +- wake_up(&journal->j_wait_transaction_locked); ++ wake_up_all(&journal->j_wait_transaction_locked); + write_unlock(&journal->j_state_lock); + + jbd_debug(3, "JBD2: commit phase 2a\n"); +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index c0cbeeaec2d1a..e4c1994f01ad6 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -926,10 +926,16 @@ int jbd2_fc_wait_bufs(journal_t *journal, int num_blks) + for (i = j_fc_off - 1; i >= j_fc_off - num_blks; i--) { + bh = journal->j_fc_wbuf[i]; + wait_on_buffer(bh); ++ /* ++ * Update j_fc_off so jbd2_fc_release_bufs can release remain ++ * buffer head. ++ */ ++ if (unlikely(!buffer_uptodate(bh))) { ++ journal->j_fc_off = i + 1; ++ return -EIO; ++ } + put_bh(bh); + journal->j_fc_wbuf[i] = NULL; +- if (unlikely(!buffer_uptodate(bh))) +- return -EIO; + } + + return 0; +diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c +index 8ca3527189f87..3c5dd010e39d2 100644 +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -256,6 +256,7 @@ static int fc_do_one_pass(journal_t *journal, + err = journal->j_fc_replay_callback(journal, bh, pass, + next_fc_block - journal->j_fc_first, + expected_commit_id); ++ brelse(bh); + next_fc_block++; + if (err < 0 || err == JBD2_FC_REPLAY_STOP) + break; +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index e0377f558eb14..f3ab28cf4a65d 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -168,7 +168,7 @@ static void wait_transaction_locked(journal_t *journal) + int need_to_start; + tid_t tid = journal->j_running_transaction->t_tid; + +- prepare_to_wait(&journal->j_wait_transaction_locked, &wait, ++ prepare_to_wait_exclusive(&journal->j_wait_transaction_locked, &wait, + TASK_UNINTERRUPTIBLE); + need_to_start = !tid_geq(journal->j_commit_request, tid); + read_unlock(&journal->j_state_lock); +@@ -194,7 +194,7 @@ static void wait_transaction_switching(journal_t *journal) + read_unlock(&journal->j_state_lock); + return; + } +- prepare_to_wait(&journal->j_wait_transaction_locked, &wait, ++ prepare_to_wait_exclusive(&journal->j_wait_transaction_locked, &wait, + TASK_UNINTERRUPTIBLE); + read_unlock(&journal->j_state_lock); + /* +@@ -920,7 +920,7 @@ void jbd2_journal_unlock_updates (journal_t *journal) + write_lock(&journal->j_state_lock); + --journal->j_barrier_count; + write_unlock(&journal->j_state_lock); +- wake_up(&journal->j_wait_transaction_locked); ++ wake_up_all(&journal->j_wait_transaction_locked); + } + + static void warn_dirty_buffer(struct buffer_head *bh) +diff --git a/fs/ksmbd/server.c b/fs/ksmbd/server.c +index 4cd03d661df0b..9996e8dc421b4 100644 +--- a/fs/ksmbd/server.c ++++ b/fs/ksmbd/server.c +@@ -235,10 +235,8 @@ send: + if (work->sess && work->sess->enc && work->encrypted && + conn->ops->encrypt_resp) { + rc = conn->ops->encrypt_resp(work); +- if (rc < 0) { ++ if (rc < 0) + conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); +- goto send; +- } + } + + ksmbd_conn_write(work); +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 35f5ea1c9dfcd..466256bf7ba42 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -3798,11 +3798,6 @@ static int __query_dir(struct dir_context *ctx, const char *name, int namlen, + return 0; + } + +-static void restart_ctx(struct dir_context *ctx) +-{ +- ctx->pos = 0; +-} +- + static int verify_info_level(int info_level) + { + switch (info_level) { +@@ -3911,7 +3906,6 @@ int smb2_query_dir(struct ksmbd_work *work) + if (srch_flag & SMB2_REOPEN || srch_flag & SMB2_RESTART_SCANS) { + ksmbd_debug(SMB, "Restart directory scan\n"); + generic_file_llseek(dir_fp->filp, 0, SEEK_SET); +- restart_ctx(&dir_fp->readdir_data.ctx); + } + + memset(&d_info, 0, sizeof(struct ksmbd_dir_info)); +@@ -3958,11 +3952,9 @@ int smb2_query_dir(struct ksmbd_work *work) + */ + if (!d_info.out_buf_len && !d_info.num_entry) + goto no_buf_len; +- if (rc == 0) +- restart_ctx(&dir_fp->readdir_data.ctx); +- if (rc == -ENOSPC) ++ if (rc > 0 || rc == -ENOSPC) + rc = 0; +- if (rc) ++ else if (rc) + goto err_out; + + d_info.wptr = d_info.rptr; +@@ -4019,6 +4011,8 @@ err_out2: + rsp->hdr.Status = STATUS_NO_MEMORY; + else if (rc == -EFAULT) + rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; ++ else if (rc == -EIO) ++ rsp->hdr.Status = STATUS_FILE_CORRUPT_ERROR; + if (!rsp->hdr.Status) + rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; + +@@ -7633,11 +7627,16 @@ int smb2_ioctl(struct ksmbd_work *work) + goto out; + } + +- if (in_buf_len < sizeof(struct validate_negotiate_info_req)) +- return -EINVAL; ++ if (in_buf_len < offsetof(struct validate_negotiate_info_req, ++ Dialects)) { ++ ret = -EINVAL; ++ goto out; ++ } + +- if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) +- return -EINVAL; ++ if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) { ++ ret = -EINVAL; ++ goto out; ++ } + + ret = fsctl_validate_negotiate_info(conn, + (struct validate_negotiate_info_req *)&req->Buffer[0], +diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c +index 7f8ab14fb8ec1..d96da872d70a1 100644 +--- a/fs/ksmbd/smb_common.c ++++ b/fs/ksmbd/smb_common.c +@@ -4,6 +4,8 @@ + * Copyright (C) 2018 Namjae Jeon <linkinjeon@kernel.org> + */ + ++#include <linux/user_namespace.h> ++ + #include "smb_common.h" + #include "server.h" + #include "misc.h" +@@ -625,8 +627,8 @@ int ksmbd_override_fsids(struct ksmbd_work *work) + if (!cred) + return -ENOMEM; + +- cred->fsuid = make_kuid(current_user_ns(), uid); +- cred->fsgid = make_kgid(current_user_ns(), gid); ++ cred->fsuid = make_kuid(&init_user_ns, uid); ++ cred->fsgid = make_kgid(&init_user_ns, gid); + + gi = groups_alloc(0); + if (!gi) { +diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c +index 981a3a7a6e160..57854ca022d18 100644 +--- a/fs/nfsd/nfs3proc.c ++++ b/fs/nfsd/nfs3proc.c +@@ -147,7 +147,6 @@ nfsd3_proc_read(struct svc_rqst *rqstp) + { + struct nfsd3_readargs *argp = rqstp->rq_argp; + struct nfsd3_readres *resp = rqstp->rq_resp; +- u32 max_blocksize = svc_max_payload(rqstp); + unsigned int len; + int v; + +@@ -156,7 +155,8 @@ nfsd3_proc_read(struct svc_rqst *rqstp) + (unsigned long) argp->count, + (unsigned long long) argp->offset); + +- argp->count = min_t(u32, argp->count, max_blocksize); ++ argp->count = min_t(u32, argp->count, svc_max_payload(rqstp)); ++ argp->count = min_t(u32, argp->count, rqstp->rq_res.buflen); + if (argp->offset > (u64)OFFSET_MAX) + argp->offset = (u64)OFFSET_MAX; + if (argp->offset + argp->count > (u64)OFFSET_MAX) +@@ -550,13 +550,14 @@ static void nfsd3_init_dirlist_pages(struct svc_rqst *rqstp, + { + struct xdr_buf *buf = &resp->dirlist; + struct xdr_stream *xdr = &resp->xdr; +- +- count = clamp(count, (u32)(XDR_UNIT * 2), svc_max_payload(rqstp)); ++ unsigned int sendbuf = min_t(unsigned int, rqstp->rq_res.buflen, ++ svc_max_payload(rqstp)); + + memset(buf, 0, sizeof(*buf)); + + /* Reserve room for the NULL ptr & eof flag (-2 words) */ +- buf->buflen = count - XDR_UNIT * 2; ++ buf->buflen = clamp(count, (u32)(XDR_UNIT * 2), sendbuf); ++ buf->buflen -= XDR_UNIT * 2; + buf->pages = rqstp->rq_next_page; + rqstp->rq_next_page += (buf->buflen + PAGE_SIZE - 1) >> PAGE_SHIFT; + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 3895eb52d2b10..c12e66cc58a27 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -2663,9 +2663,6 @@ nfsd4_proc_compound(struct svc_rqst *rqstp) + status = nfserr_minor_vers_mismatch; + if (nfsd_minorversion(nn, args->minorversion, NFSD_TEST) <= 0) + goto out; +- status = nfserr_resource; +- if (args->opcnt > NFSD_MAX_OPS_PER_COMPOUND) +- goto out; + + status = nfs41_check_op_ordering(args); + if (status) { +@@ -2678,10 +2675,20 @@ nfsd4_proc_compound(struct svc_rqst *rqstp) + + rqstp->rq_lease_breaker = (void **)&cstate->clp; + +- trace_nfsd_compound(rqstp, args->opcnt); ++ trace_nfsd_compound(rqstp, args->client_opcnt); + while (!status && resp->opcnt < args->opcnt) { + op = &args->ops[resp->opcnt++]; + ++ if (unlikely(resp->opcnt == NFSD_MAX_OPS_PER_COMPOUND)) { ++ /* If there are still more operations to process, ++ * stop here and report NFS4ERR_RESOURCE. */ ++ if (cstate->minorversion == 0 && ++ args->client_opcnt > resp->opcnt) { ++ op->status = nfserr_resource; ++ goto encode_op; ++ } ++ } ++ + /* + * The XDR decode routines may have pre-set op->status; + * for example, if there is a miscellaneous XDR error +@@ -2757,8 +2764,8 @@ encode_op: + status = op->status; + } + +- trace_nfsd_compound_status(args->opcnt, resp->opcnt, status, +- nfsd4_op_name(op->opnum)); ++ trace_nfsd_compound_status(args->client_opcnt, resp->opcnt, ++ status, nfsd4_op_name(op->opnum)); + + nfsd4_cstate_clear_replay(cstate); + nfsd4_increment_op_stats(op->opnum); +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index c634483d85d2a..8f24485e0f04f 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -815,8 +815,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, + princhash.data = memdup_user( + &ci->cc_princhash.cp_data, + princhashlen); +- if (IS_ERR_OR_NULL(princhash.data)) ++ if (IS_ERR_OR_NULL(princhash.data)) { ++ kfree(name.data); + return -EFAULT; ++ } + princhash.len = princhashlen; + } else + princhash.len = 0; +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 9409a0dc1b767..c16646f9db31f 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -1049,6 +1049,7 @@ static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp) + + static void nfs4_free_deleg(struct nfs4_stid *stid) + { ++ WARN_ON(!list_empty(&stid->sc_cp_list)); + kmem_cache_free(deleg_slab, stid); + atomic_long_dec(&num_delegations); + } +@@ -1463,6 +1464,7 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) + release_all_access(stp); + if (stp->st_stateowner) + nfs4_put_stateowner(stp->st_stateowner); ++ WARN_ON(!list_empty(&stid->sc_cp_list)); + kmem_cache_free(stateid_slab, stid); + } + +@@ -6608,6 +6610,7 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s) + struct nfs4_client *clp = s->st_stid.sc_client; + bool unhashed; + LIST_HEAD(reaplist); ++ struct nfs4_ol_stateid *stp; + + spin_lock(&clp->cl_lock); + unhashed = unhash_open_stateid(s, &reaplist); +@@ -6616,6 +6619,8 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s) + if (unhashed) + put_ol_stateid_locked(s, &reaplist); + spin_unlock(&clp->cl_lock); ++ list_for_each_entry(stp, &reaplist, st_locks) ++ nfs4_free_cpntf_statelist(clp->net, &stp->st_stid); + free_ol_stateid_reaplist(&reaplist); + } else { + spin_unlock(&clp->cl_lock); +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 2acea7792bb26..1e5822d000430 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2347,16 +2347,10 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) + + if (xdr_stream_decode_u32(argp->xdr, &argp->minorversion) < 0) + return false; +- if (xdr_stream_decode_u32(argp->xdr, &argp->opcnt) < 0) ++ if (xdr_stream_decode_u32(argp->xdr, &argp->client_opcnt) < 0) + return false; +- +- /* +- * NFS4ERR_RESOURCE is a more helpful error than GARBAGE_ARGS +- * here, so we return success at the xdr level so that +- * nfsd4_proc can handle this is an NFS-level error. +- */ +- if (argp->opcnt > NFSD_MAX_OPS_PER_COMPOUND) +- return true; ++ argp->opcnt = min_t(u32, argp->client_opcnt, ++ NFSD_MAX_OPS_PER_COMPOUND); + + if (argp->opcnt > ARRAY_SIZE(argp->iops)) { + argp->ops = kzalloc(argp->opcnt * sizeof(*argp->ops), GFP_KERNEL); +@@ -4001,7 +3995,7 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr, + if (resp->xdr->buf->page_len && + test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags)) { + WARN_ON_ONCE(1); +- return nfserr_resource; ++ return nfserr_serverfault; + } + xdr_commit_encode(xdr); + +diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c +index fcdab8a8a41f4..f65eba938a57d 100644 +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -182,6 +182,7 @@ nfsd_proc_read(struct svc_rqst *rqstp) + argp->count, argp->offset); + + argp->count = min_t(u32, argp->count, NFSSVC_MAXBLKSIZE_V2); ++ argp->count = min_t(u32, argp->count, rqstp->rq_res.buflen); + + v = 0; + len = argp->count; +@@ -556,12 +557,11 @@ static void nfsd_init_dirlist_pages(struct svc_rqst *rqstp, + struct xdr_buf *buf = &resp->dirlist; + struct xdr_stream *xdr = &resp->xdr; + +- count = clamp(count, (u32)(XDR_UNIT * 2), svc_max_payload(rqstp)); +- + memset(buf, 0, sizeof(*buf)); + + /* Reserve room for the NULL ptr & eof flag (-2 words) */ +- buf->buflen = count - XDR_UNIT * 2; ++ buf->buflen = clamp(count, (u32)(XDR_UNIT * 2), (u32)PAGE_SIZE); ++ buf->buflen -= XDR_UNIT * 2; + buf->pages = rqstp->rq_next_page; + rqstp->rq_next_page++; + +diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h +index 7b744011f2d3d..77286e8c9ab02 100644 +--- a/fs/nfsd/xdr4.h ++++ b/fs/nfsd/xdr4.h +@@ -689,9 +689,10 @@ struct nfsd4_compoundargs { + struct svcxdr_tmpbuf *to_free; + struct svc_rqst *rqstp; + +- u32 taglen; + char * tag; ++ u32 taglen; + u32 minorversion; ++ u32 client_opcnt; + u32 opcnt; + struct nfsd4_op *ops; + struct nfsd4_op iops[8]; +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 803ff4c63c318..3b94ad22d9c0b 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1941,8 +1941,6 @@ const struct inode_operations ntfs_link_inode_operations = { + .setattr = ntfs3_setattr, + .listxattr = ntfs_listxattr, + .permission = ntfs_permission, +- .get_acl = ntfs_get_acl, +- .set_acl = ntfs_set_acl, + }; + + const struct address_space_operations ntfs_aops = { +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index e3d443ccb9be6..19ce48726b007 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -625,67 +625,6 @@ int ntfs_set_acl(struct user_namespace *mnt_userns, struct inode *inode, + return ntfs_set_acl_ex(mnt_userns, inode, acl, type, false); + } + +-static int ntfs_xattr_get_acl(struct user_namespace *mnt_userns, +- struct inode *inode, int type, void *buffer, +- size_t size) +-{ +- struct posix_acl *acl; +- int err; +- +- if (!(inode->i_sb->s_flags & SB_POSIXACL)) { +- ntfs_inode_warn(inode, "add mount option \"acl\" to use acl"); +- return -EOPNOTSUPP; +- } +- +- acl = ntfs_get_acl(inode, type, false); +- if (IS_ERR(acl)) +- return PTR_ERR(acl); +- +- if (!acl) +- return -ENODATA; +- +- err = posix_acl_to_xattr(&init_user_ns, acl, buffer, size); +- posix_acl_release(acl); +- +- return err; +-} +- +-static int ntfs_xattr_set_acl(struct user_namespace *mnt_userns, +- struct inode *inode, int type, const void *value, +- size_t size) +-{ +- struct posix_acl *acl; +- int err; +- +- if (!(inode->i_sb->s_flags & SB_POSIXACL)) { +- ntfs_inode_warn(inode, "add mount option \"acl\" to use acl"); +- return -EOPNOTSUPP; +- } +- +- if (!inode_owner_or_capable(mnt_userns, inode)) +- return -EPERM; +- +- if (!value) { +- acl = NULL; +- } else { +- acl = posix_acl_from_xattr(&init_user_ns, value, size); +- if (IS_ERR(acl)) +- return PTR_ERR(acl); +- +- if (acl) { +- err = posix_acl_valid(&init_user_ns, acl); +- if (err) +- goto release_and_out; +- } +- } +- +- err = ntfs_set_acl(mnt_userns, inode, acl, type); +- +-release_and_out: +- posix_acl_release(acl); +- return err; +-} +- + /* + * ntfs_init_acl - Initialize the ACLs of a new inode. + * +@@ -852,23 +791,6 @@ static int ntfs_getxattr(const struct xattr_handler *handler, struct dentry *de, + goto out; + } + +-#ifdef CONFIG_NTFS3_FS_POSIX_ACL +- if ((name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 && +- !memcmp(name, XATTR_NAME_POSIX_ACL_ACCESS, +- sizeof(XATTR_NAME_POSIX_ACL_ACCESS))) || +- (name_len == sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1 && +- !memcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT, +- sizeof(XATTR_NAME_POSIX_ACL_DEFAULT)))) { +- /* TODO: init_user_ns? */ +- err = ntfs_xattr_get_acl( +- &init_user_ns, inode, +- name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 +- ? ACL_TYPE_ACCESS +- : ACL_TYPE_DEFAULT, +- buffer, size); +- goto out; +- } +-#endif + /* Deal with NTFS extended attribute. */ + err = ntfs_get_ea(inode, name, name_len, buffer, size, NULL); + +@@ -981,22 +903,6 @@ set_new_fa: + goto out; + } + +-#ifdef CONFIG_NTFS3_FS_POSIX_ACL +- if ((name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 && +- !memcmp(name, XATTR_NAME_POSIX_ACL_ACCESS, +- sizeof(XATTR_NAME_POSIX_ACL_ACCESS))) || +- (name_len == sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1 && +- !memcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT, +- sizeof(XATTR_NAME_POSIX_ACL_DEFAULT)))) { +- err = ntfs_xattr_set_acl( +- mnt_userns, inode, +- name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 +- ? ACL_TYPE_ACCESS +- : ACL_TYPE_DEFAULT, +- value, size); +- goto out; +- } +-#endif + /* Deal with NTFS extended attribute. */ + err = ntfs_set_ea(inode, name, name_len, value, size, flags, 0); + +@@ -1086,7 +992,7 @@ static bool ntfs_xattr_user_list(struct dentry *dentry) + } + + // clang-format off +-static const struct xattr_handler ntfs_xattr_handler = { ++static const struct xattr_handler ntfs_other_xattr_handler = { + .prefix = "", + .get = ntfs_getxattr, + .set = ntfs_setxattr, +@@ -1094,7 +1000,11 @@ static const struct xattr_handler ntfs_xattr_handler = { + }; + + const struct xattr_handler *ntfs_xattr_handlers[] = { +- &ntfs_xattr_handler, ++#ifdef CONFIG_NTFS3_FS_POSIX_ACL ++ &posix_acl_access_xattr_handler, ++ &posix_acl_default_xattr_handler, ++#endif ++ &ntfs_other_xattr_handler, + NULL, + }; + // clang-format on +diff --git a/fs/open.c b/fs/open.c +index 1d57fbde2feb1..5874258b54bd8 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -810,7 +810,9 @@ static int do_dentry_open(struct file *f, + return 0; + } + +- if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { ++ if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { ++ i_readcount_inc(inode); ++ } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { + error = get_write_access(inode); + if (unlikely(error)) + goto cleanup_file; +@@ -850,8 +852,6 @@ static int do_dentry_open(struct file *f, + goto cleanup_all; + } + f->f_mode |= FMODE_OPENED; +- if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) +- i_readcount_inc(inode); + if ((f->f_mode & FMODE_READ) && + likely(f->f_op->read || f->f_op->read_iter)) + f->f_mode |= FMODE_CAN_READ; +@@ -902,10 +902,7 @@ cleanup_all: + if (WARN_ON_ONCE(error > 0)) + error = -EINVAL; + fops_put(f->f_op); +- if (f->f_mode & FMODE_WRITER) { +- put_write_access(inode); +- __mnt_drop_write(f->f_path.mnt); +- } ++ put_file_access(f); + cleanup_file: + path_put(&f->f_path); + f->f_path.mnt = NULL; +diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c +index 5f2405994280a..7e65d67de9f33 100644 +--- a/fs/quota/quota_tree.c ++++ b/fs/quota/quota_tree.c +@@ -71,6 +71,35 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) + return ret; + } + ++static inline int do_check_range(struct super_block *sb, const char *val_name, ++ uint val, uint min_val, uint max_val) ++{ ++ if (val < min_val || val > max_val) { ++ quota_error(sb, "Getting %s %u out of range %u-%u", ++ val_name, val, min_val, max_val); ++ return -EUCLEAN; ++ } ++ ++ return 0; ++} ++ ++static int check_dquot_block_header(struct qtree_mem_dqinfo *info, ++ struct qt_disk_dqdbheader *dh) ++{ ++ int err = 0; ++ ++ err = do_check_range(info->dqi_sb, "dqdh_next_free", ++ le32_to_cpu(dh->dqdh_next_free), 0, ++ info->dqi_blocks - 1); ++ if (err) ++ return err; ++ err = do_check_range(info->dqi_sb, "dqdh_prev_free", ++ le32_to_cpu(dh->dqdh_prev_free), 0, ++ info->dqi_blocks - 1); ++ ++ return err; ++} ++ + /* Remove empty block from list and return it */ + static int get_free_dqblk(struct qtree_mem_dqinfo *info) + { +@@ -85,6 +114,9 @@ static int get_free_dqblk(struct qtree_mem_dqinfo *info) + ret = read_blk(info, blk, buf); + if (ret < 0) + goto out_buf; ++ ret = check_dquot_block_header(info, dh); ++ if (ret) ++ goto out_buf; + info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free); + } + else { +@@ -232,6 +264,9 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, + *err = read_blk(info, blk, buf); + if (*err < 0) + goto out_buf; ++ *err = check_dquot_block_header(info, dh); ++ if (*err) ++ goto out_buf; + } else { + blk = get_free_dqblk(info); + if ((int)blk < 0) { +@@ -424,6 +459,9 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, + goto out_buf; + } + dh = (struct qt_disk_dqdbheader *)buf; ++ ret = check_dquot_block_header(info, dh); ++ if (ret) ++ goto out_buf; + le16_add_cpu(&dh->dqdh_entries, -1); + if (!le16_to_cpu(dh->dqdh_entries)) { /* Block got free? */ + ret = remove_free_dqentry(info, buf, blk); +diff --git a/fs/splice.c b/fs/splice.c +index 93a2c9bf62494..047b79db8eb52 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -814,15 +814,17 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + { + struct pipe_inode_info *pipe; + long ret, bytes; ++ umode_t i_mode; + size_t len; + int i, flags, more; + + /* +- * We require the input to be seekable, as we don't want to randomly +- * drop data for eg socket -> socket splicing. Use the piped splicing +- * for that! ++ * We require the input being a regular file, as we don't want to ++ * randomly drop data for eg socket -> socket splicing. Use the ++ * piped splicing for that! + */ +- if (unlikely(!(in->f_mode & FMODE_LSEEK))) ++ i_mode = file_inode(in)->i_mode; ++ if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode))) + return -EINVAL; + + /* +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index ab0576d372d6e..fa0a2fa5debbd 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -991,7 +991,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *new, + int fd; + + fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, new, +- O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode); ++ O_RDONLY | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode); + if (fd < 0) + return fd; + +@@ -2096,7 +2096,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) + mmgrab(ctx->mm); + + fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, ctx, +- O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL); ++ O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL); + if (fd < 0) { + mmdrop(ctx->mm); + kmem_cache_free(userfaultfd_ctx_cachep, ctx); +diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c +index aa977c7ea370b..a845e3b237a66 100644 +--- a/fs/xfs/xfs_super.c ++++ b/fs/xfs/xfs_super.c +@@ -650,7 +650,7 @@ xfs_fs_destroy_inode( + static void + xfs_fs_dirty_inode( + struct inode *inode, +- int flag) ++ int flags) + { + struct xfs_inode *ip = XFS_I(inode); + struct xfs_mount *mp = ip->i_mount; +@@ -658,7 +658,13 @@ xfs_fs_dirty_inode( + + if (!(inode->i_sb->s_flags & SB_LAZYTIME)) + return; +- if (flag != I_DIRTY_SYNC || !(inode->i_state & I_DIRTY_TIME)) ++ ++ /* ++ * Only do the timestamp update if the inode is dirty (I_DIRTY_SYNC) ++ * and has dirty timestamp (I_DIRTY_TIME). I_DIRTY_TIME can be passed ++ * in flags possibly together with I_DIRTY_SYNC. ++ */ ++ if ((flags & ~I_DIRTY_TIME) != I_DIRTY_SYNC || !(flags & I_DIRTY_TIME)) + return; + + if (xfs_trans_alloc(mp, &M_RES(mp)->tr_fsyncts, 0, 0, 0, &tp)) +diff --git a/include/dt-bindings/clock/samsung,exynosautov9.h b/include/dt-bindings/clock/samsung,exynosautov9.h +index ea9f91b4eb1a3..a7db6516593fe 100644 +--- a/include/dt-bindings/clock/samsung,exynosautov9.h ++++ b/include/dt-bindings/clock/samsung,exynosautov9.h +@@ -226,21 +226,21 @@ + #define CLK_GOUT_PERIC0_IPCLK_8 28 + #define CLK_GOUT_PERIC0_IPCLK_9 29 + #define CLK_GOUT_PERIC0_IPCLK_10 30 +-#define CLK_GOUT_PERIC0_IPCLK_11 30 +-#define CLK_GOUT_PERIC0_PCLK_0 31 +-#define CLK_GOUT_PERIC0_PCLK_1 32 +-#define CLK_GOUT_PERIC0_PCLK_2 33 +-#define CLK_GOUT_PERIC0_PCLK_3 34 +-#define CLK_GOUT_PERIC0_PCLK_4 35 +-#define CLK_GOUT_PERIC0_PCLK_5 36 +-#define CLK_GOUT_PERIC0_PCLK_6 37 +-#define CLK_GOUT_PERIC0_PCLK_7 38 +-#define CLK_GOUT_PERIC0_PCLK_8 39 +-#define CLK_GOUT_PERIC0_PCLK_9 40 +-#define CLK_GOUT_PERIC0_PCLK_10 41 +-#define CLK_GOUT_PERIC0_PCLK_11 42 ++#define CLK_GOUT_PERIC0_IPCLK_11 31 ++#define CLK_GOUT_PERIC0_PCLK_0 32 ++#define CLK_GOUT_PERIC0_PCLK_1 33 ++#define CLK_GOUT_PERIC0_PCLK_2 34 ++#define CLK_GOUT_PERIC0_PCLK_3 35 ++#define CLK_GOUT_PERIC0_PCLK_4 36 ++#define CLK_GOUT_PERIC0_PCLK_5 37 ++#define CLK_GOUT_PERIC0_PCLK_6 38 ++#define CLK_GOUT_PERIC0_PCLK_7 39 ++#define CLK_GOUT_PERIC0_PCLK_8 40 ++#define CLK_GOUT_PERIC0_PCLK_9 41 ++#define CLK_GOUT_PERIC0_PCLK_10 42 ++#define CLK_GOUT_PERIC0_PCLK_11 43 + +-#define PERIC0_NR_CLK 43 ++#define PERIC0_NR_CLK 44 + + /* CMU_PERIC1 */ + #define CLK_MOUT_PERIC1_BUS_USER 1 +@@ -272,21 +272,21 @@ + #define CLK_GOUT_PERIC1_IPCLK_8 28 + #define CLK_GOUT_PERIC1_IPCLK_9 29 + #define CLK_GOUT_PERIC1_IPCLK_10 30 +-#define CLK_GOUT_PERIC1_IPCLK_11 30 +-#define CLK_GOUT_PERIC1_PCLK_0 31 +-#define CLK_GOUT_PERIC1_PCLK_1 32 +-#define CLK_GOUT_PERIC1_PCLK_2 33 +-#define CLK_GOUT_PERIC1_PCLK_3 34 +-#define CLK_GOUT_PERIC1_PCLK_4 35 +-#define CLK_GOUT_PERIC1_PCLK_5 36 +-#define CLK_GOUT_PERIC1_PCLK_6 37 +-#define CLK_GOUT_PERIC1_PCLK_7 38 +-#define CLK_GOUT_PERIC1_PCLK_8 39 +-#define CLK_GOUT_PERIC1_PCLK_9 40 +-#define CLK_GOUT_PERIC1_PCLK_10 41 +-#define CLK_GOUT_PERIC1_PCLK_11 42 ++#define CLK_GOUT_PERIC1_IPCLK_11 31 ++#define CLK_GOUT_PERIC1_PCLK_0 32 ++#define CLK_GOUT_PERIC1_PCLK_1 33 ++#define CLK_GOUT_PERIC1_PCLK_2 34 ++#define CLK_GOUT_PERIC1_PCLK_3 35 ++#define CLK_GOUT_PERIC1_PCLK_4 36 ++#define CLK_GOUT_PERIC1_PCLK_5 37 ++#define CLK_GOUT_PERIC1_PCLK_6 38 ++#define CLK_GOUT_PERIC1_PCLK_7 39 ++#define CLK_GOUT_PERIC1_PCLK_8 40 ++#define CLK_GOUT_PERIC1_PCLK_9 41 ++#define CLK_GOUT_PERIC1_PCLK_10 42 ++#define CLK_GOUT_PERIC1_PCLK_11 43 + +-#define PERIC1_NR_CLK 43 ++#define PERIC1_NR_CLK 44 + + /* CMU_PERIS */ + #define CLK_MOUT_PERIS_BUS_USER 1 +diff --git a/include/linux/ata.h b/include/linux/ata.h +index 21292b5bbb550..e3050e153a716 100644 +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -566,6 +566,18 @@ struct ata_bmdma_prd { + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 2))) ++#define ata_id_has_devslp(id) \ ++ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ ++ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ ++ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))) ++#define ata_id_has_ncq_autosense(id) \ ++ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ ++ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ ++ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))) ++#define ata_id_has_dipm(id) \ ++ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ ++ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ ++ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 3))) + #define ata_id_iordy_disable(id) ((id)[ATA_ID_CAPABILITY] & (1 << 10)) + #define ata_id_has_iordy(id) ((id)[ATA_ID_CAPABILITY] & (1 << 11)) + #define ata_id_u32(id,n) \ +@@ -578,9 +590,6 @@ struct ata_bmdma_prd { + + #define ata_id_cdb_intr(id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20) + #define ata_id_has_da(id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) +-#define ata_id_has_devslp(id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)) +-#define ata_id_has_ncq_autosense(id) \ +- ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)) + + static inline bool ata_id_has_hipm(const u16 *id) + { +@@ -592,17 +601,6 @@ static inline bool ata_id_has_hipm(const u16 *id) + return val & (1 << 9); + } + +-static inline bool ata_id_has_dipm(const u16 *id) +-{ +- u16 val = id[ATA_ID_FEATURE_SUPP]; +- +- if (val == 0 || val == 0xffff) +- return false; +- +- return val & (1 << 3); +-} +- +- + static inline bool ata_id_has_fua(const u16 *id) + { + if ((id[ATA_ID_CFSSE] & 0xC000) != 0x4000) +@@ -771,16 +769,21 @@ static inline bool ata_id_has_read_log_dma_ext(const u16 *id) + + static inline bool ata_id_has_sense_reporting(const u16 *id) + { +- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) ++ if (!(id[ATA_ID_CFS_ENABLE_2] & BIT(15))) ++ return false; ++ if ((id[ATA_ID_COMMAND_SET_3] & (BIT(15) | BIT(14))) != BIT(14)) + return false; +- return id[ATA_ID_COMMAND_SET_3] & (1 << 6); ++ return id[ATA_ID_COMMAND_SET_3] & BIT(6); + } + + static inline bool ata_id_sense_reporting_enabled(const u16 *id) + { +- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) ++ if (!ata_id_has_sense_reporting(id)) ++ return false; ++ /* ata_id_has_sense_reporting() == true, word 86 must have bit 15 set */ ++ if ((id[ATA_ID_COMMAND_SET_4] & (BIT(15) | BIT(14))) != BIT(14)) + return false; +- return id[ATA_ID_COMMAND_SET_4] & (1 << 6); ++ return id[ATA_ID_COMMAND_SET_4] & BIT(6); + } + + /** +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 992ee987f2738..c436874109409 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -509,7 +509,7 @@ static inline void bio_set_dev(struct bio *bio, struct block_device *bdev) + { + bio_clear_flag(bio, BIO_REMAPPED); + if (bio->bi_bdev != bdev) +- bio_clear_flag(bio, BIO_THROTTLED); ++ bio_clear_flag(bio, BIO_BPS_THROTTLED); + bio->bi_bdev = bdev; + bio_associate_blkg(bio); + } +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index a24d4078fb214..5b5dc01c006d5 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -323,7 +323,7 @@ enum { + BIO_QUIET, /* Make BIO Quiet */ + BIO_CHAIN, /* chained bio, ->bi_remaining in effect */ + BIO_REFFED, /* bio has elevated ->bi_cnt */ +- BIO_THROTTLED, /* This bio has already been subjected to ++ BIO_BPS_THROTTLED, /* This bio has already been subjected to + * throttling rules. Don't do it again. */ + BIO_TRACE_COMPLETION, /* bio_endio() should trace the final completion + * of this bio. */ +diff --git a/include/linux/bpf-cgroup-defs.h b/include/linux/bpf-cgroup-defs.h +index 695d1224a71ba..5d268e76d8e6c 100644 +--- a/include/linux/bpf-cgroup-defs.h ++++ b/include/linux/bpf-cgroup-defs.h +@@ -47,8 +47,8 @@ struct cgroup_bpf { + * have either zero or one element + * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS + */ +- struct list_head progs[MAX_CGROUP_BPF_ATTACH_TYPE]; +- u32 flags[MAX_CGROUP_BPF_ATTACH_TYPE]; ++ struct hlist_head progs[MAX_CGROUP_BPF_ATTACH_TYPE]; ++ u8 flags[MAX_CGROUP_BPF_ATTACH_TYPE]; + + /* list of cgroup shared storages */ + struct list_head storages; +diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h +index 669d96d074ada..6673acfbf2ef2 100644 +--- a/include/linux/bpf-cgroup.h ++++ b/include/linux/bpf-cgroup.h +@@ -95,7 +95,7 @@ struct bpf_cgroup_link { + }; + + struct bpf_prog_list { +- struct list_head node; ++ struct hlist_node node; + struct bpf_prog *prog; + struct bpf_cgroup_link *link; + struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]; +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index ed352c00330cd..33ec4658c1ee5 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -869,6 +869,7 @@ struct bpf_dispatcher { + struct bpf_dispatcher_prog progs[BPF_DISPATCHER_MAX]; + int num_progs; + void *image; ++ void *rw_image; + u32 image_off; + struct bpf_ksym ksym; + }; +@@ -888,7 +889,7 @@ int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampolin + struct bpf_trampoline *bpf_trampoline_get(u64 key, + struct bpf_attach_target_info *tgt_info); + void bpf_trampoline_put(struct bpf_trampoline *tr); +-int arch_prepare_bpf_dispatcher(void *image, s64 *funcs, int num_funcs); ++int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs); + #define BPF_DISPATCHER_INIT(_name) { \ + .mutex = __MUTEX_INITIALIZER(_name.mutex), \ + .func = &_name##_func, \ +@@ -2273,12 +2274,9 @@ extern const struct bpf_func_proto bpf_for_each_map_elem_proto; + extern const struct bpf_func_proto bpf_btf_find_by_name_kind_proto; + extern const struct bpf_func_proto bpf_sk_setsockopt_proto; + extern const struct bpf_func_proto bpf_sk_getsockopt_proto; +-extern const struct bpf_func_proto bpf_kallsyms_lookup_name_proto; + extern const struct bpf_func_proto bpf_find_vma_proto; + extern const struct bpf_func_proto bpf_loop_proto; +-extern const struct bpf_func_proto bpf_strncmp_proto; + extern const struct bpf_func_proto bpf_copy_from_user_task_proto; +-extern const struct bpf_func_proto bpf_kptr_xchg_proto; + + const struct bpf_func_proto *tracing_prog_func_proto( + enum bpf_func_id func_id, const struct bpf_prog *prog); +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index e8439f6cbe57a..e66ee8d87e27e 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -212,6 +212,17 @@ struct bpf_reference_state { + * is used purely to inform the user of a reference leak. + */ + int insn_idx; ++ /* There can be a case like: ++ * main (frame 0) ++ * cb (frame 1) ++ * func (frame 3) ++ * cb (frame 4) ++ * Hence for frame 4, if callback_ref just stored boolean, it would be ++ * impossible to distinguish nested callback refs. Hence store the ++ * frameno and compare that to callback_ref in check_reference_leak when ++ * exiting a callback function. ++ */ ++ int callback_ref; + }; + + /* state of the program: +diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h +index dce631e678dd6..8d9eec5f6d8bb 100644 +--- a/include/linux/dynamic_debug.h ++++ b/include/linux/dynamic_debug.h +@@ -55,9 +55,6 @@ struct _ddebug { + + #if defined(CONFIG_DYNAMIC_DEBUG_CORE) + +-/* exported for module authors to exercise >control */ +-int dynamic_debug_exec_queries(const char *query, const char *modname); +- + int ddebug_add_module(struct _ddebug *tab, unsigned int n, + const char *modname); + extern int ddebug_remove_module(const char *mod_name); +@@ -201,7 +198,7 @@ static inline int ddebug_remove_module(const char *mod) + static inline int ddebug_dyndbg_module_param_cb(char *param, char *val, + const char *modname) + { +- if (strstr(param, "dyndbg")) { ++ if (!strcmp(param, "dyndbg")) { + /* avoid pr_warn(), which wants pr_fmt() fully defined */ + printk(KERN_WARNING "dyndbg param is supported only in " + "CONFIG_DYNAMIC_DEBUG builds\n"); +@@ -221,12 +218,6 @@ static inline int ddebug_dyndbg_module_param_cb(char *param, char *val, + rowsize, groupsize, buf, len, ascii); \ + } while (0) + +-static inline int dynamic_debug_exec_queries(const char *query, const char *modname) +-{ +- pr_warn("kernel not built with CONFIG_DYNAMIC_DEBUG_CORE\n"); +- return 0; +-} +- + #endif /* !CONFIG_DYNAMIC_DEBUG_CORE */ + + #endif +diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h +index 305d5f19093b9..30eb30d6909b0 100644 +--- a/include/linux/eventfd.h ++++ b/include/linux/eventfd.h +@@ -46,7 +46,7 @@ void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt); + + static inline bool eventfd_signal_allowed(void) + { +- return !current->in_eventfd_signal; ++ return !current->in_eventfd; + } + + #else /* CONFIG_EVENTFD */ +diff --git a/include/linux/export-internal.h b/include/linux/export-internal.h +index c2b1d4fd59873..fe7e6ba918f10 100644 +--- a/include/linux/export-internal.h ++++ b/include/linux/export-internal.h +@@ -10,8 +10,10 @@ + #include <linux/compiler.h> + #include <linux/types.h> + +-/* __used is needed to keep __crc_* for LTO */ + #define SYMBOL_CRC(sym, crc, sec) \ +- u32 __section("___kcrctab" sec "+" #sym) __used __crc_##sym = crc ++ asm(".section \"___kcrctab" sec "+" #sym "\",\"a\"" "\n" \ ++ "__crc_" #sym ":" "\n" \ ++ ".long " #crc "\n" \ ++ ".previous" "\n") + + #endif /* __LINUX_EXPORT_INTERNAL_H__ */ +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 8fd2e2f58eeb2..e11335c70982e 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -1052,6 +1052,8 @@ extern long bpf_jit_limit_max; + + typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); + ++void bpf_jit_fill_hole_with_zero(void *area, unsigned int size); ++ + struct bpf_binary_header * + bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr, + unsigned int alignment, +@@ -1064,6 +1066,9 @@ void bpf_jit_free(struct bpf_prog *fp); + struct bpf_binary_header * + bpf_jit_binary_pack_hdr(const struct bpf_prog *fp); + ++void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns); ++void bpf_prog_pack_free(struct bpf_binary_header *hdr); ++ + static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp) + { + return list_empty(&fp->aux->ksym.lnode) || +diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h +index 3b401fa0f3746..fce2fb2fc9626 100644 +--- a/include/linux/fortify-string.h ++++ b/include/linux/fortify-string.h +@@ -19,7 +19,8 @@ void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning(" + unsigned char *__p = (unsigned char *)(p); \ + size_t __ret = (size_t)-1; \ + size_t __p_size = __builtin_object_size(p, 1); \ +- if (__p_size != (size_t)-1) { \ ++ if (__p_size != (size_t)-1 && \ ++ __builtin_constant_p(*__p)) { \ + size_t __p_len = __p_size - 1; \ + if (__builtin_constant_p(__p[__p_len]) && \ + __p[__p_len] == '\0') \ +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 9ad5e3520fae5..fb19f532c76c6 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -2241,13 +2241,14 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, + * don't have to write inode on fdatasync() when only + * e.g. the timestamps have changed. + * I_DIRTY_PAGES Inode has dirty pages. Inode itself may be clean. +- * I_DIRTY_TIME The inode itself only has dirty timestamps, and the ++ * I_DIRTY_TIME The inode itself has dirty timestamps, and the + * lazytime mount option is enabled. We keep track of this + * separately from I_DIRTY_SYNC in order to implement + * lazytime. This gets cleared if I_DIRTY_INODE +- * (I_DIRTY_SYNC and/or I_DIRTY_DATASYNC) gets set. I.e. +- * either I_DIRTY_TIME *or* I_DIRTY_INODE can be set in +- * i_state, but not both. I_DIRTY_PAGES may still be set. ++ * (I_DIRTY_SYNC and/or I_DIRTY_DATASYNC) gets set. But ++ * I_DIRTY_TIME can still be set if I_DIRTY_SYNC is already ++ * in place because writeback might already be in progress ++ * and we don't want to lose the time update + * I_NEW Serves as both a mutex and completion notification. + * New inodes set I_NEW. If two processes both create + * the same inode, one of them will release its inode and +diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h +index 756b66ff025e5..ab940b97decca 100644 +--- a/include/linux/hugetlb.h ++++ b/include/linux/hugetlb.h +@@ -203,8 +203,8 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, + struct page *follow_huge_pd(struct vm_area_struct *vma, + unsigned long address, hugepd_t hpd, + int flags, int pdshift); +-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address, +- pmd_t *pmd, int flags); ++struct page *follow_huge_pmd_pte(struct vm_area_struct *vma, unsigned long address, ++ int flags); + struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address, + pud_t *pud, int flags); + struct page *follow_huge_pgd(struct mm_struct *mm, unsigned long address, +@@ -308,8 +308,8 @@ static inline struct page *follow_huge_pd(struct vm_area_struct *vma, + return NULL; + } + +-static inline struct page *follow_huge_pmd(struct mm_struct *mm, +- unsigned long address, pmd_t *pmd, int flags) ++static inline struct page *follow_huge_pmd_pte(struct vm_area_struct *vma, ++ unsigned long address, int flags) + { + return NULL; + } +diff --git a/include/linux/hw_random.h b/include/linux/hw_random.h +index aa1d4da03538b..77c2885c4c130 100644 +--- a/include/linux/hw_random.h ++++ b/include/linux/hw_random.h +@@ -50,6 +50,7 @@ struct hwrng { + struct list_head list; + struct kref ref; + struct completion cleanup_done; ++ struct completion dying; + }; + + struct device; +@@ -61,4 +62,6 @@ extern int devm_hwrng_register(struct device *dev, struct hwrng *rng); + extern void hwrng_unregister(struct hwrng *rng); + extern void devm_hwrng_unregister(struct device *dve, struct hwrng *rng); + ++extern long hwrng_msleep(struct hwrng *rng, unsigned int msecs); ++ + #endif /* LINUX_HWRANDOM_H_ */ +diff --git a/include/linux/iova.h b/include/linux/iova.h +index 320a70e402330..f1dba47cfc976 100644 +--- a/include/linux/iova.h ++++ b/include/linux/iova.h +@@ -75,7 +75,7 @@ static inline unsigned long iova_pfn(struct iova_domain *iovad, dma_addr_t iova) + return iova >> iova_shift(iovad); + } + +-#if IS_ENABLED(CONFIG_IOMMU_IOVA) ++#if IS_REACHABLE(CONFIG_IOMMU_IOVA) + int iova_cache_get(void); + void iova_cache_put(void); + +diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h +index 37f9758751020..12c7f2d3e2107 100644 +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -292,6 +292,7 @@ struct mmc_card { + #define MMC_QUIRK_BROKEN_IRQ_POLLING (1<<11) /* Polling SDIO_CCCR_INTx could create a fake interrupt */ + #define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */ + #define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */ ++#define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */ + + bool reenable_cmdq; /* Re-enable Command Queue */ + +diff --git a/include/linux/once.h b/include/linux/once.h +index f54523052bbcb..aebc038e79e58 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -5,10 +5,18 @@ + #include <linux/types.h> + #include <linux/jump_label.h> + ++/* Helpers used from arbitrary contexts. ++ * Hard irqs are blocked, be cautious. ++ */ + bool __do_once_start(bool *done, unsigned long *flags); + void __do_once_done(bool *done, struct static_key_true *once_key, + unsigned long *flags, struct module *mod); + ++/* Variant for process contexts only. */ ++bool __do_once_slow_start(bool *done); ++void __do_once_slow_done(bool *done, struct static_key_true *once_key, ++ struct module *mod); ++ + /* Call a function exactly once. The idea of DO_ONCE() is to perform + * a function call such as initialization of random seeds, etc, only + * once, where DO_ONCE() can live in the fast-path. After @func has +@@ -52,9 +60,29 @@ void __do_once_done(bool *done, struct static_key_true *once_key, + ___ret; \ + }) + ++/* Variant of DO_ONCE() for process/sleepable contexts. */ ++#define DO_ONCE_SLOW(func, ...) \ ++ ({ \ ++ bool ___ret = false; \ ++ static bool __section(".data.once") ___done = false; \ ++ static DEFINE_STATIC_KEY_TRUE(___once_key); \ ++ if (static_branch_unlikely(&___once_key)) { \ ++ ___ret = __do_once_slow_start(&___done); \ ++ if (unlikely(___ret)) { \ ++ func(__VA_ARGS__); \ ++ __do_once_slow_done(&___done, &___once_key, \ ++ THIS_MODULE); \ ++ } \ ++ } \ ++ ___ret; \ ++ }) ++ + #define get_random_once(buf, nbytes) \ + DO_ONCE(get_random_bytes, (buf), (nbytes)) + #define get_random_once_wait(buf, nbytes) \ + DO_ONCE(get_random_bytes_wait, (buf), (nbytes)) \ + ++#define get_random_slow_once(buf, nbytes) \ ++ DO_ONCE_SLOW(get_random_bytes, (buf), (nbytes)) ++ + #endif /* _LINUX_ONCE_H */ +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index dac53fd3afea3..2504df9a0453e 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -101,7 +101,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k + int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full); + __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + struct file *filp, poll_table *poll_table); +- ++void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu); + + #define RING_BUFFER_ALL_CPUS -1 + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 6d877c7e22ffd..e02dc270fa2ce 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -934,7 +934,7 @@ struct task_struct { + #endif + #ifdef CONFIG_EVENTFD + /* Recursion prevention for eventfd_signal() */ +- unsigned in_eventfd_signal:1; ++ unsigned in_eventfd:1; + #endif + #ifdef CONFIG_IOMMU_SVA + unsigned pasid_activated:1; +diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h +index ff84a3ed10ea9..b0183e90fe90b 100644 +--- a/include/linux/serial_8250.h ++++ b/include/linux/serial_8250.h +@@ -74,6 +74,7 @@ struct uart_8250_port; + struct uart_8250_ops { + int (*setup_irq)(struct uart_8250_port *); + void (*release_irq)(struct uart_8250_port *); ++ void (*setup_timer)(struct uart_8250_port *); + }; + + struct uart_8250_em485 { +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 037a8d81a66cf..690a8de5324eb 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -101,7 +101,7 @@ struct uart_icount { + __u32 buf_overrun; + }; + +-typedef unsigned int __bitwise upf_t; ++typedef u64 __bitwise upf_t; + typedef unsigned int __bitwise upstat_t; + + struct uart_port { +@@ -208,6 +208,7 @@ struct uart_port { + #define UPF_FIXED_PORT ((__force upf_t) (1 << 29)) + #define UPF_DEAD ((__force upf_t) (1 << 30)) + #define UPF_IOREMAP ((__force upf_t) (1 << 31)) ++#define UPF_FULL_PROBE ((__force upf_t) (1ULL << 32)) + + #define __UPF_CHANGE_MASK 0x17fff + #define UPF_CHANGE_MASK ((__force upf_t) __UPF_CHANGE_MASK) +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 63d0a21b63162..f8a240817b4cf 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -965,6 +965,7 @@ typedef unsigned char *sk_buff_data_t; + * @csum_level: indicates the number of consecutive checksums found in + * the packet minus one that have been verified as + * CHECKSUM_UNNECESSARY (max 3) ++ * @scm_io_uring: SKB holds io_uring registered files + * @dst_pending_confirm: need to confirm neighbour + * @decrypted: Decrypted SKB + * @slow_gro: state present at GRO time, slower prepare step required +@@ -1144,6 +1145,7 @@ struct sk_buff { + #endif + __u8 slow_gro:1; + __u8 csum_not_inet:1; ++ __u8 scm_io_uring:1; + + #ifdef CONFIG_NET_SCHED + __u16 tc_index; /* traffic control index */ +diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h +index daecb009c05b5..0ca8a8ffb47e4 100644 +--- a/include/linux/sunrpc/svc.h ++++ b/include/linux/sunrpc/svc.h +@@ -544,16 +544,27 @@ static inline void svc_reserve_auth(struct svc_rqst *rqstp, int space) + } + + /** +- * svcxdr_init_decode - Prepare an xdr_stream for svc Call decoding ++ * svcxdr_init_decode - Prepare an xdr_stream for Call decoding + * @rqstp: controlling server RPC transaction context + * ++ * This function currently assumes the RPC header in rq_arg has ++ * already been decoded. Upon return, xdr->p points to the ++ * location of the upper layer header. + */ + static inline void svcxdr_init_decode(struct svc_rqst *rqstp) + { + struct xdr_stream *xdr = &rqstp->rq_arg_stream; +- struct kvec *argv = rqstp->rq_arg.head; ++ struct xdr_buf *buf = &rqstp->rq_arg; ++ struct kvec *argv = buf->head; + +- xdr_init_decode(xdr, &rqstp->rq_arg, argv->iov_base, NULL); ++ /* ++ * svc_getnl() and friends do not keep the xdr_buf's ::len ++ * field up to date. Refresh that field before initializing ++ * the argument decoding stream. ++ */ ++ buf->len = buf->head->iov_len + buf->page_len + buf->tail->iov_len; ++ ++ xdr_init_decode(xdr, buf, argv->iov_base, NULL); + xdr_set_scratch_page(xdr, rqstp->rq_scratch_page); + } + +@@ -576,7 +587,7 @@ static inline void svcxdr_init_encode(struct svc_rqst *rqstp) + xdr->end = resv->iov_base + PAGE_SIZE - rqstp->rq_auth_slack; + buf->len = resv->iov_len; + xdr->page_ptr = buf->pages - 1; +- buf->buflen = PAGE_SIZE * (1 + rqstp->rq_page_end - buf->pages); ++ buf->buflen = PAGE_SIZE * (rqstp->rq_page_end - buf->pages); + buf->buflen -= rqstp->rq_auth_slack; + xdr->rqst = NULL; + } +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index 1168302b79274..bb31d60addace 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -265,7 +265,7 @@ struct tcp_sock { + u32 packets_out; /* Packets which are "in flight" */ + u32 retrans_out; /* Retransmitted packets out */ + u32 max_packets_out; /* max packets_out in last window */ +- u32 max_packets_seq; /* right edge of max_packets_out flight */ ++ u32 cwnd_usage_seq; /* right edge of cwnd usage tracking flight */ + + u16 urg_data; /* Saved octet of OOB data and control flags */ + u8 ecn_flags; /* ECN status bits. */ +diff --git a/include/linux/trace.h b/include/linux/trace.h +index bf169612ffe12..b5e16e438448f 100644 +--- a/include/linux/trace.h ++++ b/include/linux/trace.h +@@ -2,8 +2,6 @@ + #ifndef _LINUX_TRACE_H + #define _LINUX_TRACE_H + +-#ifdef CONFIG_TRACING +- + #define TRACE_EXPORT_FUNCTION BIT(0) + #define TRACE_EXPORT_EVENT BIT(1) + #define TRACE_EXPORT_MARKER BIT(2) +@@ -28,6 +26,8 @@ struct trace_export { + int flags; + }; + ++#ifdef CONFIG_TRACING ++ + int register_ftrace_export(struct trace_export *export); + int unregister_ftrace_export(struct trace_export *export); + +@@ -48,6 +48,38 @@ void osnoise_arch_unregister(void); + void osnoise_trace_irq_entry(int id); + void osnoise_trace_irq_exit(int id, const char *desc); + ++#else /* CONFIG_TRACING */ ++static inline int register_ftrace_export(struct trace_export *export) ++{ ++ return -EINVAL; ++} ++static inline int unregister_ftrace_export(struct trace_export *export) ++{ ++ return 0; ++} ++static inline void trace_printk_init_buffers(void) ++{ ++} ++static inline int trace_array_printk(struct trace_array *tr, unsigned long ip, ++ const char *fmt, ...) ++{ ++ return 0; ++} ++static inline int trace_array_init_printk(struct trace_array *tr) ++{ ++ return -EINVAL; ++} ++static inline void trace_array_put(struct trace_array *tr) ++{ ++} ++static inline struct trace_array *trace_array_get_by_name(const char *name) ++{ ++ return NULL; ++} ++static inline int trace_array_destroy(struct trace_array *tr) ++{ ++ return 0; ++} + #endif /* CONFIG_TRACING */ + + #endif /* _LINUX_TRACE_H */ +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index b18759a673c66..b6a54d92d4a09 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -92,6 +92,7 @@ struct trace_iterator { + unsigned int temp_size; + char *fmt; /* modified format holder */ + unsigned int fmt_size; ++ long wait_index; + + /* trace_seq for __print_flags() and __print_symbolic() etc. */ + struct trace_seq tmp_seq; +diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h +index a8994f307fc38..03b64bf876a46 100644 +--- a/include/net/ieee802154_netdev.h ++++ b/include/net/ieee802154_netdev.h +@@ -185,21 +185,27 @@ static inline int + ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len) + { + struct ieee802154_addr_sa *sa; ++ int ret = 0; + + sa = &daddr->addr; + if (len < IEEE802154_MIN_NAMELEN) + return -EINVAL; + switch (sa->addr_type) { ++ case IEEE802154_ADDR_NONE: ++ break; + case IEEE802154_ADDR_SHORT: + if (len < IEEE802154_NAMELEN_SHORT) +- return -EINVAL; ++ ret = -EINVAL; + break; + case IEEE802154_ADDR_LONG: + if (len < IEEE802154_NAMELEN_LONG) +- return -EINVAL; ++ ret = -EINVAL; ++ break; ++ default: ++ ret = -EINVAL; + break; + } +- return 0; ++ return ret; + } + + static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a, +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 78a64e1b33a7e..788b1f17b5e35 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1289,11 +1289,14 @@ static inline bool tcp_is_cwnd_limited(const struct sock *sk) + { + const struct tcp_sock *tp = tcp_sk(sk); + ++ if (tp->is_cwnd_limited) ++ return true; ++ + /* If in slow start, ensure cwnd grows to twice what was ACKed. */ + if (tcp_in_slow_start(tp)) + return tcp_snd_cwnd(tp) < 2 * tp->max_packets_out; + +- return tp->is_cwnd_limited; ++ return false; + } + + /* BBR congestion control needs pacing. +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index 9758a4a9923f5..5a10e5acfad26 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -213,6 +213,8 @@ struct iscsi_conn { + struct list_head cmdqueue; /* data-path cmd queue */ + struct list_head requeue; /* tasks needing another run */ + struct work_struct xmitwork; /* per-conn. xmit workqueue */ ++ /* recv */ ++ struct work_struct recvwork; + unsigned long flags; /* ISCSI_CONN_FLAGs */ + + /* negotiated params */ +@@ -452,8 +454,10 @@ extern int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn, + extern int iscsi_conn_get_addr_param(struct sockaddr_storage *addr, + enum iscsi_param param, char *buf); + extern void iscsi_suspend_tx(struct iscsi_conn *conn); ++extern void iscsi_suspend_rx(struct iscsi_conn *conn); + extern void iscsi_suspend_queue(struct iscsi_conn *conn); +-extern void iscsi_conn_queue_work(struct iscsi_conn *conn); ++extern void iscsi_conn_queue_xmit(struct iscsi_conn *conn); ++extern void iscsi_conn_queue_recv(struct iscsi_conn *conn); + + #define iscsi_conn_printk(prefix, _c, fmt, a...) \ + iscsi_cls_conn_printk(prefix, ((struct iscsi_conn *)_c)->cls_conn, \ +diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h +index 86be4a92b67bf..a96b7d2770e15 100644 +--- a/include/uapi/rdma/mlx5-abi.h ++++ b/include/uapi/rdma/mlx5-abi.h +@@ -104,6 +104,7 @@ enum mlx5_ib_alloc_ucontext_resp_mask { + MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_ECE = 1UL << 2, + MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_SQD2RTS = 1UL << 3, + MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_REAL_TIME_TS = 1UL << 4, ++ MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_MKEY_UPDATE_TAG = 1UL << 5, + }; + + enum mlx5_user_cmds_supp_uhw { +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index 15a6f1e93e5af..096b6d14f40d7 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -4215,6 +4215,7 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags) + return -EAGAIN; + } + ++ req->cqe.res = iov_iter_count(&s->iter); + /* + * Now retry read with the IOCB_WAITQ parts set in the iocb. If + * we get -EIOCBQUEUED, then we'll get a notification when the +@@ -5849,10 +5850,13 @@ static int io_setup_async_msg(struct io_kiocb *req, + async_msg = req->async_data; + req->flags |= REQ_F_NEED_CLEANUP; + memcpy(async_msg, kmsg, sizeof(*kmsg)); +- async_msg->msg.msg_name = &async_msg->addr; ++ if (async_msg->msg.msg_name) ++ async_msg->msg.msg_name = &async_msg->addr; + /* if were using fast_iov, set it to the new one */ +- if (!async_msg->free_iov) +- async_msg->msg.msg_iter.iov = async_msg->fast_iov; ++ if (!kmsg->free_iov) { ++ size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov; ++ async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx]; ++ } + + return -EAGAIN; + } +@@ -9480,6 +9484,7 @@ static int io_scm_file_account(struct io_ring_ctx *ctx, struct file *file) + + UNIXCB(skb).fp = fpl; + skb->sk = sk; ++ skb->scm_io_uring = 1; + skb->destructor = unix_destruct_scm; + refcount_add(skb->truesize, &sk->sk_wmem_alloc); + } +@@ -10706,12 +10711,6 @@ static void io_flush_apoll_cache(struct io_ring_ctx *ctx) + static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) + { + io_sq_thread_finish(ctx); +- +- if (ctx->mm_account) { +- mmdrop(ctx->mm_account); +- ctx->mm_account = NULL; +- } +- + io_rsrc_refs_drop(ctx); + /* __io_rsrc_put_work() may need uring_lock to progress, wait w/o it */ + io_wait_rsrc_data(ctx->buf_data); +@@ -10750,6 +10749,10 @@ static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) + #endif + WARN_ON_ONCE(!list_empty(&ctx->ltimeout_list)); + ++ if (ctx->mm_account) { ++ mmdrop(ctx->mm_account); ++ ctx->mm_account = NULL; ++ } + io_mem_free(ctx->rings); + io_mem_free(ctx->sq_sqes); + +diff --git a/ipc/mqueue.c b/ipc/mqueue.c +index 12ad7860bb88f..83370fef88796 100644 +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -1746,6 +1746,7 @@ out_filesystem: + unregister_filesystem(&mqueue_fs_type); + out_sysctl: + kmem_cache_destroy(mqueue_inode_cachep); ++ retire_mq_sysctls(&init_ipc_ns); + return error; + } + +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 0c33e04c293ad..73121c0185cea 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1016,7 +1016,6 @@ static void audit_reset_context(struct audit_context *ctx) + WARN_ON(!list_empty(&ctx->killed_trees)); + audit_free_module(ctx); + ctx->fds[0] = -1; +- audit_proctitle_free(ctx); + ctx->type = 0; /* reset last for audit_free_*() */ + } + +@@ -1102,6 +1101,7 @@ static inline void audit_free_context(struct audit_context *context) + { + /* resetting is extra work, but it is likely just noise */ + audit_reset_context(context); ++ audit_proctitle_free(context); + free_tree_refs(context); + kfree(context->filterkey); + kfree(context); +@@ -2094,7 +2094,7 @@ void __audit_syscall_exit(int success, long return_code) + /* run through both filters to ensure we set the filterkey properly */ + audit_filter_syscall(current, context); + audit_filter_inodes(current, context); +- if (context->current_state < AUDIT_STATE_RECORD) ++ if (context->current_state != AUDIT_STATE_RECORD) + goto out; + + audit_log_exit(); +diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c +index 8ce40fd869f6a..d13ffb00e9813 100644 +--- a/kernel/bpf/bpf_local_storage.c ++++ b/kernel/bpf/bpf_local_storage.c +@@ -555,11 +555,11 @@ void bpf_local_storage_map_free(struct bpf_local_storage_map *smap, + struct bpf_local_storage_elem, map_node))) { + if (busy_counter) { + migrate_disable(); +- __this_cpu_inc(*busy_counter); ++ this_cpu_inc(*busy_counter); + } + bpf_selem_unlink(selem, false); + if (busy_counter) { +- __this_cpu_dec(*busy_counter); ++ this_cpu_dec(*busy_counter); + migrate_enable(); + } + cond_resched_rcu(); +diff --git a/kernel/bpf/bpf_task_storage.c b/kernel/bpf/bpf_task_storage.c +index e9014dc626820..6f290623347e0 100644 +--- a/kernel/bpf/bpf_task_storage.c ++++ b/kernel/bpf/bpf_task_storage.c +@@ -26,20 +26,20 @@ static DEFINE_PER_CPU(int, bpf_task_storage_busy); + static void bpf_task_storage_lock(void) + { + migrate_disable(); +- __this_cpu_inc(bpf_task_storage_busy); ++ this_cpu_inc(bpf_task_storage_busy); + } + + static void bpf_task_storage_unlock(void) + { +- __this_cpu_dec(bpf_task_storage_busy); ++ this_cpu_dec(bpf_task_storage_busy); + migrate_enable(); + } + + static bool bpf_task_storage_trylock(void) + { + migrate_disable(); +- if (unlikely(__this_cpu_inc_return(bpf_task_storage_busy) != 1)) { +- __this_cpu_dec(bpf_task_storage_busy); ++ if (unlikely(this_cpu_inc_return(bpf_task_storage_busy) != 1)) { ++ this_cpu_dec(bpf_task_storage_busy); + migrate_enable(); + return false; + } +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index eb12d4f705cce..ff4a2c0b14ead 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -3120,7 +3120,7 @@ static int btf_struct_resolve(struct btf_verifier_env *env, + if (v->next_member) { + const struct btf_type *last_member_type; + const struct btf_member *last_member; +- u16 last_member_type_id; ++ u32 last_member_type_id; + + last_member = btf_type_member(v->t) + v->next_member - 1; + last_member_type_id = last_member->type; +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index 34dfa45ef4f3b..13526b01f1fd1 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -157,11 +157,12 @@ static void cgroup_bpf_release(struct work_struct *work) + mutex_lock(&cgroup_mutex); + + for (atype = 0; atype < ARRAY_SIZE(cgrp->bpf.progs); atype++) { +- struct list_head *progs = &cgrp->bpf.progs[atype]; +- struct bpf_prog_list *pl, *pltmp; ++ struct hlist_head *progs = &cgrp->bpf.progs[atype]; ++ struct bpf_prog_list *pl; ++ struct hlist_node *pltmp; + +- list_for_each_entry_safe(pl, pltmp, progs, node) { +- list_del(&pl->node); ++ hlist_for_each_entry_safe(pl, pltmp, progs, node) { ++ hlist_del(&pl->node); + if (pl->prog) + bpf_prog_put(pl->prog); + if (pl->link) +@@ -217,12 +218,12 @@ static struct bpf_prog *prog_list_prog(struct bpf_prog_list *pl) + /* count number of elements in the list. + * it's slow but the list cannot be long + */ +-static u32 prog_list_length(struct list_head *head) ++static u32 prog_list_length(struct hlist_head *head) + { + struct bpf_prog_list *pl; + u32 cnt = 0; + +- list_for_each_entry(pl, head, node) { ++ hlist_for_each_entry(pl, head, node) { + if (!prog_list_prog(pl)) + continue; + cnt++; +@@ -291,7 +292,7 @@ static int compute_effective_progs(struct cgroup *cgrp, + if (cnt > 0 && !(p->bpf.flags[atype] & BPF_F_ALLOW_MULTI)) + continue; + +- list_for_each_entry(pl, &p->bpf.progs[atype], node) { ++ hlist_for_each_entry(pl, &p->bpf.progs[atype], node) { + if (!prog_list_prog(pl)) + continue; + +@@ -342,7 +343,7 @@ int cgroup_bpf_inherit(struct cgroup *cgrp) + cgroup_bpf_get(p); + + for (i = 0; i < NR; i++) +- INIT_LIST_HEAD(&cgrp->bpf.progs[i]); ++ INIT_HLIST_HEAD(&cgrp->bpf.progs[i]); + + INIT_LIST_HEAD(&cgrp->bpf.storages); + +@@ -418,7 +419,7 @@ cleanup: + + #define BPF_CGROUP_MAX_PROGS 64 + +-static struct bpf_prog_list *find_attach_entry(struct list_head *progs, ++static struct bpf_prog_list *find_attach_entry(struct hlist_head *progs, + struct bpf_prog *prog, + struct bpf_cgroup_link *link, + struct bpf_prog *replace_prog, +@@ -428,12 +429,12 @@ static struct bpf_prog_list *find_attach_entry(struct list_head *progs, + + /* single-attach case */ + if (!allow_multi) { +- if (list_empty(progs)) ++ if (hlist_empty(progs)) + return NULL; +- return list_first_entry(progs, typeof(*pl), node); ++ return hlist_entry(progs->first, typeof(*pl), node); + } + +- list_for_each_entry(pl, progs, node) { ++ hlist_for_each_entry(pl, progs, node) { + if (prog && pl->prog == prog && prog != replace_prog) + /* disallow attaching the same prog twice */ + return ERR_PTR(-EINVAL); +@@ -444,7 +445,7 @@ static struct bpf_prog_list *find_attach_entry(struct list_head *progs, + + /* direct prog multi-attach w/ replacement case */ + if (replace_prog) { +- list_for_each_entry(pl, progs, node) { ++ hlist_for_each_entry(pl, progs, node) { + if (pl->prog == replace_prog) + /* a match found */ + return pl; +@@ -480,7 +481,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp, + struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; + enum cgroup_bpf_attach_type atype; + struct bpf_prog_list *pl; +- struct list_head *progs; ++ struct hlist_head *progs; + int err; + + if (((flags & BPF_F_ALLOW_OVERRIDE) && (flags & BPF_F_ALLOW_MULTI)) || +@@ -503,7 +504,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp, + if (!hierarchy_allows_attach(cgrp, atype)) + return -EPERM; + +- if (!list_empty(progs) && cgrp->bpf.flags[atype] != saved_flags) ++ if (!hlist_empty(progs) && cgrp->bpf.flags[atype] != saved_flags) + /* Disallow attaching non-overridable on top + * of existing overridable in this cgroup. + * Disallow attaching multi-prog if overridable or none +@@ -525,12 +526,22 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp, + if (pl) { + old_prog = pl->prog; + } else { ++ struct hlist_node *last = NULL; ++ + pl = kmalloc(sizeof(*pl), GFP_KERNEL); + if (!pl) { + bpf_cgroup_storages_free(new_storage); + return -ENOMEM; + } +- list_add_tail(&pl->node, progs); ++ if (hlist_empty(progs)) ++ hlist_add_head(&pl->node, progs); ++ else ++ hlist_for_each(last, progs) { ++ if (last->next) ++ continue; ++ hlist_add_behind(&pl->node, last); ++ break; ++ } + } + + pl->prog = prog; +@@ -556,7 +567,7 @@ cleanup: + } + bpf_cgroup_storages_free(new_storage); + if (!old_prog) { +- list_del(&pl->node); ++ hlist_del(&pl->node); + kfree(pl); + } + return err; +@@ -587,7 +598,7 @@ static void replace_effective_prog(struct cgroup *cgrp, + struct cgroup_subsys_state *css; + struct bpf_prog_array *progs; + struct bpf_prog_list *pl; +- struct list_head *head; ++ struct hlist_head *head; + struct cgroup *cg; + int pos; + +@@ -603,7 +614,7 @@ static void replace_effective_prog(struct cgroup *cgrp, + continue; + + head = &cg->bpf.progs[atype]; +- list_for_each_entry(pl, head, node) { ++ hlist_for_each_entry(pl, head, node) { + if (!prog_list_prog(pl)) + continue; + if (pl->link == link) +@@ -637,7 +648,7 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, + enum cgroup_bpf_attach_type atype; + struct bpf_prog *old_prog; + struct bpf_prog_list *pl; +- struct list_head *progs; ++ struct hlist_head *progs; + bool found = false; + + atype = to_cgroup_bpf_attach_type(link->type); +@@ -649,7 +660,7 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, + if (link->link.prog->type != new_prog->type) + return -EINVAL; + +- list_for_each_entry(pl, progs, node) { ++ hlist_for_each_entry(pl, progs, node) { + if (pl->link == link) { + found = true; + break; +@@ -688,7 +699,7 @@ out_unlock: + return ret; + } + +-static struct bpf_prog_list *find_detach_entry(struct list_head *progs, ++static struct bpf_prog_list *find_detach_entry(struct hlist_head *progs, + struct bpf_prog *prog, + struct bpf_cgroup_link *link, + bool allow_multi) +@@ -696,14 +707,14 @@ static struct bpf_prog_list *find_detach_entry(struct list_head *progs, + struct bpf_prog_list *pl; + + if (!allow_multi) { +- if (list_empty(progs)) ++ if (hlist_empty(progs)) + /* report error when trying to detach and nothing is attached */ + return ERR_PTR(-ENOENT); + + /* to maintain backward compatibility NONE and OVERRIDE cgroups + * allow detaching with invalid FD (prog==NULL) in legacy mode + */ +- return list_first_entry(progs, typeof(*pl), node); ++ return hlist_entry(progs->first, typeof(*pl), node); + } + + if (!prog && !link) +@@ -713,7 +724,7 @@ static struct bpf_prog_list *find_detach_entry(struct list_head *progs, + return ERR_PTR(-EINVAL); + + /* find the prog or link and detach it */ +- list_for_each_entry(pl, progs, node) { ++ hlist_for_each_entry(pl, progs, node) { + if (pl->prog == prog && pl->link == link) + return pl; + } +@@ -737,7 +748,7 @@ static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *prog, + struct cgroup_subsys_state *css; + struct bpf_prog_array *progs; + struct bpf_prog_list *pl; +- struct list_head *head; ++ struct hlist_head *head; + struct cgroup *cg; + int pos; + +@@ -754,7 +765,7 @@ static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *prog, + continue; + + head = &cg->bpf.progs[atype]; +- list_for_each_entry(pl, head, node) { ++ hlist_for_each_entry(pl, head, node) { + if (!prog_list_prog(pl)) + continue; + if (pl->prog == prog && pl->link == link) +@@ -793,7 +804,7 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog, + enum cgroup_bpf_attach_type atype; + struct bpf_prog *old_prog; + struct bpf_prog_list *pl; +- struct list_head *progs; ++ struct hlist_head *progs; + u32 flags; + + atype = to_cgroup_bpf_attach_type(type); +@@ -824,9 +835,10 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog, + } + + /* now can actually delete it from this cgroup list */ +- list_del(&pl->node); ++ hlist_del(&pl->node); ++ + kfree(pl); +- if (list_empty(progs)) ++ if (hlist_empty(progs)) + /* last program was detached, reset flags to zero */ + cgrp->bpf.flags[atype] = 0; + if (old_prog) +@@ -854,7 +866,7 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, + enum bpf_attach_type type = attr->query.attach_type; + enum cgroup_bpf_attach_type atype; + struct bpf_prog_array *effective; +- struct list_head *progs; ++ struct hlist_head *progs; + struct bpf_prog *prog; + int cnt, ret = 0, i; + u32 flags; +@@ -893,7 +905,7 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, + u32 id; + + i = 0; +- list_for_each_entry(pl, progs, node) { ++ hlist_for_each_entry(pl, progs, node) { + prog = prog_list_prog(pl); + id = prog->aux->id; + if (copy_to_user(prog_ids + i, &id, sizeof(id))) +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index cf44ff50b1f23..be736aa979275 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -822,6 +822,11 @@ struct bpf_prog_pack { + unsigned long bitmap[]; + }; + ++void bpf_jit_fill_hole_with_zero(void *area, unsigned int size) ++{ ++ memset(area, 0, size); ++} ++ + #define BPF_PROG_SIZE_TO_NBITS(size) (round_up(size, BPF_PROG_CHUNK_SIZE) / BPF_PROG_CHUNK_SIZE) + + static size_t bpf_prog_pack_size = -1; +@@ -892,7 +897,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins + return pack; + } + +-static void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns) ++void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns) + { + unsigned int nbits = BPF_PROG_SIZE_TO_NBITS(size); + struct bpf_prog_pack *pack; +@@ -936,7 +941,7 @@ out: + return ptr; + } + +-static void bpf_prog_pack_free(struct bpf_binary_header *hdr) ++void bpf_prog_pack_free(struct bpf_binary_header *hdr) + { + struct bpf_prog_pack *pack = NULL, *tmp; + unsigned int nbits; +diff --git a/kernel/bpf/dispatcher.c b/kernel/bpf/dispatcher.c +index 2444bd15cc2d0..fa64b80b8bcab 100644 +--- a/kernel/bpf/dispatcher.c ++++ b/kernel/bpf/dispatcher.c +@@ -85,12 +85,12 @@ static bool bpf_dispatcher_remove_prog(struct bpf_dispatcher *d, + return false; + } + +-int __weak arch_prepare_bpf_dispatcher(void *image, s64 *funcs, int num_funcs) ++int __weak arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs) + { + return -ENOTSUPP; + } + +-static int bpf_dispatcher_prepare(struct bpf_dispatcher *d, void *image) ++static int bpf_dispatcher_prepare(struct bpf_dispatcher *d, void *image, void *buf) + { + s64 ips[BPF_DISPATCHER_MAX] = {}, *ipsp = &ips[0]; + int i; +@@ -99,12 +99,12 @@ static int bpf_dispatcher_prepare(struct bpf_dispatcher *d, void *image) + if (d->progs[i].prog) + *ipsp++ = (s64)(uintptr_t)d->progs[i].prog->bpf_func; + } +- return arch_prepare_bpf_dispatcher(image, &ips[0], d->num_progs); ++ return arch_prepare_bpf_dispatcher(image, buf, &ips[0], d->num_progs); + } + + static void bpf_dispatcher_update(struct bpf_dispatcher *d, int prev_num_progs) + { +- void *old, *new; ++ void *old, *new, *tmp; + u32 noff; + int err; + +@@ -117,8 +117,14 @@ static void bpf_dispatcher_update(struct bpf_dispatcher *d, int prev_num_progs) + } + + new = d->num_progs ? d->image + noff : NULL; ++ tmp = d->num_progs ? d->rw_image + noff : NULL; + if (new) { +- if (bpf_dispatcher_prepare(d, new)) ++ /* Prepare the dispatcher in d->rw_image. Then use ++ * bpf_arch_text_copy to update d->image, which is RO+X. ++ */ ++ if (bpf_dispatcher_prepare(d, new, tmp)) ++ return; ++ if (IS_ERR(bpf_arch_text_copy(new, tmp, PAGE_SIZE / 2))) + return; + } + +@@ -140,9 +146,18 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from, + + mutex_lock(&d->mutex); + if (!d->image) { +- d->image = bpf_jit_alloc_exec_page(); ++ d->image = bpf_prog_pack_alloc(PAGE_SIZE, bpf_jit_fill_hole_with_zero); + if (!d->image) + goto out; ++ d->rw_image = bpf_jit_alloc_exec(PAGE_SIZE); ++ if (!d->rw_image) { ++ u32 size = PAGE_SIZE; ++ ++ bpf_arch_text_copy(d->image, &size, sizeof(size)); ++ bpf_prog_pack_free((struct bpf_binary_header *)d->image); ++ d->image = NULL; ++ goto out; ++ } + bpf_image_ksym_add(d->image, &d->ksym); + } + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 4dd5e0005afa1..e20f3d0e3fc7d 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -162,17 +162,25 @@ static inline int htab_lock_bucket(const struct bpf_htab *htab, + unsigned long *pflags) + { + unsigned long flags; ++ bool use_raw_lock; + + hash = hash & HASHTAB_MAP_LOCK_MASK; + +- migrate_disable(); ++ use_raw_lock = htab_use_raw_lock(htab); ++ if (use_raw_lock) ++ preempt_disable(); ++ else ++ migrate_disable(); + if (unlikely(__this_cpu_inc_return(*(htab->map_locked[hash])) != 1)) { + __this_cpu_dec(*(htab->map_locked[hash])); +- migrate_enable(); ++ if (use_raw_lock) ++ preempt_enable(); ++ else ++ migrate_enable(); + return -EBUSY; + } + +- if (htab_use_raw_lock(htab)) ++ if (use_raw_lock) + raw_spin_lock_irqsave(&b->raw_lock, flags); + else + spin_lock_irqsave(&b->lock, flags); +@@ -185,13 +193,18 @@ static inline void htab_unlock_bucket(const struct bpf_htab *htab, + struct bucket *b, u32 hash, + unsigned long flags) + { ++ bool use_raw_lock = htab_use_raw_lock(htab); ++ + hash = hash & HASHTAB_MAP_LOCK_MASK; +- if (htab_use_raw_lock(htab)) ++ if (use_raw_lock) + raw_spin_unlock_irqrestore(&b->raw_lock, flags); + else + spin_unlock_irqrestore(&b->lock, flags); + __this_cpu_dec(*(htab->map_locked[hash])); +- migrate_enable(); ++ if (use_raw_lock) ++ preempt_enable(); ++ else ++ migrate_enable(); + } + + static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node); +@@ -1691,8 +1704,11 @@ again_nocopy: + /* do not grab the lock unless need it (bucket_cnt > 0). */ + if (locked) { + ret = htab_lock_bucket(htab, b, batch, &flags); +- if (ret) +- goto next_batch; ++ if (ret) { ++ rcu_read_unlock(); ++ bpf_enable_instrumentation(); ++ goto after_loop; ++ } + } + + bucket_cnt = 0; +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 9853db0ce487b..ed7649b047041 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -584,7 +584,7 @@ BPF_CALL_3(bpf_strncmp, const char *, s1, u32, s1_sz, const char *, s2) + return strncmp(s1, s2, s1_sz); + } + +-const struct bpf_func_proto bpf_strncmp_proto = { ++static const struct bpf_func_proto bpf_strncmp_proto = { + .func = bpf_strncmp, + .gpl_only = false, + .ret_type = RET_INTEGER, +@@ -1402,7 +1402,7 @@ BPF_CALL_2(bpf_kptr_xchg, void *, map_value, void *, ptr) + */ + #define BPF_PTR_POISON ((void *)((0xeB9FUL << 2) + POISON_POINTER_DELTA)) + +-const struct bpf_func_proto bpf_kptr_xchg_proto = { ++static const struct bpf_func_proto bpf_kptr_xchg_proto = { + .func = bpf_kptr_xchg, + .gpl_only = false, + .ret_type = RET_PTR_TO_BTF_ID_OR_NULL, +@@ -1468,6 +1468,8 @@ BPF_CALL_4(bpf_dynptr_from_mem, void *, data, u32, size, u64, flags, struct bpf_ + { + int err; + ++ BTF_TYPE_EMIT(struct bpf_dynptr); ++ + err = bpf_dynptr_check_size(size); + if (err) + goto error; +@@ -1487,7 +1489,7 @@ error: + return err; + } + +-const struct bpf_func_proto bpf_dynptr_from_mem_proto = { ++static const struct bpf_func_proto bpf_dynptr_from_mem_proto = { + .func = bpf_dynptr_from_mem, + .gpl_only = false, + .ret_type = RET_INTEGER, +@@ -1514,7 +1516,7 @@ BPF_CALL_5(bpf_dynptr_read, void *, dst, u32, len, struct bpf_dynptr_kern *, src + return 0; + } + +-const struct bpf_func_proto bpf_dynptr_read_proto = { ++static const struct bpf_func_proto bpf_dynptr_read_proto = { + .func = bpf_dynptr_read, + .gpl_only = false, + .ret_type = RET_INTEGER, +@@ -1542,7 +1544,7 @@ BPF_CALL_5(bpf_dynptr_write, struct bpf_dynptr_kern *, dst, u32, offset, void *, + return 0; + } + +-const struct bpf_func_proto bpf_dynptr_write_proto = { ++static const struct bpf_func_proto bpf_dynptr_write_proto = { + .func = bpf_dynptr_write, + .gpl_only = false, + .ret_type = RET_INTEGER, +@@ -1570,7 +1572,7 @@ BPF_CALL_3(bpf_dynptr_data, struct bpf_dynptr_kern *, ptr, u32, offset, u32, len + return (unsigned long)(ptr->data + ptr->offset + offset); + } + +-const struct bpf_func_proto bpf_dynptr_data_proto = { ++static const struct bpf_func_proto bpf_dynptr_data_proto = { + .func = bpf_dynptr_data, + .gpl_only = false, + .ret_type = RET_PTR_TO_DYNPTR_MEM_OR_NULL, +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index d334aeb234076..494ba88054e81 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -4361,7 +4361,9 @@ static int bpf_task_fd_query(const union bpf_attr *attr, + if (attr->task_fd_query.flags != 0) + return -EINVAL; + ++ rcu_read_lock(); + task = get_pid_task(find_vpid(pid), PIDTYPE_PID); ++ rcu_read_unlock(); + if (!task) + return -ENOENT; + +@@ -5138,7 +5140,7 @@ BPF_CALL_4(bpf_kallsyms_lookup_name, const char *, name, int, name_sz, int, flag + return *res ? 0 : -ENOENT; + } + +-const struct bpf_func_proto bpf_kallsyms_lookup_name_proto = { ++static const struct bpf_func_proto bpf_kallsyms_lookup_name_proto = { + .func = bpf_kallsyms_lookup_name, + .gpl_only = false, + .ret_type = RET_INTEGER, +diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c +index 93c7675f0c9e7..fe4f4d9d043b4 100644 +--- a/kernel/bpf/trampoline.c ++++ b/kernel/bpf/trampoline.c +@@ -585,7 +585,7 @@ u64 notrace __bpf_prog_enter(struct bpf_prog *prog, struct bpf_tramp_run_ctx *ru + + run_ctx->saved_run_ctx = bpf_set_run_ctx(&run_ctx->run_ctx); + +- if (unlikely(__this_cpu_inc_return(*(prog->active)) != 1)) { ++ if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) { + inc_misses_counter(prog); + return 0; + } +@@ -620,7 +620,7 @@ void notrace __bpf_prog_exit(struct bpf_prog *prog, u64 start, struct bpf_tramp_ + bpf_reset_run_ctx(run_ctx->saved_run_ctx); + + update_prog_stats(prog, start); +- __this_cpu_dec(*(prog->active)); ++ this_cpu_dec(*(prog->active)); + migrate_enable(); + rcu_read_unlock(); + } +@@ -631,7 +631,7 @@ u64 notrace __bpf_prog_enter_sleepable(struct bpf_prog *prog, struct bpf_tramp_r + migrate_disable(); + might_fault(); + +- if (unlikely(__this_cpu_inc_return(*(prog->active)) != 1)) { ++ if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) { + inc_misses_counter(prog); + return 0; + } +@@ -647,7 +647,7 @@ void notrace __bpf_prog_exit_sleepable(struct bpf_prog *prog, u64 start, + bpf_reset_run_ctx(run_ctx->saved_run_ctx); + + update_prog_stats(prog, start); +- __this_cpu_dec(*(prog->active)); ++ this_cpu_dec(*(prog->active)); + migrate_enable(); + rcu_read_unlock_trace(); + } +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 339147061127a..b908ff6e520fe 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -467,25 +467,11 @@ static bool type_is_rdonly_mem(u32 type) + return type & MEM_RDONLY; + } + +-static bool arg_type_may_be_refcounted(enum bpf_arg_type type) +-{ +- return type == ARG_PTR_TO_SOCK_COMMON; +-} +- + static bool type_may_be_null(u32 type) + { + return type & PTR_MAYBE_NULL; + } + +-static bool may_be_acquire_function(enum bpf_func_id func_id) +-{ +- return func_id == BPF_FUNC_sk_lookup_tcp || +- func_id == BPF_FUNC_sk_lookup_udp || +- func_id == BPF_FUNC_skc_lookup_tcp || +- func_id == BPF_FUNC_map_lookup_elem || +- func_id == BPF_FUNC_ringbuf_reserve; +-} +- + static bool is_acquire_function(enum bpf_func_id func_id, + const struct bpf_map *map) + { +@@ -518,6 +504,26 @@ static bool is_ptr_cast_function(enum bpf_func_id func_id) + func_id == BPF_FUNC_skc_to_tcp_request_sock; + } + ++static bool is_dynptr_acquire_function(enum bpf_func_id func_id) ++{ ++ return func_id == BPF_FUNC_dynptr_data; ++} ++ ++static bool helper_multiple_ref_obj_use(enum bpf_func_id func_id, ++ const struct bpf_map *map) ++{ ++ int ref_obj_uses = 0; ++ ++ if (is_ptr_cast_function(func_id)) ++ ref_obj_uses++; ++ if (is_acquire_function(func_id, map)) ++ ref_obj_uses++; ++ if (is_dynptr_acquire_function(func_id)) ++ ref_obj_uses++; ++ ++ return ref_obj_uses > 1; ++} ++ + static bool is_cmpxchg_insn(const struct bpf_insn *insn) + { + return BPF_CLASS(insn->code) == BPF_STX && +@@ -1086,6 +1092,7 @@ static int acquire_reference_state(struct bpf_verifier_env *env, int insn_idx) + id = ++env->id_gen; + state->refs[new_ofs].id = id; + state->refs[new_ofs].insn_idx = insn_idx; ++ state->refs[new_ofs].callback_ref = state->in_callback_fn ? state->frameno : 0; + + return id; + } +@@ -1098,6 +1105,9 @@ static int release_reference_state(struct bpf_func_state *state, int ptr_id) + last_idx = state->acquired_refs - 1; + for (i = 0; i < state->acquired_refs; i++) { + if (state->refs[i].id == ptr_id) { ++ /* Cannot release caller references in callbacks */ ++ if (state->in_callback_fn && state->refs[i].callback_ref != state->frameno) ++ return -EINVAL; + if (last_idx && i != last_idx) + memcpy(&state->refs[i], &state->refs[last_idx], + sizeof(*state->refs)); +@@ -6456,33 +6466,6 @@ static bool check_arg_pair_ok(const struct bpf_func_proto *fn) + return true; + } + +-static bool check_refcount_ok(const struct bpf_func_proto *fn, int func_id) +-{ +- int count = 0; +- +- if (arg_type_may_be_refcounted(fn->arg1_type)) +- count++; +- if (arg_type_may_be_refcounted(fn->arg2_type)) +- count++; +- if (arg_type_may_be_refcounted(fn->arg3_type)) +- count++; +- if (arg_type_may_be_refcounted(fn->arg4_type)) +- count++; +- if (arg_type_may_be_refcounted(fn->arg5_type)) +- count++; +- +- /* A reference acquiring function cannot acquire +- * another refcounted ptr. +- */ +- if (may_be_acquire_function(func_id) && count) +- return false; +- +- /* We only support one arg being unreferenced at the moment, +- * which is sufficient for the helper functions we have right now. +- */ +- return count <= 1; +-} +- + static bool check_btf_id_ok(const struct bpf_func_proto *fn) + { + int i; +@@ -6506,8 +6489,7 @@ static int check_func_proto(const struct bpf_func_proto *fn, int func_id, + { + return check_raw_mode_ok(fn) && + check_arg_pair_ok(fn) && +- check_btf_id_ok(fn) && +- check_refcount_ok(fn, func_id) ? 0 : -EINVAL; ++ check_btf_id_ok(fn) ? 0 : -EINVAL; + } + + /* Packet data might have moved, any old PTR_TO_PACKET[_META,_END] +@@ -6941,10 +6923,17 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) + caller->regs[BPF_REG_0] = *r0; + } + +- /* Transfer references to the caller */ +- err = copy_reference_state(caller, callee); +- if (err) +- return err; ++ /* callback_fn frame should have released its own additions to parent's ++ * reference state at this point, or check_reference_leak would ++ * complain, hence it must be the same as the caller. There is no need ++ * to copy it back. ++ */ ++ if (!callee->in_callback_fn) { ++ /* Transfer references to the caller */ ++ err = copy_reference_state(caller, callee); ++ if (err) ++ return err; ++ } + + *insn_idx = callee->callsite + 1; + if (env->log.level & BPF_LOG_LEVEL) { +@@ -7066,13 +7055,20 @@ record_func_key(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta, + static int check_reference_leak(struct bpf_verifier_env *env) + { + struct bpf_func_state *state = cur_func(env); ++ bool refs_lingering = false; + int i; + ++ if (state->frameno && !state->in_callback_fn) ++ return 0; ++ + for (i = 0; i < state->acquired_refs; i++) { ++ if (state->in_callback_fn && state->refs[i].callback_ref != state->frameno) ++ continue; + verbose(env, "Unreleased reference id=%d alloc_insn=%d\n", + state->refs[i].id, state->refs[i].insn_idx); ++ refs_lingering = true; + } +- return state->acquired_refs ? -EINVAL : 0; ++ return refs_lingering ? -EINVAL : 0; + } + + static int check_bpf_snprintf_call(struct bpf_verifier_env *env, +@@ -7410,6 +7406,12 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn + if (type_may_be_null(regs[BPF_REG_0].type)) + regs[BPF_REG_0].id = ++env->id_gen; + ++ if (helper_multiple_ref_obj_use(func_id, meta.map_ptr)) { ++ verbose(env, "verifier internal error: func %s#%d sets ref_obj_id more than once\n", ++ func_id_name(func_id), func_id); ++ return -EFAULT; ++ } ++ + if (is_ptr_cast_function(func_id)) { + /* For release_reference() */ + regs[BPF_REG_0].ref_obj_id = meta.ref_obj_id; +@@ -7422,10 +7424,10 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn + regs[BPF_REG_0].id = id; + /* For release_reference() */ + regs[BPF_REG_0].ref_obj_id = id; +- } else if (func_id == BPF_FUNC_dynptr_data) { ++ } else if (is_dynptr_acquire_function(func_id)) { + int dynptr_id = 0, i; + +- /* Find the id of the dynptr we're acquiring a reference to */ ++ /* Find the id of the dynptr we're tracking the reference of */ + for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) { + if (arg_type_is_dynptr(fn->arg_type[i])) { + if (dynptr_id) { +@@ -12260,6 +12262,16 @@ static int do_check(struct bpf_verifier_env *env) + return -EINVAL; + } + ++ /* We must do check_reference_leak here before ++ * prepare_func_exit to handle the case when ++ * state->curframe > 0, it may be a callback ++ * function, for which reference_state must ++ * match caller reference state when it exits. ++ */ ++ err = check_reference_leak(env); ++ if (err) ++ return err; ++ + if (state->curframe) { + /* exit from nested function */ + err = prepare_func_exit(env, &env->insn_idx); +@@ -12269,10 +12281,6 @@ static int do_check(struct bpf_verifier_env *env) + continue; + } + +- err = check_reference_leak(env); +- if (err) +- return err; +- + err = check_return_code(env); + if (err) + return err; +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 80c23f48f3b4b..90019724c7191 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -6615,8 +6615,12 @@ struct cgroup *cgroup_get_from_path(const char *path) + { + struct kernfs_node *kn; + struct cgroup *cgrp = ERR_PTR(-ENOENT); ++ struct cgroup *root_cgrp; + +- kn = kernfs_walk_and_get(cgrp_dfl_root.cgrp.kn, path); ++ spin_lock_irq(&css_set_lock); ++ root_cgrp = current_cgns_cgroup_from_root(&cgrp_dfl_root); ++ kn = kernfs_walk_and_get(root_cgrp->kn, path); ++ spin_unlock_irq(&css_set_lock); + if (!kn) + goto out; + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 1f3a55297f39d..50bf837571ac8 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -33,6 +33,7 @@ + #include <linux/interrupt.h> + #include <linux/kernel.h> + #include <linux/kmod.h> ++#include <linux/kthread.h> + #include <linux/list.h> + #include <linux/mempolicy.h> + #include <linux/mm.h> +@@ -1127,10 +1128,18 @@ static void update_tasks_cpumask(struct cpuset *cs) + { + struct css_task_iter it; + struct task_struct *task; ++ bool top_cs = cs == &top_cpuset; + + css_task_iter_start(&cs->css, 0, &it); +- while ((task = css_task_iter_next(&it))) ++ while ((task = css_task_iter_next(&it))) { ++ /* ++ * Percpu kthreads in top_cpuset are ignored ++ */ ++ if (top_cs && (task->flags & PF_KTHREAD) && ++ kthread_is_per_cpu(task)) ++ continue; + set_cpus_allowed_ptr(task, cs->effective_cpus); ++ } + css_task_iter_end(&it); + } + +@@ -2092,12 +2101,7 @@ static int update_prstate(struct cpuset *cs, int new_prs) + update_flag(CS_CPU_EXCLUSIVE, cs, 0); + } + +- /* +- * Update cpumask of parent's tasks except when it is the top +- * cpuset as some system daemons cannot be mapped to other CPUs. +- */ +- if (parent != &top_cpuset) +- update_tasks_cpumask(parent); ++ update_tasks_cpumask(parent); + + if (parent->child_ecpus_count) + update_sibling_cpumasks(parent, cs, &tmpmask); +diff --git a/kernel/livepatch/transition.c b/kernel/livepatch/transition.c +index 5d03a2ad10661..30187b1d82759 100644 +--- a/kernel/livepatch/transition.c ++++ b/kernel/livepatch/transition.c +@@ -610,9 +610,23 @@ void klp_reverse_transition(void) + /* Called from copy_process() during fork */ + void klp_copy_process(struct task_struct *child) + { +- child->patch_state = current->patch_state; + +- /* TIF_PATCH_PENDING gets copied in setup_thread_stack() */ ++ /* ++ * The parent process may have gone through a KLP transition since ++ * the thread flag was copied in setup_thread_stack earlier. Bring ++ * the task flag up to date with the parent here. ++ * ++ * The operation is serialized against all klp_*_transition() ++ * operations by the tasklist_lock. The only exception is ++ * klp_update_patch_state(current), but we cannot race with ++ * that because we are current. ++ */ ++ if (test_tsk_thread_flag(current, TIF_PATCH_PENDING)) ++ set_tsk_thread_flag(child, TIF_PATCH_PENDING); ++ else ++ clear_tsk_thread_flag(child, TIF_PATCH_PENDING); ++ ++ child->patch_state = current->patch_state; + } + + /* +diff --git a/kernel/module/tracking.c b/kernel/module/tracking.c +index 7f8133044d092..af52cabfe6321 100644 +--- a/kernel/module/tracking.c ++++ b/kernel/module/tracking.c +@@ -21,6 +21,9 @@ int try_add_tainted_module(struct module *mod) + + module_assert_mutex_or_preempt(); + ++ if (!mod->taints) ++ goto out; ++ + list_for_each_entry_rcu(mod_taint, &unloaded_tainted_modules, list, + lockdep_is_held(&module_mutex)) { + if (!strcmp(mod_taint->name, mod->name) && +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index c25ba442044a6..54a3a19c4c0ba 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -3508,15 +3508,16 @@ static void fill_page_cache_func(struct work_struct *work) + bnode = (struct kvfree_rcu_bulk_data *) + __get_free_page(GFP_KERNEL | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN); + +- if (bnode) { +- raw_spin_lock_irqsave(&krcp->lock, flags); +- pushed = put_cached_bnode(krcp, bnode); +- raw_spin_unlock_irqrestore(&krcp->lock, flags); ++ if (!bnode) ++ break; + +- if (!pushed) { +- free_page((unsigned long) bnode); +- break; +- } ++ raw_spin_lock_irqsave(&krcp->lock, flags); ++ pushed = put_cached_bnode(krcp, bnode); ++ raw_spin_unlock_irqrestore(&krcp->lock, flags); ++ ++ if (!pushed) { ++ free_page((unsigned long) bnode); ++ break; + } + } + +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index c8ba0fe17267c..d164938528cde 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -641,7 +641,8 @@ static void rcu_read_unlock_special(struct task_struct *t) + + expboost = (t->rcu_blocked_node && READ_ONCE(t->rcu_blocked_node->exp_tasks)) || + (rdp->grpmask & READ_ONCE(rnp->expmask)) || +- IS_ENABLED(CONFIG_RCU_STRICT_GRACE_PERIOD) || ++ (IS_ENABLED(CONFIG_RCU_STRICT_GRACE_PERIOD) && ++ ((rdp->grpmask & READ_ONCE(rnp->qsmask)) || t->rcu_blocked_node)) || + (IS_ENABLED(CONFIG_RCU_BOOST) && irqs_were_disabled && + t->rcu_blocked_node); + // Need to defer quiescent state until everything is enabled. +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 88589d74a892e..af13fdf1d86c3 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1026,6 +1026,22 @@ static const struct bpf_func_proto bpf_get_func_ip_proto_tracing = { + .arg1_type = ARG_PTR_TO_CTX, + }; + ++#ifdef CONFIG_X86_KERNEL_IBT ++static unsigned long get_entry_ip(unsigned long fentry_ip) ++{ ++ u32 instr; ++ ++ /* Being extra safe in here in case entry ip is on the page-edge. */ ++ if (get_kernel_nofault(instr, (u32 *) fentry_ip - 1)) ++ return fentry_ip; ++ if (is_endbr(instr)) ++ fentry_ip -= ENDBR_INSN_SIZE; ++ return fentry_ip; ++} ++#else ++#define get_entry_ip(fentry_ip) fentry_ip ++#endif ++ + BPF_CALL_1(bpf_get_func_ip_kprobe, struct pt_regs *, regs) + { + struct kprobe *kp = kprobe_running(); +@@ -2414,13 +2430,13 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + } + + static void +-kprobe_multi_link_handler(struct fprobe *fp, unsigned long entry_ip, ++kprobe_multi_link_handler(struct fprobe *fp, unsigned long fentry_ip, + struct pt_regs *regs) + { + struct bpf_kprobe_multi_link *link; + + link = container_of(fp, struct bpf_kprobe_multi_link, fp); +- kprobe_multi_link_prog_run(link, entry_ip, regs); ++ kprobe_multi_link_prog_run(link, get_entry_ip(fentry_ip), regs); + } + + static int symbols_cmp_r(const void *a, const void *b, const void *priv) +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 4baa99363b166..2efc1ddd8e26e 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1644,6 +1644,18 @@ ftrace_find_tramp_ops_any_other(struct dyn_ftrace *rec, struct ftrace_ops *op_ex + static struct ftrace_ops * + ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops); + ++static bool skip_record(struct dyn_ftrace *rec) ++{ ++ /* ++ * At boot up, weak functions are set to disable. Function tracing ++ * can be enabled before they are, and they still need to be disabled now. ++ * If the record is disabled, still continue if it is marked as already ++ * enabled (this is needed to keep the accounting working). ++ */ ++ return rec->flags & FTRACE_FL_DISABLED && ++ !(rec->flags & FTRACE_FL_ENABLED); ++} ++ + static bool __ftrace_hash_rec_update(struct ftrace_ops *ops, + int filter_hash, + bool inc) +@@ -1693,7 +1705,7 @@ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops, + int in_hash = 0; + int match = 0; + +- if (rec->flags & FTRACE_FL_DISABLED) ++ if (skip_record(rec)) + continue; + + if (all) { +@@ -2090,7 +2102,7 @@ static int ftrace_check_record(struct dyn_ftrace *rec, bool enable, bool update) + + ftrace_bug_type = FTRACE_BUG_UNKNOWN; + +- if (rec->flags & FTRACE_FL_DISABLED) ++ if (skip_record(rec)) + return FTRACE_UPDATE_IGNORE; + + /* +@@ -2205,7 +2217,7 @@ static int ftrace_check_record(struct dyn_ftrace *rec, bool enable, bool update) + if (update) { + /* If there's no more users, clear all flags */ + if (!ftrace_rec_count(rec)) +- rec->flags = 0; ++ rec->flags &= FTRACE_FL_DISABLED; + else + /* + * Just disable the record, but keep the ops TRAMP +@@ -2599,7 +2611,7 @@ void __weak ftrace_replace_code(int mod_flags) + + do_for_each_ftrace_rec(pg, rec) { + +- if (rec->flags & FTRACE_FL_DISABLED) ++ if (skip_record(rec)) + continue; + + failed = __ftrace_replace_code(rec, enable); +@@ -6037,8 +6049,12 @@ int ftrace_regex_release(struct inode *inode, struct file *file) + + if (filter_hash) { + orig_hash = &iter->ops->func_hash->filter_hash; +- if (iter->tr && !list_empty(&iter->tr->mod_trace)) +- iter->hash->flags |= FTRACE_HASH_FL_MOD; ++ if (iter->tr) { ++ if (list_empty(&iter->tr->mod_trace)) ++ iter->hash->flags &= ~FTRACE_HASH_FL_MOD; ++ else ++ iter->hash->flags |= FTRACE_HASH_FL_MOD; ++ } + } else + orig_hash = &iter->ops->func_hash->notrace_hash; + +diff --git a/kernel/trace/kprobe_event_gen_test.c b/kernel/trace/kprobe_event_gen_test.c +index 18b0f1cbb947f..80e04a1e19772 100644 +--- a/kernel/trace/kprobe_event_gen_test.c ++++ b/kernel/trace/kprobe_event_gen_test.c +@@ -35,6 +35,45 @@ + static struct trace_event_file *gen_kprobe_test; + static struct trace_event_file *gen_kretprobe_test; + ++#define KPROBE_GEN_TEST_FUNC "do_sys_open" ++ ++/* X86 */ ++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_32) ++#define KPROBE_GEN_TEST_ARG0 "dfd=%ax" ++#define KPROBE_GEN_TEST_ARG1 "filename=%dx" ++#define KPROBE_GEN_TEST_ARG2 "flags=%cx" ++#define KPROBE_GEN_TEST_ARG3 "mode=+4($stack)" ++ ++/* ARM64 */ ++#elif defined(CONFIG_ARM64) ++#define KPROBE_GEN_TEST_ARG0 "dfd=%x0" ++#define KPROBE_GEN_TEST_ARG1 "filename=%x1" ++#define KPROBE_GEN_TEST_ARG2 "flags=%x2" ++#define KPROBE_GEN_TEST_ARG3 "mode=%x3" ++ ++/* ARM */ ++#elif defined(CONFIG_ARM) ++#define KPROBE_GEN_TEST_ARG0 "dfd=%r0" ++#define KPROBE_GEN_TEST_ARG1 "filename=%r1" ++#define KPROBE_GEN_TEST_ARG2 "flags=%r2" ++#define KPROBE_GEN_TEST_ARG3 "mode=%r3" ++ ++/* RISCV */ ++#elif defined(CONFIG_RISCV) ++#define KPROBE_GEN_TEST_ARG0 "dfd=%a0" ++#define KPROBE_GEN_TEST_ARG1 "filename=%a1" ++#define KPROBE_GEN_TEST_ARG2 "flags=%a2" ++#define KPROBE_GEN_TEST_ARG3 "mode=%a3" ++ ++/* others */ ++#else ++#define KPROBE_GEN_TEST_ARG0 NULL ++#define KPROBE_GEN_TEST_ARG1 NULL ++#define KPROBE_GEN_TEST_ARG2 NULL ++#define KPROBE_GEN_TEST_ARG3 NULL ++#endif ++ ++ + /* + * Test to make sure we can create a kprobe event, then add more + * fields. +@@ -58,14 +97,14 @@ static int __init test_gen_kprobe_cmd(void) + * fields. + */ + ret = kprobe_event_gen_cmd_start(&cmd, "gen_kprobe_test", +- "do_sys_open", +- "dfd=%ax", "filename=%dx"); ++ KPROBE_GEN_TEST_FUNC, ++ KPROBE_GEN_TEST_ARG0, KPROBE_GEN_TEST_ARG1); + if (ret) + goto free; + + /* Use kprobe_event_add_fields to add the rest of the fields */ + +- ret = kprobe_event_add_fields(&cmd, "flags=%cx", "mode=+4($stack)"); ++ ret = kprobe_event_add_fields(&cmd, KPROBE_GEN_TEST_ARG2, KPROBE_GEN_TEST_ARG3); + if (ret) + goto free; + +@@ -128,7 +167,7 @@ static int __init test_gen_kretprobe_cmd(void) + * Define the kretprobe event. + */ + ret = kretprobe_event_gen_cmd_start(&cmd, "gen_kretprobe_test", +- "do_sys_open", ++ KPROBE_GEN_TEST_FUNC, + "$retval"); + if (ret) + goto free; +@@ -206,7 +245,7 @@ static void __exit kprobe_event_gen_test_exit(void) + WARN_ON(kprobe_event_delete("gen_kprobe_test")); + + /* Disable the event or you can't remove it */ +- WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr, ++ WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, + "kprobes", + "gen_kretprobe_test", false)); + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index d59b6a328b7fe..c3f354cfc5ba1 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -413,6 +413,7 @@ struct rb_irq_work { + struct irq_work work; + wait_queue_head_t waiters; + wait_queue_head_t full_waiters; ++ long wait_index; + bool waiters_pending; + bool full_waiters_pending; + bool wakeup_full; +@@ -917,12 +918,44 @@ static void rb_wake_up_waiters(struct irq_work *work) + struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work); + + wake_up_all(&rbwork->waiters); +- if (rbwork->wakeup_full) { ++ if (rbwork->full_waiters_pending || rbwork->wakeup_full) { + rbwork->wakeup_full = false; ++ rbwork->full_waiters_pending = false; + wake_up_all(&rbwork->full_waiters); + } + } + ++/** ++ * ring_buffer_wake_waiters - wake up any waiters on this ring buffer ++ * @buffer: The ring buffer to wake waiters on ++ * ++ * In the case of a file that represents a ring buffer is closing, ++ * it is prudent to wake up any waiters that are on this. ++ */ ++void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) ++{ ++ struct ring_buffer_per_cpu *cpu_buffer; ++ struct rb_irq_work *rbwork; ++ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ ++ /* Wake up individual ones too. One level recursion */ ++ for_each_buffer_cpu(buffer, cpu) ++ ring_buffer_wake_waiters(buffer, cpu); ++ ++ rbwork = &buffer->irq_work; ++ } else { ++ cpu_buffer = buffer->buffers[cpu]; ++ rbwork = &cpu_buffer->irq_work; ++ } ++ ++ rbwork->wait_index++; ++ /* make sure the waiters see the new index */ ++ smp_wmb(); ++ ++ rb_wake_up_waiters(&rbwork->work); ++} ++ + /** + * ring_buffer_wait - wait for input to the ring buffer + * @buffer: buffer to wait on +@@ -938,6 +971,7 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + struct ring_buffer_per_cpu *cpu_buffer; + DEFINE_WAIT(wait); + struct rb_irq_work *work; ++ long wait_index; + int ret = 0; + + /* +@@ -956,6 +990,7 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + work = &cpu_buffer->irq_work; + } + ++ wait_index = READ_ONCE(work->wait_index); + + while (true) { + if (full) +@@ -1011,7 +1046,7 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + nr_pages = cpu_buffer->nr_pages; + dirty = ring_buffer_nr_dirty_pages(buffer, cpu); + if (!cpu_buffer->shortest_full || +- cpu_buffer->shortest_full < full) ++ cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; + raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + if (!pagebusy && +@@ -1020,6 +1055,11 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + } + + schedule(); ++ ++ /* Make sure to see the new wait index */ ++ smp_rmb(); ++ if (wait_index != work->wait_index) ++ break; + } + + if (full) +@@ -2608,6 +2648,9 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, + /* Mark the rest of the page with padding */ + rb_event_set_padding(event); + ++ /* Make sure the padding is visible before the write update */ ++ smp_wmb(); ++ + /* Set the write back to the previous setting */ + local_sub(length, &tail_page->write); + return; +@@ -2619,6 +2662,9 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer, + /* time delta must be non zero */ + event->time_delta = 1; + ++ /* Make sure the padding is visible before the tail_page->write update */ ++ smp_wmb(); ++ + /* Set write to end of buffer */ + length = (tail + length) - BUF_PAGE_SIZE; + local_sub(length, &tail_page->write); +@@ -4587,6 +4633,33 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) + arch_spin_unlock(&cpu_buffer->lock); + local_irq_restore(flags); + ++ /* ++ * The writer has preempt disable, wait for it. But not forever ++ * Although, 1 second is pretty much "forever" ++ */ ++#define USECS_WAIT 1000000 ++ for (nr_loops = 0; nr_loops < USECS_WAIT; nr_loops++) { ++ /* If the write is past the end of page, a writer is still updating it */ ++ if (likely(!reader || rb_page_write(reader) <= BUF_PAGE_SIZE)) ++ break; ++ ++ udelay(1); ++ ++ /* Get the latest version of the reader write value */ ++ smp_rmb(); ++ } ++ ++ /* The writer is not moving forward? Something is wrong */ ++ if (RB_WARN_ON(cpu_buffer, nr_loops == USECS_WAIT)) ++ reader = NULL; ++ ++ /* ++ * Make sure we see any padding after the write update ++ * (see rb_reset_tail()) ++ */ ++ smp_rmb(); ++ ++ + return reader; + } + +@@ -5616,7 +5689,15 @@ int ring_buffer_read_page(struct trace_buffer *buffer, + unsigned int pos = 0; + unsigned int size; + +- if (full) ++ /* ++ * If a full page is expected, this can still be returned ++ * if there's been a previous partial read and the ++ * rest of the page can be read and the commit page is off ++ * the reader page. ++ */ ++ if (full && ++ (!read || (len < (commit - read)) || ++ cpu_buffer->reader_page == cpu_buffer->commit_page)) + goto out_unlock; + + if (len > (commit - read)) +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index b8dd546270750..818fdf24f5ec6 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1193,12 +1193,14 @@ void *tracing_cond_snapshot_data(struct trace_array *tr) + { + void *cond_data = NULL; + ++ local_irq_disable(); + arch_spin_lock(&tr->max_lock); + + if (tr->cond_snapshot) + cond_data = tr->cond_snapshot->cond_data; + + arch_spin_unlock(&tr->max_lock); ++ local_irq_enable(); + + return cond_data; + } +@@ -1334,9 +1336,11 @@ int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data, + goto fail_unlock; + } + ++ local_irq_disable(); + arch_spin_lock(&tr->max_lock); + tr->cond_snapshot = cond_snapshot; + arch_spin_unlock(&tr->max_lock); ++ local_irq_enable(); + + mutex_unlock(&trace_types_lock); + +@@ -1363,6 +1367,7 @@ int tracing_snapshot_cond_disable(struct trace_array *tr) + { + int ret = 0; + ++ local_irq_disable(); + arch_spin_lock(&tr->max_lock); + + if (!tr->cond_snapshot) +@@ -1373,6 +1378,7 @@ int tracing_snapshot_cond_disable(struct trace_array *tr) + } + + arch_spin_unlock(&tr->max_lock); ++ local_irq_enable(); + + return ret; + } +@@ -2200,6 +2206,11 @@ static size_t tgid_map_max; + + #define SAVED_CMDLINES_DEFAULT 128 + #define NO_CMDLINE_MAP UINT_MAX ++/* ++ * Preemption must be disabled before acquiring trace_cmdline_lock. ++ * The various trace_arrays' max_lock must be acquired in a context ++ * where interrupt is disabled. ++ */ + static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED; + struct saved_cmdlines_buffer { + unsigned map_pid_to_cmdline[PID_MAX_DEFAULT+1]; +@@ -2412,7 +2423,11 @@ static int trace_save_cmdline(struct task_struct *tsk) + * the lock, but we also don't want to spin + * nor do we want to disable interrupts, + * so if we miss here, then better luck next time. ++ * ++ * This is called within the scheduler and wake up, so interrupts ++ * had better been disabled and run queue lock been held. + */ ++ lockdep_assert_preemption_disabled(); + if (!arch_spin_trylock(&trace_cmdline_lock)) + return 0; + +@@ -5890,9 +5905,11 @@ tracing_saved_cmdlines_size_read(struct file *filp, char __user *ubuf, + char buf[64]; + int r; + ++ preempt_disable(); + arch_spin_lock(&trace_cmdline_lock); + r = scnprintf(buf, sizeof(buf), "%u\n", savedcmd->cmdline_num); + arch_spin_unlock(&trace_cmdline_lock); ++ preempt_enable(); + + return simple_read_from_buffer(ubuf, cnt, ppos, buf, r); + } +@@ -5917,10 +5934,12 @@ static int tracing_resize_saved_cmdlines(unsigned int val) + return -ENOMEM; + } + ++ preempt_disable(); + arch_spin_lock(&trace_cmdline_lock); + savedcmd_temp = savedcmd; + savedcmd = s; + arch_spin_unlock(&trace_cmdline_lock); ++ preempt_enable(); + free_saved_cmdlines_buffer(savedcmd_temp); + + return 0; +@@ -6373,10 +6392,12 @@ int tracing_set_tracer(struct trace_array *tr, const char *buf) + + #ifdef CONFIG_TRACER_SNAPSHOT + if (t->use_max_tr) { ++ local_irq_disable(); + arch_spin_lock(&tr->max_lock); + if (tr->cond_snapshot) + ret = -EBUSY; + arch_spin_unlock(&tr->max_lock); ++ local_irq_enable(); + if (ret) + goto out; + } +@@ -6407,12 +6428,12 @@ int tracing_set_tracer(struct trace_array *tr, const char *buf) + if (tr->current_trace->reset) + tr->current_trace->reset(tr); + ++#ifdef CONFIG_TRACER_MAX_TRACE ++ had_max_tr = tr->current_trace->use_max_tr; ++ + /* Current trace needs to be nop_trace before synchronize_rcu */ + tr->current_trace = &nop_trace; + +-#ifdef CONFIG_TRACER_MAX_TRACE +- had_max_tr = tr->allocated_snapshot; +- + if (had_max_tr && !t->use_max_tr) { + /* + * We need to make sure that the update_max_tr sees that +@@ -6425,11 +6446,13 @@ int tracing_set_tracer(struct trace_array *tr, const char *buf) + free_snapshot(tr); + } + +- if (t->use_max_tr && !had_max_tr) { ++ if (t->use_max_tr && !tr->allocated_snapshot) { + ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + goto out; + } ++#else ++ tr->current_trace = &nop_trace; + #endif + + if (t->init) { +@@ -7436,10 +7459,12 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + goto out; + } + ++ local_irq_disable(); + arch_spin_lock(&tr->max_lock); + if (tr->cond_snapshot) + ret = -EBUSY; + arch_spin_unlock(&tr->max_lock); ++ local_irq_enable(); + if (ret) + goto out; + +@@ -8137,6 +8162,12 @@ static int tracing_buffers_release(struct inode *inode, struct file *file) + + __trace_array_put(iter->tr); + ++ iter->wait_index++; ++ /* Make sure the waiters see the new wait_index */ ++ smp_wmb(); ++ ++ ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file); ++ + if (info->spare) + ring_buffer_free_read_page(iter->array_buffer->buffer, + info->spare_cpu, info->spare); +@@ -8290,6 +8321,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + + /* did we read anything? */ + if (!spd.nr_pages) { ++ long wait_index; ++ + if (ret) + goto out; + +@@ -8297,10 +8330,21 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK)) + goto out; + ++ wait_index = READ_ONCE(iter->wait_index); ++ + ret = wait_on_pipe(iter, iter->tr->buffer_percent); + if (ret) + goto out; + ++ /* No need to wait after waking up when tracing is off */ ++ if (!tracer_tracing_is_on(iter->tr)) ++ goto out; ++ ++ /* Make sure we see the new wait_index */ ++ smp_rmb(); ++ if (wait_index != iter->wait_index) ++ goto out; ++ + goto again; + } + +@@ -8311,12 +8355,34 @@ out: + return ret; + } + ++/* An ioctl call with cmd 0 to the ring buffer file will wake up all waiters */ ++static long tracing_buffers_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ struct ftrace_buffer_info *info = file->private_data; ++ struct trace_iterator *iter = &info->iter; ++ ++ if (cmd) ++ return -ENOIOCTLCMD; ++ ++ mutex_lock(&trace_types_lock); ++ ++ iter->wait_index++; ++ /* Make sure the waiters see the new wait_index */ ++ smp_wmb(); ++ ++ ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file); ++ ++ mutex_unlock(&trace_types_lock); ++ return 0; ++} ++ + static const struct file_operations tracing_buffers_fops = { + .open = tracing_buffers_open, + .read = tracing_buffers_read, + .poll = tracing_buffers_poll, + .release = tracing_buffers_release, + .splice_read = tracing_buffers_splice_read, ++ .unlocked_ioctl = tracing_buffers_ioctl, + .llseek = no_llseek, + }; + +@@ -9005,6 +9071,8 @@ rb_simple_write(struct file *filp, const char __user *ubuf, + tracer_tracing_off(tr); + if (tr->current_trace->stop) + tr->current_trace->stop(tr); ++ /* Wake up any waiters */ ++ ring_buffer_wake_waiters(buffer, RING_BUFFER_ALL_CPUS); + } + mutex_unlock(&trace_types_lock); + } +diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c +index 4c57fc89fa17b..29a66a9d42ae5 100644 +--- a/kernel/trace/trace_eprobe.c ++++ b/kernel/trace/trace_eprobe.c +@@ -16,6 +16,7 @@ + #include "trace_dynevent.h" + #include "trace_probe.h" + #include "trace_probe_tmpl.h" ++#include "trace_probe_kernel.h" + + #define EPROBE_EVENT_SYSTEM "eprobes" + +@@ -452,29 +453,14 @@ NOKPROBE_SYMBOL(process_fetch_insn) + static nokprobe_inline int + fetch_store_strlen_user(unsigned long addr) + { +- const void __user *uaddr = (__force const void __user *)addr; +- +- return strnlen_user_nofault(uaddr, MAX_STRING_SIZE); ++ return kern_fetch_store_strlen_user(addr); + } + + /* Return the length of string -- including null terminal byte */ + static nokprobe_inline int + fetch_store_strlen(unsigned long addr) + { +- int ret, len = 0; +- u8 c; +- +-#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE +- if (addr < TASK_SIZE) +- return fetch_store_strlen_user(addr); +-#endif +- +- do { +- ret = copy_from_kernel_nofault(&c, (u8 *)addr + len, 1); +- len++; +- } while (c && ret == 0 && len < MAX_STRING_SIZE); +- +- return (ret < 0) ? ret : len; ++ return kern_fetch_store_strlen(addr); + } + + /* +@@ -484,21 +470,7 @@ fetch_store_strlen(unsigned long addr) + static nokprobe_inline int + fetch_store_string_user(unsigned long addr, void *dest, void *base) + { +- const void __user *uaddr = (__force const void __user *)addr; +- int maxlen = get_loc_len(*(u32 *)dest); +- void *__dest; +- long ret; +- +- if (unlikely(!maxlen)) +- return -ENOMEM; +- +- __dest = get_loc_data(dest, base); +- +- ret = strncpy_from_user_nofault(__dest, uaddr, maxlen); +- if (ret >= 0) +- *(u32 *)dest = make_data_loc(ret, __dest - base); +- +- return ret; ++ return kern_fetch_store_string_user(addr, dest, base); + } + + /* +@@ -508,29 +480,7 @@ fetch_store_string_user(unsigned long addr, void *dest, void *base) + static nokprobe_inline int + fetch_store_string(unsigned long addr, void *dest, void *base) + { +- int maxlen = get_loc_len(*(u32 *)dest); +- void *__dest; +- long ret; +- +-#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE +- if ((unsigned long)addr < TASK_SIZE) +- return fetch_store_string_user(addr, dest, base); +-#endif +- +- if (unlikely(!maxlen)) +- return -ENOMEM; +- +- __dest = get_loc_data(dest, base); +- +- /* +- * Try to get string again, since the string can be changed while +- * probing. +- */ +- ret = strncpy_from_kernel_nofault(__dest, (void *)addr, maxlen); +- if (ret >= 0) +- *(u32 *)dest = make_data_loc(ret, __dest - base); +- +- return ret; ++ return kern_fetch_store_string(addr, dest, base); + } + + static nokprobe_inline int +diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c +index 5e8c07aef071b..e310052dc83ce 100644 +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -17,6 +17,8 @@ + /* for gfp flag names */ + #include <linux/trace_events.h> + #include <trace/events/mmflags.h> ++#include "trace_probe.h" ++#include "trace_probe_kernel.h" + + #include "trace_synth.h" + +@@ -409,6 +411,7 @@ static unsigned int trace_string(struct synth_trace_event *entry, + { + unsigned int len = 0; + char *str_field; ++ int ret; + + if (is_dynamic) { + u32 data_offset; +@@ -417,19 +420,27 @@ static unsigned int trace_string(struct synth_trace_event *entry, + data_offset += event->n_u64 * sizeof(u64); + data_offset += data_size; + +- str_field = (char *)entry + data_offset; +- +- len = strlen(str_val) + 1; +- strscpy(str_field, str_val, len); ++ len = kern_fetch_store_strlen((unsigned long)str_val); + + data_offset |= len << 16; + *(u32 *)&entry->fields[*n_u64] = data_offset; + ++ ret = kern_fetch_store_string((unsigned long)str_val, &entry->fields[*n_u64], entry); ++ + (*n_u64)++; + } else { + str_field = (char *)&entry->fields[*n_u64]; + +- strscpy(str_field, str_val, STR_VAR_LEN_MAX); ++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE ++ if ((unsigned long)str_val < TASK_SIZE) ++ ret = strncpy_from_user_nofault(str_field, str_val, STR_VAR_LEN_MAX); ++ else ++#endif ++ ret = strncpy_from_kernel_nofault(str_field, str_val, STR_VAR_LEN_MAX); ++ ++ if (ret < 0) ++ strcpy(str_field, FAULT_STRING); ++ + (*n_u64) += STR_VAR_LEN_MAX / sizeof(u64); + } + +@@ -462,7 +473,7 @@ static notrace void trace_event_raw_event_synth(void *__data, + val_idx = var_ref_idx[field_pos]; + str_val = (char *)(long)var_ref_vals[val_idx]; + +- len = strlen(str_val) + 1; ++ len = kern_fetch_store_strlen((unsigned long)str_val); + + fields_size += len; + } +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index a245ea673715d..656e2c239c532 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -20,6 +20,7 @@ + #include "trace_kprobe_selftest.h" + #include "trace_probe.h" + #include "trace_probe_tmpl.h" ++#include "trace_probe_kernel.h" + + #define KPROBE_EVENT_SYSTEM "kprobes" + #define KRETPROBE_MAXACTIVE_MAX 4096 +@@ -1219,29 +1220,14 @@ static const struct file_operations kprobe_profile_ops = { + static nokprobe_inline int + fetch_store_strlen_user(unsigned long addr) + { +- const void __user *uaddr = (__force const void __user *)addr; +- +- return strnlen_user_nofault(uaddr, MAX_STRING_SIZE); ++ return kern_fetch_store_strlen_user(addr); + } + + /* Return the length of string -- including null terminal byte */ + static nokprobe_inline int + fetch_store_strlen(unsigned long addr) + { +- int ret, len = 0; +- u8 c; +- +-#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE +- if (addr < TASK_SIZE) +- return fetch_store_strlen_user(addr); +-#endif +- +- do { +- ret = copy_from_kernel_nofault(&c, (u8 *)addr + len, 1); +- len++; +- } while (c && ret == 0 && len < MAX_STRING_SIZE); +- +- return (ret < 0) ? ret : len; ++ return kern_fetch_store_strlen(addr); + } + + /* +@@ -1251,21 +1237,7 @@ fetch_store_strlen(unsigned long addr) + static nokprobe_inline int + fetch_store_string_user(unsigned long addr, void *dest, void *base) + { +- const void __user *uaddr = (__force const void __user *)addr; +- int maxlen = get_loc_len(*(u32 *)dest); +- void *__dest; +- long ret; +- +- if (unlikely(!maxlen)) +- return -ENOMEM; +- +- __dest = get_loc_data(dest, base); +- +- ret = strncpy_from_user_nofault(__dest, uaddr, maxlen); +- if (ret >= 0) +- *(u32 *)dest = make_data_loc(ret, __dest - base); +- +- return ret; ++ return kern_fetch_store_string_user(addr, dest, base); + } + + /* +@@ -1275,29 +1247,7 @@ fetch_store_string_user(unsigned long addr, void *dest, void *base) + static nokprobe_inline int + fetch_store_string(unsigned long addr, void *dest, void *base) + { +- int maxlen = get_loc_len(*(u32 *)dest); +- void *__dest; +- long ret; +- +-#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE +- if ((unsigned long)addr < TASK_SIZE) +- return fetch_store_string_user(addr, dest, base); +-#endif +- +- if (unlikely(!maxlen)) +- return -ENOMEM; +- +- __dest = get_loc_data(dest, base); +- +- /* +- * Try to get string again, since the string can be changed while +- * probing. +- */ +- ret = strncpy_from_kernel_nofault(__dest, (void *)addr, maxlen); +- if (ret >= 0) +- *(u32 *)dest = make_data_loc(ret, __dest - base); +- +- return ret; ++ return kern_fetch_store_string(addr, dest, base); + } + + static nokprobe_inline int +diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c +index 313439920a8ce..78d536d3ff3db 100644 +--- a/kernel/trace/trace_osnoise.c ++++ b/kernel/trace/trace_osnoise.c +@@ -1786,8 +1786,9 @@ static int start_per_cpu_kthreads(void) + for_each_cpu(cpu, current_mask) { + retval = start_kthread(cpu); + if (retval) { ++ cpus_read_unlock(); + stop_per_cpu_kthreads(); +- break; ++ return retval; + } + } + +diff --git a/kernel/trace/trace_probe_kernel.h b/kernel/trace/trace_probe_kernel.h +new file mode 100644 +index 0000000000000..77dbd9ff97826 +--- /dev/null ++++ b/kernel/trace/trace_probe_kernel.h +@@ -0,0 +1,115 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __TRACE_PROBE_KERNEL_H_ ++#define __TRACE_PROBE_KERNEL_H_ ++ ++#define FAULT_STRING "(fault)" ++ ++/* ++ * This depends on trace_probe.h, but can not include it due to ++ * the way trace_probe_tmpl.h is used by trace_kprobe.c and trace_eprobe.c. ++ * Which means that any other user must include trace_probe.h before including ++ * this file. ++ */ ++/* Return the length of string -- including null terminal byte */ ++static nokprobe_inline int ++kern_fetch_store_strlen_user(unsigned long addr) ++{ ++ const void __user *uaddr = (__force const void __user *)addr; ++ int ret; ++ ++ ret = strnlen_user_nofault(uaddr, MAX_STRING_SIZE); ++ /* ++ * strnlen_user_nofault returns zero on fault, insert the ++ * FAULT_STRING when that occurs. ++ */ ++ if (ret <= 0) ++ return strlen(FAULT_STRING) + 1; ++ return ret; ++} ++ ++/* Return the length of string -- including null terminal byte */ ++static nokprobe_inline int ++kern_fetch_store_strlen(unsigned long addr) ++{ ++ int ret, len = 0; ++ u8 c; ++ ++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE ++ if (addr < TASK_SIZE) ++ return kern_fetch_store_strlen_user(addr); ++#endif ++ ++ do { ++ ret = copy_from_kernel_nofault(&c, (u8 *)addr + len, 1); ++ len++; ++ } while (c && ret == 0 && len < MAX_STRING_SIZE); ++ ++ /* For faults, return enough to hold the FAULT_STRING */ ++ return (ret < 0) ? strlen(FAULT_STRING) + 1 : len; ++} ++ ++static nokprobe_inline void set_data_loc(int ret, void *dest, void *__dest, void *base, int len) ++{ ++ if (ret >= 0) { ++ *(u32 *)dest = make_data_loc(ret, __dest - base); ++ } else { ++ strscpy(__dest, FAULT_STRING, len); ++ ret = strlen(__dest) + 1; ++ } ++} ++ ++/* ++ * Fetch a null-terminated string from user. Caller MUST set *(u32 *)buf ++ * with max length and relative data location. ++ */ ++static nokprobe_inline int ++kern_fetch_store_string_user(unsigned long addr, void *dest, void *base) ++{ ++ const void __user *uaddr = (__force const void __user *)addr; ++ int maxlen = get_loc_len(*(u32 *)dest); ++ void *__dest; ++ long ret; ++ ++ if (unlikely(!maxlen)) ++ return -ENOMEM; ++ ++ __dest = get_loc_data(dest, base); ++ ++ ret = strncpy_from_user_nofault(__dest, uaddr, maxlen); ++ set_data_loc(ret, dest, __dest, base, maxlen); ++ ++ return ret; ++} ++ ++/* ++ * Fetch a null-terminated string. Caller MUST set *(u32 *)buf with max ++ * length and relative data location. ++ */ ++static nokprobe_inline int ++kern_fetch_store_string(unsigned long addr, void *dest, void *base) ++{ ++ int maxlen = get_loc_len(*(u32 *)dest); ++ void *__dest; ++ long ret; ++ ++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE ++ if ((unsigned long)addr < TASK_SIZE) ++ return kern_fetch_store_string_user(addr, dest, base); ++#endif ++ ++ if (unlikely(!maxlen)) ++ return -ENOMEM; ++ ++ __dest = get_loc_data(dest, base); ++ ++ /* ++ * Try to get string again, since the string can be changed while ++ * probing. ++ */ ++ ret = strncpy_from_kernel_nofault(__dest, (void *)addr, maxlen); ++ set_data_loc(ret, dest, __dest, base, maxlen); ++ ++ return ret; ++} ++ ++#endif /* __TRACE_PROBE_KERNEL_H_ */ +diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug +index c399ab486557f..8c31c98f0bfce 100644 +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -231,6 +231,11 @@ config DEBUG_INFO + in the "Debug information" choice below, indicating that debug + information will be generated for build targets. + ++# Clang is known to generate .{s,u}leb128 with symbol deltas with DWARF5, which ++# some targets may not support: https://sourceware.org/bugzilla/show_bug.cgi?id=27215 ++config AS_HAS_NON_CONST_LEB128 ++ def_bool $(as-instr,.uleb128 .Lexpr_end4 - .Lexpr_start3\n.Lexpr_start3:\n.Lexpr_end4:) ++ + choice + prompt "Debug information" + depends on DEBUG_KERNEL +@@ -253,6 +258,7 @@ config DEBUG_INFO_NONE + config DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT + bool "Rely on the toolchain's implicit default DWARF version" + select DEBUG_INFO ++ depends on !CC_IS_CLANG || AS_IS_LLVM || CLANG_VERSION < 140000 || (AS_IS_GNU && AS_VERSION >= 23502 && AS_HAS_NON_CONST_LEB128) + help + The implicit default version of DWARF debug info produced by a + toolchain changes over time. +@@ -264,7 +270,7 @@ config DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT + config DEBUG_INFO_DWARF4 + bool "Generate DWARF Version 4 debuginfo" + select DEBUG_INFO +- depends on !CC_IS_CLANG || (CC_IS_CLANG && (AS_IS_LLVM || (AS_IS_GNU && AS_VERSION >= 23502))) ++ depends on !CC_IS_CLANG || AS_IS_LLVM || (AS_IS_GNU && AS_VERSION >= 23502) + help + Generate DWARF v4 debug info. This requires gcc 4.5+, binutils 2.35.2 + if using clang without clang's integrated assembler, and gdb 7.0+. +@@ -276,7 +282,7 @@ config DEBUG_INFO_DWARF4 + config DEBUG_INFO_DWARF5 + bool "Generate DWARF Version 5 debuginfo" + select DEBUG_INFO +- depends on !CC_IS_CLANG || (CC_IS_CLANG && (AS_IS_LLVM || (AS_IS_GNU && AS_VERSION >= 23502))) ++ depends on !CC_IS_CLANG || AS_IS_LLVM || (AS_IS_GNU && AS_VERSION >= 23502 && AS_HAS_NON_CONST_LEB128) + help + Generate DWARF v5 debug info. Requires binutils 2.35.2, gcc 5.0+ (gcc + 5.0+ accepts the -gdwarf-5 flag but only had partial support for some +diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c +index dd7f56af9aed3..c9b3d9e5d470f 100644 +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -211,10 +211,11 @@ static int ddebug_change(const struct ddebug_query *query, + continue; + #ifdef CONFIG_JUMP_LABEL + if (dp->flags & _DPRINTK_FLAGS_PRINT) { +- if (!(modifiers->flags & _DPRINTK_FLAGS_PRINT)) ++ if (!(newflags & _DPRINTK_FLAGS_PRINT)) + static_branch_disable(&dp->key.dd_key_true); +- } else if (modifiers->flags & _DPRINTK_FLAGS_PRINT) ++ } else if (newflags & _DPRINTK_FLAGS_PRINT) { + static_branch_enable(&dp->key.dd_key_true); ++ } + #endif + dp->flags = newflags; + v4pr_info("changed %s:%d [%s]%s =%s\n", +@@ -383,10 +384,6 @@ static int ddebug_parse_query(char *words[], int nwords, + return -EINVAL; + } + +- if (modname) +- /* support $modname.dyndbg=<multiple queries> */ +- query->module = modname; +- + for (i = 0; i < nwords; i += 2) { + char *keyword = words[i]; + char *arg = words[i+1]; +@@ -427,6 +424,13 @@ static int ddebug_parse_query(char *words[], int nwords, + if (rc) + return rc; + } ++ if (!query->module && modname) ++ /* ++ * support $modname.dyndbg=<multiple queries>, when ++ * not given in the query itself ++ */ ++ query->module = modname; ++ + vpr_info_dq(query, "parsed"); + return 0; + } +@@ -553,35 +557,6 @@ static int ddebug_exec_queries(char *query, const char *modname) + return nfound; + } + +-/** +- * dynamic_debug_exec_queries - select and change dynamic-debug prints +- * @query: query-string described in admin-guide/dynamic-debug-howto +- * @modname: string containing module name, usually &module.mod_name +- * +- * This uses the >/proc/dynamic_debug/control reader, allowing module +- * authors to modify their dynamic-debug callsites. The modname is +- * canonically struct module.mod_name, but can also be null or a +- * module-wildcard, for example: "drm*". +- */ +-int dynamic_debug_exec_queries(const char *query, const char *modname) +-{ +- int rc; +- char *qry; /* writable copy of query */ +- +- if (!query) { +- pr_err("non-null query/command string expected\n"); +- return -EINVAL; +- } +- qry = kstrndup(query, PAGE_SIZE, GFP_KERNEL); +- if (!qry) +- return -ENOMEM; +- +- rc = ddebug_exec_queries(qry, modname); +- kfree(qry); +- return rc; +-} +-EXPORT_SYMBOL_GPL(dynamic_debug_exec_queries); +- + #define PREFIX_SIZE 64 + + static int remaining(int wrote) +diff --git a/lib/once.c b/lib/once.c +index 59149bf3bfb4a..351f66aad310a 100644 +--- a/lib/once.c ++++ b/lib/once.c +@@ -66,3 +66,33 @@ void __do_once_done(bool *done, struct static_key_true *once_key, + once_disable_jump(once_key, mod); + } + EXPORT_SYMBOL(__do_once_done); ++ ++static DEFINE_MUTEX(once_mutex); ++ ++bool __do_once_slow_start(bool *done) ++ __acquires(once_mutex) ++{ ++ mutex_lock(&once_mutex); ++ if (*done) { ++ mutex_unlock(&once_mutex); ++ /* Keep sparse happy by restoring an even lock count on ++ * this mutex. In case we return here, we don't call into ++ * __do_once_done but return early in the DO_ONCE_SLOW() macro. ++ */ ++ __acquire(once_mutex); ++ return false; ++ } ++ ++ return true; ++} ++EXPORT_SYMBOL(__do_once_slow_start); ++ ++void __do_once_slow_done(bool *done, struct static_key_true *once_key, ++ struct module *mod) ++ __releases(once_mutex) ++{ ++ *done = true; ++ mutex_unlock(&once_mutex); ++ once_disable_jump(once_key, mod); ++} ++EXPORT_SYMBOL(__do_once_slow_done); +diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c +index 3c7b9d6dca95d..1d16c6c796386 100644 +--- a/mm/damon/vaddr.c ++++ b/mm/damon/vaddr.c +@@ -304,6 +304,11 @@ static int damon_mkold_pmd_entry(pmd_t *pmd, unsigned long addr, + + if (pmd_huge(*pmd)) { + ptl = pmd_lock(walk->mm, pmd); ++ if (!pmd_present(*pmd)) { ++ spin_unlock(ptl); ++ return 0; ++ } ++ + if (pmd_huge(*pmd)) { + damon_pmdp_mkold(pmd, walk->mm, addr); + spin_unlock(ptl); +@@ -431,6 +436,11 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr, + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + if (pmd_huge(*pmd)) { + ptl = pmd_lock(walk->mm, pmd); ++ if (!pmd_present(*pmd)) { ++ spin_unlock(ptl); ++ return 0; ++ } ++ + if (!pmd_huge(*pmd)) { + spin_unlock(ptl); + goto regular_page; +diff --git a/mm/gup.c b/mm/gup.c +index 0d500cdfa6e0e..31898908e04b4 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -531,6 +531,18 @@ static struct page *follow_page_pte(struct vm_area_struct *vma, + if (WARN_ON_ONCE((flags & (FOLL_PIN | FOLL_GET)) == + (FOLL_PIN | FOLL_GET))) + return ERR_PTR(-EINVAL); ++ ++ /* ++ * Considering PTE level hugetlb, like continuous-PTE hugetlb on ++ * ARM64 architecture. ++ */ ++ if (is_vm_hugetlb_page(vma)) { ++ page = follow_huge_pmd_pte(vma, address, flags); ++ if (page) ++ return page; ++ return no_page_table(vma, flags); ++ } ++ + retry: + if (unlikely(pmd_bad(*pmd))) + return no_page_table(vma, flags); +@@ -663,7 +675,7 @@ static struct page *follow_pmd_mask(struct vm_area_struct *vma, + if (pmd_none(pmdval)) + return no_page_table(vma, flags); + if (pmd_huge(pmdval) && is_vm_hugetlb_page(vma)) { +- page = follow_huge_pmd(mm, address, pmd, flags); ++ page = follow_huge_pmd_pte(vma, address, flags); + if (page) + return page; + return no_page_table(vma, flags); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index b508efbdcdbed..ff232eaca1b93 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -5050,6 +5050,7 @@ static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct + * unmapped and its refcount is dropped, so just clear pte here. + */ + if (unlikely(!pte_present(pte))) { ++#ifdef CONFIG_PTE_MARKER_UFFD_WP + /* + * If the pte was wr-protected by uffd-wp in any of the + * swap forms, meanwhile the caller does not want to +@@ -5061,6 +5062,7 @@ static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct + set_huge_pte_at(mm, address, ptep, + make_pte_marker(PTE_MARKER_UFFD_WP)); + else ++#endif + huge_pte_clear(mm, address, ptep, sz); + spin_unlock(ptl); + continue; +@@ -5089,11 +5091,13 @@ static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct + tlb_remove_huge_tlb_entry(h, tlb, ptep, address); + if (huge_pte_dirty(pte)) + set_page_dirty(page); ++#ifdef CONFIG_PTE_MARKER_UFFD_WP + /* Leave a uffd-wp pte marker if needed */ + if (huge_pte_uffd_wp(pte) && + !(zap_flags & ZAP_FLAG_DROP_MARKER)) + set_huge_pte_at(mm, address, ptep, + make_pte_marker(PTE_MARKER_UFFD_WP)); ++#endif + hugetlb_count_sub(pages_per_huge_page(h), mm); + page_remove_rmap(page, vma, true); + +@@ -5463,7 +5467,6 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, + unsigned long addr, + unsigned long reason) + { +- vm_fault_t ret; + u32 hash; + struct vm_fault vmf = { + .vma = vma, +@@ -5481,18 +5484,14 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, + }; + + /* +- * hugetlb_fault_mutex and i_mmap_rwsem must be +- * dropped before handling userfault. Reacquire +- * after handling fault to make calling code simpler. ++ * vma_lock and hugetlb_fault_mutex must be dropped before handling ++ * userfault. Also mmap_lock will be dropped during handling ++ * userfault, any vma operation should be careful from here. + */ + hash = hugetlb_fault_mutex_hash(mapping, idx); + mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); +- ret = handle_userfault(&vmf, reason); +- i_mmap_lock_read(mapping); +- mutex_lock(&hugetlb_fault_mutex_table[hash]); +- +- return ret; ++ return handle_userfault(&vmf, reason); + } + + static vm_fault_t hugetlb_no_page(struct mm_struct *mm, +@@ -5510,6 +5509,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, + spinlock_t *ptl; + unsigned long haddr = address & huge_page_mask(h); + bool new_page, new_pagecache_page = false; ++ u32 hash = hugetlb_fault_mutex_hash(mapping, idx); + + /* + * Currently, we are forced to kill the process in the event the +@@ -5520,7 +5520,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, + if (is_vma_resv_set(vma, HPAGE_RESV_UNMAPPED)) { + pr_warn_ratelimited("PID %d killed due to inadequate hugepage pool\n", + current->pid); +- return ret; ++ goto out; + } + + /* +@@ -5537,12 +5537,10 @@ retry: + page = find_lock_page(mapping, idx); + if (!page) { + /* Check for page in userfault range */ +- if (userfaultfd_missing(vma)) { +- ret = hugetlb_handle_userfault(vma, mapping, idx, ++ if (userfaultfd_missing(vma)) ++ return hugetlb_handle_userfault(vma, mapping, idx, + flags, haddr, address, + VM_UFFD_MISSING); +- goto out; +- } + + page = alloc_huge_page(vma, haddr, 0); + if (IS_ERR(page)) { +@@ -5602,10 +5600,9 @@ retry: + if (userfaultfd_minor(vma)) { + unlock_page(page); + put_page(page); +- ret = hugetlb_handle_userfault(vma, mapping, idx, ++ return hugetlb_handle_userfault(vma, mapping, idx, + flags, haddr, address, + VM_UFFD_MINOR); +- goto out; + } + } + +@@ -5663,6 +5660,8 @@ retry: + + unlock_page(page); + out: ++ mutex_unlock(&hugetlb_fault_mutex_table[hash]); ++ i_mmap_unlock_read(mapping); + return ret; + + backout: +@@ -5761,11 +5760,13 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, + + entry = huge_ptep_get(ptep); + /* PTE markers should be handled the same way as none pte */ +- if (huge_pte_none_mostly(entry)) { +- ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep, ++ if (huge_pte_none_mostly(entry)) ++ /* ++ * hugetlb_no_page will drop vma lock and hugetlb fault ++ * mutex internally, which make us return immediately. ++ */ ++ return hugetlb_no_page(mm, vma, mapping, idx, address, ptep, + entry, flags); +- goto out_mutex; +- } + + ret = 0; + +@@ -6906,12 +6907,13 @@ follow_huge_pd(struct vm_area_struct *vma, + } + + struct page * __weak +-follow_huge_pmd(struct mm_struct *mm, unsigned long address, +- pmd_t *pmd, int flags) ++follow_huge_pmd_pte(struct vm_area_struct *vma, unsigned long address, int flags) + { ++ struct hstate *h = hstate_vma(vma); ++ struct mm_struct *mm = vma->vm_mm; + struct page *page = NULL; + spinlock_t *ptl; +- pte_t pte; ++ pte_t *ptep, pte; + + /* + * FOLL_PIN is not supported for follow_page(). Ordinary GUP goes via +@@ -6921,17 +6923,15 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address, + return NULL; + + retry: +- ptl = pmd_lockptr(mm, pmd); +- spin_lock(ptl); +- /* +- * make sure that the address range covered by this pmd is not +- * unmapped from other threads. +- */ +- if (!pmd_huge(*pmd)) +- goto out; +- pte = huge_ptep_get((pte_t *)pmd); ++ ptep = huge_pte_offset(mm, address, huge_page_size(h)); ++ if (!ptep) ++ return NULL; ++ ++ ptl = huge_pte_lock(h, mm, ptep); ++ pte = huge_ptep_get(ptep); + if (pte_present(pte)) { +- page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT); ++ page = pte_page(pte) + ++ ((address & ~huge_page_mask(h)) >> PAGE_SHIFT); + /* + * try_grab_page() should always succeed here, because: a) we + * hold the pmd (ptl) lock, and b) we've just checked that the +@@ -6947,7 +6947,7 @@ retry: + } else { + if (is_hugetlb_entry_migration(pte)) { + spin_unlock(ptl); +- __migration_entry_wait_huge((pte_t *)pmd, ptl); ++ __migration_entry_wait_huge(ptep, ptl); + goto retry; + } + /* +diff --git a/mm/memory.c b/mm/memory.c +index e644f6fad3892..9658a9abf7c0d 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1385,10 +1385,12 @@ zap_install_uffd_wp_if_needed(struct vm_area_struct *vma, + unsigned long addr, pte_t *pte, + struct zap_details *details, pte_t pteval) + { ++#ifdef CONFIG_PTE_MARKER_UFFD_WP + if (zap_drop_file_uffd_wp(details)) + return; + + pte_install_uffd_wp_if_needed(vma, addr, pte, pteval); ++#endif + } + + static unsigned long zap_pte_range(struct mmu_gather *tlb, +diff --git a/mm/mmap.c b/mm/mmap.c +index 3b284b091bb7e..921a16f83c2b8 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1845,7 +1845,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr, + if (!arch_validate_flags(vma->vm_flags)) { + error = -EINVAL; + if (file) +- goto unmap_and_free_vma; ++ goto close_and_free_vma; + else + goto free_vma; + } +@@ -1892,6 +1892,9 @@ out: + + return addr; + ++close_and_free_vma: ++ if (vma->vm_ops && vma->vm_ops->close) ++ vma->vm_ops->close(vma); + unmap_and_free_vma: + fput(vma->vm_file); + vma->vm_file = NULL; +diff --git a/mm/mprotect.c b/mm/mprotect.c +index 0d38d5b637621..6bc74c67407e7 100644 +--- a/mm/mprotect.c ++++ b/mm/mprotect.c +@@ -222,6 +222,7 @@ static unsigned long change_pte_range(struct mmu_gather *tlb, + } else { + /* It must be an none page, or what else?.. */ + WARN_ON_ONCE(!pte_none(oldpte)); ++#ifdef CONFIG_PTE_MARKER_UFFD_WP + if (unlikely(uffd_wp && !vma_is_anonymous(vma))) { + /* + * For file-backed mem, we need to be able to +@@ -233,6 +234,7 @@ static unsigned long change_pte_range(struct mmu_gather *tlb, + make_pte_marker(PTE_MARKER_UFFD_WP)); + pages++; + } ++#endif + } + } while (pte++, addr += PAGE_SIZE, addr != end); + arch_leave_lazy_mmu_mode(); +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 48029a390c65a..8ecc0a18df762 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3370,15 +3370,27 @@ static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb) + return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len); + } + +-static void __check_timeout(struct hci_dev *hdev, unsigned int cnt) ++static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type) + { +- if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { +- /* ACL tx timeout must be longer than maximum +- * link supervision timeout (40.9 seconds) */ +- if (!cnt && time_after(jiffies, hdev->acl_last_tx + +- HCI_ACL_TX_TIMEOUT)) +- hci_link_tx_to(hdev, ACL_LINK); ++ unsigned long last_tx; ++ ++ if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) ++ return; ++ ++ switch (type) { ++ case LE_LINK: ++ last_tx = hdev->le_last_tx; ++ break; ++ default: ++ last_tx = hdev->acl_last_tx; ++ break; + } ++ ++ /* tx timeout must be longer than maximum link supervision timeout ++ * (40.9 seconds) ++ */ ++ if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT)) ++ hci_link_tx_to(hdev, type); + } + + /* Schedule SCO */ +@@ -3436,7 +3448,7 @@ static void hci_sched_acl_pkt(struct hci_dev *hdev) + struct sk_buff *skb; + int quote; + +- __check_timeout(hdev, cnt); ++ __check_timeout(hdev, cnt, ACL_LINK); + + while (hdev->acl_cnt && + (chan = hci_chan_sent(hdev, ACL_LINK, "e))) { +@@ -3479,8 +3491,6 @@ static void hci_sched_acl_blk(struct hci_dev *hdev) + int quote; + u8 type; + +- __check_timeout(hdev, cnt); +- + BT_DBG("%s", hdev->name); + + if (hdev->dev_type == HCI_AMP) +@@ -3488,6 +3498,8 @@ static void hci_sched_acl_blk(struct hci_dev *hdev) + else + type = ACL_LINK; + ++ __check_timeout(hdev, cnt, type); ++ + while (hdev->block_cnt > 0 && + (chan = hci_chan_sent(hdev, type, "e))) { + u32 priority = (skb_peek(&chan->data_q))->priority; +@@ -3561,7 +3573,7 @@ static void hci_sched_le(struct hci_dev *hdev) + + cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt; + +- __check_timeout(hdev, cnt); ++ __check_timeout(hdev, cnt, LE_LINK); + + tmp = cnt; + while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) { +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 3b4cee67bbd60..a7c0cd2fabfb2 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4033,6 +4033,7 @@ setup_failed: + hci_dev_test_flag(hdev, HCI_MGMT) && + hdev->dev_type == HCI_PRIMARY) { + ret = hci_powered_update_sync(hdev); ++ mgmt_power_on(hdev, ret); + } + } else { + /* Init failed, cleanup */ +diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c +index 4e3e0451b08c1..08542dfc2dc53 100644 +--- a/net/bluetooth/hci_sysfs.c ++++ b/net/bluetooth/hci_sysfs.c +@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn) + + BT_DBG("conn %p", conn); + ++ if (device_is_registered(&conn->dev)) ++ return; ++ + dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle); + + if (device_add(&conn->dev) < 0) { +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 48fbd0ae882bf..0f98c5d8c4de9 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -61,6 +61,9 @@ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); + + static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, + struct sk_buff_head *skbs, u8 event); ++static void l2cap_retrans_timeout(struct work_struct *work); ++static void l2cap_monitor_timeout(struct work_struct *work); ++static void l2cap_ack_timeout(struct work_struct *work); + + static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type) + { +@@ -476,6 +479,9 @@ struct l2cap_chan *l2cap_chan_create(void) + write_unlock(&chan_list_lock); + + INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout); ++ INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); ++ INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); ++ INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); + + chan->state = BT_OPEN; + +@@ -3319,10 +3325,6 @@ int l2cap_ertm_init(struct l2cap_chan *chan) + chan->rx_state = L2CAP_RX_STATE_RECV; + chan->tx_state = L2CAP_TX_STATE_XMIT; + +- INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); +- INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); +- INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); +- + skb_queue_head_init(&chan->srej_q); + + err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win); +@@ -4306,6 +4308,12 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, + } + } + ++ chan = l2cap_chan_hold_unless_zero(chan); ++ if (!chan) { ++ err = -EBADSLT; ++ goto unlock; ++ } ++ + err = 0; + + l2cap_chan_lock(chan); +@@ -4335,6 +4343,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, + } + + l2cap_chan_unlock(chan); ++ l2cap_chan_put(chan); + + unlock: + mutex_unlock(&conn->chan_lock); +diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c +index 4bf4ea6cbb5ee..21e24da4847f0 100644 +--- a/net/bluetooth/rfcomm/sock.c ++++ b/net/bluetooth/rfcomm/sock.c +@@ -902,7 +902,10 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how) + lock_sock(sk); + if (!sk->sk_shutdown) { + sk->sk_shutdown = SHUTDOWN_MASK; ++ ++ release_sock(sk); + __rfcomm_sock_close(sk); ++ lock_sock(sk); + + if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && + !(current->flags & PF_EXITING)) +diff --git a/net/can/bcm.c b/net/can/bcm.c +index e60161bec850a..f16271a7ae2e8 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -274,6 +274,7 @@ static void bcm_can_tx(struct bcm_op *op) + struct sk_buff *skb; + struct net_device *dev; + struct canfd_frame *cf = op->frames + op->cfsiz * op->currframe; ++ int err; + + /* no target device? => exit */ + if (!op->ifindex) +@@ -298,11 +299,11 @@ static void bcm_can_tx(struct bcm_op *op) + /* send with loopback */ + skb->dev = dev; + can_skb_set_owner(skb, op->sk); +- can_send(skb, 1); ++ err = can_send(skb, 1); ++ if (!err) ++ op->frames_abs++; + +- /* update statistics */ + op->currframe++; +- op->frames_abs++; + + /* reached last frame? */ + if (op->currframe >= op->nframes) +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index bcba61ef5b378..ac63604330036 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1168,8 +1168,8 @@ proto_again: + nhoff += sizeof(*vlan); + } + +- if (dissector_uses_key(flow_dissector, +- FLOW_DISSECTOR_KEY_NUM_OF_VLANS)) { ++ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_NUM_OF_VLANS) && ++ !(key_control->flags & FLOW_DIS_ENCAPSULATION)) { + struct flow_dissector_key_num_of_vlans *key_nvs; + + key_nvs = skb_flow_dissector_target(flow_dissector, +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 69ac686c7cae3..864cd7ded2ca6 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -435,8 +435,10 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, + if (copied + copy > len) + copy = len - copied; + copy = copy_page_to_iter(page, sge->offset, copy, iter); +- if (!copy) +- return copied ? copied : -EFAULT; ++ if (!copy) { ++ copied = copied ? copied : -EFAULT; ++ goto out; ++ } + + copied += copy; + if (likely(!peek)) { +@@ -456,7 +458,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, + * didn't copy the entire length lets just break. + */ + if (copy != sge->length) +- return copied; ++ goto out; + sk_msg_iter_var_next(i); + } + +@@ -478,7 +480,9 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, + } + msg_rx = sk_psock_peek_msg(psock); + } +- ++out: ++ if (psock->work_state.skb && copied > 0) ++ schedule_work(&psock->work); + return copied; + } + EXPORT_SYMBOL_GPL(sk_msg_recvmsg); +diff --git a/net/core/stream.c b/net/core/stream.c +index 06b36c730ce8a..2ee82115b919a 100644 +--- a/net/core/stream.c ++++ b/net/core/stream.c +@@ -159,7 +159,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p) + *timeo_p = current_timeo; + } + out: +- remove_wait_queue(sk_sleep(sk), &wait); ++ if (!sock_flag(sk, SOCK_DEAD)) ++ remove_wait_queue(sk_sleep(sk), &wait); + return err; + + do_error: +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index 7889e1ef7fad6..6e55fae4c6860 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -272,6 +272,10 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + err = -EMSGSIZE; + goto out_dev; + } ++ if (!size) { ++ err = 0; ++ goto out_dev; ++ } + + hlen = LL_RESERVED_SPACE(dev); + tlen = dev->needed_tailroom; +diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c +index ffd57523331fd..405a8c2aea641 100644 +--- a/net/ipv4/datagram.c ++++ b/net/ipv4/datagram.c +@@ -42,6 +42,8 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len + oif = inet->mc_index; + if (!saddr) + saddr = inet->mc_addr; ++ } else if (!oif) { ++ oif = inet->uc_index; + } + fl4 = &inet->cork.fl.u.ip4; + rt = ip_route_connect(fl4, usin->sin_addr.s_addr, saddr, oif, +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index 935026f4c807e..170152772d332 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -110,7 +110,10 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x, + struct sk_buff *skb, + netdev_features_t features) + { +- return skb_eth_gso_segment(skb, features, htons(ETH_P_IP)); ++ __be16 type = x->inner_mode.family == AF_INET6 ? htons(ETH_P_IPV6) ++ : htons(ETH_P_IP); ++ ++ return skb_eth_gso_segment(skb, features, type); + } + + static struct sk_buff *xfrm4_transport_gso_segment(struct xfrm_state *x, +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index b9d995b5ce24c..f5950a7172d61 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -729,8 +729,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, + if (likely(remaining > 1)) + remaining &= ~1U; + +- net_get_random_once(table_perturb, +- INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb)); ++ get_random_slow_once(table_perturb, ++ INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb)); + index = port_offset & (INET_TABLE_PERTURB_SIZE - 1); + + offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32); +diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c +index b75cac69bd7e6..7ade04ff972d7 100644 +--- a/net/ipv4/netfilter/nft_fib_ipv4.c ++++ b/net/ipv4/netfilter/nft_fib_ipv4.c +@@ -83,6 +83,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, + else + oif = NULL; + ++ if (priv->flags & NFTA_FIB_F_IIF) ++ fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif); ++ + if (nft_hook(pkt) == NF_INET_PRE_ROUTING && + nft_fib_is_loopback(pkt->skb, nft_in(pkt))) { + nft_fib_store_result(dest, priv, nft_in(pkt)); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index ab03977b65781..83fa8886f8685 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3042,6 +3042,8 @@ int tcp_disconnect(struct sock *sk, int flags) + tp->snd_ssthresh = TCP_INFINITE_SSTHRESH; + tcp_snd_cwnd_set(tp, TCP_INIT_CWND); + tp->snd_cwnd_cnt = 0; ++ tp->is_cwnd_limited = 0; ++ tp->max_packets_out = 0; + tp->window_clamp = 0; + tp->delivered = 0; + tp->delivered_ce = 0; +@@ -4347,12 +4349,16 @@ static void __tcp_alloc_md5sig_pool(void) + * to memory. See smp_rmb() in tcp_get_md5sig_pool() + */ + smp_wmb(); +- tcp_md5sig_pool_populated = true; ++ /* Paired with READ_ONCE() from tcp_alloc_md5sig_pool() ++ * and tcp_get_md5sig_pool(). ++ */ ++ WRITE_ONCE(tcp_md5sig_pool_populated, true); + } + + bool tcp_alloc_md5sig_pool(void) + { +- if (unlikely(!tcp_md5sig_pool_populated)) { ++ /* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */ ++ if (unlikely(!READ_ONCE(tcp_md5sig_pool_populated))) { + mutex_lock(&tcp_md5sig_mutex); + + if (!tcp_md5sig_pool_populated) { +@@ -4363,7 +4369,8 @@ bool tcp_alloc_md5sig_pool(void) + + mutex_unlock(&tcp_md5sig_mutex); + } +- return tcp_md5sig_pool_populated; ++ /* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */ ++ return READ_ONCE(tcp_md5sig_pool_populated); + } + EXPORT_SYMBOL(tcp_alloc_md5sig_pool); + +@@ -4379,7 +4386,8 @@ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void) + { + local_bh_disable(); + +- if (tcp_md5sig_pool_populated) { ++ /* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */ ++ if (READ_ONCE(tcp_md5sig_pool_populated)) { + /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */ + smp_rmb(); + return this_cpu_ptr(&tcp_md5sig_pool); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 84314de754f87..a16139cacc454 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1875,15 +1875,20 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited) + const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; + struct tcp_sock *tp = tcp_sk(sk); + +- /* Track the maximum number of outstanding packets in each +- * window, and remember whether we were cwnd-limited then. ++ /* Track the strongest available signal of the degree to which the cwnd ++ * is fully utilized. If cwnd-limited then remember that fact for the ++ * current window. If not cwnd-limited then track the maximum number of ++ * outstanding packets in the current window. (If cwnd-limited then we ++ * chose to not update tp->max_packets_out to avoid an extra else ++ * clause with no functional impact.) + */ +- if (!before(tp->snd_una, tp->max_packets_seq) || +- tp->packets_out > tp->max_packets_out || +- is_cwnd_limited) { +- tp->max_packets_out = tp->packets_out; +- tp->max_packets_seq = tp->snd_nxt; ++ if (!before(tp->snd_una, tp->cwnd_usage_seq) || ++ is_cwnd_limited || ++ (!tp->is_cwnd_limited && ++ tp->packets_out > tp->max_packets_out)) { + tp->is_cwnd_limited = is_cwnd_limited; ++ tp->max_packets_out = tp->packets_out; ++ tp->cwnd_usage_seq = tp->snd_nxt; + } + + if (tcp_is_cwnd_limited(sk)) { +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index 3a293838a91db..79d43548279cb 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -145,7 +145,10 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x, + struct sk_buff *skb, + netdev_features_t features) + { +- return skb_eth_gso_segment(skb, features, htons(ETH_P_IPV6)); ++ __be16 type = x->inner_mode.family == AF_INET ? htons(ETH_P_IP) ++ : htons(ETH_P_IPV6); ++ ++ return skb_eth_gso_segment(skb, features, type); + } + + static struct sk_buff *xfrm6_transport_gso_segment(struct xfrm_state *x, +diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c +index 8970d0b4faeb4..1d7e520d9966c 100644 +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -41,6 +41,9 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv, + if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) { + lookup_flags |= RT6_LOOKUP_F_IFACE; + fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev); ++ } else if ((priv->flags & NFTA_FIB_F_IIF) && ++ (netif_is_l3_master(dev) || netif_is_l3_slave(dev))) { ++ fl6->flowi6_oif = dev->ifindex; + } + + if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST) +@@ -197,7 +200,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, + if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL)) + goto put_rt_err; + +- if (oif && oif != rt->rt6i_idev->dev) ++ if (oif && oif != rt->rt6i_idev->dev && ++ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex) + goto put_rt_err; + + nft_fib_store_result(dest, priv, rt->rt6i_idev->dev); +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 9ca25ae503b04..37484c26259d7 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -3545,9 +3545,6 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata, + case NL80211_IFTYPE_MESH_POINT: { + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + +- if (params->chandef.width != sdata->vif.bss_conf.chandef.width) +- return -EINVAL; +- + /* changes into another band are not supported */ + if (sdata->vif.bss_conf.chandef.chan->band != + params->chandef.chan->band) +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 369aeabb94fe2..8ef19f033773c 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -67,6 +67,7 @@ struct conntrack_gc_work { + struct delayed_work dwork; + u32 next_bucket; + u32 avg_timeout; ++ u32 count; + u32 start_time; + bool exiting; + bool early_drop; +@@ -85,10 +86,12 @@ static DEFINE_MUTEX(nf_conntrack_mutex); + /* clamp timeouts to this value (TCP unacked) */ + #define GC_SCAN_INTERVAL_CLAMP (300ul * HZ) + +-/* large initial bias so that we don't scan often just because we have +- * three entries with a 1s timeout. ++/* Initial bias pretending we have 100 entries at the upper bound so we don't ++ * wakeup often just because we have three entries with a 1s timeout while still ++ * allowing non-idle machines to wakeup more often when needed. + */ +-#define GC_SCAN_INTERVAL_INIT INT_MAX ++#define GC_SCAN_INITIAL_COUNT 100 ++#define GC_SCAN_INTERVAL_INIT GC_SCAN_INTERVAL_MAX + + #define GC_SCAN_MAX_DURATION msecs_to_jiffies(10) + #define GC_SCAN_EXPIRED_MAX (64000u / HZ) +@@ -1468,6 +1471,7 @@ static void gc_worker(struct work_struct *work) + unsigned int expired_count = 0; + unsigned long next_run; + s32 delta_time; ++ long count; + + gc_work = container_of(work, struct conntrack_gc_work, dwork.work); + +@@ -1477,10 +1481,12 @@ static void gc_worker(struct work_struct *work) + + if (i == 0) { + gc_work->avg_timeout = GC_SCAN_INTERVAL_INIT; ++ gc_work->count = GC_SCAN_INITIAL_COUNT; + gc_work->start_time = start_time; + } + + next_run = gc_work->avg_timeout; ++ count = gc_work->count; + + end_time = start_time + GC_SCAN_MAX_DURATION; + +@@ -1500,8 +1506,8 @@ static void gc_worker(struct work_struct *work) + + hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[i], hnnode) { + struct nf_conntrack_net *cnet; +- unsigned long expires; + struct net *net; ++ long expires; + + tmp = nf_ct_tuplehash_to_ctrack(h); + +@@ -1515,6 +1521,7 @@ static void gc_worker(struct work_struct *work) + + gc_work->next_bucket = i; + gc_work->avg_timeout = next_run; ++ gc_work->count = count; + + delta_time = nfct_time_stamp - gc_work->start_time; + +@@ -1530,8 +1537,8 @@ static void gc_worker(struct work_struct *work) + } + + expires = clamp(nf_ct_expires(tmp), GC_SCAN_INTERVAL_MIN, GC_SCAN_INTERVAL_CLAMP); ++ expires = (expires - (long)next_run) / ++count; + next_run += expires; +- next_run /= 2u; + + if (nf_conntrack_max95 == 0 || gc_worker_skip_ct(tmp)) + continue; +@@ -1572,6 +1579,7 @@ static void gc_worker(struct work_struct *work) + delta_time = nfct_time_stamp - end_time; + if (delta_time > 0 && i < hashsz) { + gc_work->avg_timeout = next_run; ++ gc_work->count = count; + gc_work->next_bucket = i; + next_run = 0; + goto early_exit; +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 6c9d153afbeee..93c596e3b22b9 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -252,10 +252,17 @@ void ovs_dp_process_packet(struct sk_buff *skb, struct sw_flow_key *key) + + upcall.mru = OVS_CB(skb)->mru; + error = ovs_dp_upcall(dp, skb, key, &upcall, 0); +- if (unlikely(error)) +- kfree_skb(skb); +- else ++ switch (error) { ++ case 0: ++ case -EAGAIN: ++ case -ERESTARTSYS: ++ case -EINTR: + consume_skb(skb); ++ break; ++ default: ++ kfree_skb(skb); ++ break; ++ } + stats_counter = &stats->n_missed; + goto out; + } +@@ -551,8 +558,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, + out: + if (err) + skb_tx_error(skb); +- kfree_skb(user_skb); +- kfree_skb(nskb); ++ consume_skb(user_skb); ++ consume_skb(nskb); ++ + return err; + } + +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index 73ee2771093d6..d0ff413f697c3 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -166,10 +166,10 @@ void rds_tcp_reset_callbacks(struct socket *sock, + */ + atomic_set(&cp->cp_state, RDS_CONN_RESETTING); + wait_event(cp->cp_waitq, !test_bit(RDS_IN_XMIT, &cp->cp_flags)); +- lock_sock(osock->sk); + /* reset receive side state for rds_tcp_data_recv() for osock */ + cancel_delayed_work_sync(&cp->cp_send_w); + cancel_delayed_work_sync(&cp->cp_recv_w); ++ lock_sock(osock->sk); + if (tc->t_tinc) { + rds_inc_put(&tc->t_tinc->ti_inc); + tc->t_tinc = NULL; +diff --git a/net/sctp/auth.c b/net/sctp/auth.c +index db6b7373d16c3..34964145514e6 100644 +--- a/net/sctp/auth.c ++++ b/net/sctp/auth.c +@@ -863,12 +863,17 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, + } + + list_del_init(&shkey->key_list); +- sctp_auth_shkey_release(shkey); + list_add(&cur_key->key_list, sh_keys); + +- if (asoc && asoc->active_key_id == auth_key->sca_keynumber) +- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); ++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber && ++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL)) { ++ list_del_init(&cur_key->key_list); ++ sctp_auth_shkey_release(cur_key); ++ list_add(&shkey->key_list, sh_keys); ++ return -ENOMEM; ++ } + ++ sctp_auth_shkey_release(shkey); + return 0; + } + +@@ -902,8 +907,13 @@ int sctp_auth_set_active_key(struct sctp_endpoint *ep, + return -EINVAL; + + if (asoc) { ++ __u16 active_key_id = asoc->active_key_id; ++ + asoc->active_key_id = key_id; +- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); ++ if (sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL)) { ++ asoc->active_key_id = active_key_id; ++ return -ENOMEM; ++ } + } else + ep->active_key_id = key_id; + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 2206e6f8902d7..c3a0e37705691 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -548,12 +548,6 @@ static void unix_sock_destructor(struct sock *sk) + + skb_queue_purge(&sk->sk_receive_queue); + +-#if IS_ENABLED(CONFIG_AF_UNIX_OOB) +- if (u->oob_skb) { +- kfree_skb(u->oob_skb); +- u->oob_skb = NULL; +- } +-#endif + WARN_ON(refcount_read(&sk->sk_wmem_alloc)); + WARN_ON(!sk_unhashed(sk)); + WARN_ON(sk->sk_socket); +@@ -598,6 +592,13 @@ static void unix_release_sock(struct sock *sk, int embrion) + + unix_state_unlock(sk); + ++#if IS_ENABLED(CONFIG_AF_UNIX_OOB) ++ if (u->oob_skb) { ++ kfree_skb(u->oob_skb); ++ u->oob_skb = NULL; ++ } ++#endif ++ + wake_up_interruptible_all(&u->peer_wait); + + if (skpair != NULL) { +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index d45d5366115a7..dc27635403932 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -204,6 +204,7 @@ void wait_for_unix_gc(void) + /* The external entry point: unix_gc() */ + void unix_gc(void) + { ++ struct sk_buff *next_skb, *skb; + struct unix_sock *u; + struct unix_sock *next; + struct sk_buff_head hitlist; +@@ -297,11 +298,30 @@ void unix_gc(void) + + spin_unlock(&unix_gc_lock); + ++ /* We need io_uring to clean its registered files, ignore all io_uring ++ * originated skbs. It's fine as io_uring doesn't keep references to ++ * other io_uring instances and so killing all other files in the cycle ++ * will put all io_uring references forcing it to go through normal ++ * release.path eventually putting registered files. ++ */ ++ skb_queue_walk_safe(&hitlist, skb, next_skb) { ++ if (skb->scm_io_uring) { ++ __skb_unlink(skb, &hitlist); ++ skb_queue_tail(&skb->sk->sk_receive_queue, skb); ++ } ++ } ++ + /* Here we are. Hitlist is filled. Die. */ + __skb_queue_purge(&hitlist); + + spin_lock(&unix_gc_lock); + ++ /* There could be io_uring registered files, just push them back to ++ * the inflight list ++ */ ++ list_for_each_entry_safe(u, next, &gc_candidates, link) ++ list_move_tail(&u->link, &gc_inflight_list); ++ + /* All candidates should have been detached by now. */ + BUG_ON(!list_empty(&gc_candidates)); + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index ec2c2afbf0d06..3a12aee33e92f 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -1342,7 +1342,7 @@ EXPORT_SYMBOL_GPL(virtio_transport_recv_pkt); + + void virtio_transport_free_pkt(struct virtio_vsock_pkt *pkt) + { +- kfree(pkt->buf); ++ kvfree(pkt->buf); + kfree(pkt); + } + EXPORT_SYMBOL_GPL(virtio_transport_free_pkt); +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index c7383ede794fc..d5c7a5aa68532 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2389,6 +2389,10 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev) + switch (iftype) { + case NL80211_IFTYPE_AP: + case NL80211_IFTYPE_P2P_GO: ++ if (!wdev->links[link].ap.beacon_interval) ++ continue; ++ chandef = wdev->links[link].ap.chandef; ++ break; + case NL80211_IFTYPE_MESH_POINT: + if (!wdev->u.mesh.beacon_interval) + continue; +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 7e311420aab9f..e24d62f8883a3 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -355,16 +355,15 @@ static u32 xsk_tx_peek_release_fallback(struct xsk_buff_pool *pool, u32 max_entr + return nb_pkts; + } + +-u32 xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, u32 max_entries) ++u32 xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, u32 nb_pkts) + { + struct xdp_sock *xs; +- u32 nb_pkts; + + rcu_read_lock(); + if (!list_is_singular(&pool->xsk_tx_list)) { + /* Fallback to the non-batched version */ + rcu_read_unlock(); +- return xsk_tx_peek_release_fallback(pool, max_entries); ++ return xsk_tx_peek_release_fallback(pool, nb_pkts); + } + + xs = list_first_or_null_rcu(&pool->xsk_tx_list, struct xdp_sock, tx_list); +@@ -373,12 +372,7 @@ u32 xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, u32 max_entries) + goto out; + } + +- max_entries = xskq_cons_nb_entries(xs->tx, max_entries); +- nb_pkts = xskq_cons_read_desc_batch(xs->tx, pool, max_entries); +- if (!nb_pkts) { +- xs->tx->queue_empty_descs++; +- goto out; +- } ++ nb_pkts = xskq_cons_nb_entries(xs->tx, nb_pkts); + + /* This is the backpressure mechanism for the Tx path. Try to + * reserve space in the completion queue for all packets, but +@@ -386,12 +380,18 @@ u32 xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, u32 max_entries) + * packets. This avoids having to implement any buffering in + * the Tx path. + */ +- nb_pkts = xskq_prod_reserve_addr_batch(pool->cq, pool->tx_descs, nb_pkts); ++ nb_pkts = xskq_prod_nb_free(pool->cq, nb_pkts); + if (!nb_pkts) + goto out; + +- xskq_cons_release_n(xs->tx, max_entries); ++ nb_pkts = xskq_cons_read_desc_batch(xs->tx, pool, nb_pkts); ++ if (!nb_pkts) { ++ xs->tx->queue_empty_descs++; ++ goto out; ++ } ++ + __xskq_cons_release(xs->tx); ++ xskq_prod_write_addr_batch(pool->cq, pool->tx_descs, nb_pkts); + xs->sk.sk_write_space(&xs->sk); + + out: +diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h +index fb20bf7207cfb..c6fb6b7636582 100644 +--- a/net/xdp/xsk_queue.h ++++ b/net/xdp/xsk_queue.h +@@ -205,6 +205,11 @@ static inline bool xskq_cons_read_desc(struct xsk_queue *q, + return false; + } + ++static inline void xskq_cons_release_n(struct xsk_queue *q, u32 cnt) ++{ ++ q->cached_cons += cnt; ++} ++ + static inline u32 xskq_cons_read_desc_batch(struct xsk_queue *q, struct xsk_buff_pool *pool, + u32 max) + { +@@ -226,6 +231,8 @@ static inline u32 xskq_cons_read_desc_batch(struct xsk_queue *q, struct xsk_buff + cached_cons++; + } + ++ /* Release valid plus any invalid entries */ ++ xskq_cons_release_n(q, cached_cons - q->cached_cons); + return nb_entries; + } + +@@ -291,11 +298,6 @@ static inline void xskq_cons_release(struct xsk_queue *q) + q->cached_cons++; + } + +-static inline void xskq_cons_release_n(struct xsk_queue *q, u32 cnt) +-{ +- q->cached_cons += cnt; +-} +- + static inline u32 xskq_cons_present_entries(struct xsk_queue *q) + { + /* No barriers needed since data is not accessed */ +@@ -350,21 +352,17 @@ static inline int xskq_prod_reserve_addr(struct xsk_queue *q, u64 addr) + return 0; + } + +-static inline u32 xskq_prod_reserve_addr_batch(struct xsk_queue *q, struct xdp_desc *descs, +- u32 max) ++static inline void xskq_prod_write_addr_batch(struct xsk_queue *q, struct xdp_desc *descs, ++ u32 nb_entries) + { + struct xdp_umem_ring *ring = (struct xdp_umem_ring *)q->ring; +- u32 nb_entries, i, cached_prod; +- +- nb_entries = xskq_prod_nb_free(q, max); ++ u32 i, cached_prod; + + /* A, matches D */ + cached_prod = q->cached_prod; + for (i = 0; i < nb_entries; i++) + ring->desc[cached_prod++ & q->ring_mask] = descs[i].addr; + q->cached_prod = cached_prod; +- +- return nb_entries; + } + + static inline int xskq_prod_reserve_desc(struct xsk_queue *q, +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index b2f4ec9c537f0..aa5220565763c 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -24,7 +24,8 @@ + #include "xfrm_inout.h" + + struct xfrm_trans_tasklet { +- struct tasklet_struct tasklet; ++ struct work_struct work; ++ spinlock_t queue_lock; + struct sk_buff_head queue; + }; + +@@ -760,18 +761,22 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr) + } + EXPORT_SYMBOL(xfrm_input_resume); + +-static void xfrm_trans_reinject(struct tasklet_struct *t) ++static void xfrm_trans_reinject(struct work_struct *work) + { +- struct xfrm_trans_tasklet *trans = from_tasklet(trans, t, tasklet); ++ struct xfrm_trans_tasklet *trans = container_of(work, struct xfrm_trans_tasklet, work); + struct sk_buff_head queue; + struct sk_buff *skb; + + __skb_queue_head_init(&queue); ++ spin_lock_bh(&trans->queue_lock); + skb_queue_splice_init(&trans->queue, &queue); ++ spin_unlock_bh(&trans->queue_lock); + ++ local_bh_disable(); + while ((skb = __skb_dequeue(&queue))) + XFRM_TRANS_SKB_CB(skb)->finish(XFRM_TRANS_SKB_CB(skb)->net, + NULL, skb); ++ local_bh_enable(); + } + + int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, +@@ -789,8 +794,10 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, + + XFRM_TRANS_SKB_CB(skb)->finish = finish; + XFRM_TRANS_SKB_CB(skb)->net = net; ++ spin_lock_bh(&trans->queue_lock); + __skb_queue_tail(&trans->queue, skb); +- tasklet_schedule(&trans->tasklet); ++ spin_unlock_bh(&trans->queue_lock); ++ schedule_work(&trans->work); + return 0; + } + EXPORT_SYMBOL(xfrm_trans_queue_net); +@@ -817,7 +824,8 @@ void __init xfrm_input_init(void) + struct xfrm_trans_tasklet *trans; + + trans = &per_cpu(xfrm_trans_tasklet, i); ++ spin_lock_init(&trans->queue_lock); + __skb_queue_head_init(&trans->queue); +- tasklet_setup(&trans->tasklet, xfrm_trans_reinject); ++ INIT_WORK(&trans->work, xfrm_trans_reinject); + } + } +diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c +index cb40ff0ff28da..92ad336a83ab5 100644 +--- a/net/xfrm/xfrm_ipcomp.c ++++ b/net/xfrm/xfrm_ipcomp.c +@@ -203,6 +203,7 @@ static void ipcomp_free_scratches(void) + vfree(*per_cpu_ptr(scratches, i)); + + free_percpu(scratches); ++ ipcomp_scratches = NULL; + } + + static void * __percpu *ipcomp_alloc_scratches(void) +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index ece44b7350613..2bc08ace38a3b 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -100,8 +100,29 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\ + quiet_redirect := + silent_redirect := exec >/dev/null; + ++# Delete the target on interruption ++# ++# GNU Make automatically deletes the target if it has already been changed by ++# the interrupted recipe. So, you can safely stop the build by Ctrl-C (Make ++# will delete incomplete targets), and resume it later. ++# ++# However, this does not work when the stderr is piped to another program, like ++# $ make >&2 | tee log ++# Make dies with SIGPIPE before cleaning the targets. ++# ++# To address it, we clean the target in signal traps. ++# ++# Make deletes the target when it catches SIGHUP, SIGINT, SIGQUIT, SIGTERM. ++# So, we cover them, and also SIGPIPE just in case. ++# ++# Of course, this is unneeded for phony targets. ++delete-on-interrupt = \ ++ $(if $(filter-out $(PHONY), $@), \ ++ $(foreach sig, HUP INT QUIT TERM PIPE, \ ++ trap 'rm -f $@; trap - $(sig); kill -s $(sig) $$$$' $(sig);)) ++ + # printing commands +-cmd = @set -e; $(echo-cmd) $($(quiet)redirect) $(cmd_$(1)) ++cmd = @set -e; $(echo-cmd) $($(quiet)redirect) $(delete-on-interrupt) $(cmd_$(1)) + + ### + # if_changed - execute command if any prerequisite is newer than +diff --git a/scripts/package/mkspec b/scripts/package/mkspec +index 7c477ca7dc982..951cc60e5a903 100755 +--- a/scripts/package/mkspec ++++ b/scripts/package/mkspec +@@ -85,10 +85,10 @@ $S + mkdir -p %{buildroot}/boot + %ifarch ia64 + mkdir -p %{buildroot}/boot/efi +- cp \$($MAKE image_name) %{buildroot}/boot/efi/vmlinuz-$KERNELRELEASE ++ cp \$($MAKE -s image_name) %{buildroot}/boot/efi/vmlinuz-$KERNELRELEASE + ln -s efi/vmlinuz-$KERNELRELEASE %{buildroot}/boot/ + %else +- cp \$($MAKE image_name) %{buildroot}/boot/vmlinuz-$KERNELRELEASE ++ cp \$($MAKE -s image_name) %{buildroot}/boot/vmlinuz-$KERNELRELEASE + %endif + $M $MAKE %{?_smp_mflags} INSTALL_MOD_PATH=%{buildroot} modules_install + $MAKE %{?_smp_mflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install +diff --git a/scripts/pahole-flags.sh b/scripts/pahole-flags.sh +index 0d99ef17e4a52..d4f3d63cb4344 100755 +--- a/scripts/pahole-flags.sh ++++ b/scripts/pahole-flags.sh +@@ -20,4 +20,8 @@ if [ "${pahole_ver}" -ge "122" ]; then + extra_paholeopt="${extra_paholeopt} -j" + fi + ++if [ "${pahole_ver}" -ge "124" ]; then ++ extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_enum64" ++fi ++ + echo ${extra_paholeopt} +diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh +index 2dccf141241d7..20af56ce245c5 100755 +--- a/scripts/selinux/install_policy.sh ++++ b/scripts/selinux/install_policy.sh +@@ -78,7 +78,7 @@ cd /etc/selinux/dummy/contexts/files + $SF -F file_contexts / + + mounts=`cat /proc/$$/mounts | \ +- egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \ ++ grep -E "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \ + awk '{ print $2 '}` + $SF -F file_contexts $mounts + +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index bde74fcecee38..3e0fbbd995342 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -750,22 +750,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, + const struct evm_ima_xattr_data *xvalue = xattr_value; + int digsig = 0; + int result; ++ int err; + + result = ima_protect_xattr(dentry, xattr_name, xattr_value, + xattr_value_len); + if (result == 1) { + if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST)) + return -EINVAL; ++ ++ err = validate_hash_algo(dentry, xvalue, xattr_value_len); ++ if (err) ++ return err; ++ + digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG); + } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) { + digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG); + } + if (result == 1 || evm_revalidate_status(xattr_name)) { +- result = validate_hash_algo(dentry, xvalue, xattr_value_len); +- if (result) +- return result; +- + ima_reset_appraise_flags(d_backing_inode(dentry), digsig); ++ if (result == 1) ++ result = 0; + } + return result; + } +diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c +index af6f717e1e7e6..c6ccb75036aec 100644 +--- a/sound/core/pcm_dmaengine.c ++++ b/sound/core/pcm_dmaengine.c +@@ -131,12 +131,14 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_set_config_from_dai_data); + + static void dmaengine_pcm_dma_complete(void *arg) + { ++ unsigned int new_pos; + struct snd_pcm_substream *substream = arg; + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); + +- prtd->pos += snd_pcm_lib_period_bytes(substream); +- if (prtd->pos >= snd_pcm_lib_buffer_bytes(substream)) +- prtd->pos = 0; ++ new_pos = prtd->pos + snd_pcm_lib_period_bytes(substream); ++ if (new_pos >= snd_pcm_lib_buffer_bytes(substream)) ++ new_pos = 0; ++ prtd->pos = new_pos; + + snd_pcm_period_elapsed(substream); + } +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index befa9809ff001..b1632ab432cf7 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -1835,10 +1835,8 @@ static int snd_rawmidi_free(struct snd_rawmidi *rmidi) + + snd_info_free_entry(rmidi->proc_entry); + rmidi->proc_entry = NULL; +- mutex_lock(®ister_mutex); + if (rmidi->ops && rmidi->ops->dev_unregister) + rmidi->ops->dev_unregister(rmidi); +- mutex_unlock(®ister_mutex); + + snd_rawmidi_free_substreams(&rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT]); + snd_rawmidi_free_substreams(&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT]); +diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c +index 7ed0a2a910352..2751bf2ff61bc 100644 +--- a/sound/core/sound_oss.c ++++ b/sound/core/sound_oss.c +@@ -162,7 +162,6 @@ int snd_unregister_oss_device(int type, struct snd_card *card, int dev) + mutex_unlock(&sound_oss_mutex); + return -ENOENT; + } +- unregister_sound_special(minor); + switch (SNDRV_MINOR_OSS_DEVICE(minor)) { + case SNDRV_MINOR_OSS_PCM: + track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_AUDIO); +@@ -174,12 +173,18 @@ int snd_unregister_oss_device(int type, struct snd_card *card, int dev) + track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_DMMIDI1); + break; + } +- if (track2 >= 0) { +- unregister_sound_special(track2); ++ if (track2 >= 0) + snd_oss_minors[track2] = NULL; +- } + snd_oss_minors[minor] = NULL; + mutex_unlock(&sound_oss_mutex); ++ ++ /* call unregister_sound_special() outside sound_oss_mutex; ++ * otherwise may deadlock, as it can trigger the release of a card ++ */ ++ unregister_sound_special(minor); ++ if (track2 >= 0) ++ unregister_sound_special(track2); ++ + kfree(mptr); + return 0; + } +diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c +index ec9cbb219bc14..dbc7dfd00c44a 100644 +--- a/sound/hda/intel-dsp-config.c ++++ b/sound/hda/intel-dsp-config.c +@@ -422,6 +422,11 @@ static const struct config_entry config_table[] = { + .device = 0x51cd, + }, + /* Alderlake-PS */ ++ { ++ .flags = FLAG_SOF, ++ .device = 0x51c9, ++ .codec_hid = &essx_83x6, ++ }, + { + .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, + .device = 0x51c9, +diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c +index 53a2b89f8983c..e63621bcb2142 100644 +--- a/sound/pci/hda/hda_beep.c ++++ b/sound/pci/hda/hda_beep.c +@@ -118,6 +118,12 @@ static int snd_hda_beep_event(struct input_dev *dev, unsigned int type, + return 0; + } + ++static void turn_on_beep(struct hda_beep *beep) ++{ ++ if (beep->keep_power_at_enable) ++ snd_hda_power_up_pm(beep->codec); ++} ++ + static void turn_off_beep(struct hda_beep *beep) + { + cancel_work_sync(&beep->beep_work); +@@ -125,6 +131,8 @@ static void turn_off_beep(struct hda_beep *beep) + /* turn off beep */ + generate_tone(beep, 0); + } ++ if (beep->keep_power_at_enable) ++ snd_hda_power_down_pm(beep->codec); + } + + /** +@@ -140,7 +148,9 @@ int snd_hda_enable_beep_device(struct hda_codec *codec, int enable) + enable = !!enable; + if (beep->enabled != enable) { + beep->enabled = enable; +- if (!enable) ++ if (enable) ++ turn_on_beep(beep); ++ else + turn_off_beep(beep); + return 1; + } +@@ -167,7 +177,8 @@ static int beep_dev_disconnect(struct snd_device *device) + input_unregister_device(beep->dev); + else + input_free_device(beep->dev); +- turn_off_beep(beep); ++ if (beep->enabled) ++ turn_off_beep(beep); + return 0; + } + +diff --git a/sound/pci/hda/hda_beep.h b/sound/pci/hda/hda_beep.h +index a25358a4807ab..db76e3ddba654 100644 +--- a/sound/pci/hda/hda_beep.h ++++ b/sound/pci/hda/hda_beep.h +@@ -25,6 +25,7 @@ struct hda_beep { + unsigned int enabled:1; + unsigned int linear_tone:1; /* linear tone for IDT/STAC codec */ + unsigned int playing:1; ++ unsigned int keep_power_at_enable:1; /* set by driver */ + struct work_struct beep_work; /* scheduled task for beep event */ + struct mutex mutex; + void (*power_hook)(struct hda_beep *beep, bool on); +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index c239d9dbbaefe..63c0c84348d0e 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2747,9 +2747,6 @@ static void generic_acomp_pin_eld_notify(void *audio_ptr, int port, int dev_id) + */ + if (codec->core.dev.power.power_state.event == PM_EVENT_SUSPEND) + return; +- /* ditto during suspend/resume process itself */ +- if (snd_hdac_is_in_pm(&codec->core)) +- return; + + check_presence_and_report(codec, pin_nid, dev_id); + } +@@ -2933,9 +2930,6 @@ static void intel_pin_eld_notify(void *audio_ptr, int port, int pipe) + */ + if (codec->core.dev.power.power_state.event == PM_EVENT_SUSPEND) + return; +- /* ditto during suspend/resume process itself */ +- if (snd_hdac_is_in_pm(&codec->core)) +- return; + + snd_hdac_i915_set_bclk(&codec->bus->core); + check_presence_and_report(codec, pin_nid, dev_id); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2f335f0d8b4b5..86c23f1e8855f 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8396,11 +8396,13 @@ static const struct hda_fixup alc269_fixups[] = { + [ALC285_FIXUP_ASUS_G533Z_PINS] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- { 0x14, 0x90170120 }, ++ { 0x14, 0x90170152 }, /* Speaker Surround Playback Switch */ ++ { 0x19, 0x03a19020 }, /* Mic Boost Volume */ ++ { 0x1a, 0x03a11c30 }, /* Mic Boost Volume */ ++ { 0x1e, 0x90170151 }, /* Rear jack, IN OUT EAPD Detect */ ++ { 0x21, 0x03211420 }, + { } + }, +- .chained = true, +- .chain_id = ALC294_FIXUP_ASUS_G513_PINS, + }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, +@@ -9151,7 +9153,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), +- SND_PCI_QUIRK(0x1028, 0x087d, "Dell Precision 5530", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), +@@ -9375,6 +9376,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), +@@ -9396,6 +9398,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE), + SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), + SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), ++ SND_PCI_QUIRK(0x10ec, 0x124c, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10ec, 0x1252, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10ec, 0x1254, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE), +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 7f340f18599c9..a794a01a68ca6 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -4311,6 +4311,8 @@ static int stac_parse_auto_config(struct hda_codec *codec) + if (codec->beep) { + /* IDT/STAC codecs have linear beep tone parameter */ + codec->beep->linear_tone = spec->linear_tone_beep; ++ /* keep power up while beep is enabled */ ++ codec->beep->keep_power_at_enable = 1; + /* if no beep switch is available, make its own one */ + caps = query_amp_caps(codec, nid, HDA_OUTPUT); + if (!(caps & AC_AMPCAP_MUTE)) { +@@ -4444,28 +4446,6 @@ static int stac_suspend(struct hda_codec *codec) + + return 0; + } +- +-static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid) +-{ +-#ifdef CONFIG_SND_HDA_INPUT_BEEP +- struct sigmatel_spec *spec = codec->spec; +-#endif +- int ret = snd_hda_gen_check_power_status(codec, nid); +- +-#ifdef CONFIG_SND_HDA_INPUT_BEEP +- if (nid == spec->gen.beep_nid && codec->beep) { +- if (codec->beep->enabled != spec->beep_power_on) { +- spec->beep_power_on = codec->beep->enabled; +- if (spec->beep_power_on) +- snd_hda_power_up_pm(codec); +- else +- snd_hda_power_down_pm(codec); +- } +- ret |= spec->beep_power_on; +- } +-#endif +- return ret; +-} + #else + #define stac_suspend NULL + #endif /* CONFIG_PM */ +@@ -4478,7 +4458,6 @@ static const struct hda_codec_ops stac_patch_ops = { + .unsol_event = snd_hda_jack_unsol_event, + #ifdef CONFIG_PM + .suspend = stac_suspend, +- .check_power_status = stac_check_power_status, + #endif + }; + +diff --git a/sound/soc/codecs/da7219.c b/sound/soc/codecs/da7219.c +index 7fdef38ed8cd3..1bfba7ef51ce5 100644 +--- a/sound/soc/codecs/da7219.c ++++ b/sound/soc/codecs/da7219.c +@@ -2196,6 +2196,7 @@ static int da7219_register_dai_clks(struct snd_soc_component *component) + dai_clk_lookup = clkdev_hw_create(dai_clk_hw, init.name, + "%s", dev_name(dev)); + if (!dai_clk_lookup) { ++ clk_hw_unregister(dai_clk_hw); + ret = -ENOMEM; + goto err; + } else { +@@ -2217,12 +2218,12 @@ static int da7219_register_dai_clks(struct snd_soc_component *component) + return 0; + + err: +- do { ++ while (--i >= 0) { + if (da7219->dai_clks_lookup[i]) + clkdev_drop(da7219->dai_clks_lookup[i]); + + clk_hw_unregister(&da7219->dai_clks_hw[i]); +- } while (i-- > 0); ++ } + + if (np) + kfree(da7219->clk_hw_data); +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 55503ba480bb6..e162a08d99452 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -823,17 +823,23 @@ static int tx_macro_tx_mixer_put(struct snd_kcontrol *kcontrol, + struct tx_macro *tx = snd_soc_component_get_drvdata(component); + + if (enable) { ++ if (tx->active_decimator[dai_id] == dec_id) ++ return 0; ++ + set_bit(dec_id, &tx->active_ch_mask[dai_id]); + tx->active_ch_cnt[dai_id]++; + tx->active_decimator[dai_id] = dec_id; + } else { ++ if (tx->active_decimator[dai_id] == -1) ++ return 0; ++ + tx->active_ch_cnt[dai_id]--; + clear_bit(dec_id, &tx->active_ch_mask[dai_id]); + tx->active_decimator[dai_id] = -1; + } + snd_soc_dapm_mixer_update_power(widget->dapm, kcontrol, enable, update); + +- return 0; ++ return 1; + } + + static int tx_macro_enable_dec(struct snd_soc_dapm_widget *w, +@@ -1019,9 +1025,12 @@ static int tx_macro_dec_mode_put(struct snd_kcontrol *kcontrol, + int path = e->shift_l; + struct tx_macro *tx = snd_soc_component_get_drvdata(component); + ++ if (tx->dec_mode[path] == value) ++ return 0; ++ + tx->dec_mode[path] = value; + +- return 0; ++ return 1; + } + + static int tx_macro_get_bcs(struct snd_kcontrol *kcontrol, +diff --git a/sound/soc/codecs/mt6359-accdet.c b/sound/soc/codecs/mt6359-accdet.c +index c190628e29056..7f624854948c7 100644 +--- a/sound/soc/codecs/mt6359-accdet.c ++++ b/sound/soc/codecs/mt6359-accdet.c +@@ -965,7 +965,7 @@ static int mt6359_accdet_probe(struct platform_device *pdev) + mutex_init(&priv->res_lock); + + priv->accdet_irq = platform_get_irq(pdev, 0); +- if (priv->accdet_irq) { ++ if (priv->accdet_irq >= 0) { + ret = devm_request_threaded_irq(&pdev->dev, priv->accdet_irq, + NULL, mt6359_accdet_irq, + IRQF_TRIGGER_HIGH | IRQF_ONESHOT, +@@ -979,7 +979,7 @@ static int mt6359_accdet_probe(struct platform_device *pdev) + + if (priv->caps & ACCDET_PMIC_EINT0) { + priv->accdet_eint0 = platform_get_irq(pdev, 1); +- if (priv->accdet_eint0) { ++ if (priv->accdet_eint0 >= 0) { + ret = devm_request_threaded_irq(&pdev->dev, + priv->accdet_eint0, + NULL, mt6359_accdet_irq, +@@ -994,7 +994,7 @@ static int mt6359_accdet_probe(struct platform_device *pdev) + } + } else if (priv->caps & ACCDET_PMIC_EINT1) { + priv->accdet_eint1 = platform_get_irq(pdev, 2); +- if (priv->accdet_eint1) { ++ if (priv->accdet_eint1 >= 0) { + ret = devm_request_threaded_irq(&pdev->dev, + priv->accdet_eint1, + NULL, mt6359_accdet_irq, +diff --git a/sound/soc/codecs/mt6660.c b/sound/soc/codecs/mt6660.c +index ba11555796ad8..45e0df13afb9f 100644 +--- a/sound/soc/codecs/mt6660.c ++++ b/sound/soc/codecs/mt6660.c +@@ -503,13 +503,17 @@ static int mt6660_i2c_probe(struct i2c_client *client) + dev_err(chip->dev, "read chip revision fail\n"); + goto probe_fail; + } +- pm_runtime_set_active(chip->dev); +- pm_runtime_enable(chip->dev); + + ret = devm_snd_soc_register_component(chip->dev, + &mt6660_component_driver, + &mt6660_codec_dai, 1); ++ if (!ret) { ++ pm_runtime_set_active(chip->dev); ++ pm_runtime_enable(chip->dev); ++ } ++ + return ret; ++ + probe_fail: + _mt6660_chip_power_on(chip, 0); + mutex_destroy(&chip->io_lock); +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 4cb788f3e5f71..7ae7a5249f952 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -34,6 +34,9 @@ struct tas2764_priv { + + int v_sense_slot; + int i_sense_slot; ++ ++ bool dac_powered; ++ bool unmuted; + }; + + static void tas2764_reset(struct tas2764_priv *tas2764) +@@ -50,34 +53,22 @@ static void tas2764_reset(struct tas2764_priv *tas2764) + usleep_range(1000, 2000); + } + +-static int tas2764_set_bias_level(struct snd_soc_component *component, +- enum snd_soc_bias_level level) ++static int tas2764_update_pwr_ctrl(struct tas2764_priv *tas2764) + { +- struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); ++ struct snd_soc_component *component = tas2764->component; ++ unsigned int val; ++ int ret; + +- switch (level) { +- case SND_SOC_BIAS_ON: +- snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_ACTIVE); +- break; +- case SND_SOC_BIAS_STANDBY: +- case SND_SOC_BIAS_PREPARE: +- snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_MUTE); +- break; +- case SND_SOC_BIAS_OFF: +- snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_SHUTDOWN); +- break; ++ if (tas2764->dac_powered) ++ val = tas2764->unmuted ? ++ TAS2764_PWR_CTRL_ACTIVE : TAS2764_PWR_CTRL_MUTE; ++ else ++ val = TAS2764_PWR_CTRL_SHUTDOWN; + +- default: +- dev_err(tas2764->dev, +- "wrong power level setting %d\n", level); +- return -EINVAL; +- } ++ ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, ++ TAS2764_PWR_CTRL_MASK, val); ++ if (ret < 0) ++ return ret; + + return 0; + } +@@ -114,9 +105,7 @@ static int tas2764_codec_resume(struct snd_soc_component *component) + usleep_range(1000, 2000); + } + +- ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_ACTIVE); ++ ret = tas2764_update_pwr_ctrl(tas2764); + + if (ret < 0) + return ret; +@@ -150,14 +139,12 @@ static int tas2764_dac_event(struct snd_soc_dapm_widget *w, + + switch (event) { + case SND_SOC_DAPM_POST_PMU: +- ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_MUTE); ++ tas2764->dac_powered = true; ++ ret = tas2764_update_pwr_ctrl(tas2764); + break; + case SND_SOC_DAPM_PRE_PMD: +- ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_SHUTDOWN); ++ tas2764->dac_powered = false; ++ ret = tas2764_update_pwr_ctrl(tas2764); + break; + default: + dev_err(tas2764->dev, "Unsupported event\n"); +@@ -202,17 +189,11 @@ static const struct snd_soc_dapm_route tas2764_audio_map[] = { + + static int tas2764_mute(struct snd_soc_dai *dai, int mute, int direction) + { +- struct snd_soc_component *component = dai->component; +- int ret; +- +- ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- mute ? TAS2764_PWR_CTRL_MUTE : 0); ++ struct tas2764_priv *tas2764 = ++ snd_soc_component_get_drvdata(dai->component); + +- if (ret < 0) +- return ret; +- +- return 0; ++ tas2764->unmuted = !mute; ++ return tas2764_update_pwr_ctrl(tas2764); + } + + static int tas2764_set_bitwidth(struct tas2764_priv *tas2764, int bitwidth) +@@ -485,7 +466,7 @@ static struct snd_soc_dai_driver tas2764_dai_driver[] = { + .id = 0, + .playback = { + .stream_name = "ASI1 Playback", +- .channels_min = 2, ++ .channels_min = 1, + .channels_max = 2, + .rates = TAS2764_RATES, + .formats = TAS2764_FORMATS, +@@ -526,12 +507,6 @@ static int tas2764_codec_probe(struct snd_soc_component *component) + if (ret < 0) + return ret; + +- ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, +- TAS2764_PWR_CTRL_MASK, +- TAS2764_PWR_CTRL_MUTE); +- if (ret < 0) +- return ret; +- + return 0; + } + +@@ -549,7 +524,6 @@ static const struct snd_soc_component_driver soc_component_driver_tas2764 = { + .probe = tas2764_codec_probe, + .suspend = tas2764_codec_suspend, + .resume = tas2764_codec_resume, +- .set_bias_level = tas2764_set_bias_level, + .controls = tas2764_snd_controls, + .num_controls = ARRAY_SIZE(tas2764_snd_controls), + .dapm_widgets = tas2764_dapm_widgets, +diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c +index 541ef1cd3b74e..6b2ff38db5f9c 100644 +--- a/sound/soc/codecs/wcd9335.c ++++ b/sound/soc/codecs/wcd9335.c +@@ -1983,8 +1983,8 @@ static int wcd9335_trigger(struct snd_pcm_substream *substream, int cmd, + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- slim_stream_unprepare(dai_data->sruntime); + slim_stream_disable(dai_data->sruntime); ++ slim_stream_unprepare(dai_data->sruntime); + break; + default: + break; +diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c +index f56907d0942db..28175c746b9ae 100644 +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -1913,8 +1913,8 @@ static int wcd934x_trigger(struct snd_pcm_substream *substream, int cmd, + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- slim_stream_unprepare(dai_data->sruntime); + slim_stream_disable(dai_data->sruntime); ++ slim_stream_unprepare(dai_data->sruntime); + break; + default: + break; +diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c +index b034df47a5ef1..e92daeba11f20 100644 +--- a/sound/soc/codecs/wm5102.c ++++ b/sound/soc/codecs/wm5102.c +@@ -2100,9 +2100,6 @@ static int wm5102_probe(struct platform_device *pdev) + regmap_update_bits(arizona->regmap, wm5102_digital_vu[i], + WM5102_DIG_VU, WM5102_DIG_VU); + +- pm_runtime_enable(&pdev->dev); +- pm_runtime_idle(&pdev->dev); +- + ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1, + "ADSP2 Compressed IRQ", wm5102_adsp2_irq, + wm5102); +@@ -2135,6 +2132,9 @@ static int wm5102_probe(struct platform_device *pdev) + goto err_spk_irqs; + } + ++ pm_runtime_enable(&pdev->dev); ++ pm_runtime_idle(&pdev->dev); ++ + return ret; + + err_spk_irqs: +diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c +index 4ab7a672f8de8..1b0da02b5c79c 100644 +--- a/sound/soc/codecs/wm5110.c ++++ b/sound/soc/codecs/wm5110.c +@@ -2458,9 +2458,6 @@ static int wm5110_probe(struct platform_device *pdev) + regmap_update_bits(arizona->regmap, wm5110_digital_vu[i], + WM5110_DIG_VU, WM5110_DIG_VU); + +- pm_runtime_enable(&pdev->dev); +- pm_runtime_idle(&pdev->dev); +- + ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1, + "ADSP2 Compressed IRQ", wm5110_adsp2_irq, + wm5110); +@@ -2493,6 +2490,9 @@ static int wm5110_probe(struct platform_device *pdev) + goto err_spk_irqs; + } + ++ pm_runtime_enable(&pdev->dev); ++ pm_runtime_idle(&pdev->dev); ++ + return ret; + + err_spk_irqs: +diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c +index 38ef631d1a1ff..c8c711e555c0e 100644 +--- a/sound/soc/codecs/wm8997.c ++++ b/sound/soc/codecs/wm8997.c +@@ -1162,9 +1162,6 @@ static int wm8997_probe(struct platform_device *pdev) + regmap_update_bits(arizona->regmap, wm8997_digital_vu[i], + WM8997_DIG_VU, WM8997_DIG_VU); + +- pm_runtime_enable(&pdev->dev); +- pm_runtime_idle(&pdev->dev); +- + arizona_init_common(arizona); + + ret = arizona_init_vol_limit(arizona); +@@ -1183,6 +1180,9 @@ static int wm8997_probe(struct platform_device *pdev) + goto err_spk_irqs; + } + ++ pm_runtime_enable(&pdev->dev); ++ pm_runtime_idle(&pdev->dev); ++ + return ret; + + err_spk_irqs: +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index a7784ac15dde6..0e2c785d911f1 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1617,7 +1617,9 @@ static int wm_adsp_buffer_init(struct wm_adsp *dsp) + if (list_empty(&dsp->buffer_list)) { + /* Fall back to legacy support */ + ret = wm_adsp_buffer_parse_legacy(dsp); +- if (ret) ++ if (ret == -ENODEV) ++ adsp_info(dsp, "Legacy support not available\n"); ++ else if (ret) + adsp_warn(dsp, "Failed to parse legacy: %d\n", ret); + } + +diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c +index 8b61582753c86..9af4c4a35eb16 100644 +--- a/sound/soc/fsl/eukrea-tlv320.c ++++ b/sound/soc/fsl/eukrea-tlv320.c +@@ -86,7 +86,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) + int ret; + int int_port = 0, ext_port; + struct device_node *np = pdev->dev.of_node; +- struct device_node *ssi_np = NULL, *codec_np = NULL; ++ struct device_node *ssi_np = NULL, *codec_np = NULL, *tmp_np = NULL; + + eukrea_tlv320.dev = &pdev->dev; + if (np) { +@@ -143,7 +143,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) + } + + if (machine_is_eukrea_cpuimx27() || +- of_find_compatible_node(NULL, NULL, "fsl,imx21-audmux")) { ++ (tmp_np = of_find_compatible_node(NULL, NULL, "fsl,imx21-audmux"))) { + imx_audmux_v1_configure_port(MX27_AUDMUX_HPCR1_SSI0, + IMX_AUDMUX_V1_PCR_SYN | + IMX_AUDMUX_V1_PCR_TFSDIR | +@@ -158,10 +158,11 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) + IMX_AUDMUX_V1_PCR_SYN | + IMX_AUDMUX_V1_PCR_RXDSEL(MX27_AUDMUX_HPCR1_SSI0) + ); ++ of_node_put(tmp_np); + } else if (machine_is_eukrea_cpuimx25sd() || + machine_is_eukrea_cpuimx35sd() || + machine_is_eukrea_cpuimx51sd() || +- of_find_compatible_node(NULL, NULL, "fsl,imx31-audmux")) { ++ (tmp_np = of_find_compatible_node(NULL, NULL, "fsl,imx31-audmux"))) { + if (!np) + ext_port = machine_is_eukrea_cpuimx25sd() ? + 4 : 3; +@@ -178,6 +179,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) + IMX_AUDMUX_V2_PTCR_SYN, + IMX_AUDMUX_V2_PDCR_RXDSEL(int_port) + ); ++ of_node_put(tmp_np); + } else { + if (np) { + /* The eukrea,asoc-tlv320 driver was explicitly +diff --git a/sound/soc/sh/rcar/ctu.c b/sound/soc/sh/rcar/ctu.c +index 6156445bcb69a..e39eb2ac7e955 100644 +--- a/sound/soc/sh/rcar/ctu.c ++++ b/sound/soc/sh/rcar/ctu.c +@@ -171,7 +171,11 @@ static int rsnd_ctu_init(struct rsnd_mod *mod, + struct rsnd_dai_stream *io, + struct rsnd_priv *priv) + { +- rsnd_mod_power_on(mod); ++ int ret; ++ ++ ret = rsnd_mod_power_on(mod); ++ if (ret < 0) ++ return ret; + + rsnd_ctu_activation(mod); + +diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c +index 5137e03a9d7c7..16befcbc312cb 100644 +--- a/sound/soc/sh/rcar/dvc.c ++++ b/sound/soc/sh/rcar/dvc.c +@@ -186,7 +186,11 @@ static int rsnd_dvc_init(struct rsnd_mod *mod, + struct rsnd_dai_stream *io, + struct rsnd_priv *priv) + { +- rsnd_mod_power_on(mod); ++ int ret; ++ ++ ret = rsnd_mod_power_on(mod); ++ if (ret < 0) ++ return ret; + + rsnd_dvc_activation(mod); + +diff --git a/sound/soc/sh/rcar/mix.c b/sound/soc/sh/rcar/mix.c +index 3572c2c5686c7..1de0e085804cc 100644 +--- a/sound/soc/sh/rcar/mix.c ++++ b/sound/soc/sh/rcar/mix.c +@@ -146,7 +146,11 @@ static int rsnd_mix_init(struct rsnd_mod *mod, + struct rsnd_dai_stream *io, + struct rsnd_priv *priv) + { +- rsnd_mod_power_on(mod); ++ int ret; ++ ++ ret = rsnd_mod_power_on(mod); ++ if (ret < 0) ++ return ret; + + rsnd_mix_activation(mod); + +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index 0ea84ae57c6ac..f832165e46bc0 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -463,11 +463,14 @@ static int rsnd_src_init(struct rsnd_mod *mod, + struct rsnd_priv *priv) + { + struct rsnd_src *src = rsnd_mod_to_src(mod); ++ int ret; + + /* reset sync convert_rate */ + src->sync.val = 0; + +- rsnd_mod_power_on(mod); ++ ret = rsnd_mod_power_on(mod); ++ if (ret < 0) ++ return ret; + + rsnd_src_activation(mod); + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 43c5e27dc5c86..7ade6c5ed96ff 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -480,7 +480,9 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, + + ssi->usrcnt++; + +- rsnd_mod_power_on(mod); ++ ret = rsnd_mod_power_on(mod); ++ if (ret < 0) ++ return ret; + + rsnd_ssi_config_init(mod, io); + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 0c1de56248427..6359d00b7bdaa 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -723,7 +723,7 @@ static int soc_pcm_close(struct snd_pcm_substream *substream) + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + + snd_soc_dpcm_mutex_lock(rtd); +- soc_pcm_clean(rtd, substream, 0); ++ __soc_pcm_close(rtd, substream); + snd_soc_dpcm_mutex_unlock(rtd); + return 0; + } +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index 17f2f3a982c38..7d9e62ab9d0e4 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -376,6 +376,10 @@ static int dmic_num_override = -1; + module_param_named(dmic_num, dmic_num_override, int, 0444); + MODULE_PARM_DESC(dmic_num, "SOF HDA DMIC number"); + ++static int mclk_id_override = -1; ++module_param_named(mclk_id, mclk_id_override, int, 0444); ++MODULE_PARM_DESC(mclk_id, "SOF SSP mclk_id"); ++ + #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) + static bool hda_codec_use_common_hdmi = IS_ENABLED(CONFIG_SND_HDA_CODEC_HDMI); + module_param_named(use_common_hdmi, hda_codec_use_common_hdmi, bool, 0444); +@@ -1433,6 +1437,13 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev) + + sof_pdata->tplg_filename = tplg_filename; + } ++ ++ /* check if mclk_id should be modified from topology defaults */ ++ if (mclk_id_override >= 0) { ++ dev_info(sdev->dev, "Overriding topology with MCLK %d from kernel_parameter\n", mclk_id_override); ++ sdev->mclk_id_override = true; ++ sdev->mclk_id_quirk = mclk_id_override; ++ } + } + + /* +diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c +index e97f50d5bcba1..b8ec302bc8871 100644 +--- a/sound/soc/sof/ipc3-topology.c ++++ b/sound/soc/sof/ipc3-topology.c +@@ -1233,6 +1233,7 @@ static int sof_link_afe_load(struct snd_soc_component *scomp, struct snd_sof_dai + static int sof_link_ssp_load(struct snd_soc_component *scomp, struct snd_sof_dai_link *slink, + struct sof_ipc_dai_config *config, struct snd_sof_dai *dai) + { ++ struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(scomp); + struct snd_soc_tplg_hw_config *hw_config = slink->hw_configs; + struct sof_dai_private_data *private = dai->private; + u32 size = sizeof(*config); +@@ -1257,6 +1258,12 @@ static int sof_link_ssp_load(struct snd_soc_component *scomp, struct snd_sof_dai + + config[i].hdr.size = size; + ++ if (sdev->mclk_id_override) { ++ dev_dbg(scomp->dev, "tplg: overriding topology mclk_id %d by quirk %d\n", ++ config[i].ssp.mclk_id, sdev->mclk_id_quirk); ++ config[i].ssp.mclk_id = sdev->mclk_id_quirk; ++ } ++ + /* copy differentiating hw configs to ipc structs */ + config[i].ssp.mclk_rate = le32_to_cpu(hw_config[i].mclk_rate); + config[i].ssp.bclk_rate = le32_to_cpu(hw_config[i].bclk_rate); +diff --git a/sound/soc/sof/mediatek/mt8195/mt8195.c b/sound/soc/sof/mediatek/mt8195/mt8195.c +index 30111ab23bf5e..30ab2274fbf8f 100644 +--- a/sound/soc/sof/mediatek/mt8195/mt8195.c ++++ b/sound/soc/sof/mediatek/mt8195/mt8195.c +@@ -634,4 +634,5 @@ static struct platform_driver snd_sof_of_mt8195_driver = { + module_platform_driver(snd_sof_of_mt8195_driver); + + MODULE_IMPORT_NS(SND_SOC_SOF_XTENSA); ++MODULE_IMPORT_NS(SND_SOC_SOF_MTK_COMMON); + MODULE_LICENSE("Dual BSD/GPL"); +diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c +index d627092b399d7..643fd1036d60b 100644 +--- a/sound/soc/sof/sof-pci-dev.c ++++ b/sound/soc/sof/sof-pci-dev.c +@@ -138,7 +138,7 @@ static const struct dmi_system_id community_key_platforms[] = { + .ident = "Google Chromebooks", + .callback = chromebook_use_community_key, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Google"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Google"), + } + }, + {}, +diff --git a/sound/soc/sof/sof-priv.h b/sound/soc/sof/sof-priv.h +index f11f575fd1da2..544e5be9d10ef 100644 +--- a/sound/soc/sof/sof-priv.h ++++ b/sound/soc/sof/sof-priv.h +@@ -585,6 +585,10 @@ struct snd_sof_dev { + /* to protect the ipc_rx_handler_list and dsp_state_handler_list list */ + struct mutex client_event_handler_mutex; + ++ /* quirks to override topology values */ ++ bool mclk_id_override; ++ u16 mclk_id_quirk; /* same size as in IPC3 definitions */ ++ + void *private; /* core does not touch this */ + }; + +diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c +index 6ee714542b84a..c0f964891b584 100644 +--- a/sound/soc/stm/stm32_adfsdm.c ++++ b/sound/soc/stm/stm32_adfsdm.c +@@ -334,8 +334,6 @@ static int stm32_adfsdm_probe(struct platform_device *pdev) + + dev_set_drvdata(&pdev->dev, priv); + +- pm_runtime_enable(&pdev->dev); +- + ret = devm_snd_soc_register_component(&pdev->dev, + &stm32_adfsdm_dai_component, + &priv->dai_drv, 1); +@@ -365,9 +363,13 @@ static int stm32_adfsdm_probe(struct platform_device *pdev) + #endif + + ret = snd_soc_add_component(component, NULL, 0); +- if (ret < 0) ++ if (ret < 0) { + dev_err(&pdev->dev, "%s: Failed to register PCM platform\n", + __func__); ++ return ret; ++ } ++ ++ pm_runtime_enable(&pdev->dev); + + return ret; + } +diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c +index ac5dff4d1677a..d9e622f4c4221 100644 +--- a/sound/soc/stm/stm32_i2s.c ++++ b/sound/soc/stm/stm32_i2s.c +@@ -1135,8 +1135,6 @@ static int stm32_i2s_probe(struct platform_device *pdev) + return dev_err_probe(&pdev->dev, PTR_ERR(i2s->regmap), + "Regmap init error\n"); + +- pm_runtime_enable(&pdev->dev); +- + ret = snd_dmaengine_pcm_register(&pdev->dev, &stm32_i2s_pcm_config, 0); + if (ret) + return dev_err_probe(&pdev->dev, ret, "PCM DMA register error\n"); +@@ -1179,6 +1177,8 @@ static int stm32_i2s_probe(struct platform_device *pdev) + FIELD_GET(I2S_VERR_MIN_MASK, val)); + } + ++ pm_runtime_enable(&pdev->dev); ++ + return ret; + + error: +diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c +index 6f7882c4fe6ad..60be4894e5fdc 100644 +--- a/sound/soc/stm/stm32_spdifrx.c ++++ b/sound/soc/stm/stm32_spdifrx.c +@@ -1001,8 +1001,6 @@ static int stm32_spdifrx_probe(struct platform_device *pdev) + udelay(2); + reset_control_deassert(rst); + +- pm_runtime_enable(&pdev->dev); +- + pcm_config = &stm32_spdifrx_pcm_config; + ret = snd_dmaengine_pcm_register(&pdev->dev, pcm_config, 0); + if (ret) +@@ -1035,6 +1033,8 @@ static int stm32_spdifrx_probe(struct platform_device *pdev) + FIELD_GET(SPDIFRX_VERR_MIN_MASK, ver)); + } + ++ pm_runtime_enable(&pdev->dev); ++ + return ret; + + error: +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 706d249a9ad6b..a5ed11ea11456 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -690,7 +690,7 @@ static bool get_alias_id(struct usb_device *dev, unsigned int *id) + return false; + } + +-static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) ++static int check_delayed_register_option(struct snd_usb_audio *chip) + { + int i; + unsigned int id, inum; +@@ -699,14 +699,31 @@ static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) + if (delayed_register[i] && + sscanf(delayed_register[i], "%x:%x", &id, &inum) == 2 && + id == chip->usb_id) +- return iface < inum; ++ return inum; + } + +- return false; ++ return -1; + } + + static const struct usb_device_id usb_audio_ids[]; /* defined below */ + ++/* look for the last interface that matches with our ids and remember it */ ++static void find_last_interface(struct snd_usb_audio *chip) ++{ ++ struct usb_host_config *config = chip->dev->actconfig; ++ struct usb_interface *intf; ++ int i; ++ ++ if (!config) ++ return; ++ for (i = 0; i < config->desc.bNumInterfaces; i++) { ++ intf = config->interface[i]; ++ if (usb_match_id(intf, usb_audio_ids)) ++ chip->last_iface = intf->altsetting[0].desc.bInterfaceNumber; ++ } ++ usb_audio_dbg(chip, "Found last interface = %d\n", chip->last_iface); ++} ++ + /* look for the corresponding quirk */ + static const struct snd_usb_audio_quirk * + get_alias_quirk(struct usb_device *dev, unsigned int id) +@@ -813,6 +830,7 @@ static int usb_audio_probe(struct usb_interface *intf, + err = -ENODEV; + goto __error; + } ++ find_last_interface(chip); + } + + if (chip->num_interfaces >= MAX_CARD_INTERFACES) { +@@ -862,11 +880,11 @@ static int usb_audio_probe(struct usb_interface *intf, + chip->need_delayed_register = false; /* clear again */ + } + +- /* we are allowed to call snd_card_register() many times, but first +- * check to see if a device needs to skip it or do anything special ++ /* register card if we reach to the last interface or to the specified ++ * one given via option + */ +- if (!snd_usb_registration_quirk(chip, ifnum) && +- !check_delayed_register_option(chip, ifnum)) { ++ if (check_delayed_register_option(chip) == ifnum || ++ usb_interface_claimed(usb_ifnum_to_if(dev, chip->last_iface))) { + err = snd_card_register(chip->card); + if (err < 0) + goto __error; +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 5d105c44b46df..118b1fb7dc86c 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -39,6 +39,7 @@ struct snd_usb_iface_ref { + struct snd_usb_clock_ref { + unsigned char clock; + atomic_t locked; ++ int opened; + int rate; + struct list_head list; + }; +@@ -93,12 +94,13 @@ static inline unsigned get_usb_high_speed_rate(unsigned int rate) + */ + static void release_urb_ctx(struct snd_urb_ctx *u) + { +- if (u->buffer_size) ++ if (u->urb && u->buffer_size) + usb_free_coherent(u->ep->chip->dev, u->buffer_size, + u->urb->transfer_buffer, + u->urb->transfer_dma); + usb_free_urb(u->urb); + u->urb = NULL; ++ u->buffer_size = 0; + } + + static const char *usb_error_string(int err) +@@ -801,6 +803,7 @@ snd_usb_endpoint_open(struct snd_usb_audio *chip, + ep = NULL; + goto unlock; + } ++ ep->clock_ref->opened++; + } + + ep->cur_audiofmt = fp; +@@ -924,8 +927,10 @@ void snd_usb_endpoint_close(struct snd_usb_audio *chip, + endpoint_set_interface(chip, ep, false); + + if (!--ep->opened) { +- if (ep->clock_ref && !atomic_read(&ep->clock_ref->locked)) +- ep->clock_ref->rate = 0; ++ if (ep->clock_ref) { ++ if (!--ep->clock_ref->opened) ++ ep->clock_ref->rate = 0; ++ } + ep->iface = 0; + ep->altsetting = 0; + ep->cur_audiofmt = NULL; +@@ -1261,6 +1266,7 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep) + if (!ep->syncbuf) + return -ENOMEM; + ++ ep->nurbs = SYNC_URBS; + for (i = 0; i < SYNC_URBS; i++) { + struct snd_urb_ctx *u = &ep->urb[i]; + u->index = i; +@@ -1280,8 +1286,6 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep) + u->urb->complete = snd_complete_urb; + } + +- ep->nurbs = SYNC_URBS; +- + return 0; + + out_of_memory: +@@ -1633,8 +1637,7 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep, bool keep_pending) + WRITE_ONCE(ep->sync_source->sync_sink, NULL); + stop_urbs(ep, false, keep_pending); + if (ep->clock_ref) +- if (!atomic_dec_return(&ep->clock_ref->locked)) +- ep->clock_ref->rate = 0; ++ atomic_dec(&ep->clock_ref->locked); + } + } + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 5b4d8f5eade20..8c3b0be909eb0 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1728,48 +1728,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip, + } + } + +-/* +- * registration quirk: +- * the registration is skipped if a device matches with the given ID, +- * unless the interface reaches to the defined one. This is for delaying +- * the registration until the last known interface, so that the card and +- * devices appear at the same time. +- */ +- +-struct registration_quirk { +- unsigned int usb_id; /* composed via USB_ID() */ +- unsigned int interface; /* the interface to trigger register */ +-}; +- +-#define REG_QUIRK_ENTRY(vendor, product, iface) \ +- { .usb_id = USB_ID(vendor, product), .interface = (iface) } +- +-static const struct registration_quirk registration_quirks[] = { +- REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */ +- REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ +- REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ +- REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ +- REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ +- REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */ +- REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ +- REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ +- REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ +- { 0 } /* terminator */ +-}; +- +-/* return true if skipping registration */ +-bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface) +-{ +- const struct registration_quirk *q; +- +- for (q = registration_quirks; q->usb_id; q++) +- if (chip->usb_id == q->usb_id) +- return iface < q->interface; +- +- /* Register as normal */ +- return false; +-} +- + /* + * driver behavior quirk flags + */ +diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h +index 31abb7cb01a52..f9bfd5ac7bab0 100644 +--- a/sound/usb/quirks.h ++++ b/sound/usb/quirks.h +@@ -48,8 +48,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip, + struct audioformat *fp, + int stream); + +-bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface); +- + void snd_usb_init_quirk_flags(struct snd_usb_audio *chip); + + #endif /* __USBAUDIO_QUIRKS_H */ +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index ffbb4b0d09a07..2c6575029b1cd 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -37,6 +37,7 @@ struct snd_usb_audio { + unsigned int quirk_flags; + unsigned int need_delayed_register:1; /* warn for delayed registration */ + int num_interfaces; ++ int last_iface; + int num_suspended_intf; + int sample_rate_read_error; + +diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c +index f5dddf8ef404b..6d041d1f53959 100644 +--- a/tools/bpf/bpftool/btf_dumper.c ++++ b/tools/bpf/bpftool/btf_dumper.c +@@ -426,7 +426,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset, + *(char *)data); + break; + case BTF_INT_BOOL: +- jsonw_bool(jw, *(int *)data); ++ jsonw_bool(jw, *(bool *)data); + break; + default: + /* shouldn't happen */ +diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c +index 9062ef2b87670..0881437587bad 100644 +--- a/tools/bpf/bpftool/main.c ++++ b/tools/bpf/bpftool/main.c +@@ -435,6 +435,16 @@ int main(int argc, char **argv) + + setlinebuf(stdout); + ++#ifdef USE_LIBCAP ++ /* Libcap < 2.63 hooks before main() to compute the number of ++ * capabilities of the running kernel, and doing so it calls prctl() ++ * which may fail and set errno to non-zero. ++ * Let's reset errno to make sure this does not interfere with the ++ * batch mode. ++ */ ++ errno = 0; ++#endif ++ + last_do_help = do_help; + pretty_output = false; + json_output = false; +diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c +index 67dc010e9fe3b..63954a2e213da 100644 +--- a/tools/lib/bpf/xsk.c ++++ b/tools/lib/bpf/xsk.c +@@ -1228,15 +1228,15 @@ void xsk_socket__delete(struct xsk_socket *xsk) + ctx = xsk->ctx; + umem = ctx->umem; + +- xsk_put_ctx(ctx, true); +- +- if (!ctx->refcount) { ++ if (ctx->refcount == 1) { + xsk_delete_bpf_maps(xsk); + close(ctx->prog_fd); + if (ctx->has_bpf_link) + close(ctx->link_fd); + } + ++ xsk_put_ctx(ctx, true); ++ + err = xsk_get_mmap_offsets(xsk->fd, &off); + if (!err) { + if (xsk->rx) { +diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c +index c25e957c1e520..7e24b09b1163a 100644 +--- a/tools/objtool/elf.c ++++ b/tools/objtool/elf.c +@@ -619,6 +619,11 @@ static int elf_update_symbol(struct elf *elf, struct section *symtab, + Elf64_Xword entsize = symtab->sh.sh_entsize; + int max_idx, idx = sym->idx; + Elf_Scn *s, *t = NULL; ++ bool is_special_shndx = sym->sym.st_shndx >= SHN_LORESERVE && ++ sym->sym.st_shndx != SHN_XINDEX; ++ ++ if (is_special_shndx) ++ shndx = sym->sym.st_shndx; + + s = elf_getscn(elf->elf, symtab->idx); + if (!s) { +@@ -704,7 +709,7 @@ static int elf_update_symbol(struct elf *elf, struct section *symtab, + } + + /* setup extended section index magic and write the symbol */ +- if (shndx >= SHN_UNDEF && shndx < SHN_LORESERVE) { ++ if ((shndx >= SHN_UNDEF && shndx < SHN_LORESERVE) || is_special_shndx) { + sym->sym.st_shndx = shndx; + if (!shndx_data) + shndx = 0; +diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c +index 06c2cdfd8f2fa..892339da90cf4 100644 +--- a/tools/perf/arch/x86/util/intel-pt.c ++++ b/tools/perf/arch/x86/util/intel-pt.c +@@ -871,7 +871,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, + * User space tasks can migrate between CPUs, so when tracing + * selected CPUs, sideband for all CPUs is still needed. + */ +- need_system_wide_tracking = evlist->core.has_user_cpus && ++ need_system_wide_tracking = opts->target.cpu_list && + !intel_pt_evsel->core.attr.exclude_user; + + tracking_evsel = evlist__add_aux_dummy(evlist, need_system_wide_tracking); +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 62b2f375a94dc..5a87c80ea3259 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -3878,6 +3878,7 @@ static const char * const intel_pt_info_fmts[] = { + [INTEL_PT_SNAPSHOT_MODE] = " Snapshot mode %"PRId64"\n", + [INTEL_PT_PER_CPU_MMAPS] = " Per-cpu maps %"PRId64"\n", + [INTEL_PT_MTC_BIT] = " MTC bit %#"PRIx64"\n", ++ [INTEL_PT_MTC_FREQ_BITS] = " MTC freq bits %#"PRIx64"\n", + [INTEL_PT_TSC_CTC_N] = " TSC:CTC numerator %"PRIu64"\n", + [INTEL_PT_TSC_CTC_D] = " TSC:CTC denominator %"PRIu64"\n", + [INTEL_PT_CYC_BIT] = " CYC bit %#"PRIx64"\n", +@@ -3892,8 +3893,12 @@ static void intel_pt_print_info(__u64 *arr, int start, int finish) + if (!dump_trace) + return; + +- for (i = start; i <= finish; i++) +- fprintf(stdout, intel_pt_info_fmts[i], arr[i]); ++ for (i = start; i <= finish; i++) { ++ const char *fmt = intel_pt_info_fmts[i]; ++ ++ if (fmt) ++ fprintf(stdout, fmt, arr[i]); ++ } + } + + static void intel_pt_print_info_str(const char *name, const char *str) +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index b51c646c212e5..d5646c867c5b9 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -255,6 +255,9 @@ __add_event(struct list_head *list, int *idx, + struct perf_cpu_map *cpus = pmu ? perf_cpu_map__get(pmu->cpus) : + cpu_list ? perf_cpu_map__new(cpu_list) : NULL; + ++ if (pmu) ++ perf_pmu__warn_invalid_formats(pmu); ++ + if (pmu && attr->type == PERF_TYPE_RAW) + perf_pmu__warn_invalid_config(pmu, attr->config, name); + +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 9a1c7e63e6630..6c1924883b183 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -1048,6 +1048,23 @@ err: + return NULL; + } + ++void perf_pmu__warn_invalid_formats(struct perf_pmu *pmu) ++{ ++ struct perf_pmu_format *format; ++ ++ /* fake pmu doesn't have format list */ ++ if (pmu == &perf_pmu__fake) ++ return; ++ ++ list_for_each_entry(format, &pmu->format, list) ++ if (format->value >= PERF_PMU_FORMAT_VALUE_CONFIG_END) { ++ pr_warning("WARNING: '%s' format '%s' requires 'perf_event_attr::config%d'" ++ "which is not supported by this version of perf!\n", ++ pmu->name, format->name, format->value); ++ return; ++ } ++} ++ + static struct perf_pmu *pmu_find(const char *name) + { + struct perf_pmu *pmu; +diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h +index 541889fa9f9c6..420d8b83c6905 100644 +--- a/tools/perf/util/pmu.h ++++ b/tools/perf/util/pmu.h +@@ -17,6 +17,7 @@ enum { + PERF_PMU_FORMAT_VALUE_CONFIG, + PERF_PMU_FORMAT_VALUE_CONFIG1, + PERF_PMU_FORMAT_VALUE_CONFIG2, ++ PERF_PMU_FORMAT_VALUE_CONFIG_END, + }; + + #define PERF_PMU_FORMAT_BITS 64 +@@ -139,6 +140,7 @@ int perf_pmu__caps_parse(struct perf_pmu *pmu); + + void perf_pmu__warn_invalid_config(struct perf_pmu *pmu, __u64 config, + const char *name); ++void perf_pmu__warn_invalid_formats(struct perf_pmu *pmu); + + bool perf_pmu__has_hybrid(void); + int perf_pmu__match(char *pattern, char *name, char *tok); +diff --git a/tools/perf/util/pmu.l b/tools/perf/util/pmu.l +index a15d9fbd7c0ed..58b4926cfaca9 100644 +--- a/tools/perf/util/pmu.l ++++ b/tools/perf/util/pmu.l +@@ -27,8 +27,6 @@ num_dec [0-9]+ + + {num_dec} { return value(10); } + config { return PP_CONFIG; } +-config1 { return PP_CONFIG1; } +-config2 { return PP_CONFIG2; } + - { return '-'; } + : { return ':'; } + , { return ','; } +diff --git a/tools/perf/util/pmu.y b/tools/perf/util/pmu.y +index bfd7e8509869b..283efe059819d 100644 +--- a/tools/perf/util/pmu.y ++++ b/tools/perf/util/pmu.y +@@ -20,7 +20,7 @@ do { \ + + %} + +-%token PP_CONFIG PP_CONFIG1 PP_CONFIG2 ++%token PP_CONFIG + %token PP_VALUE PP_ERROR + %type <num> PP_VALUE + %type <bits> bit_term +@@ -47,18 +47,11 @@ PP_CONFIG ':' bits + $3)); + } + | +-PP_CONFIG1 ':' bits ++PP_CONFIG PP_VALUE ':' bits + { + ABORT_ON(perf_pmu__new_format(format, name, +- PERF_PMU_FORMAT_VALUE_CONFIG1, +- $3)); +-} +-| +-PP_CONFIG2 ':' bits +-{ +- ABORT_ON(perf_pmu__new_format(format, name, +- PERF_PMU_FORMAT_VALUE_CONFIG2, +- $3)); ++ $2, ++ $4)); + } + + bits: +diff --git a/tools/testing/selftests/arm64/signal/testcases/testcases.c b/tools/testing/selftests/arm64/signal/testcases/testcases.c +index 84c36bee4d82a..d98828cb542be 100644 +--- a/tools/testing/selftests/arm64/signal/testcases/testcases.c ++++ b/tools/testing/selftests/arm64/signal/testcases/testcases.c +@@ -33,7 +33,7 @@ bool validate_extra_context(struct extra_context *extra, char **err) + return false; + + fprintf(stderr, "Validating EXTRA...\n"); +- term = GET_RESV_NEXT_HEAD(extra); ++ term = GET_RESV_NEXT_HEAD(&extra->head); + if (!term || term->magic || term->size) { + *err = "Missing terminator after EXTRA context"; + return false; +diff --git a/tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c b/tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c +index 78c76496b14ad..b595556315bc3 100644 +--- a/tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c ++++ b/tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c +@@ -3,6 +3,7 @@ + #include <stdio.h> + #include <errno.h> + #include <string.h> ++#include <unistd.h> + + #include <bpf/bpf.h> + #include <bpf/libbpf.h> +@@ -137,6 +138,7 @@ static void __test_map_lookup_and_update_batch(bool is_pcpu) + free(keys); + free(values); + free(visited); ++ close(map_fd); + } + + static void array_map_batch_ops(void) +diff --git a/tools/testing/selftests/bpf/map_tests/htab_map_batch_ops.c b/tools/testing/selftests/bpf/map_tests/htab_map_batch_ops.c +index f807d53fd8dd4..1230ccf901280 100644 +--- a/tools/testing/selftests/bpf/map_tests/htab_map_batch_ops.c ++++ b/tools/testing/selftests/bpf/map_tests/htab_map_batch_ops.c +@@ -3,6 +3,7 @@ + #include <stdio.h> + #include <errno.h> + #include <string.h> ++#include <unistd.h> + + #include <bpf/bpf.h> + #include <bpf/libbpf.h> +@@ -255,6 +256,7 @@ void __test_map_lookup_and_delete_batch(bool is_pcpu) + free(visited); + if (!is_pcpu) + free(values); ++ close(map_fd); + } + + void htab_map_batch_ops(void) +diff --git a/tools/testing/selftests/bpf/map_tests/lpm_trie_map_batch_ops.c b/tools/testing/selftests/bpf/map_tests/lpm_trie_map_batch_ops.c +index 87d07b596e170..b66d56ddb7ef2 100644 +--- a/tools/testing/selftests/bpf/map_tests/lpm_trie_map_batch_ops.c ++++ b/tools/testing/selftests/bpf/map_tests/lpm_trie_map_batch_ops.c +@@ -7,6 +7,7 @@ + #include <errno.h> + #include <string.h> + #include <stdlib.h> ++#include <unistd.h> + + #include <bpf/bpf.h> + #include <bpf/libbpf.h> +@@ -150,4 +151,5 @@ void test_lpm_trie_map_batch_ops(void) + free(keys); + free(values); + free(visited); ++ close(map_fd); + } +diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi.c b/tools/testing/selftests/bpf/progs/kprobe_multi.c +index 08f95a8155d1b..98c3399e15c03 100644 +--- a/tools/testing/selftests/bpf/progs/kprobe_multi.c ++++ b/tools/testing/selftests/bpf/progs/kprobe_multi.c +@@ -36,15 +36,13 @@ __u64 kretprobe_test6_result = 0; + __u64 kretprobe_test7_result = 0; + __u64 kretprobe_test8_result = 0; + +-extern bool CONFIG_X86_KERNEL_IBT __kconfig __weak; +- + static void kprobe_multi_check(void *ctx, bool is_return) + { + if (bpf_get_current_pid_tgid() >> 32 != pid) + return; + + __u64 cookie = test_cookie ? bpf_get_attach_cookie(ctx) : 0; +- __u64 addr = bpf_get_func_ip(ctx) - (CONFIG_X86_KERNEL_IBT ? 4 : 0); ++ __u64 addr = bpf_get_func_ip(ctx); + + #define SET(__var, __addr, __cookie) ({ \ + if (((const void *) addr == __addr) && \ +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index cbebfaa7c1e82..4d42ffea00388 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -658,13 +658,13 @@ static void test_sockmap(unsigned int tasks, void *data) + { + struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_msg, *bpf_map_break; + int map_fd_msg = 0, map_fd_rx = 0, map_fd_tx = 0, map_fd_break; ++ struct bpf_object *parse_obj, *verdict_obj, *msg_obj; + int ports[] = {50200, 50201, 50202, 50204}; + int err, i, fd, udp, sfd[6] = {0xdeadbeef}; + u8 buf[20] = {0x0, 0x5, 0x3, 0x2, 0x1, 0x0}; + int parse_prog, verdict_prog, msg_prog; + struct sockaddr_in addr; + int one = 1, s, sc, rc; +- struct bpf_object *obj; + struct timeval to; + __u32 key, value; + pid_t pid[tasks]; +@@ -760,6 +760,7 @@ static void test_sockmap(unsigned int tasks, void *data) + i, udp); + goto out_sockmap; + } ++ close(udp); + + /* Test update without programs */ + for (i = 0; i < 6; i++) { +@@ -822,27 +823,27 @@ static void test_sockmap(unsigned int tasks, void *data) + + /* Load SK_SKB program and Attach */ + err = bpf_prog_test_load(SOCKMAP_PARSE_PROG, +- BPF_PROG_TYPE_SK_SKB, &obj, &parse_prog); ++ BPF_PROG_TYPE_SK_SKB, &parse_obj, &parse_prog); + if (err) { + printf("Failed to load SK_SKB parse prog\n"); + goto out_sockmap; + } + + err = bpf_prog_test_load(SOCKMAP_TCP_MSG_PROG, +- BPF_PROG_TYPE_SK_MSG, &obj, &msg_prog); ++ BPF_PROG_TYPE_SK_MSG, &msg_obj, &msg_prog); + if (err) { + printf("Failed to load SK_SKB msg prog\n"); + goto out_sockmap; + } + + err = bpf_prog_test_load(SOCKMAP_VERDICT_PROG, +- BPF_PROG_TYPE_SK_SKB, &obj, &verdict_prog); ++ BPF_PROG_TYPE_SK_SKB, &verdict_obj, &verdict_prog); + if (err) { + printf("Failed to load SK_SKB verdict prog\n"); + goto out_sockmap; + } + +- bpf_map_rx = bpf_object__find_map_by_name(obj, "sock_map_rx"); ++ bpf_map_rx = bpf_object__find_map_by_name(verdict_obj, "sock_map_rx"); + if (!bpf_map_rx) { + printf("Failed to load map rx from verdict prog\n"); + goto out_sockmap; +@@ -854,7 +855,7 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- bpf_map_tx = bpf_object__find_map_by_name(obj, "sock_map_tx"); ++ bpf_map_tx = bpf_object__find_map_by_name(verdict_obj, "sock_map_tx"); + if (!bpf_map_tx) { + printf("Failed to load map tx from verdict prog\n"); + goto out_sockmap; +@@ -866,7 +867,7 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- bpf_map_msg = bpf_object__find_map_by_name(obj, "sock_map_msg"); ++ bpf_map_msg = bpf_object__find_map_by_name(verdict_obj, "sock_map_msg"); + if (!bpf_map_msg) { + printf("Failed to load map msg from msg_verdict prog\n"); + goto out_sockmap; +@@ -878,7 +879,7 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- bpf_map_break = bpf_object__find_map_by_name(obj, "sock_map_break"); ++ bpf_map_break = bpf_object__find_map_by_name(verdict_obj, "sock_map_break"); + if (!bpf_map_break) { + printf("Failed to load map tx from verdict prog\n"); + goto out_sockmap; +@@ -1124,7 +1125,9 @@ static void test_sockmap(unsigned int tasks, void *data) + } + close(fd); + close(map_fd_rx); +- bpf_object__close(obj); ++ bpf_object__close(parse_obj); ++ bpf_object__close(msg_obj); ++ bpf_object__close(verdict_obj); + return; + out: + for (i = 0; i < 6; i++) +@@ -1282,8 +1285,11 @@ static void test_map_in_map(void) + printf("Inner map mim.inner was not destroyed\n"); + goto out_map_in_map; + } ++ ++ close(fd); + } + ++ bpf_object__close(obj); + return; + + out_map_in_map: +diff --git a/tools/testing/selftests/bpf/xdpxceiver.c b/tools/testing/selftests/bpf/xdpxceiver.c +index e5992a6b5e096..92e466310e27b 100644 +--- a/tools/testing/selftests/bpf/xdpxceiver.c ++++ b/tools/testing/selftests/bpf/xdpxceiver.c +@@ -1589,6 +1589,8 @@ static struct ifobject *ifobject_create(void) + if (!ifobj->umem) + goto out_umem; + ++ ifobj->ns_fd = -1; ++ + return ifobj; + + out_umem: +@@ -1600,6 +1602,8 @@ out_xsk_arr: + + static void ifobject_delete(struct ifobject *ifobj) + { ++ if (ifobj->ns_fd != -1) ++ close(ifobj->ns_fd); + free(ifobj->umem); + free(ifobj->xsk_arr); + free(ifobj); +diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh +index 03b586760164a..31c3b6ebd388b 100755 +--- a/tools/testing/selftests/net/fcnal-test.sh ++++ b/tools/testing/selftests/net/fcnal-test.sh +@@ -1466,6 +1466,13 @@ ipv4_udp_novrf() + run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} + log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF" + ++ log_start ++ run_cmd_nsb nettest -D -s & ++ sleep 1 ++ run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U ++ log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()" ++ ++ + log_start + show_hint "Should fail 'Connection refused'" + run_cmd nettest -D -r ${a} +@@ -1525,6 +1532,13 @@ ipv4_udp_novrf() + run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} + log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection" + ++ log_start ++ run_cmd nettest -s -D & ++ sleep 1 ++ run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U ++ log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" ++ ++ + # IPv4 with device bind has really weird behavior - it overrides the + # fib lookup, generates an rtable and tries to send the packet. This + # causes failures for local traffic at different places +@@ -1550,6 +1564,15 @@ ipv4_udp_novrf() + sleep 1 + run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S + log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" ++ ++ log_start ++ show_hint "Should fail since addresses on loopback are out of device scope" ++ run_cmd nettest -D -s & ++ sleep 1 ++ run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U ++ log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" ++ ++ + done + + a=${NSA_IP} +@@ -3157,6 +3180,13 @@ ipv6_udp_novrf() + sleep 1 + run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S + log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" ++ ++ log_start ++ show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" ++ run_cmd nettest -6 -D -s & ++ sleep 1 ++ run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U ++ log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" + done + + a=${NSA_IP6} +diff --git a/tools/testing/selftests/net/nettest.c b/tools/testing/selftests/net/nettest.c +index d9a6fd2cd9d31..7900fa98eccb1 100644 +--- a/tools/testing/selftests/net/nettest.c ++++ b/tools/testing/selftests/net/nettest.c +@@ -127,6 +127,9 @@ struct sock_args { + + /* ESP in UDP encap test */ + int use_xfrm; ++ ++ /* use send() and connect() instead of sendto */ ++ int datagram_connect; + }; + + static int server_mode; +@@ -979,6 +982,11 @@ static int send_msg(int sd, void *addr, socklen_t alen, struct sock_args *args) + log_err_errno("write failed sending msg to peer"); + return 1; + } ++ } else if (args->datagram_connect) { ++ if (send(sd, msg, msglen, 0) < 0) { ++ log_err_errno("send failed sending msg to peer"); ++ return 1; ++ } + } else if (args->ifindex && args->use_cmsg) { + if (send_msg_cmsg(sd, addr, alen, args->ifindex, args->version)) + return 1; +@@ -1659,7 +1667,7 @@ static int connectsock(void *addr, socklen_t alen, struct sock_args *args) + if (args->has_local_ip && bind_socket(sd, args)) + goto err; + +- if (args->type != SOCK_STREAM) ++ if (args->type != SOCK_STREAM && !args->datagram_connect) + goto out; + + if (args->password && tcp_md5sig(sd, addr, alen, args)) +@@ -1854,7 +1862,7 @@ static int ipc_parent(int cpid, int fd, struct sock_args *args) + return client_status; + } + +-#define GETOPT_STR "sr:l:c:p:t:g:P:DRn:M:X:m:d:I:BN:O:SCi6xL:0:1:2:3:Fbqf" ++#define GETOPT_STR "sr:l:c:p:t:g:P:DRn:M:X:m:d:I:BN:O:SUCi6xL:0:1:2:3:Fbqf" + #define OPT_FORCE_BIND_KEY_IFINDEX 1001 + #define OPT_NO_BIND_KEY_IFINDEX 1002 + +@@ -1891,6 +1899,7 @@ static void print_usage(char *prog) + " -I dev bind socket to given device name - server mode\n" + " -S use setsockopt (IP_UNICAST_IF or IP_MULTICAST_IF)\n" + " to set device binding\n" ++ " -U Use connect() and send() for datagram sockets\n" + " -f bind socket with the IP[V6]_FREEBIND option\n" + " -C use cmsg and IP_PKTINFO to specify device binding\n" + "\n" +@@ -2074,6 +2083,9 @@ int main(int argc, char *argv[]) + case 'x': + args.use_xfrm = 1; + break; ++ case 'U': ++ args.datagram_connect = 1; ++ break; + default: + print_usage(argv[0]); + return 1; +diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py +index 057a4f49c79d9..c7363c6764fc6 100644 +--- a/tools/testing/selftests/tpm2/tpm2.py ++++ b/tools/testing/selftests/tpm2/tpm2.py +@@ -371,6 +371,10 @@ class Client: + fcntl.fcntl(self.tpm, fcntl.F_SETFL, flags) + self.tpm_poll = select.poll() + ++ def __del__(self): ++ if self.tpm: ++ self.tpm.close() ++ + def close(self): + self.tpm.close() + |