Linux patch 5.5.125.5-14

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 4075 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index dd392c09..1bae1b32 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch:  1010_linux-5.5.11.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.5.11
 
+Patch:  1011_linux-5.5.12.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.5.12
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1011_linux-5.5.12.patch b/1011_linux-5.5.12.patch
new file mode 100644
index 00000000..b3c0d262
--- /dev/null
+++ b/1011_linux-5.5.12.patch
@@ -0,0 +1,4071 @@
+diff --git a/Documentation/kbuild/modules.rst b/Documentation/kbuild/modules.rst
+index 69fa48ee93d6..e0b45a257f21 100644
+--- a/Documentation/kbuild/modules.rst
++++ b/Documentation/kbuild/modules.rst
+@@ -470,9 +470,9 @@ build.
+ 
+ 	The syntax of the Module.symvers file is::
+ 
+-	<CRC>       <Symbol>          <Namespace>  <Module>                         <Export Type>
++	<CRC>       <Symbol>         <Module>                         <Export Type>     <Namespace>
+ 
+-	0xe1cc2a05  usb_stor_suspend  USB_STORAGE  drivers/usb/storage/usb-storage  EXPORT_SYMBOL_GPL
++	0xe1cc2a05  usb_stor_suspend drivers/usb/storage/usb-storage  EXPORT_SYMBOL_GPL USB_STORAGE
+ 
+ 	The fields are separated by tabs and values may be empty (e.g.
+ 	if no namespace is defined for an exported symbol).
+diff --git a/Makefile b/Makefile
+index b3a42cb0042d..d962fe0f26ce 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 5
+-SUBLEVEL = 11
++SUBLEVEL = 12
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+index 1b5a835f66bd..b8c4b5bb265a 100644
+--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+@@ -31,6 +31,8 @@
+ 		pwr {
+ 			label = "PWR";
+ 			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++			default-state = "keep";
++			linux,default-trigger = "default-on";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts
+index 66ab35eccba7..28be0332c1c8 100644
+--- a/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts
+@@ -26,6 +26,8 @@
+ 		pwr {
+ 			label = "PWR";
+ 			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++			default-state = "keep";
++			linux,default-trigger = "default-on";
+ 		};
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+index 74ed6d047807..37343148643d 100644
+--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+@@ -27,6 +27,8 @@
+ 		pwr {
+ 			label = "PWR";
+ 			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
++			default-state = "keep";
++			linux,default-trigger = "default-on";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi
+index 7e7aa101d8a4..912ee8778830 100644
+--- a/arch/arm/boot/dts/dra7-l4.dtsi
++++ b/arch/arm/boot/dts/dra7-l4.dtsi
+@@ -3461,6 +3461,7 @@
+ 				clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER13_CLKCTRL 24>;
+ 				clock-names = "fck";
+ 				interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>;
++				ti,timer-pwm;
+ 			};
+ 		};
+ 
+@@ -3489,6 +3490,7 @@
+ 				clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER14_CLKCTRL 24>;
+ 				clock-names = "fck";
+ 				interrupts = <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>;
++				ti,timer-pwm;
+ 			};
+ 		};
+ 
+@@ -3517,6 +3519,7 @@
+ 				clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>;
+ 				clock-names = "fck";
+ 				interrupts = <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
++				ti,timer-pwm;
+ 			};
+ 		};
+ 
+@@ -3545,6 +3548,7 @@
+ 				clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>;
+ 				clock-names = "fck";
+ 				interrupts = <GIC_SPI 342 IRQ_TYPE_LEVEL_HIGH>;
++				ti,timer-pwm;
+ 			};
+ 		};
+ 
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 73e5011f531a..c5af7530be7c 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -184,6 +184,7 @@
+ 				device_type = "pci";
+ 				ranges = <0x81000000 0 0          0x03000 0 0x00010000
+ 					  0x82000000 0 0x20013000 0x13000 0 0xffed000>;
++				dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ 				bus-range = <0x00 0xff>;
+ 				#interrupt-cells = <1>;
+ 				num-lanes = <1>;
+@@ -238,6 +239,7 @@
+ 				device_type = "pci";
+ 				ranges = <0x81000000 0 0          0x03000 0 0x00010000
+ 					  0x82000000 0 0x30013000 0x13000 0 0xffed000>;
++				dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ 				bus-range = <0x00 0xff>;
+ 				#interrupt-cells = <1>;
+ 				num-lanes = <1>;
+diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig
+index 519ff58e67b3..0afcae9f7cf8 100644
+--- a/arch/arm/configs/bcm2835_defconfig
++++ b/arch/arm/configs/bcm2835_defconfig
+@@ -178,6 +178,7 @@ CONFIG_SCHED_TRACER=y
+ CONFIG_STACK_TRACER=y
+ CONFIG_FUNCTION_PROFILER=y
+ CONFIG_TEST_KSTRTOX=y
++CONFIG_DEBUG_FS=y
+ CONFIG_KGDB=y
+ CONFIG_KGDB_KDB=y
+ CONFIG_STRICT_DEVMEM=y
+diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
+index 5af82587909e..8c1b73dc8f55 100644
+--- a/arch/arm64/include/asm/unistd.h
++++ b/arch/arm64/include/asm/unistd.h
+@@ -25,8 +25,8 @@
+ #define __NR_compat_gettimeofday	78
+ #define __NR_compat_sigreturn		119
+ #define __NR_compat_rt_sigreturn	173
+-#define __NR_compat_clock_getres	247
+ #define __NR_compat_clock_gettime	263
++#define __NR_compat_clock_getres	264
+ #define __NR_compat_clock_gettime64	403
+ #define __NR_compat_clock_getres_time64	406
+ 
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index d4ed9a19d8fe..5407bf5d98ac 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -958,11 +958,22 @@ void tick_broadcast(const struct cpumask *mask)
+ }
+ #endif
+ 
++/*
++ * The number of CPUs online, not counting this CPU (which may not be
++ * fully online and so not counted in num_online_cpus()).
++ */
++static inline unsigned int num_other_online_cpus(void)
++{
++	unsigned int this_cpu_online = cpu_online(smp_processor_id());
++
++	return num_online_cpus() - this_cpu_online;
++}
++
+ void smp_send_stop(void)
+ {
+ 	unsigned long timeout;
+ 
+-	if (num_online_cpus() > 1) {
++	if (num_other_online_cpus()) {
+ 		cpumask_t mask;
+ 
+ 		cpumask_copy(&mask, cpu_online_mask);
+@@ -975,10 +986,10 @@ void smp_send_stop(void)
+ 
+ 	/* Wait up to one second for other CPUs to stop */
+ 	timeout = USEC_PER_SEC;
+-	while (num_online_cpus() > 1 && timeout--)
++	while (num_other_online_cpus() && timeout--)
+ 		udelay(1);
+ 
+-	if (num_online_cpus() > 1)
++	if (num_other_online_cpus())
+ 		pr_warn("SMP: failed to stop secondary CPUs %*pbl\n",
+ 			cpumask_pr_args(cpu_online_mask));
+ 
+@@ -1001,7 +1012,11 @@ void crash_smp_send_stop(void)
+ 
+ 	cpus_stopped = 1;
+ 
+-	if (num_online_cpus() == 1) {
++	/*
++	 * If this cpu is the only one alive at this point in time, online or
++	 * not, there are no stop messages to be sent around, so just back out.
++	 */
++	if (num_other_online_cpus() == 0) {
+ 		sdei_mask_local_cpu();
+ 		return;
+ 	}
+@@ -1009,7 +1024,7 @@ void crash_smp_send_stop(void)
+ 	cpumask_copy(&mask, cpu_online_mask);
+ 	cpumask_clear_cpu(smp_processor_id(), &mask);
+ 
+-	atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1);
++	atomic_set(&waiting_for_crash_ipi, num_other_online_cpus());
+ 
+ 	pr_crit("SMP: stopping secondary CPUs\n");
+ 	smp_cross_call(&mask, IPI_CPU_CRASH_STOP);
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 8834220036a5..857ab49750f1 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -303,6 +303,12 @@ SECTIONS
+ 		*(.branch_lt)
+ 	}
+ 
++#ifdef CONFIG_DEBUG_INFO_BTF
++	.BTF : AT(ADDR(.BTF) - LOAD_OFFSET) {
++		*(.BTF)
++	}
++#endif
++
+ 	.opd : AT(ADDR(.opd) - LOAD_OFFSET) {
+ 		__start_opd = .;
+ 		KEEP(*(.opd))
+diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
+index fa7dc03459e7..1be11c23fa33 100644
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -121,6 +121,7 @@ config ARCH_FLATMEM_ENABLE
+ 
+ config ARCH_SPARSEMEM_ENABLE
+ 	def_bool y
++	depends on MMU
+ 	select SPARSEMEM_VMEMMAP_ENABLE
+ 
+ config ARCH_SELECT_MEMORY_MODEL
+diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h
+index 42347d0981e7..49350c8bd7b0 100644
+--- a/arch/riscv/include/asm/syscall.h
++++ b/arch/riscv/include/asm/syscall.h
+@@ -28,13 +28,6 @@ static inline int syscall_get_nr(struct task_struct *task,
+ 	return regs->a7;
+ }
+ 
+-static inline void syscall_set_nr(struct task_struct *task,
+-				  struct pt_regs *regs,
+-				  int sysno)
+-{
+-	regs->a7 = sysno;
+-}
+-
+ static inline void syscall_rollback(struct task_struct *task,
+ 				    struct pt_regs *regs)
+ {
+diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
+index e163b7b64c86..f6486d495601 100644
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -228,20 +228,13 @@ check_syscall_nr:
+ 	/* Check to make sure we don't jump to a bogus syscall number. */
+ 	li t0, __NR_syscalls
+ 	la s0, sys_ni_syscall
+-	/*
+-	 * The tracer can change syscall number to valid/invalid value.
+-	 * We use syscall_set_nr helper in syscall_trace_enter thus we
+-	 * cannot trust the current value in a7 and have to reload from
+-	 * the current task pt_regs.
+-	 */
+-	REG_L a7, PT_A7(sp)
+ 	/*
+ 	 * Syscall number held in a7.
+ 	 * If syscall number is above allowed value, redirect to ni_syscall.
+ 	 */
+ 	bge a7, t0, 1f
+ 	/*
+-	 * Check if syscall is rejected by tracer or seccomp, i.e., a7 == -1.
++	 * Check if syscall is rejected by tracer, i.e., a7 == -1.
+ 	 * If yes, we pretend it was executed.
+ 	 */
+ 	li t1, -1
+@@ -334,6 +327,7 @@ work_resched:
+ handle_syscall_trace_enter:
+ 	move a0, sp
+ 	call do_syscall_trace_enter
++	move t0, a0
+ 	REG_L a0, PT_A0(sp)
+ 	REG_L a1, PT_A1(sp)
+ 	REG_L a2, PT_A2(sp)
+@@ -342,6 +336,7 @@ handle_syscall_trace_enter:
+ 	REG_L a5, PT_A5(sp)
+ 	REG_L a6, PT_A6(sp)
+ 	REG_L a7, PT_A7(sp)
++	bnez t0, ret_from_syscall_rejected
+ 	j check_syscall_nr
+ handle_syscall_trace_exit:
+ 	move a0, sp
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index b7401858d872..8bbe5dbe1341 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -8,6 +8,10 @@
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/moduleloader.h>
++#include <linux/vmalloc.h>
++#include <linux/sizes.h>
++#include <asm/pgtable.h>
++#include <asm/sections.h>
+ 
+ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+@@ -386,3 +390,15 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
+ 
+ 	return 0;
+ }
++
++#if defined(CONFIG_MMU) && defined(CONFIG_64BIT)
++#define VMALLOC_MODULE_START \
++	 max(PFN_ALIGN((unsigned long)&_end - SZ_2G), VMALLOC_START)
++void *module_alloc(unsigned long size)
++{
++	return __vmalloc_node_range(size, 1, VMALLOC_MODULE_START,
++				    VMALLOC_END, GFP_KERNEL,
++				    PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
++				    __builtin_return_address(0));
++}
++#endif
+diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
+index 407464201b91..444dc7b0fd78 100644
+--- a/arch/riscv/kernel/ptrace.c
++++ b/arch/riscv/kernel/ptrace.c
+@@ -148,21 +148,19 @@ long arch_ptrace(struct task_struct *child, long request,
+  * Allows PTRACE_SYSCALL to work.  These are called from entry.S in
+  * {handle,ret_from}_syscall.
+  */
+-__visible void do_syscall_trace_enter(struct pt_regs *regs)
++__visible int do_syscall_trace_enter(struct pt_regs *regs)
+ {
+ 	if (test_thread_flag(TIF_SYSCALL_TRACE))
+ 		if (tracehook_report_syscall_entry(regs))
+-			syscall_set_nr(current, regs, -1);
++			return -1;
+ 
+ 	/*
+ 	 * Do the secure computing after ptrace; failures should be fast.
+ 	 * If this fails we might have return value in a0 from seccomp
+ 	 * (via SECCOMP_RET_ERRNO/TRACE).
+ 	 */
+-	if (secure_computing() == -1) {
+-		syscall_set_nr(current, regs, -1);
+-		return;
+-	}
++	if (secure_computing() == -1)
++		return -1;
+ 
+ #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
+ 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+@@ -170,6 +168,7 @@ __visible void do_syscall_trace_enter(struct pt_regs *regs)
+ #endif
+ 
+ 	audit_syscall_entry(regs->a7, regs->a0, regs->a1, regs->a2, regs->a3);
++	return 0;
+ }
+ 
+ __visible void do_syscall_trace_exit(struct pt_regs *regs)
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 965a8cf4829c..fab855963c73 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -131,7 +131,7 @@ void __init setup_bootmem(void)
+ 	for_each_memblock(memory, reg) {
+ 		phys_addr_t end = reg->base + reg->size;
+ 
+-		if (reg->base <= vmlinux_end && vmlinux_end <= end) {
++		if (reg->base <= vmlinux_start && vmlinux_end <= end) {
+ 			mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET);
+ 
+ 			/*
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 304d31d8cbbc..c494c8c05824 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -189,7 +189,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
+ 	return pmd_k;
+ }
+ 
+-void vmalloc_sync_all(void)
++static void vmalloc_sync(void)
+ {
+ 	unsigned long address;
+ 
+@@ -216,6 +216,16 @@ void vmalloc_sync_all(void)
+ 	}
+ }
+ 
++void vmalloc_sync_mappings(void)
++{
++	vmalloc_sync();
++}
++
++void vmalloc_sync_unmappings(void)
++{
++	vmalloc_sync();
++}
++
+ /*
+  * 32-bit:
+  *
+@@ -318,11 +328,23 @@ out:
+ 
+ #else /* CONFIG_X86_64: */
+ 
+-void vmalloc_sync_all(void)
++void vmalloc_sync_mappings(void)
+ {
++	/*
++	 * 64-bit mappings might allocate new p4d/pud pages
++	 * that need to be propagated to all tasks' PGDs.
++	 */
+ 	sync_global_pgds(VMALLOC_START & PGDIR_MASK, VMALLOC_END);
+ }
+ 
++void vmalloc_sync_unmappings(void)
++{
++	/*
++	 * Unmappings never allocate or free p4d/pud pages.
++	 * No work is required here.
++	 */
++}
++
+ /*
+  * 64-bit:
+  *
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 8906c80175e6..2122b83821ba 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -171,7 +171,7 @@ int ghes_estatus_pool_init(int num_ghes)
+ 	 * New allocation must be visible in all pgd before it can be found by
+ 	 * an NMI allocating from the pool.
+ 	 */
+-	vmalloc_sync_all();
++	vmalloc_sync_mappings();
+ 
+ 	rc = gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ 	if (rc)
+diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
+index 110e41f920c2..f303106b3362 100644
+--- a/drivers/android/binderfs.c
++++ b/drivers/android/binderfs.c
+@@ -448,6 +448,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
+ 	inode->i_uid = info->root_uid;
+ 	inode->i_gid = info->root_gid;
+ 
++	refcount_set(&device->ref, 1);
+ 	device->binderfs_inode = inode;
+ 	device->miscdev.minor = minor;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 8e6726e0d035..7ab386deb52a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -694,11 +694,11 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ 	ssize_t result = 0;
+ 	uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data;
+ 
+-	if (size & 3 || *pos & 3)
++	if (size > 4096 || size & 3 || *pos & 3)
+ 		return -EINVAL;
+ 
+ 	/* decode offset */
+-	offset = *pos & GENMASK_ULL(11, 0);
++	offset = (*pos & GENMASK_ULL(11, 0)) >> 2;
+ 	se = (*pos & GENMASK_ULL(19, 12)) >> 12;
+ 	sh = (*pos & GENMASK_ULL(27, 20)) >> 20;
+ 	cu = (*pos & GENMASK_ULL(35, 28)) >> 28;
+@@ -729,7 +729,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ 	while (size) {
+ 		uint32_t value;
+ 
+-		value = data[offset++];
++		value = data[result >> 2];
+ 		r = put_user(value, (uint32_t *)buf);
+ 		if (r) {
+ 			result = r;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 6b5b243af15d..1a80423b1d4f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -3496,6 +3496,7 @@ static int gfx_v10_0_kcq_init_queue(struct amdgpu_ring *ring)
+ 
+ 		/* reset ring buffer */
+ 		ring->wptr = 0;
++		atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0);
+ 		amdgpu_ring_clear_ring(ring);
+ 	} else {
+ 		amdgpu_ring_clear_ring(ring);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 085b84322e92..67f30fec94df 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -3538,6 +3538,7 @@ static int gfx_v9_0_kcq_init_queue(struct amdgpu_ring *ring)
+ 
+ 		/* reset ring buffer */
+ 		ring->wptr = 0;
++		atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0);
+ 		amdgpu_ring_clear_ring(ring);
+ 	} else {
+ 		amdgpu_ring_clear_ring(ring);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 2bf8534c18fb..1e3bc708b2e8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -382,6 +382,7 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 					   aconnector->dc_sink);
+ 		dc_sink_release(aconnector->dc_sink);
+ 		aconnector->dc_sink = NULL;
++		aconnector->dc_link->cur_link_settings.lane_count = 0;
+ 	}
+ 
+ 	drm_connector_unregister(connector);
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+index a02c10e23e0d..d163388c99a0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+@@ -840,8 +840,8 @@ static void hubbub1_det_request_size(
+ 
+ 	hubbub1_get_blk256_size(&blk256_width, &blk256_height, bpe);
+ 
+-	swath_bytes_horz_wc = height * blk256_height * bpe;
+-	swath_bytes_vert_wc = width * blk256_width * bpe;
++	swath_bytes_horz_wc = width * blk256_height * bpe;
++	swath_bytes_vert_wc = height * blk256_width * bpe;
+ 
+ 	*req128_horz_wc = (2 * swath_bytes_horz_wc <= detile_buf_size) ?
+ 			false : /* full 256B request */
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index 67fca439bbfb..24965e53d351 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -1624,28 +1624,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode)
+ 		frame.colorspace = HDMI_COLORSPACE_RGB;
+ 
+ 	/* Set up colorimetry */
+-	switch (hdmi->hdmi_data.enc_out_encoding) {
+-	case V4L2_YCBCR_ENC_601:
+-		if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601)
+-			frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
+-		else
++	if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) {
++		switch (hdmi->hdmi_data.enc_out_encoding) {
++		case V4L2_YCBCR_ENC_601:
++			if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601)
++				frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
++			else
++				frame.colorimetry = HDMI_COLORIMETRY_ITU_601;
++			frame.extended_colorimetry =
++					HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++			break;
++		case V4L2_YCBCR_ENC_709:
++			if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709)
++				frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
++			else
++				frame.colorimetry = HDMI_COLORIMETRY_ITU_709;
++			frame.extended_colorimetry =
++					HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
++			break;
++		default: /* Carries no data */
+ 			frame.colorimetry = HDMI_COLORIMETRY_ITU_601;
++			frame.extended_colorimetry =
++					HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++			break;
++		}
++	} else {
++		frame.colorimetry = HDMI_COLORIMETRY_NONE;
+ 		frame.extended_colorimetry =
+-				HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+-		break;
+-	case V4L2_YCBCR_ENC_709:
+-		if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709)
+-			frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
+-		else
+-			frame.colorimetry = HDMI_COLORIMETRY_ITU_709;
+-		frame.extended_colorimetry =
+-				HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
+-		break;
+-	default: /* Carries no data */
+-		frame.colorimetry = HDMI_COLORIMETRY_ITU_601;
+-		frame.extended_colorimetry =
+-				HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+-		break;
++			HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+ 	}
+ 
+ 	frame.scan_mode = HDMI_SCAN_MODE_NONE;
+diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
+index 3035584f6dc7..29367b6506a8 100644
+--- a/drivers/gpu/drm/drm_client_modeset.c
++++ b/drivers/gpu/drm/drm_client_modeset.c
+@@ -114,33 +114,6 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc)
+ 	return NULL;
+ }
+ 
+-static struct drm_display_mode *
+-drm_connector_get_tiled_mode(struct drm_connector *connector)
+-{
+-	struct drm_display_mode *mode;
+-
+-	list_for_each_entry(mode, &connector->modes, head) {
+-		if (mode->hdisplay == connector->tile_h_size &&
+-		    mode->vdisplay == connector->tile_v_size)
+-			return mode;
+-	}
+-	return NULL;
+-}
+-
+-static struct drm_display_mode *
+-drm_connector_fallback_non_tiled_mode(struct drm_connector *connector)
+-{
+-	struct drm_display_mode *mode;
+-
+-	list_for_each_entry(mode, &connector->modes, head) {
+-		if (mode->hdisplay == connector->tile_h_size &&
+-		    mode->vdisplay == connector->tile_v_size)
+-			continue;
+-		return mode;
+-	}
+-	return NULL;
+-}
+-
+ static struct drm_display_mode *
+ drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height)
+ {
+@@ -375,15 +348,8 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,
+ 	struct drm_connector *connector;
+ 	u64 conn_configured = 0;
+ 	int tile_pass = 0;
+-	int num_tiled_conns = 0;
+ 	int i;
+ 
+-	for (i = 0; i < connector_count; i++) {
+-		if (connectors[i]->has_tile &&
+-		    connectors[i]->status == connector_status_connected)
+-			num_tiled_conns++;
+-	}
+-
+ retry:
+ 	for (i = 0; i < connector_count; i++) {
+ 		connector = connectors[i];
+@@ -433,28 +399,6 @@ retry:
+ 			list_for_each_entry(modes[i], &connector->modes, head)
+ 				break;
+ 		}
+-		/*
+-		 * In case of tiled mode if all tiles not present fallback to
+-		 * first available non tiled mode.
+-		 * After all tiles are present, try to find the tiled mode
+-		 * for all and if tiled mode not present due to fbcon size
+-		 * limitations, use first non tiled mode only for
+-		 * tile 0,0 and set to no mode for all other tiles.
+-		 */
+-		if (connector->has_tile) {
+-			if (num_tiled_conns <
+-			    connector->num_h_tile * connector->num_v_tile ||
+-			    (connector->tile_h_loc == 0 &&
+-			     connector->tile_v_loc == 0 &&
+-			     !drm_connector_get_tiled_mode(connector))) {
+-				DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
+-					      connector->base.id);
+-				modes[i] = drm_connector_fallback_non_tiled_mode(connector);
+-			} else {
+-				modes[i] = drm_connector_get_tiled_mode(connector);
+-			}
+-		}
+-
+ 		DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name :
+ 			  "none");
+ 		conn_configured |= BIT_ULL(i);
+@@ -571,7 +515,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ 	bool fallback = true, ret = true;
+ 	int num_connectors_enabled = 0;
+ 	int num_connectors_detected = 0;
+-	int num_tiled_conns = 0;
+ 	struct drm_modeset_acquire_ctx ctx;
+ 
+ 	if (!drm_drv_uses_atomic_modeset(dev))
+@@ -589,11 +532,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ 	memcpy(save_enabled, enabled, count);
+ 	mask = GENMASK(count - 1, 0);
+ 	conn_configured = 0;
+-	for (i = 0; i < count; i++) {
+-		if (connectors[i]->has_tile &&
+-		    connectors[i]->status == connector_status_connected)
+-			num_tiled_conns++;
+-	}
+ retry:
+ 	conn_seq = conn_configured;
+ 	for (i = 0; i < count; i++) {
+@@ -693,16 +631,6 @@ retry:
+ 				      connector->name);
+ 			modes[i] = &connector->state->crtc->mode;
+ 		}
+-		/*
+-		 * In case of tiled modes, if all tiles are not present
+-		 * then fallback to a non tiled mode.
+-		 */
+-		if (connector->has_tile &&
+-		    num_tiled_conns < connector->num_h_tile * connector->num_v_tile) {
+-			DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
+-				      connector->base.id);
+-			modes[i] = drm_connector_fallback_non_tiled_mode(connector);
+-		}
+ 		crtcs[i] = new_crtc;
+ 
+ 		DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n",
+diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
+index b481cafdde28..825abe38201a 100644
+--- a/drivers/gpu/drm/drm_lease.c
++++ b/drivers/gpu/drm/drm_lease.c
+@@ -542,10 +542,12 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ 	}
+ 
+ 	DRM_DEBUG_LEASE("Creating lease\n");
++	/* lessee will take the ownership of leases */
+ 	lessee = drm_lease_create(lessor, &leases);
+ 
+ 	if (IS_ERR(lessee)) {
+ 		ret = PTR_ERR(lessee);
++		idr_destroy(&leases);
+ 		goto out_leases;
+ 	}
+ 
+@@ -580,7 +582,6 @@ out_lessee:
+ 
+ out_leases:
+ 	put_unused_fd(fd);
+-	idr_destroy(&leases);
+ 
+ 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
+ 	return ret;
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+index 72726f2c7a9f..0f6497670e29 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+@@ -1751,8 +1751,9 @@ static int exynos_dsi_probe(struct platform_device *pdev)
+ 	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies),
+ 				      dsi->supplies);
+ 	if (ret) {
+-		dev_info(dev, "failed to get regulators: %d\n", ret);
+-		return -EPROBE_DEFER;
++		if (ret != -EPROBE_DEFER)
++			dev_info(dev, "failed to get regulators: %d\n", ret);
++		return ret;
+ 	}
+ 
+ 	dsi->clks = devm_kcalloc(dev,
+@@ -1765,9 +1766,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
+ 		dsi->clks[i] = devm_clk_get(dev, clk_names[i]);
+ 		if (IS_ERR(dsi->clks[i])) {
+ 			if (strcmp(clk_names[i], "sclk_mipi") == 0) {
+-				strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME);
+-				i--;
+-				continue;
++				dsi->clks[i] = devm_clk_get(dev,
++							OLD_SCLK_MIPI_CLK_NAME);
++				if (!IS_ERR(dsi->clks[i]))
++					continue;
+ 			}
+ 
+ 			dev_info(dev, "failed to get the clock: %s\n",
+diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
+index 48159d5d2214..d85e15e816e9 100644
+--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
+@@ -1803,18 +1803,10 @@ static int hdmi_resources_init(struct hdmi_context *hdata)
+ 
+ 	hdata->reg_hdmi_en = devm_regulator_get_optional(dev, "hdmi-en");
+ 
+-	if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV) {
++	if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV)
+ 		if (IS_ERR(hdata->reg_hdmi_en))
+ 			return PTR_ERR(hdata->reg_hdmi_en);
+ 
+-		ret = regulator_enable(hdata->reg_hdmi_en);
+-		if (ret) {
+-			DRM_DEV_ERROR(dev,
+-				      "failed to enable hdmi-en regulator\n");
+-			return ret;
+-		}
+-	}
+-
+ 	return hdmi_bridge_init(hdata);
+ }
+ 
+@@ -2021,6 +2013,15 @@ static int hdmi_probe(struct platform_device *pdev)
+ 		}
+ 	}
+ 
++	if (!IS_ERR(hdata->reg_hdmi_en)) {
++		ret = regulator_enable(hdata->reg_hdmi_en);
++		if (ret) {
++			DRM_DEV_ERROR(dev,
++			      "failed to enable hdmi-en regulator\n");
++			goto err_hdmiphy;
++		}
++	}
++
+ 	pm_runtime_enable(dev);
+ 
+ 	audio_infoframe = &hdata->audio.infoframe;
+@@ -2045,7 +2046,8 @@ err_unregister_audio:
+ 
+ err_rpm_disable:
+ 	pm_runtime_disable(dev);
+-
++	if (!IS_ERR(hdata->reg_hdmi_en))
++		regulator_disable(hdata->reg_hdmi_en);
+ err_hdmiphy:
+ 	if (hdata->hdmiphy_port)
+ 		put_device(&hdata->hdmiphy_port->dev);
+diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
+index 32d1af99bf27..b2fba630d784 100644
+--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
+@@ -1422,17 +1422,6 @@ static void virtual_xfer_breadcrumbs(struct virtual_engine *ve,
+ 	spin_unlock(&old->breadcrumbs.irq_lock);
+ }
+ 
+-static struct i915_request *
+-last_active(const struct intel_engine_execlists *execlists)
+-{
+-	struct i915_request * const *last = READ_ONCE(execlists->active);
+-
+-	while (*last && i915_request_completed(*last))
+-		last++;
+-
+-	return *last;
+-}
+-
+ #define for_each_waiter(p__, rq__) \
+ 	list_for_each_entry_lockless(p__, \
+ 				     &(rq__)->sched.waiters_list, \
+@@ -1562,11 +1551,9 @@ static void record_preemption(struct intel_engine_execlists *execlists)
+ 	(void)I915_SELFTEST_ONLY(execlists->preempt_hang.count++);
+ }
+ 
+-static unsigned long active_preempt_timeout(struct intel_engine_cs *engine)
++static unsigned long active_preempt_timeout(struct intel_engine_cs *engine,
++					    const struct i915_request *rq)
+ {
+-	struct i915_request *rq;
+-
+-	rq = last_active(&engine->execlists);
+ 	if (!rq)
+ 		return 0;
+ 
+@@ -1577,13 +1564,14 @@ static unsigned long active_preempt_timeout(struct intel_engine_cs *engine)
+ 	return READ_ONCE(engine->props.preempt_timeout_ms);
+ }
+ 
+-static void set_preempt_timeout(struct intel_engine_cs *engine)
++static void set_preempt_timeout(struct intel_engine_cs *engine,
++				const struct i915_request *rq)
+ {
+ 	if (!intel_engine_has_preempt_reset(engine))
+ 		return;
+ 
+ 	set_timer_ms(&engine->execlists.preempt,
+-		     active_preempt_timeout(engine));
++		     active_preempt_timeout(engine, rq));
+ }
+ 
+ static void execlists_dequeue(struct intel_engine_cs *engine)
+@@ -1591,6 +1579,7 @@ static void execlists_dequeue(struct intel_engine_cs *engine)
+ 	struct intel_engine_execlists * const execlists = &engine->execlists;
+ 	struct i915_request **port = execlists->pending;
+ 	struct i915_request ** const last_port = port + execlists->port_mask;
++	struct i915_request * const *active;
+ 	struct i915_request *last;
+ 	struct rb_node *rb;
+ 	bool submit = false;
+@@ -1645,7 +1634,10 @@ static void execlists_dequeue(struct intel_engine_cs *engine)
+ 	 * i.e. we will retrigger preemption following the ack in case
+ 	 * of trouble.
+ 	 */
+-	last = last_active(execlists);
++	active = READ_ONCE(execlists->active);
++	while ((last = *active) && i915_request_completed(last))
++		active++;
++
+ 	if (last) {
+ 		if (need_preempt(engine, last, rb)) {
+ 			GEM_TRACE("%s: preempting last=%llx:%lld, prio=%d, hint=%d\n",
+@@ -1930,7 +1922,7 @@ done:
+ 		 * Skip if we ended up with exactly the same set of requests,
+ 		 * e.g. trying to timeslice a pair of ordered contexts
+ 		 */
+-		if (!memcmp(execlists->active, execlists->pending,
++		if (!memcmp(active, execlists->pending,
+ 			    (port - execlists->pending + 1) * sizeof(*port))) {
+ 			do
+ 				execlists_schedule_out(fetch_and_zero(port));
+@@ -1942,7 +1934,7 @@ done:
+ 		memset(port + 1, 0, (last_port - port) * sizeof(*port));
+ 		execlists_submit_ports(engine);
+ 
+-		set_preempt_timeout(engine);
++		set_preempt_timeout(engine, *active);
+ 	} else {
+ skip_submit:
+ 		ring_set_paused(engine, 0);
+@@ -3503,26 +3495,6 @@ static int gen12_emit_flush_render(struct i915_request *request,
+ 
+ 		*cs++ = preparser_disable(false);
+ 		intel_ring_advance(request, cs);
+-
+-		/*
+-		 * Wa_1604544889:tgl
+-		 */
+-		if (IS_TGL_REVID(request->i915, TGL_REVID_A0, TGL_REVID_A0)) {
+-			flags = 0;
+-			flags |= PIPE_CONTROL_CS_STALL;
+-			flags |= PIPE_CONTROL_HDC_PIPELINE_FLUSH;
+-
+-			flags |= PIPE_CONTROL_STORE_DATA_INDEX;
+-			flags |= PIPE_CONTROL_QW_WRITE;
+-
+-			cs = intel_ring_begin(request, 6);
+-			if (IS_ERR(cs))
+-				return PTR_ERR(cs);
+-
+-			cs = gen8_emit_pipe_control(cs, flags,
+-						    LRC_PPHWSP_SCRATCH_ADDR);
+-			intel_ring_advance(request, cs);
+-		}
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index e4bccc14602f..8cafdee7d43d 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1504,15 +1504,34 @@ err_obj:
+ 	return ERR_PTR(err);
+ }
+ 
++static const struct {
++	u32 start;
++	u32 end;
++} mcr_ranges_gen8[] = {
++	{ .start = 0x5500, .end = 0x55ff },
++	{ .start = 0x7000, .end = 0x7fff },
++	{ .start = 0x9400, .end = 0x97ff },
++	{ .start = 0xb000, .end = 0xb3ff },
++	{ .start = 0xe000, .end = 0xe7ff },
++	{},
++};
++
+ static bool mcr_range(struct drm_i915_private *i915, u32 offset)
+ {
++	int i;
++
++	if (INTEL_GEN(i915) < 8)
++		return false;
++
+ 	/*
+-	 * Registers in this range are affected by the MCR selector
++	 * Registers in these ranges are affected by the MCR selector
+ 	 * which only controls CPU initiated MMIO. Routing does not
+ 	 * work for CS access so we cannot verify them on this path.
+ 	 */
+-	if (INTEL_GEN(i915) >= 8 && (offset >= 0xb000 && offset <= 0xb4ff))
+-		return true;
++	for (i = 0; mcr_ranges_gen8[i].start; i++)
++		if (offset >= mcr_ranges_gen8[i].start &&
++		    offset <= mcr_ranges_gen8[i].end)
++			return true;
+ 
+ 	return false;
+ }
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index c3f5111fd563..1d46fbe9e07c 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -549,10 +549,18 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {
+ 
+ static int mtk_drm_crtc_init(struct drm_device *drm,
+ 			     struct mtk_drm_crtc *mtk_crtc,
+-			     struct drm_plane *primary,
+-			     struct drm_plane *cursor, unsigned int pipe)
++			     unsigned int pipe)
+ {
+-	int ret;
++	struct drm_plane *primary = NULL;
++	struct drm_plane *cursor = NULL;
++	int i, ret;
++
++	for (i = 0; i < mtk_crtc->layer_nr; i++) {
++		if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_PRIMARY)
++			primary = &mtk_crtc->planes[i];
++		else if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_CURSOR)
++			cursor = &mtk_crtc->planes[i];
++	}
+ 
+ 	ret = drm_crtc_init_with_planes(drm, &mtk_crtc->base, primary, cursor,
+ 					&mtk_crtc_funcs, NULL);
+@@ -598,11 +606,12 @@ static int mtk_drm_crtc_num_comp_planes(struct mtk_drm_crtc *mtk_crtc,
+ }
+ 
+ static inline
+-enum drm_plane_type mtk_drm_crtc_plane_type(unsigned int plane_idx)
++enum drm_plane_type mtk_drm_crtc_plane_type(unsigned int plane_idx,
++					    unsigned int num_planes)
+ {
+ 	if (plane_idx == 0)
+ 		return DRM_PLANE_TYPE_PRIMARY;
+-	else if (plane_idx == 1)
++	else if (plane_idx == (num_planes - 1))
+ 		return DRM_PLANE_TYPE_CURSOR;
+ 	else
+ 		return DRM_PLANE_TYPE_OVERLAY;
+@@ -621,7 +630,8 @@ static int mtk_drm_crtc_init_comp_planes(struct drm_device *drm_dev,
+ 		ret = mtk_plane_init(drm_dev,
+ 				&mtk_crtc->planes[mtk_crtc->layer_nr],
+ 				BIT(pipe),
+-				mtk_drm_crtc_plane_type(mtk_crtc->layer_nr),
++				mtk_drm_crtc_plane_type(mtk_crtc->layer_nr,
++							num_planes),
+ 				mtk_ddp_comp_supported_rotations(comp));
+ 		if (ret)
+ 			return ret;
+@@ -710,9 +720,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ 			return ret;
+ 	}
+ 
+-	ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0],
+-				mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] :
+-				NULL, pipe);
++	ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, pipe);
+ 	if (ret < 0)
+ 		return ret;
+ 
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index 8e48c7458aa3..255f8f41c8ff 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -718,9 +718,6 @@ static int msc_win_set_lockout(struct msc_window *win,
+ 
+ 	if (old != expect) {
+ 		ret = -EINVAL;
+-		dev_warn_ratelimited(msc_dev(win->msc),
+-				     "expected lockout state %d, got %d\n",
+-				     expect, old);
+ 		goto unlock;
+ 	}
+ 
+@@ -741,6 +738,10 @@ unlock:
+ 		/* from intel_th_msc_window_unlock(), don't warn if not locked */
+ 		if (expect == WIN_LOCKED && old == new)
+ 			return 0;
++
++		dev_warn_ratelimited(msc_dev(win->msc),
++				     "expected lockout state %d, got %d\n",
++				     expect, old);
+ 	}
+ 
+ 	return ret;
+@@ -760,7 +761,7 @@ static int msc_configure(struct msc *msc)
+ 	lockdep_assert_held(&msc->buf_mutex);
+ 
+ 	if (msc->mode > MSC_MODE_MULTI)
+-		return -ENOTSUPP;
++		return -EINVAL;
+ 
+ 	if (msc->mode == MSC_MODE_MULTI) {
+ 		if (msc_win_set_lockout(msc->cur_win, WIN_READY, WIN_INUSE))
+@@ -1294,7 +1295,7 @@ static int msc_buffer_alloc(struct msc *msc, unsigned long *nr_pages,
+ 	} else if (msc->mode == MSC_MODE_MULTI) {
+ 		ret = msc_buffer_multi_alloc(msc, nr_pages, nr_wins);
+ 	} else {
+-		ret = -ENOTSUPP;
++		ret = -EINVAL;
+ 	}
+ 
+ 	if (!ret) {
+@@ -1530,7 +1531,7 @@ static ssize_t intel_th_msc_read(struct file *file, char __user *buf,
+ 		if (ret >= 0)
+ 			*ppos = iter->offset;
+ 	} else {
+-		ret = -ENOTSUPP;
++		ret = -EINVAL;
+ 	}
+ 
+ put_count:
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index e9d90b53bbc4..86aa6a46bcba 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -234,6 +234,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
+ 		.driver_data = (kernel_ulong_t)&intel_th_2x,
+ 	},
++	{
++		/* Elkhart Lake CPU */
++		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529),
++		.driver_data = (kernel_ulong_t)&intel_th_2x,
++	},
+ 	{
+ 		/* Elkhart Lake */
+ 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
+diff --git a/drivers/hwtracing/stm/p_sys-t.c b/drivers/hwtracing/stm/p_sys-t.c
+index b178a5495b67..360b5c03df95 100644
+--- a/drivers/hwtracing/stm/p_sys-t.c
++++ b/drivers/hwtracing/stm/p_sys-t.c
+@@ -238,7 +238,7 @@ static struct configfs_attribute *sys_t_policy_attrs[] = {
+ static inline bool sys_t_need_ts(struct sys_t_output *op)
+ {
+ 	if (op->node.ts_interval &&
+-	    time_after(op->ts_jiffies + op->node.ts_interval, jiffies)) {
++	    time_after(jiffies, op->ts_jiffies + op->node.ts_interval)) {
+ 		op->ts_jiffies = jiffies;
+ 
+ 		return true;
+@@ -250,8 +250,8 @@ static inline bool sys_t_need_ts(struct sys_t_output *op)
+ static bool sys_t_need_clock_sync(struct sys_t_output *op)
+ {
+ 	if (op->node.clocksync_interval &&
+-	    time_after(op->clocksync_jiffies + op->node.clocksync_interval,
+-		       jiffies)) {
++	    time_after(jiffies,
++		       op->clocksync_jiffies + op->node.clocksync_interval)) {
+ 		op->clocksync_jiffies = jiffies;
+ 
+ 		return true;
+diff --git a/drivers/iio/accel/adxl372.c b/drivers/iio/accel/adxl372.c
+index 67b8817995c0..60daf04ce188 100644
+--- a/drivers/iio/accel/adxl372.c
++++ b/drivers/iio/accel/adxl372.c
+@@ -237,6 +237,7 @@ static const struct adxl372_axis_lookup adxl372_axis_lookup_table[] = {
+ 		.realbits = 12,						\
+ 		.storagebits = 16,					\
+ 		.shift = 4,						\
++		.endianness = IIO_BE,					\
+ 	},								\
+ }
+ 
+diff --git a/drivers/iio/accel/st_accel_i2c.c b/drivers/iio/accel/st_accel_i2c.c
+index 50fa0fc32baa..0a0bffe04217 100644
+--- a/drivers/iio/accel/st_accel_i2c.c
++++ b/drivers/iio/accel/st_accel_i2c.c
+@@ -114,7 +114,7 @@ MODULE_DEVICE_TABLE(of, st_accel_of_match);
+ 
+ #ifdef CONFIG_ACPI
+ static const struct acpi_device_id st_accel_acpi_match[] = {
+-	{"SMO8840", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME},
++	{"SMO8840", (kernel_ulong_t)LIS2DH12_ACCEL_DEV_NAME},
+ 	{"SMO8A90", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME},
+ 	{ },
+ };
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index e1850f3d5cf3..2a6950aa6ae9 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -723,6 +723,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ 
+ 	for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+ 		struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
++		u32 cor;
+ 
+ 		if (!chan)
+ 			continue;
+@@ -731,6 +732,20 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ 		    chan->type == IIO_PRESSURE)
+ 			continue;
+ 
++		if (state) {
++			cor = at91_adc_readl(st, AT91_SAMA5D2_COR);
++
++			if (chan->differential)
++				cor |= (BIT(chan->channel) |
++					BIT(chan->channel2)) <<
++					AT91_SAMA5D2_COR_DIFF_OFFSET;
++			else
++				cor &= ~(BIT(chan->channel) <<
++				       AT91_SAMA5D2_COR_DIFF_OFFSET);
++
++			at91_adc_writel(st, AT91_SAMA5D2_COR, cor);
++		}
++
+ 		if (state) {
+ 			at91_adc_writel(st, AT91_SAMA5D2_CHER,
+ 					BIT(chan->channel));
+diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
+index 0339ecdd06bd..3ae0366a7b58 100644
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -842,31 +842,6 @@ static inline void stm32_dfsdm_process_data(struct stm32_dfsdm_adc *adc,
+ 	}
+ }
+ 
+-static irqreturn_t stm32_dfsdm_adc_trigger_handler(int irq, void *p)
+-{
+-	struct iio_poll_func *pf = p;
+-	struct iio_dev *indio_dev = pf->indio_dev;
+-	struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+-	int available = stm32_dfsdm_adc_dma_residue(adc);
+-
+-	while (available >= indio_dev->scan_bytes) {
+-		s32 *buffer = (s32 *)&adc->rx_buf[adc->bufi];
+-
+-		stm32_dfsdm_process_data(adc, buffer);
+-
+-		iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+-						   pf->timestamp);
+-		available -= indio_dev->scan_bytes;
+-		adc->bufi += indio_dev->scan_bytes;
+-		if (adc->bufi >= adc->buf_sz)
+-			adc->bufi = 0;
+-	}
+-
+-	iio_trigger_notify_done(indio_dev->trig);
+-
+-	return IRQ_HANDLED;
+-}
+-
+ static void stm32_dfsdm_dma_buffer_done(void *data)
+ {
+ 	struct iio_dev *indio_dev = data;
+@@ -874,11 +849,6 @@ static void stm32_dfsdm_dma_buffer_done(void *data)
+ 	int available = stm32_dfsdm_adc_dma_residue(adc);
+ 	size_t old_pos;
+ 
+-	if (indio_dev->currentmode & INDIO_BUFFER_TRIGGERED) {
+-		iio_trigger_poll_chained(indio_dev->trig);
+-		return;
+-	}
+-
+ 	/*
+ 	 * FIXME: In Kernel interface does not support cyclic DMA buffer,and
+ 	 * offers only an interface to push data samples per samples.
+@@ -906,7 +876,15 @@ static void stm32_dfsdm_dma_buffer_done(void *data)
+ 			adc->bufi = 0;
+ 			old_pos = 0;
+ 		}
+-		/* regular iio buffer without trigger */
++		/*
++		 * In DMA mode the trigger services of IIO are not used
++		 * (e.g. no call to iio_trigger_poll).
++		 * Calling irq handler associated to the hardware trigger is not
++		 * relevant as the conversions have already been done. Data
++		 * transfers are performed directly in DMA callback instead.
++		 * This implementation avoids to call trigger irq handler that
++		 * may sleep, in an atomic context (DMA irq handler context).
++		 */
+ 		if (adc->dev_data->type == DFSDM_IIO)
+ 			iio_push_to_buffers(indio_dev, buffer);
+ 	}
+@@ -1517,8 +1495,7 @@ static int stm32_dfsdm_adc_init(struct iio_dev *indio_dev)
+ 	}
+ 
+ 	ret = iio_triggered_buffer_setup(indio_dev,
+-					 &iio_pollfunc_store_time,
+-					 &stm32_dfsdm_adc_trigger_handler,
++					 &iio_pollfunc_store_time, NULL,
+ 					 &stm32_dfsdm_buffer_setup_ops);
+ 	if (ret) {
+ 		stm32_dfsdm_dma_release(indio_dev);
+diff --git a/drivers/iio/chemical/Kconfig b/drivers/iio/chemical/Kconfig
+index 0b91de4df8f4..a7e65a59bf42 100644
+--- a/drivers/iio/chemical/Kconfig
++++ b/drivers/iio/chemical/Kconfig
+@@ -91,6 +91,8 @@ config SPS30
+ 	tristate "SPS30 particulate matter sensor"
+ 	depends on I2C
+ 	select CRC8
++	select IIO_BUFFER
++	select IIO_TRIGGERED_BUFFER
+ 	help
+ 	  Say Y here to build support for the Sensirion SPS30 particulate
+ 	  matter sensor.
+diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
+index b0e241aaefb4..e5b00a6611ac 100644
+--- a/drivers/iio/light/vcnl4000.c
++++ b/drivers/iio/light/vcnl4000.c
+@@ -167,16 +167,17 @@ static int vcnl4200_init(struct vcnl4000_data *data)
+ 	data->vcnl4200_ps.reg = VCNL4200_PS_DATA;
+ 	switch (id) {
+ 	case VCNL4200_PROD_ID:
+-		/* Integration time is 50ms, but the experiments */
+-		/* show 54ms in total. */
+-		data->vcnl4200_al.sampling_rate = ktime_set(0, 54000 * 1000);
+-		data->vcnl4200_ps.sampling_rate = ktime_set(0, 4200 * 1000);
++		/* Default wait time is 50ms, add 20% tolerance. */
++		data->vcnl4200_al.sampling_rate = ktime_set(0, 60000 * 1000);
++		/* Default wait time is 4.8ms, add 20% tolerance. */
++		data->vcnl4200_ps.sampling_rate = ktime_set(0, 5760 * 1000);
+ 		data->al_scale = 24000;
+ 		break;
+ 	case VCNL4040_PROD_ID:
+-		/* Integration time is 80ms, add 10ms. */
+-		data->vcnl4200_al.sampling_rate = ktime_set(0, 100000 * 1000);
+-		data->vcnl4200_ps.sampling_rate = ktime_set(0, 100000 * 1000);
++		/* Default wait time is 80ms, add 20% tolerance. */
++		data->vcnl4200_al.sampling_rate = ktime_set(0, 96000 * 1000);
++		/* Default wait time is 5ms, add 20% tolerance. */
++		data->vcnl4200_ps.sampling_rate = ktime_set(0, 6000 * 1000);
+ 		data->al_scale = 120000;
+ 		break;
+ 	}
+diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
+index fc7e910f8e8b..d32996702110 100644
+--- a/drivers/iio/magnetometer/ak8974.c
++++ b/drivers/iio/magnetometer/ak8974.c
+@@ -564,7 +564,7 @@ static int ak8974_read_raw(struct iio_dev *indio_dev,
+ 		 * We read all axes and discard all but one, for optimized
+ 		 * reading, use the triggered buffer.
+ 		 */
+-		*val = le16_to_cpu(hw_values[chan->address]);
++		*val = (s16)le16_to_cpu(hw_values[chan->address]);
+ 
+ 		ret = IIO_VAL_INT;
+ 	}
+diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
+index a5dfe65cd9b9..f98510c714b5 100644
+--- a/drivers/iio/trigger/stm32-timer-trigger.c
++++ b/drivers/iio/trigger/stm32-timer-trigger.c
+@@ -161,7 +161,8 @@ static int stm32_timer_start(struct stm32_timer_trigger *priv,
+ 	return 0;
+ }
+ 
+-static void stm32_timer_stop(struct stm32_timer_trigger *priv)
++static void stm32_timer_stop(struct stm32_timer_trigger *priv,
++			     struct iio_trigger *trig)
+ {
+ 	u32 ccer, cr1;
+ 
+@@ -179,6 +180,12 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv)
+ 	regmap_write(priv->regmap, TIM_PSC, 0);
+ 	regmap_write(priv->regmap, TIM_ARR, 0);
+ 
++	/* Force disable master mode */
++	if (stm32_timer_is_trgo2_name(trig->name))
++		regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS2, 0);
++	else
++		regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS, 0);
++
+ 	/* Make sure that registers are updated */
+ 	regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
+ }
+@@ -197,7 +204,7 @@ static ssize_t stm32_tt_store_frequency(struct device *dev,
+ 		return ret;
+ 
+ 	if (freq == 0) {
+-		stm32_timer_stop(priv);
++		stm32_timer_stop(priv, trig);
+ 	} else {
+ 		ret = stm32_timer_start(priv, trig, freq);
+ 		if (ret)
+diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h
+index c82578af56a5..2ea0360108e1 100644
+--- a/drivers/md/dm-bio-record.h
++++ b/drivers/md/dm-bio-record.h
+@@ -20,8 +20,13 @@
+ struct dm_bio_details {
+ 	struct gendisk *bi_disk;
+ 	u8 bi_partno;
++	int __bi_remaining;
+ 	unsigned long bi_flags;
+ 	struct bvec_iter bi_iter;
++	bio_end_io_t *bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++	struct bio_integrity_payload *bi_integrity;
++#endif
+ };
+ 
+ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
+@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
+ 	bd->bi_partno = bio->bi_partno;
+ 	bd->bi_flags = bio->bi_flags;
+ 	bd->bi_iter = bio->bi_iter;
++	bd->__bi_remaining = atomic_read(&bio->__bi_remaining);
++	bd->bi_end_io = bio->bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++	bd->bi_integrity = bio_integrity(bio);
++#endif
+ }
+ 
+ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
+@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
+ 	bio->bi_partno = bd->bi_partno;
+ 	bio->bi_flags = bd->bi_flags;
+ 	bio->bi_iter = bd->bi_iter;
++	atomic_set(&bio->__bi_remaining, bd->__bi_remaining);
++	bio->bi_end_io = bd->bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++	bio->bi_integrity = bd->bi_integrity;
++#endif
+ }
+ 
+ #endif
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index e1ad0b53f681..a82a9c257744 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -6,6 +6,8 @@
+  * This file is released under the GPL.
+  */
+ 
++#include "dm-bio-record.h"
++
+ #include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/device-mapper.h>
+@@ -295,11 +297,7 @@ struct dm_integrity_io {
+ 
+ 	struct completion *completion;
+ 
+-	struct gendisk *orig_bi_disk;
+-	u8 orig_bi_partno;
+-	bio_end_io_t *orig_bi_end_io;
+-	struct bio_integrity_payload *orig_bi_integrity;
+-	struct bvec_iter orig_bi_iter;
++	struct dm_bio_details bio_details;
+ };
+ 
+ struct journal_completion {
+@@ -1452,14 +1450,9 @@ static void integrity_end_io(struct bio *bio)
+ {
+ 	struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
+ 
+-	bio->bi_iter = dio->orig_bi_iter;
+-	bio->bi_disk = dio->orig_bi_disk;
+-	bio->bi_partno = dio->orig_bi_partno;
+-	if (dio->orig_bi_integrity) {
+-		bio->bi_integrity = dio->orig_bi_integrity;
++	dm_bio_restore(&dio->bio_details, bio);
++	if (bio->bi_integrity)
+ 		bio->bi_opf |= REQ_INTEGRITY;
+-	}
+-	bio->bi_end_io = dio->orig_bi_end_io;
+ 
+ 	if (dio->completion)
+ 		complete(dio->completion);
+@@ -1544,7 +1537,7 @@ static void integrity_metadata(struct work_struct *w)
+ 			}
+ 		}
+ 
+-		__bio_for_each_segment(bv, bio, iter, dio->orig_bi_iter) {
++		__bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
+ 			unsigned pos;
+ 			char *mem, *checksums_ptr;
+ 
+@@ -1588,7 +1581,7 @@ again:
+ 		if (likely(checksums != checksums_onstack))
+ 			kfree(checksums);
+ 	} else {
+-		struct bio_integrity_payload *bip = dio->orig_bi_integrity;
++		struct bio_integrity_payload *bip = dio->bio_details.bi_integrity;
+ 
+ 		if (bip) {
+ 			struct bio_vec biv;
+@@ -2007,20 +2000,13 @@ offload_to_thread:
+ 	} else
+ 		dio->completion = NULL;
+ 
+-	dio->orig_bi_iter = bio->bi_iter;
+-
+-	dio->orig_bi_disk = bio->bi_disk;
+-	dio->orig_bi_partno = bio->bi_partno;
++	dm_bio_record(&dio->bio_details, bio);
+ 	bio_set_dev(bio, ic->dev->bdev);
+-
+-	dio->orig_bi_integrity = bio_integrity(bio);
+ 	bio->bi_integrity = NULL;
+ 	bio->bi_opf &= ~REQ_INTEGRITY;
+-
+-	dio->orig_bi_end_io = bio->bi_end_io;
+ 	bio->bi_end_io = integrity_end_io;
+-
+ 	bio->bi_iter.bi_size = dio->range.n_sectors << SECTOR_SHIFT;
++
+ 	generic_make_request(bio);
+ 
+ 	if (need_sync_io) {
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index 25e5f24b3fec..5bdf57472314 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2112,8 +2112,8 @@ exit_done:
+ 	return status;
+ }
+ 
+-static int altera_get_note(u8 *p, s32 program_size,
+-			s32 *offset, char *key, char *value, int length)
++static int altera_get_note(u8 *p, s32 program_size, s32 *offset,
++			   char *key, char *value, int keylen, int vallen)
+ /*
+  * Gets key and value of NOTE fields in the JBC file.
+  * Can be called in two modes:  if offset pointer is NULL,
+@@ -2170,7 +2170,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ 						&p[note_table + (8 * i) + 4])];
+ 
+ 				if (value != NULL)
+-					strlcpy(value, value_ptr, length);
++					strlcpy(value, value_ptr, vallen);
+ 
+ 			}
+ 		}
+@@ -2189,13 +2189,13 @@ static int altera_get_note(u8 *p, s32 program_size,
+ 				strlcpy(key, &p[note_strings +
+ 						get_unaligned_be32(
+ 						&p[note_table + (8 * i)])],
+-					length);
++					keylen);
+ 
+ 			if (value != NULL)
+ 				strlcpy(value, &p[note_strings +
+ 						get_unaligned_be32(
+ 						&p[note_table + (8 * i) + 4])],
+-					length);
++					vallen);
+ 
+ 			*offset = i + 1;
+ 		}
+@@ -2449,7 +2449,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw)
+ 			__func__, (format_version == 2) ? "Jam STAPL" :
+ 						"pre-standardized Jam 1.1");
+ 		while (altera_get_note((u8 *)fw->data, fw->size,
+-					&offset, key, value, 256) == 0)
++					&offset, key, value, 32, 256) == 0)
+ 			printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n",
+ 					__func__, key, value);
+ 	}
+diff --git a/drivers/misc/cardreader/rts5227.c b/drivers/misc/cardreader/rts5227.c
+index 4feed296a327..423fecc19fc4 100644
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -394,7 +394,7 @@ static const struct pcr_ops rts522a_pcr_ops = {
+ void rts522a_init_params(struct rtsx_pcr *pcr)
+ {
+ 	rts5227_init_params(pcr);
+-
++	pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11);
+ 	pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3;
+ 
+ 	pcr->option.ocp_en = 1;
+diff --git a/drivers/misc/cardreader/rts5249.c b/drivers/misc/cardreader/rts5249.c
+index db936e4d6e56..1a81cda948c1 100644
+--- a/drivers/misc/cardreader/rts5249.c
++++ b/drivers/misc/cardreader/rts5249.c
+@@ -618,6 +618,7 @@ static const struct pcr_ops rts524a_pcr_ops = {
+ void rts524a_init_params(struct rtsx_pcr *pcr)
+ {
+ 	rts5249_init_params(pcr);
++	pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11);
+ 	pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF;
+ 	pcr->option.ltr_l1off_snooze_sspwrgate =
+ 		LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF;
+@@ -733,6 +734,7 @@ static const struct pcr_ops rts525a_pcr_ops = {
+ void rts525a_init_params(struct rtsx_pcr *pcr)
+ {
+ 	rts5249_init_params(pcr);
++	pcr->tx_initial_phase = SET_CLOCK_PHASE(25, 29, 11);
+ 	pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF;
+ 	pcr->option.ltr_l1off_snooze_sspwrgate =
+ 		LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF;
+diff --git a/drivers/misc/cardreader/rts5260.c b/drivers/misc/cardreader/rts5260.c
+index 4214f02a17fd..711054ebad74 100644
+--- a/drivers/misc/cardreader/rts5260.c
++++ b/drivers/misc/cardreader/rts5260.c
+@@ -662,7 +662,7 @@ void rts5260_init_params(struct rtsx_pcr *pcr)
+ 	pcr->sd30_drive_sel_1v8 = CFG_DRIVER_TYPE_B;
+ 	pcr->sd30_drive_sel_3v3 = CFG_DRIVER_TYPE_B;
+ 	pcr->aspm_en = ASPM_L1_EN;
+-	pcr->tx_initial_phase = SET_CLOCK_PHASE(1, 29, 16);
++	pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11);
+ 	pcr->rx_initial_phase = SET_CLOCK_PHASE(24, 6, 5);
+ 
+ 	pcr->ic_version = rts5260_get_ic_version(pcr);
+diff --git a/drivers/misc/cardreader/rts5261.c b/drivers/misc/cardreader/rts5261.c
+index 32dcec2e9dfd..a9ba0115ff00 100644
+--- a/drivers/misc/cardreader/rts5261.c
++++ b/drivers/misc/cardreader/rts5261.c
+@@ -763,7 +763,7 @@ void rts5261_init_params(struct rtsx_pcr *pcr)
+ 	pcr->sd30_drive_sel_1v8 = CFG_DRIVER_TYPE_B;
+ 	pcr->sd30_drive_sel_3v3 = CFG_DRIVER_TYPE_B;
+ 	pcr->aspm_en = ASPM_L1_EN;
+-	pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 27, 16);
++	pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 27, 11);
+ 	pcr->rx_initial_phase = SET_CLOCK_PHASE(24, 6, 5);
+ 
+ 	pcr->ic_version = rts5261_get_ic_version(pcr);
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index bd50935dc37d..11087976ab19 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -606,19 +606,22 @@ static int sd_change_phase(struct realtek_pci_sdmmc *host,
+ 		u8 sample_point, bool rx)
+ {
+ 	struct rtsx_pcr *pcr = host->pcr;
+-
++	u16 SD_VP_CTL = 0;
+ 	dev_dbg(sdmmc_dev(host), "%s(%s): sample_point = %d\n",
+ 			__func__, rx ? "RX" : "TX", sample_point);
+ 
+ 	rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, CHANGE_CLK);
+-	if (rx)
++	if (rx) {
++		SD_VP_CTL = SD_VPRX_CTL;
+ 		rtsx_pci_write_register(pcr, SD_VPRX_CTL,
+ 			PHASE_SELECT_MASK, sample_point);
+-	else
++	} else {
++		SD_VP_CTL = SD_VPTX_CTL;
+ 		rtsx_pci_write_register(pcr, SD_VPTX_CTL,
+ 			PHASE_SELECT_MASK, sample_point);
+-	rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET, 0);
+-	rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET,
++	}
++	rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET, 0);
++	rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET,
+ 				PHASE_NOT_RESET);
+ 	rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, 0);
+ 	rtsx_pci_write_register(pcr, SD_CFG1, SD_ASYNC_FIFO_NOT_RST, 0);
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 105e73d4a3b9..5d64d9c12ce9 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -23,6 +23,7 @@
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ 
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/pm.h>
+@@ -72,9 +73,16 @@ struct sdhci_acpi_host {
+ 	const struct sdhci_acpi_slot	*slot;
+ 	struct platform_device		*pdev;
+ 	bool				use_runtime_pm;
++	bool				is_intel;
++	bool				reset_signal_volt_on_suspend;
+ 	unsigned long			private[0] ____cacheline_aligned;
+ };
+ 
++enum {
++	DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP			= BIT(0),
++	DMI_QUIRK_SD_NO_WRITE_PROTECT				= BIT(1),
++};
++
+ static inline void *sdhci_acpi_priv(struct sdhci_acpi_host *c)
+ {
+ 	return (void *)c->private;
+@@ -391,6 +399,8 @@ static int intel_probe_slot(struct platform_device *pdev, struct acpi_device *ad
+ 	host->mmc_host_ops.start_signal_voltage_switch =
+ 					intel_start_signal_voltage_switch;
+ 
++	c->is_intel = true;
++
+ 	return 0;
+ }
+ 
+@@ -647,6 +657,36 @@ static const struct acpi_device_id sdhci_acpi_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(acpi, sdhci_acpi_ids);
+ 
++static const struct dmi_system_id sdhci_acpi_quirks[] = {
++	{
++		/*
++		 * The Lenovo Miix 320-10ICR has a bug in the _PS0 method of
++		 * the SHC1 ACPI device, this bug causes it to reprogram the
++		 * wrong LDO (DLDO3) to 1.8V if 1.8V modes are used and the
++		 * card is (runtime) suspended + resumed. DLDO3 is used for
++		 * the LCD and setting it to 1.8V causes the LCD to go black.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"),
++		},
++		.driver_data = (void *)DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP,
++	},
++	{
++		/*
++		 * The Acer Aspire Switch 10 (SW5-012) microSD slot always
++		 * reports the card being write-protected even though microSD
++		 * cards do not have a write-protect switch at all.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
++		},
++		.driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
++	},
++	{} /* Terminating entry */
++};
++
+ static const struct sdhci_acpi_slot *sdhci_acpi_get_slot(struct acpi_device *adev)
+ {
+ 	const struct sdhci_acpi_uid_slot *u;
+@@ -663,17 +703,23 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 	struct device *dev = &pdev->dev;
+ 	const struct sdhci_acpi_slot *slot;
+ 	struct acpi_device *device, *child;
++	const struct dmi_system_id *id;
+ 	struct sdhci_acpi_host *c;
+ 	struct sdhci_host *host;
+ 	struct resource *iomem;
+ 	resource_size_t len;
+ 	size_t priv_size;
++	int quirks = 0;
+ 	int err;
+ 
+ 	device = ACPI_COMPANION(dev);
+ 	if (!device)
+ 		return -ENODEV;
+ 
++	id = dmi_first_match(sdhci_acpi_quirks);
++	if (id)
++		quirks = (long)id->driver_data;
++
+ 	slot = sdhci_acpi_get_slot(device);
+ 
+ 	/* Power on the SDHCI controller and its children */
+@@ -759,6 +805,12 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 			dev_warn(dev, "failed to setup card detect gpio\n");
+ 			c->use_runtime_pm = false;
+ 		}
++
++		if (quirks & DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP)
++			c->reset_signal_volt_on_suspend = true;
++
++		if (quirks & DMI_QUIRK_SD_NO_WRITE_PROTECT)
++			host->mmc->caps2 |= MMC_CAP2_NO_WRITE_PROTECT;
+ 	}
+ 
+ 	err = sdhci_setup_host(host);
+@@ -823,17 +875,39 @@ static int sdhci_acpi_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static void __maybe_unused sdhci_acpi_reset_signal_voltage_if_needed(
++	struct device *dev)
++{
++	struct sdhci_acpi_host *c = dev_get_drvdata(dev);
++	struct sdhci_host *host = c->host;
++
++	if (c->is_intel && c->reset_signal_volt_on_suspend &&
++	    host->mmc->ios.signal_voltage != MMC_SIGNAL_VOLTAGE_330) {
++		struct intel_host *intel_host = sdhci_acpi_priv(c);
++		unsigned int fn = INTEL_DSM_V33_SWITCH;
++		u32 result = 0;
++
++		intel_dsm(intel_host, dev, fn, &result);
++	}
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ 
+ static int sdhci_acpi_suspend(struct device *dev)
+ {
+ 	struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+ 	struct sdhci_host *host = c->host;
++	int ret;
+ 
+ 	if (host->tuning_mode != SDHCI_TUNING_MODE_3)
+ 		mmc_retune_needed(host->mmc);
+ 
+-	return sdhci_suspend_host(host);
++	ret = sdhci_suspend_host(host);
++	if (ret)
++		return ret;
++
++	sdhci_acpi_reset_signal_voltage_if_needed(dev);
++	return 0;
+ }
+ 
+ static int sdhci_acpi_resume(struct device *dev)
+@@ -853,11 +927,17 @@ static int sdhci_acpi_runtime_suspend(struct device *dev)
+ {
+ 	struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+ 	struct sdhci_host *host = c->host;
++	int ret;
+ 
+ 	if (host->tuning_mode != SDHCI_TUNING_MODE_3)
+ 		mmc_retune_needed(host->mmc);
+ 
+-	return sdhci_runtime_suspend_host(host);
++	ret = sdhci_runtime_suspend_host(host);
++	if (ret)
++		return ret;
++
++	sdhci_acpi_reset_signal_voltage_if_needed(dev);
++	return 0;
+ }
+ 
+ static int sdhci_acpi_runtime_resume(struct device *dev)
+diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c
+index ae0ec27dd7cc..5f2e9696ee4d 100644
+--- a/drivers/mmc/host/sdhci-cadence.c
++++ b/drivers/mmc/host/sdhci-cadence.c
+@@ -11,6 +11,7 @@
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/mmc.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+ 
+ #include "sdhci-pltfm.h"
+ 
+@@ -235,6 +236,11 @@ static const struct sdhci_ops sdhci_cdns_ops = {
+ 	.set_uhs_signaling = sdhci_cdns_set_uhs_signaling,
+ };
+ 
++static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = {
++	.ops = &sdhci_cdns_ops,
++	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++};
++
+ static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = {
+ 	.ops = &sdhci_cdns_ops,
+ };
+@@ -334,6 +340,7 @@ static void sdhci_cdns_hs400_enhanced_strobe(struct mmc_host *mmc,
+ static int sdhci_cdns_probe(struct platform_device *pdev)
+ {
+ 	struct sdhci_host *host;
++	const struct sdhci_pltfm_data *data;
+ 	struct sdhci_pltfm_host *pltfm_host;
+ 	struct sdhci_cdns_priv *priv;
+ 	struct clk *clk;
+@@ -350,8 +357,12 @@ static int sdhci_cdns_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return ret;
+ 
++	data = of_device_get_match_data(dev);
++	if (!data)
++		data = &sdhci_cdns_pltfm_data;
++
+ 	nr_phy_params = sdhci_cdns_phy_param_count(dev->of_node);
+-	host = sdhci_pltfm_init(pdev, &sdhci_cdns_pltfm_data,
++	host = sdhci_pltfm_init(pdev, data,
+ 				struct_size(priv, phy_params, nr_phy_params));
+ 	if (IS_ERR(host)) {
+ 		ret = PTR_ERR(host);
+@@ -431,7 +442,10 @@ static const struct dev_pm_ops sdhci_cdns_pm_ops = {
+ };
+ 
+ static const struct of_device_id sdhci_cdns_match[] = {
+-	{ .compatible = "socionext,uniphier-sd4hc" },
++	{
++		.compatible = "socionext,uniphier-sd4hc",
++		.data = &sdhci_cdns_uniphier_pltfm_data,
++	},
+ 	{ .compatible = "cdns,sd4hc" },
+ 	{ /* sentinel */ }
+ };
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index 99d82c1874d6..d9da141e325f 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -125,7 +125,8 @@ static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
+ 
+ 	sdhci_reset(host, mask);
+ 
+-	if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++	if ((host->mmc->caps & MMC_CAP_NONREMOVABLE)
++	    || mmc_gpio_get_cd(host->mmc) >= 0)
+ 		sdhci_at91_set_force_card_detect(host);
+ 
+ 	if (priv->cal_always_on && (mask & SDHCI_RESET_ALL))
+@@ -416,8 +417,11 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ 	 * detection procedure using the SDMCC_CD signal is bypassed.
+ 	 * This bit is reset when a software reset for all command is performed
+ 	 * so we need to implement our own reset function to set back this bit.
++	 *
++	 * WA: SAMA5D2 doesn't drive CMD if using CD GPIO line.
+ 	 */
+-	if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++	if ((host->mmc->caps & MMC_CAP_NONREMOVABLE)
++	    || mmc_gpio_get_cd(host->mmc) >= 0)
+ 		sdhci_at91_set_force_card_detect(host);
+ 
+ 	pm_runtime_put_autosuspend(&pdev->dev);
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index af674fc0bb1e..5bb5342b8d0c 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -515,7 +515,7 @@ static int nvmet_try_send_data_pdu(struct nvmet_tcp_cmd *cmd)
+ 	return 1;
+ }
+ 
+-static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd)
++static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
+ {
+ 	struct nvmet_tcp_queue *queue = cmd->queue;
+ 	int ret;
+@@ -523,9 +523,15 @@ static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd)
+ 	while (cmd->cur_sg) {
+ 		struct page *page = sg_page(cmd->cur_sg);
+ 		u32 left = cmd->cur_sg->length - cmd->offset;
++		int flags = MSG_DONTWAIT;
++
++		if ((!last_in_batch && cmd->queue->send_list_len) ||
++		    cmd->wbytes_done + left < cmd->req.transfer_len ||
++		    queue->data_digest || !queue->nvme_sq.sqhd_disabled)
++			flags |= MSG_MORE;
+ 
+ 		ret = kernel_sendpage(cmd->queue->sock, page, cmd->offset,
+-					left, MSG_DONTWAIT | MSG_MORE);
++					left, flags);
+ 		if (ret <= 0)
+ 			return ret;
+ 
+@@ -660,7 +666,7 @@ static int nvmet_tcp_try_send_one(struct nvmet_tcp_queue *queue,
+ 	}
+ 
+ 	if (cmd->state == NVMET_TCP_SEND_DATA) {
+-		ret = nvmet_try_send_data(cmd);
++		ret = nvmet_try_send_data(cmd, last_in_batch);
+ 		if (ret <= 0)
+ 			goto done_send;
+ 	}
+diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
+index acce8781c456..f5c7a845cd7b 100644
+--- a/drivers/perf/arm_pmu_acpi.c
++++ b/drivers/perf/arm_pmu_acpi.c
+@@ -24,8 +24,6 @@ static int arm_pmu_acpi_register_irq(int cpu)
+ 	int gsi, trigger;
+ 
+ 	gicc = acpi_cpu_get_madt_gicc(cpu);
+-	if (WARN_ON(!gicc))
+-		return -EINVAL;
+ 
+ 	gsi = gicc->performance_interrupt;
+ 
+@@ -64,11 +62,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu)
+ 	int gsi;
+ 
+ 	gicc = acpi_cpu_get_madt_gicc(cpu);
+-	if (!gicc)
+-		return;
+ 
+ 	gsi = gicc->performance_interrupt;
+-	acpi_unregister_gsi(gsi);
++	if (gsi)
++		acpi_unregister_gsi(gsi);
+ }
+ 
+ #if IS_ENABLED(CONFIG_ARM_SPE_PMU)
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index 95dca2cb5265..90884d14f95f 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -388,9 +388,10 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,
+ 
+ 	if (enable) {
+ 		/*
+-		 * must disable first, then enable again
+-		 * otherwise, cycle counter will not work
+-		 * if previous state is enabled.
++		 * cycle counter is special which should firstly write 0 then
++		 * write 1 into CLEAR bit to clear it. Other counters only
++		 * need write 0 into CLEAR bit and it turns out to be 1 by
++		 * hardware. Below enable flow is harmless for all counters.
+ 		 */
+ 		writel(0, pmu->base + reg);
+ 		val = CNTL_EN | CNTL_CLEAR;
+@@ -398,7 +399,8 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,
+ 		writel(val, pmu->base + reg);
+ 	} else {
+ 		/* Disable counter */
+-		writel(0, pmu->base + reg);
++		val = readl_relaxed(pmu->base + reg) & CNTL_EN_MASK;
++		writel(val, pmu->base + reg);
+ 	}
+ }
+ 
+diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
+index a28bd15297f5..1c536fc03c83 100644
+--- a/drivers/phy/ti/phy-gmii-sel.c
++++ b/drivers/phy/ti/phy-gmii-sel.c
+@@ -80,20 +80,20 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode)
+ 		break;
+ 
+ 	case PHY_INTERFACE_MODE_MII:
+-		mode = AM33XX_GMII_SEL_MODE_MII;
++	case PHY_INTERFACE_MODE_GMII:
++		gmii_sel_mode = AM33XX_GMII_SEL_MODE_MII;
+ 		break;
+ 
+ 	default:
+-		dev_warn(dev,
+-			 "port%u: unsupported mode: \"%s\". Defaulting to MII.\n",
+-			 if_phy->id, phy_modes(rgmii_id));
++		dev_warn(dev, "port%u: unsupported mode: \"%s\"\n",
++			 if_phy->id, phy_modes(submode));
+ 		return -EINVAL;
+ 	}
+ 
+ 	if_phy->phy_if_mode = submode;
+ 
+ 	dev_dbg(dev, "%s id:%u mode:%u rgmii_id:%d rmii_clk_ext:%d\n",
+-		__func__, if_phy->id, mode, rgmii_id,
++		__func__, if_phy->id, submode, rgmii_id,
+ 		if_phy->rmii_clock_external);
+ 
+ 	regfield = if_phy->fields[PHY_GMII_SEL_PORT_MODE];
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 0f46e4a42889..91a1b13fbf71 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -327,6 +327,7 @@ config RTC_DRV_MAX6900
+ config RTC_DRV_MAX8907
+ 	tristate "Maxim MAX8907"
+ 	depends on MFD_MAX8907 || COMPILE_TEST
++	select REGMAP_IRQ
+ 	help
+ 	  If you say yes here you will get support for the
+ 	  RTC of Maxim MAX8907 PMIC.
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 7e2292c11d12..7e781c8a5ee5 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -974,20 +974,12 @@ static int omap2_mcspi_setup_transfer(struct spi_device *spi,
+  * Note that we currently allow DMA only if we get a channel
+  * for both rx and tx. Otherwise we'll do PIO for both rx and tx.
+  */
+-static int omap2_mcspi_request_dma(struct spi_device *spi)
++static int omap2_mcspi_request_dma(struct omap2_mcspi *mcspi,
++				   struct omap2_mcspi_dma *mcspi_dma)
+ {
+-	struct spi_master	*master = spi->master;
+-	struct omap2_mcspi	*mcspi;
+-	struct omap2_mcspi_dma	*mcspi_dma;
+ 	int ret = 0;
+ 
+-	mcspi = spi_master_get_devdata(master);
+-	mcspi_dma = mcspi->dma_channels + spi->chip_select;
+-
+-	init_completion(&mcspi_dma->dma_rx_completion);
+-	init_completion(&mcspi_dma->dma_tx_completion);
+-
+-	mcspi_dma->dma_rx = dma_request_chan(&master->dev,
++	mcspi_dma->dma_rx = dma_request_chan(mcspi->dev,
+ 					     mcspi_dma->dma_rx_ch_name);
+ 	if (IS_ERR(mcspi_dma->dma_rx)) {
+ 		ret = PTR_ERR(mcspi_dma->dma_rx);
+@@ -995,7 +987,7 @@ static int omap2_mcspi_request_dma(struct spi_device *spi)
+ 		goto no_dma;
+ 	}
+ 
+-	mcspi_dma->dma_tx = dma_request_chan(&master->dev,
++	mcspi_dma->dma_tx = dma_request_chan(mcspi->dev,
+ 					     mcspi_dma->dma_tx_ch_name);
+ 	if (IS_ERR(mcspi_dma->dma_tx)) {
+ 		ret = PTR_ERR(mcspi_dma->dma_tx);
+@@ -1004,20 +996,40 @@ static int omap2_mcspi_request_dma(struct spi_device *spi)
+ 		mcspi_dma->dma_rx = NULL;
+ 	}
+ 
++	init_completion(&mcspi_dma->dma_rx_completion);
++	init_completion(&mcspi_dma->dma_tx_completion);
++
+ no_dma:
+ 	return ret;
+ }
+ 
++static void omap2_mcspi_release_dma(struct spi_master *master)
++{
++	struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
++	struct omap2_mcspi_dma	*mcspi_dma;
++	int i;
++
++	for (i = 0; i < master->num_chipselect; i++) {
++		mcspi_dma = &mcspi->dma_channels[i];
++
++		if (mcspi_dma->dma_rx) {
++			dma_release_channel(mcspi_dma->dma_rx);
++			mcspi_dma->dma_rx = NULL;
++		}
++		if (mcspi_dma->dma_tx) {
++			dma_release_channel(mcspi_dma->dma_tx);
++			mcspi_dma->dma_tx = NULL;
++		}
++	}
++}
++
+ static int omap2_mcspi_setup(struct spi_device *spi)
+ {
+ 	int			ret;
+ 	struct omap2_mcspi	*mcspi = spi_master_get_devdata(spi->master);
+ 	struct omap2_mcspi_regs	*ctx = &mcspi->ctx;
+-	struct omap2_mcspi_dma	*mcspi_dma;
+ 	struct omap2_mcspi_cs	*cs = spi->controller_state;
+ 
+-	mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+-
+ 	if (!cs) {
+ 		cs = kzalloc(sizeof *cs, GFP_KERNEL);
+ 		if (!cs)
+@@ -1042,13 +1054,6 @@ static int omap2_mcspi_setup(struct spi_device *spi)
+ 		}
+ 	}
+ 
+-	if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx) {
+-		ret = omap2_mcspi_request_dma(spi);
+-		if (ret)
+-			dev_warn(&spi->dev, "not using DMA for McSPI (%d)\n",
+-				 ret);
+-	}
+-
+ 	ret = pm_runtime_get_sync(mcspi->dev);
+ 	if (ret < 0) {
+ 		pm_runtime_put_noidle(mcspi->dev);
+@@ -1065,12 +1070,8 @@ static int omap2_mcspi_setup(struct spi_device *spi)
+ 
+ static void omap2_mcspi_cleanup(struct spi_device *spi)
+ {
+-	struct omap2_mcspi	*mcspi;
+-	struct omap2_mcspi_dma	*mcspi_dma;
+ 	struct omap2_mcspi_cs	*cs;
+ 
+-	mcspi = spi_master_get_devdata(spi->master);
+-
+ 	if (spi->controller_state) {
+ 		/* Unlink controller state from context save list */
+ 		cs = spi->controller_state;
+@@ -1079,19 +1080,6 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
+ 		kfree(cs);
+ 	}
+ 
+-	if (spi->chip_select < spi->master->num_chipselect) {
+-		mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+-
+-		if (mcspi_dma->dma_rx) {
+-			dma_release_channel(mcspi_dma->dma_rx);
+-			mcspi_dma->dma_rx = NULL;
+-		}
+-		if (mcspi_dma->dma_tx) {
+-			dma_release_channel(mcspi_dma->dma_tx);
+-			mcspi_dma->dma_tx = NULL;
+-		}
+-	}
+-
+ 	if (gpio_is_valid(spi->cs_gpio))
+ 		gpio_free(spi->cs_gpio);
+ }
+@@ -1302,6 +1290,9 @@ static bool omap2_mcspi_can_dma(struct spi_master *master,
+ 	if (spi_controller_is_slave(master))
+ 		return true;
+ 
++	master->dma_rx = mcspi_dma->dma_rx;
++	master->dma_tx = mcspi_dma->dma_tx;
++
+ 	return (xfer->len >= DMA_MIN_BYTES);
+ }
+ 
+@@ -1464,6 +1455,11 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
+ 	for (i = 0; i < master->num_chipselect; i++) {
+ 		sprintf(mcspi->dma_channels[i].dma_rx_ch_name, "rx%d", i);
+ 		sprintf(mcspi->dma_channels[i].dma_tx_ch_name, "tx%d", i);
++
++		status = omap2_mcspi_request_dma(mcspi,
++						 &mcspi->dma_channels[i]);
++		if (status == -EPROBE_DEFER)
++			goto free_master;
+ 	}
+ 
+ 	status = platform_get_irq(pdev, 0);
+@@ -1501,6 +1497,7 @@ disable_pm:
+ 	pm_runtime_put_sync(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
+ free_master:
++	omap2_mcspi_release_dma(master);
+ 	spi_master_put(master);
+ 	return status;
+ }
+@@ -1510,6 +1507,8 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
+ 	struct spi_master *master = platform_get_drvdata(pdev);
+ 	struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
+ 
++	omap2_mcspi_release_dma(master);
++
+ 	pm_runtime_dont_use_autosuspend(mcspi->dev);
+ 	pm_runtime_put_sync(mcspi->dev);
+ 	pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 9071333ebdd8..cabd1a85d71e 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -70,6 +70,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
+ #define LPSS_CAPS_CS_EN_SHIFT			9
+ #define LPSS_CAPS_CS_EN_MASK			(0xf << LPSS_CAPS_CS_EN_SHIFT)
+ 
++#define LPSS_PRIV_CLOCK_GATE 0x38
++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3
++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3
++
+ struct lpss_config {
+ 	/* LPSS offset from drv_data->ioaddr */
+ 	unsigned offset;
+@@ -86,6 +90,8 @@ struct lpss_config {
+ 	unsigned cs_sel_shift;
+ 	unsigned cs_sel_mask;
+ 	unsigned cs_num;
++	/* Quirks */
++	unsigned cs_clk_stays_gated : 1;
+ };
+ 
+ /* Keep these sorted with enum pxa_ssp_type */
+@@ -156,6 +162,7 @@ static const struct lpss_config lpss_platforms[] = {
+ 		.tx_threshold_hi = 56,
+ 		.cs_sel_shift = 8,
+ 		.cs_sel_mask = 3 << 8,
++		.cs_clk_stays_gated = true,
+ 	},
+ };
+ 
+@@ -383,6 +390,22 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable)
+ 	else
+ 		value |= LPSS_CS_CONTROL_CS_HIGH;
+ 	__lpss_ssp_write_priv(drv_data, config->reg_cs_ctrl, value);
++	if (config->cs_clk_stays_gated) {
++		u32 clkgate;
++
++		/*
++		 * Changing CS alone when dynamic clock gating is on won't
++		 * actually flip CS at that time. This ruins SPI transfers
++		 * that specify delays, or have no data. Toggle the clock mode
++		 * to force on briefly to poke the CS pin to move.
++		 */
++		clkgate = __lpss_ssp_read_priv(drv_data, LPSS_PRIV_CLOCK_GATE);
++		value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK) |
++			LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON;
++
++		__lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, value);
++		__lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, clkgate);
++	}
+ }
+ 
+ static void cs_assert(struct spi_device *spi)
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index dd3434a407ea..a364b99497e2 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1217,6 +1217,11 @@ static int spi_qup_suspend(struct device *device)
+ 	struct spi_qup *controller = spi_master_get_devdata(master);
+ 	int ret;
+ 
++	if (pm_runtime_suspended(device)) {
++		ret = spi_qup_pm_resume_runtime(device);
++		if (ret)
++			return ret;
++	}
+ 	ret = spi_master_suspend(master);
+ 	if (ret)
+ 		return ret;
+@@ -1225,10 +1230,8 @@ static int spi_qup_suspend(struct device *device)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (!pm_runtime_suspended(device)) {
+-		clk_disable_unprepare(controller->cclk);
+-		clk_disable_unprepare(controller->iclk);
+-	}
++	clk_disable_unprepare(controller->cclk);
++	clk_disable_unprepare(controller->iclk);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 60c4de4e4485..7412a3042a8d 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -401,9 +401,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high)
+ 
+ 	zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry);
+ 
+-	/* Dummy generic FIFO entry */
+-	zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0);
+-
+ 	/* Manually start the generic FIFO command */
+ 	zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST,
+ 			zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) |
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 8994545367a2..0e70af2677fe 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2615,7 +2615,7 @@ int spi_register_controller(struct spi_controller *ctlr)
+ 		if (ctlr->use_gpio_descriptors) {
+ 			status = spi_get_gpio_descs(ctlr);
+ 			if (status)
+-				return status;
++				goto free_bus_id;
+ 			/*
+ 			 * A controller using GPIO descriptors always
+ 			 * supports SPI_CS_HIGH if need be.
+@@ -2625,7 +2625,7 @@ int spi_register_controller(struct spi_controller *ctlr)
+ 			/* Legacy code path for GPIOs from DT */
+ 			status = of_spi_get_gpio_numbers(ctlr);
+ 			if (status)
+-				return status;
++				goto free_bus_id;
+ 		}
+ 	}
+ 
+@@ -2633,17 +2633,14 @@ int spi_register_controller(struct spi_controller *ctlr)
+ 	 * Even if it's just one always-selected device, there must
+ 	 * be at least one chipselect.
+ 	 */
+-	if (!ctlr->num_chipselect)
+-		return -EINVAL;
++	if (!ctlr->num_chipselect) {
++		status = -EINVAL;
++		goto free_bus_id;
++	}
+ 
+ 	status = device_add(&ctlr->dev);
+-	if (status < 0) {
+-		/* free bus id */
+-		mutex_lock(&board_lock);
+-		idr_remove(&spi_master_idr, ctlr->bus_num);
+-		mutex_unlock(&board_lock);
+-		goto done;
+-	}
++	if (status < 0)
++		goto free_bus_id;
+ 	dev_dbg(dev, "registered %s %s\n",
+ 			spi_controller_is_slave(ctlr) ? "slave" : "master",
+ 			dev_name(&ctlr->dev));
+@@ -2659,11 +2656,7 @@ int spi_register_controller(struct spi_controller *ctlr)
+ 		status = spi_controller_initialize_queue(ctlr);
+ 		if (status) {
+ 			device_del(&ctlr->dev);
+-			/* free bus id */
+-			mutex_lock(&board_lock);
+-			idr_remove(&spi_master_idr, ctlr->bus_num);
+-			mutex_unlock(&board_lock);
+-			goto done;
++			goto free_bus_id;
+ 		}
+ 	}
+ 	/* add statistics */
+@@ -2678,7 +2671,12 @@ int spi_register_controller(struct spi_controller *ctlr)
+ 	/* Register devices from the device tree and ACPI */
+ 	of_register_spi_devices(ctlr);
+ 	acpi_register_spi_devices(ctlr);
+-done:
++	return status;
++
++free_bus_id:
++	mutex_lock(&board_lock);
++	idr_remove(&spi_master_idr, ctlr->bus_num);
++	mutex_unlock(&board_lock);
+ 	return status;
+ }
+ EXPORT_SYMBOL_GPL(spi_register_controller);
+diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c
+index ba6f905f26fa..69c6dce9be31 100644
+--- a/drivers/staging/greybus/tools/loopback_test.c
++++ b/drivers/staging/greybus/tools/loopback_test.c
+@@ -19,6 +19,7 @@
+ #include <signal.h>
+ 
+ #define MAX_NUM_DEVICES 10
++#define MAX_SYSFS_PREFIX 0x80
+ #define MAX_SYSFS_PATH	0x200
+ #define CSV_MAX_LINE	0x1000
+ #define SYSFS_MAX_INT	0x20
+@@ -67,7 +68,7 @@ struct loopback_results {
+ };
+ 
+ struct loopback_device {
+-	char name[MAX_SYSFS_PATH];
++	char name[MAX_STR_LEN];
+ 	char sysfs_entry[MAX_SYSFS_PATH];
+ 	char debugfs_entry[MAX_SYSFS_PATH];
+ 	struct loopback_results results;
+@@ -93,8 +94,8 @@ struct loopback_test {
+ 	int stop_all;
+ 	int poll_count;
+ 	char test_name[MAX_STR_LEN];
+-	char sysfs_prefix[MAX_SYSFS_PATH];
+-	char debugfs_prefix[MAX_SYSFS_PATH];
++	char sysfs_prefix[MAX_SYSFS_PREFIX];
++	char debugfs_prefix[MAX_SYSFS_PREFIX];
+ 	struct timespec poll_timeout;
+ 	struct loopback_device devices[MAX_NUM_DEVICES];
+ 	struct loopback_results aggregate_results;
+@@ -637,7 +638,7 @@ baddir:
+ static int open_poll_files(struct loopback_test *t)
+ {
+ 	struct loopback_device *dev;
+-	char buf[MAX_STR_LEN];
++	char buf[MAX_SYSFS_PATH + MAX_STR_LEN];
+ 	char dummy;
+ 	int fds_idx = 0;
+ 	int i;
+@@ -655,7 +656,7 @@ static int open_poll_files(struct loopback_test *t)
+ 			goto err;
+ 		}
+ 		read(t->fds[fds_idx].fd, &dummy, 1);
+-		t->fds[fds_idx].events = EPOLLERR|EPOLLPRI;
++		t->fds[fds_idx].events = POLLERR | POLLPRI;
+ 		t->fds[fds_idx].revents = 0;
+ 		fds_idx++;
+ 	}
+@@ -748,7 +749,7 @@ static int wait_for_complete(struct loopback_test *t)
+ 		}
+ 
+ 		for (i = 0; i < t->poll_count; i++) {
+-			if (t->fds[i].revents & EPOLLPRI) {
++			if (t->fds[i].revents & POLLPRI) {
+ 				/* Dummy read to clear the event */
+ 				read(t->fds[i].fd, &dummy, 1);
+ 				number_of_events++;
+@@ -907,10 +908,10 @@ int main(int argc, char *argv[])
+ 			t.iteration_max = atoi(optarg);
+ 			break;
+ 		case 'S':
+-			snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", optarg);
++			snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg);
+ 			break;
+ 		case 'D':
+-			snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", optarg);
++			snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg);
+ 			break;
+ 		case 'm':
+ 			t.mask = atol(optarg);
+@@ -961,10 +962,10 @@ int main(int argc, char *argv[])
+ 	}
+ 
+ 	if (!strcmp(t.sysfs_prefix, ""))
+-		snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", sysfs_prefix);
++		snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", sysfs_prefix);
+ 
+ 	if (!strcmp(t.debugfs_prefix, ""))
+-		snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", debugfs_prefix);
++		snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", debugfs_prefix);
+ 
+ 	ret = find_loopback_devices(&t);
+ 	if (ret)
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index b5d42f411dd8..845c8817281c 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -38,6 +38,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ 	{USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
+ 	{USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
+ 	{USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
++	{USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
+ 	{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ 	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ 	{}	/* Terminating entry */
+diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
+index 488f2539aa9a..81ecfd1a200d 100644
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -561,7 +561,7 @@ static u_long get_word(struct vc_data *vc)
+ 		return 0;
+ 	} else if (tmpx < vc->vc_cols - 2 &&
+ 		   (ch == SPACE || ch == 0 || (ch < 0x100 && IS_WDLM(ch))) &&
+-		   get_char(vc, (u_short *)&tmp_pos + 1, &temp) > SPACE) {
++		   get_char(vc, (u_short *)tmp_pos + 1, &temp) > SPACE) {
+ 		tmp_pos += 2;
+ 		tmpx++;
+ 	} else {
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 43bfeb886614..f0f77da6ca26 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -848,7 +848,7 @@ static bool tb_port_is_width_supported(struct tb_port *port, int width)
+ 	ret = tb_port_read(port, &phy, TB_CFG_PORT,
+ 			   port->cap_phy + LANE_ADP_CS_0, 1);
+ 	if (ret)
+-		return ret;
++		return false;
+ 
+ 	widths = (phy & LANE_ADP_CS_0_SUPPORTED_WIDTH_MASK) >>
+ 		LANE_ADP_CS_0_SUPPORTED_WIDTH_SHIFT;
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index d9f54c7d94f2..eb8c3e559363 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2734,9 +2734,11 @@ static int compat_tty_tiocgserial(struct tty_struct *tty,
+ 	struct serial_struct32 v32;
+ 	struct serial_struct v;
+ 	int err;
+-	memset(&v, 0, sizeof(struct serial_struct));
+ 
+-	if (!tty->ops->set_serial)
++	memset(&v, 0, sizeof(v));
++	memset(&v32, 0, sizeof(v32));
++
++	if (!tty->ops->get_serial)
+ 		return -ENOTTY;
+ 	err = tty->ops->get_serial(tty, &v);
+ 	if (!err) {
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index ffaf46f5d062..4c4ac30db498 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -1530,18 +1530,19 @@ static const struct usb_ep_ops usb_ep_ops = {
+ static void ci_hdrc_gadget_connect(struct usb_gadget *_gadget, int is_active)
+ {
+ 	struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
+-	unsigned long flags;
+ 
+ 	if (is_active) {
+ 		pm_runtime_get_sync(&_gadget->dev);
+ 		hw_device_reset(ci);
+-		spin_lock_irqsave(&ci->lock, flags);
++		spin_lock_irq(&ci->lock);
+ 		if (ci->driver) {
+ 			hw_device_state(ci, ci->ep0out->qh.dma);
+ 			usb_gadget_set_state(_gadget, USB_STATE_POWERED);
++			spin_unlock_irq(&ci->lock);
+ 			usb_udc_vbus_handler(_gadget, true);
++		} else {
++			spin_unlock_irq(&ci->lock);
+ 		}
+-		spin_unlock_irqrestore(&ci->lock, flags);
+ 	} else {
+ 		usb_udc_vbus_handler(_gadget, false);
+ 		if (ci->driver)
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 62f4fb9b362f..47f09a6ce7bd 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -896,10 +896,10 @@ static int get_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ 
+ 	ss->xmit_fifo_size = acm->writesize;
+ 	ss->baud_base = le32_to_cpu(acm->line.dwDTERate);
+-	ss->close_delay	= acm->port.close_delay / 10;
++	ss->close_delay	= jiffies_to_msecs(acm->port.close_delay) / 10;
+ 	ss->closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+ 				ASYNC_CLOSING_WAIT_NONE :
+-				acm->port.closing_wait / 10;
++				jiffies_to_msecs(acm->port.closing_wait) / 10;
+ 	return 0;
+ }
+ 
+@@ -907,24 +907,32 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ {
+ 	struct acm *acm = tty->driver_data;
+ 	unsigned int closing_wait, close_delay;
++	unsigned int old_closing_wait, old_close_delay;
+ 	int retval = 0;
+ 
+-	close_delay = ss->close_delay * 10;
++	close_delay = msecs_to_jiffies(ss->close_delay * 10);
+ 	closing_wait = ss->closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+-			ASYNC_CLOSING_WAIT_NONE : ss->closing_wait * 10;
++			ASYNC_CLOSING_WAIT_NONE :
++			msecs_to_jiffies(ss->closing_wait * 10);
++
++	/* we must redo the rounding here, so that the values match */
++	old_close_delay	= jiffies_to_msecs(acm->port.close_delay) / 10;
++	old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
++				ASYNC_CLOSING_WAIT_NONE :
++				jiffies_to_msecs(acm->port.closing_wait) / 10;
+ 
+ 	mutex_lock(&acm->port.mutex);
+ 
+-	if (!capable(CAP_SYS_ADMIN)) {
+-		if ((close_delay != acm->port.close_delay) ||
+-		    (closing_wait != acm->port.closing_wait))
++	if ((ss->close_delay != old_close_delay) ||
++            (ss->closing_wait != old_closing_wait)) {
++		if (!capable(CAP_SYS_ADMIN))
+ 			retval = -EPERM;
+-		else
+-			retval = -EOPNOTSUPP;
+-	} else {
+-		acm->port.close_delay  = close_delay;
+-		acm->port.closing_wait = closing_wait;
+-	}
++		else {
++			acm->port.close_delay  = close_delay;
++			acm->port.closing_wait = closing_wait;
++		}
++	} else
++		retval = -EOPNOTSUPP;
+ 
+ 	mutex_unlock(&acm->port.mutex);
+ 	return retval;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 2dac3e7cdd97..da30b5664ff3 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -378,6 +378,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+ 			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+ 
++	/* Realtek hub in Dell WD19 (Type-C) */
++	{ USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM },
++
++	/* Generic RTL8153 based ethernet adapters */
++	{ USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* Action Semiconductor flash disk */
+ 	{ USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ 			USB_QUIRK_STRING_FETCH_255 },
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 5e9b537df631..1fddc41fa1f3 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -136,7 +136,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		xhci->quirks |= XHCI_AMD_PLL_FIX;
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+-		(pdev->device == 0x15e0 ||
++		(pdev->device == 0x145c ||
++		 pdev->device == 0x15e0 ||
+ 		 pdev->device == 0x15e1 ||
+ 		 pdev->device == 0x43bb))
+ 		xhci->quirks |= XHCI_SUSPEND_DELAY;
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index d90cd5ec09cf..315b4552693c 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -445,6 +445,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
+ static struct platform_driver usb_xhci_driver = {
+ 	.probe	= xhci_plat_probe,
+ 	.remove	= xhci_plat_remove,
++	.shutdown = usb_hcd_platform_shutdown,
+ 	.driver	= {
+ 		.name = "xhci-hcd",
+ 		.pm = &xhci_plat_pm_ops,
+diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h
+index 56eb867803a6..b19582b2a72c 100644
+--- a/drivers/usb/host/xhci-trace.h
++++ b/drivers/usb/host/xhci-trace.h
+@@ -289,23 +289,12 @@ DECLARE_EVENT_CLASS(xhci_log_urb,
+ 	),
+ 	TP_printk("ep%d%s-%s: urb %p pipe %u slot %d length %d/%d sgs %d/%d stream %d flags %08x",
+ 			__entry->epnum, __entry->dir_in ? "in" : "out",
+-			({ char *s;
+-			switch (__entry->type) {
+-			case USB_ENDPOINT_XFER_INT:
+-				s = "intr";
+-				break;
+-			case USB_ENDPOINT_XFER_CONTROL:
+-				s = "control";
+-				break;
+-			case USB_ENDPOINT_XFER_BULK:
+-				s = "bulk";
+-				break;
+-			case USB_ENDPOINT_XFER_ISOC:
+-				s = "isoc";
+-				break;
+-			default:
+-				s = "UNKNOWN";
+-			} s; }), __entry->urb, __entry->pipe, __entry->slot_id,
++			__print_symbolic(__entry->type,
++				   { USB_ENDPOINT_XFER_INT,	"intr" },
++				   { USB_ENDPOINT_XFER_CONTROL,	"control" },
++				   { USB_ENDPOINT_XFER_BULK,	"bulk" },
++				   { USB_ENDPOINT_XFER_ISOC,	"isoc" }),
++			__entry->urb, __entry->pipe, __entry->slot_id,
+ 			__entry->actual, __entry->length, __entry->num_mapped_sgs,
+ 			__entry->num_sgs, __entry->stream, __entry->flags
+ 		)
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 084cc2fff3ae..0b5dcf973d94 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1183,6 +1183,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = NCTRL(0) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff),	/* Telit ME910G1 */
+ 	  .driver_info = NCTRL(0) | RSVD(3) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110b, 0xff),	/* Telit ME910G1 (ECM) */
++	  .driver_info = NCTRL(0) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index aab737e1e7b6..c5a2995dfa2e 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -99,6 +99,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index a019ea7e6e0e..52db5519aaf0 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -130,6 +130,7 @@
+ #define HP_LM920_PRODUCT_ID	0x026b
+ #define HP_TD620_PRODUCT_ID	0x0956
+ #define HP_LD960_PRODUCT_ID	0x0b39
++#define HP_LD381_PRODUCT_ID	0x0f7f
+ #define HP_LCM220_PRODUCT_ID	0x3139
+ #define HP_LCM960_PRODUCT_ID	0x3239
+ #define HP_LD220_PRODUCT_ID	0x3524
+diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c
+index d4d5189edfb8..77655d9ce549 100644
+--- a/drivers/usb/typec/ucsi/displayport.c
++++ b/drivers/usb/typec/ucsi/displayport.c
+@@ -271,6 +271,9 @@ void ucsi_displayport_remove_partner(struct typec_altmode *alt)
+ 		return;
+ 
+ 	dp = typec_altmode_get_drvdata(alt);
++	if (!dp)
++		return;
++
+ 	dp->data.conf = 0;
+ 	dp->data.status = 0;
+ 	dp->initialized = false;
+@@ -285,6 +288,8 @@ struct typec_altmode *ucsi_register_displayport(struct ucsi_connector *con,
+ 	struct typec_altmode *alt;
+ 	struct ucsi_dp *dp;
+ 
++	mutex_lock(&con->lock);
++
+ 	/* We can't rely on the firmware with the capabilities. */
+ 	desc->vdo |= DP_CAP_DP_SIGNALING | DP_CAP_RECEPTACLE;
+ 
+@@ -293,12 +298,15 @@ struct typec_altmode *ucsi_register_displayport(struct ucsi_connector *con,
+ 	desc->vdo |= all_assignments << 16;
+ 
+ 	alt = typec_port_register_altmode(con->port, desc);
+-	if (IS_ERR(alt))
++	if (IS_ERR(alt)) {
++		mutex_unlock(&con->lock);
+ 		return alt;
++	}
+ 
+ 	dp = devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL);
+ 	if (!dp) {
+ 		typec_unregister_altmode(alt);
++		mutex_unlock(&con->lock);
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+@@ -311,5 +319,7 @@ struct typec_altmode *ucsi_register_displayport(struct ucsi_connector *con,
+ 	alt->ops = &ucsi_displayport_ops;
+ 	typec_altmode_set_drvdata(alt, dp);
+ 
++	mutex_unlock(&con->lock);
++
+ 	return alt;
+ }
+diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
+index d239fc3c5e3d..eb5151fc8efa 100644
+--- a/drivers/xen/xenbus/xenbus_comms.c
++++ b/drivers/xen/xenbus/xenbus_comms.c
+@@ -313,6 +313,8 @@ static int process_msg(void)
+ 			req->msg.type = state.msg.type;
+ 			req->msg.len = state.msg.len;
+ 			req->body = state.body;
++			/* write body, then update state */
++			virt_wmb();
+ 			req->state = xb_req_state_got_reply;
+ 			req->cb(req);
+ 		} else
+@@ -395,6 +397,8 @@ static int process_writes(void)
+ 	if (state.req->state == xb_req_state_aborted)
+ 		kfree(state.req);
+ 	else {
++		/* write err, then update state */
++		virt_wmb();
+ 		state.req->state = xb_req_state_got_reply;
+ 		wake_up(&state.req->wq);
+ 	}
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index ddc18da61834..3a06eb699f33 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -191,8 +191,11 @@ static bool xenbus_ok(void)
+ 
+ static bool test_reply(struct xb_req_data *req)
+ {
+-	if (req->state == xb_req_state_got_reply || !xenbus_ok())
++	if (req->state == xb_req_state_got_reply || !xenbus_ok()) {
++		/* read req->state before all other fields */
++		virt_rmb();
+ 		return true;
++	}
+ 
+ 	/* Make sure to reread req->state each time. */
+ 	barrier();
+@@ -202,7 +205,7 @@ static bool test_reply(struct xb_req_data *req)
+ 
+ static void *read_reply(struct xb_req_data *req)
+ {
+-	while (req->state != xb_req_state_got_reply) {
++	do {
+ 		wait_event(req->wq, test_reply(req));
+ 
+ 		if (!xenbus_ok())
+@@ -216,7 +219,7 @@ static void *read_reply(struct xb_req_data *req)
+ 		if (req->err)
+ 			return ERR_PTR(req->err);
+ 
+-	}
++	} while (req->state != xb_req_state_got_reply);
+ 
+ 	return req->body;
+ }
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index 6934a5b8708f..acf0b7d879bc 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -849,9 +849,9 @@ static void clear_incompat_bg_bits(struct btrfs_fs_info *fs_info, u64 flags)
+ 				found_raid1c34 = true;
+ 			up_read(&sinfo->groups_sem);
+ 		}
+-		if (found_raid56)
++		if (!found_raid56)
+ 			btrfs_clear_fs_incompat(fs_info, RAID56);
+-		if (found_raid1c34)
++		if (!found_raid1c34)
+ 			btrfs_clear_fs_incompat(fs_info, RAID1C34);
+ 	}
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index e47708a9bf8b..721effb468e8 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -10159,6 +10159,10 @@ out_fail:
+ 		ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root, &ctx);
+ 		if (ret)
+ 			commit_transaction = true;
++	} else if (sync_log) {
++		mutex_lock(&root->log_mutex);
++		list_del(&ctx.list);
++		mutex_unlock(&root->log_mutex);
+ 	}
+ 	if (commit_transaction) {
+ 		ret = btrfs_commit_transaction(trans);
+diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
+index 606f26d862dc..cc3ada12848d 100644
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -324,6 +324,8 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ 	if (full_path == NULL)
+ 		goto cdda_exit;
+ 
++	convert_delimiter(full_path, '\\');
++
+ 	cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path);
+ 
+ 	if (!cifs_sb_master_tlink(cifs_sb)) {
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 92b9c8221f07..7659286954d3 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -530,6 +530,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
+ 
+ 	if (tcon->seal)
+ 		seq_puts(s, ",seal");
++	else if (tcon->ses->server->ignore_signature)
++		seq_puts(s, ",signloosely");
+ 	if (tcon->nocase)
+ 		seq_puts(s, ",nocase");
+ 	if (tcon->local_lease)
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 5b1460486535..dc195435519b 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1175,7 +1175,8 @@ try_again:
+ 	rc = posix_lock_file(file, flock, NULL);
+ 	up_write(&cinode->lock_sem);
+ 	if (rc == FILE_LOCK_DEFERRED) {
+-		rc = wait_event_interruptible(flock->fl_wait, !flock->fl_blocker);
++		rc = wait_event_interruptible(flock->fl_wait,
++					list_empty(&flock->fl_blocked_member));
+ 		if (!rc)
+ 			goto try_again;
+ 		locks_delete_block(flock);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 5b62840853ff..05a73af0e8c8 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3315,7 +3315,7 @@ static int smb3_fiemap(struct cifs_tcon *tcon,
+ 	if (rc)
+ 		goto out;
+ 
+-	if (out_data_len < sizeof(struct file_allocated_range_buffer)) {
++	if (out_data_len && out_data_len < sizeof(struct file_allocated_range_buffer)) {
+ 		rc = -EINVAL;
+ 		goto out;
+ 	}
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 67a395039268..deebb47b6333 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1860,9 +1860,9 @@ fetch_events:
+ 		waiter = true;
+ 		init_waitqueue_entry(&wait, current);
+ 
+-		spin_lock_irq(&ep->wq.lock);
++		write_lock_irq(&ep->lock);
+ 		__add_wait_queue_exclusive(&ep->wq, &wait);
+-		spin_unlock_irq(&ep->wq.lock);
++		write_unlock_irq(&ep->lock);
+ 	}
+ 
+ 	for (;;) {
+@@ -1910,9 +1910,9 @@ send_events:
+ 		goto fetch_events;
+ 
+ 	if (waiter) {
+-		spin_lock_irq(&ep->wq.lock);
++		write_lock_irq(&ep->lock);
+ 		__remove_wait_queue(&ep->wq, &wait);
+-		spin_unlock_irq(&ep->wq.lock);
++		write_unlock_irq(&ep->lock);
+ 	}
+ 
+ 	return res;
+diff --git a/fs/inode.c b/fs/inode.c
+index 96d62d97694e..c5267a4db0f5 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -137,6 +137,7 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
+ 	inode->i_sb = sb;
+ 	inode->i_blkbits = sb->s_blocksize_bits;
+ 	inode->i_flags = 0;
++	atomic64_set(&inode->i_sequence, 0);
+ 	atomic_set(&inode->i_count, 1);
+ 	inode->i_op = &empty_iops;
+ 	inode->i_fop = &no_open_fops;
+diff --git a/fs/io-wq.c b/fs/io-wq.c
+index 25ffb6685bae..1f46fe663b28 100644
+--- a/fs/io-wq.c
++++ b/fs/io-wq.c
+@@ -733,6 +733,17 @@ static bool io_wq_can_queue(struct io_wqe *wqe, struct io_wqe_acct *acct,
+ 	return true;
+ }
+ 
++static void io_run_cancel(struct io_wq_work *work)
++{
++	do {
++		struct io_wq_work *old_work = work;
++
++		work->flags |= IO_WQ_WORK_CANCEL;
++		work->func(&work);
++		work = (work == old_work) ? NULL : work;
++	} while (work);
++}
++
+ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
+ {
+ 	struct io_wqe_acct *acct = io_work_get_acct(wqe, work);
+@@ -745,8 +756,7 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
+ 	 * It's close enough to not be an issue, fork() has the same delay.
+ 	 */
+ 	if (unlikely(!io_wq_can_queue(wqe, acct, work))) {
+-		work->flags |= IO_WQ_WORK_CANCEL;
+-		work->func(&work);
++		io_run_cancel(work);
+ 		return;
+ 	}
+ 
+@@ -882,8 +892,7 @@ static enum io_wq_cancel io_wqe_cancel_cb_work(struct io_wqe *wqe,
+ 	spin_unlock_irqrestore(&wqe->lock, flags);
+ 
+ 	if (found) {
+-		work->flags |= IO_WQ_WORK_CANCEL;
+-		work->func(&work);
++		io_run_cancel(work);
+ 		return IO_WQ_CANCEL_OK;
+ 	}
+ 
+@@ -957,8 +966,7 @@ static enum io_wq_cancel io_wqe_cancel_work(struct io_wqe *wqe,
+ 	spin_unlock_irqrestore(&wqe->lock, flags);
+ 
+ 	if (found) {
+-		work->flags |= IO_WQ_WORK_CANCEL;
+-		work->func(&work);
++		io_run_cancel(work);
+ 		return IO_WQ_CANCEL_OK;
+ 	}
+ 
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 2547c6395d5e..faa0198c99ff 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -688,6 +688,7 @@ static void io_kill_timeout(struct io_kiocb *req)
+ 	if (ret != -1) {
+ 		atomic_inc(&req->ctx->cq_timeouts);
+ 		list_del_init(&req->list);
++		req->flags |= REQ_F_COMP_LOCKED;
+ 		io_cqring_fill_event(req, 0);
+ 		io_put_req(req);
+ 	}
+@@ -3097,6 +3098,9 @@ static int io_req_defer_prep(struct io_kiocb *req,
+ {
+ 	ssize_t ret = 0;
+ 
++	if (!sqe)
++		return 0;
++
+ 	switch (req->opcode) {
+ 	case IORING_OP_NOP:
+ 		break;
+@@ -3680,6 +3684,11 @@ err_req:
+ 			req->flags |= REQ_F_HARDLINK;
+ 
+ 		INIT_LIST_HEAD(&req->link_list);
++
++		if (io_alloc_async_ctx(req)) {
++			ret = -EAGAIN;
++			goto err_req;
++		}
+ 		ret = io_req_defer_prep(req, sqe);
+ 		if (ret)
+ 			req->flags |= REQ_F_FAIL_LINK;
+diff --git a/fs/locks.c b/fs/locks.c
+index 44b6da032842..b8a31c1c4fff 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -725,7 +725,6 @@ static void __locks_delete_block(struct file_lock *waiter)
+ {
+ 	locks_delete_global_blocked(waiter);
+ 	list_del_init(&waiter->fl_blocked_member);
+-	waiter->fl_blocker = NULL;
+ }
+ 
+ static void __locks_wake_up_blocks(struct file_lock *blocker)
+@@ -740,6 +739,13 @@ static void __locks_wake_up_blocks(struct file_lock *blocker)
+ 			waiter->fl_lmops->lm_notify(waiter);
+ 		else
+ 			wake_up(&waiter->fl_wait);
++
++		/*
++		 * The setting of fl_blocker to NULL marks the "done"
++		 * point in deleting a block. Paired with acquire at the top
++		 * of locks_delete_block().
++		 */
++		smp_store_release(&waiter->fl_blocker, NULL);
+ 	}
+ }
+ 
+@@ -754,24 +760,41 @@ int locks_delete_block(struct file_lock *waiter)
+ 	int status = -ENOENT;
+ 
+ 	/*
+-	 * If fl_blocker is NULL, it won't be set again as this thread
+-	 * "owns" the lock and is the only one that might try to claim
+-	 * the lock.  So it is safe to test fl_blocker locklessly.
+-	 * Also if fl_blocker is NULL, this waiter is not listed on
+-	 * fl_blocked_requests for some lock, so no other request can
+-	 * be added to the list of fl_blocked_requests for this
+-	 * request.  So if fl_blocker is NULL, it is safe to
+-	 * locklessly check if fl_blocked_requests is empty.  If both
+-	 * of these checks succeed, there is no need to take the lock.
++	 * If fl_blocker is NULL, it won't be set again as this thread "owns"
++	 * the lock and is the only one that might try to claim the lock.
++	 *
++	 * We use acquire/release to manage fl_blocker so that we can
++	 * optimize away taking the blocked_lock_lock in many cases.
++	 *
++	 * The smp_load_acquire guarantees two things:
++	 *
++	 * 1/ that fl_blocked_requests can be tested locklessly. If something
++	 * was recently added to that list it must have been in a locked region
++	 * *before* the locked region when fl_blocker was set to NULL.
++	 *
++	 * 2/ that no other thread is accessing 'waiter', so it is safe to free
++	 * it.  __locks_wake_up_blocks is careful not to touch waiter after
++	 * fl_blocker is released.
++	 *
++	 * If a lockless check of fl_blocker shows it to be NULL, we know that
++	 * no new locks can be inserted into its fl_blocked_requests list, and
++	 * can avoid doing anything further if the list is empty.
+ 	 */
+-	if (waiter->fl_blocker == NULL &&
++	if (!smp_load_acquire(&waiter->fl_blocker) &&
+ 	    list_empty(&waiter->fl_blocked_requests))
+ 		return status;
++
+ 	spin_lock(&blocked_lock_lock);
+ 	if (waiter->fl_blocker)
+ 		status = 0;
+ 	__locks_wake_up_blocks(waiter);
+ 	__locks_delete_block(waiter);
++
++	/*
++	 * The setting of fl_blocker to NULL marks the "done" point in deleting
++	 * a block. Paired with acquire at the top of this function.
++	 */
++	smp_store_release(&waiter->fl_blocker, NULL);
+ 	spin_unlock(&blocked_lock_lock);
+ 	return status;
+ }
+@@ -1364,7 +1387,8 @@ static int posix_lock_inode_wait(struct inode *inode, struct file_lock *fl)
+ 		error = posix_lock_inode(inode, fl, NULL);
+ 		if (error != FILE_LOCK_DEFERRED)
+ 			break;
+-		error = wait_event_interruptible(fl->fl_wait, !fl->fl_blocker);
++		error = wait_event_interruptible(fl->fl_wait,
++					list_empty(&fl->fl_blocked_member));
+ 		if (error)
+ 			break;
+ 	}
+@@ -1449,7 +1473,8 @@ int locks_mandatory_area(struct inode *inode, struct file *filp, loff_t start,
+ 		error = posix_lock_inode(inode, &fl, NULL);
+ 		if (error != FILE_LOCK_DEFERRED)
+ 			break;
+-		error = wait_event_interruptible(fl.fl_wait, !fl.fl_blocker);
++		error = wait_event_interruptible(fl.fl_wait,
++					list_empty(&fl.fl_blocked_member));
+ 		if (!error) {
+ 			/*
+ 			 * If we've been sleeping someone might have
+@@ -1652,7 +1677,8 @@ restart:
+ 
+ 	locks_dispose_list(&dispose);
+ 	error = wait_event_interruptible_timeout(new_fl->fl_wait,
+-						!new_fl->fl_blocker, break_time);
++					list_empty(&new_fl->fl_blocked_member),
++					break_time);
+ 
+ 	percpu_down_read(&file_rwsem);
+ 	spin_lock(&ctx->flc_lock);
+@@ -2136,7 +2162,8 @@ static int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl)
+ 		error = flock_lock_inode(inode, fl);
+ 		if (error != FILE_LOCK_DEFERRED)
+ 			break;
+-		error = wait_event_interruptible(fl->fl_wait, !fl->fl_blocker);
++		error = wait_event_interruptible(fl->fl_wait,
++				list_empty(&fl->fl_blocked_member));
+ 		if (error)
+ 			break;
+ 	}
+@@ -2413,7 +2440,8 @@ static int do_lock_file_wait(struct file *filp, unsigned int cmd,
+ 		error = vfs_lock_file(filp, cmd, fl, NULL);
+ 		if (error != FILE_LOCK_DEFERRED)
+ 			break;
+-		error = wait_event_interruptible(fl->fl_wait, !fl->fl_blocker);
++		error = wait_event_interruptible(fl->fl_wait,
++					list_empty(&fl->fl_blocked_member));
+ 		if (error)
+ 			break;
+ 	}
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 98e0349adb52..59e8fe62afe6 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -698,6 +698,7 @@ struct inode {
+ 		struct rcu_head		i_rcu;
+ 	};
+ 	atomic64_t		i_version;
++	atomic64_t		i_sequence; /* see futex */
+ 	atomic_t		i_count;
+ 	atomic_t		i_dio_count;
+ 	atomic_t		i_writecount;
+diff --git a/include/linux/futex.h b/include/linux/futex.h
+index 5cc3fed27d4c..b70df27d7e85 100644
+--- a/include/linux/futex.h
++++ b/include/linux/futex.h
+@@ -31,23 +31,26 @@ struct task_struct;
+ 
+ union futex_key {
+ 	struct {
++		u64 i_seq;
+ 		unsigned long pgoff;
+-		struct inode *inode;
+-		int offset;
++		unsigned int offset;
+ 	} shared;
+ 	struct {
++		union {
++			struct mm_struct *mm;
++			u64 __tmp;
++		};
+ 		unsigned long address;
+-		struct mm_struct *mm;
+-		int offset;
++		unsigned int offset;
+ 	} private;
+ 	struct {
++		u64 ptr;
+ 		unsigned long word;
+-		void *ptr;
+-		int offset;
++		unsigned int offset;
+ 	} both;
+ };
+ 
+-#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } }
++#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }
+ 
+ #ifdef CONFIG_FUTEX
+ enum {
+diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
+index 1bf83c8fcaa7..77de28bfefb0 100644
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -311,7 +311,7 @@ static inline int TestClearPage##uname(struct page *page) { return 0; }
+ 
+ __PAGEFLAG(Locked, locked, PF_NO_TAIL)
+ PAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) __CLEARPAGEFLAG(Waiters, waiters, PF_ONLY_HEAD)
+-PAGEFLAG(Error, error, PF_NO_COMPOUND) TESTCLEARFLAG(Error, error, PF_NO_COMPOUND)
++PAGEFLAG(Error, error, PF_NO_TAIL) TESTCLEARFLAG(Error, error, PF_NO_TAIL)
+ PAGEFLAG(Referenced, referenced, PF_HEAD)
+ 	TESTCLEARFLAG(Referenced, referenced, PF_HEAD)
+ 	__SETPAGEFLAG(Referenced, referenced, PF_HEAD)
+diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
+index a4b241102771..0e7cd3aa489b 100644
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -139,8 +139,9 @@ extern int remap_vmalloc_range_partial(struct vm_area_struct *vma,
+ 
+ extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ 							unsigned long pgoff);
+-void vmalloc_sync_all(void);
+- 
++void vmalloc_sync_mappings(void);
++void vmalloc_sync_unmappings(void);
++
+ /*
+  *	Lowlevel-APIs (not for driver use!)
+  */
+diff --git a/init/Kconfig b/init/Kconfig
+index 47d40f399000..74297c392dd4 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -767,8 +767,7 @@ config ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
+ 	bool
+ 
+ config CC_HAS_INT128
+-	def_bool y
+-	depends on !$(cc-option,-D__SIZEOF_INT128__=0)
++	def_bool !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0) && 64BIT
+ 
+ #
+ # For architectures that know their GCC __int128 support is sound
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 0cf84c8664f2..82dfacb3250e 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -385,9 +385,9 @@ static inline int hb_waiters_pending(struct futex_hash_bucket *hb)
+  */
+ static struct futex_hash_bucket *hash_futex(union futex_key *key)
+ {
+-	u32 hash = jhash2((u32*)&key->both.word,
+-			  (sizeof(key->both.word)+sizeof(key->both.ptr))/4,
++	u32 hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / 4,
+ 			  key->both.offset);
++
+ 	return &futex_queues[hash & (futex_hashsize - 1)];
+ }
+ 
+@@ -429,7 +429,7 @@ static void get_futex_key_refs(union futex_key *key)
+ 
+ 	switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
+ 	case FUT_OFF_INODE:
+-		ihold(key->shared.inode); /* implies smp_mb(); (B) */
++		smp_mb();		/* explicit smp_mb(); (B) */
+ 		break;
+ 	case FUT_OFF_MMSHARED:
+ 		futex_get_mm(key); /* implies smp_mb(); (B) */
+@@ -463,7 +463,6 @@ static void drop_futex_key_refs(union futex_key *key)
+ 
+ 	switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
+ 	case FUT_OFF_INODE:
+-		iput(key->shared.inode);
+ 		break;
+ 	case FUT_OFF_MMSHARED:
+ 		mmdrop(key->private.mm);
+@@ -505,6 +504,46 @@ futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
+ 	return timeout;
+ }
+ 
++/*
++ * Generate a machine wide unique identifier for this inode.
++ *
++ * This relies on u64 not wrapping in the life-time of the machine; which with
++ * 1ns resolution means almost 585 years.
++ *
++ * This further relies on the fact that a well formed program will not unmap
++ * the file while it has a (shared) futex waiting on it. This mapping will have
++ * a file reference which pins the mount and inode.
++ *
++ * If for some reason an inode gets evicted and read back in again, it will get
++ * a new sequence number and will _NOT_ match, even though it is the exact same
++ * file.
++ *
++ * It is important that match_futex() will never have a false-positive, esp.
++ * for PI futexes that can mess up the state. The above argues that false-negatives
++ * are only possible for malformed programs.
++ */
++static u64 get_inode_sequence_number(struct inode *inode)
++{
++	static atomic64_t i_seq;
++	u64 old;
++
++	/* Does the inode already have a sequence number? */
++	old = atomic64_read(&inode->i_sequence);
++	if (likely(old))
++		return old;
++
++	for (;;) {
++		u64 new = atomic64_add_return(1, &i_seq);
++		if (WARN_ON_ONCE(!new))
++			continue;
++
++		old = atomic64_cmpxchg_relaxed(&inode->i_sequence, 0, new);
++		if (old)
++			return old;
++		return new;
++	}
++}
++
+ /**
+  * get_futex_key() - Get parameters which are the keys for a futex
+  * @uaddr:	virtual address of the futex
+@@ -517,9 +556,15 @@ futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
+  *
+  * The key words are stored in @key on success.
+  *
+- * For shared mappings, it's (page->index, file_inode(vma->vm_file),
+- * offset_within_page).  For private mappings, it's (uaddr, current->mm).
+- * We can usually work out the index without swapping in the page.
++ * For shared mappings (when @fshared), the key is:
++ *   ( inode->i_sequence, page->index, offset_within_page )
++ * [ also see get_inode_sequence_number() ]
++ *
++ * For private mappings (or when !@fshared), the key is:
++ *   ( current->mm, address, 0 )
++ *
++ * This allows (cross process, where applicable) identification of the futex
++ * without keeping the page pinned for the duration of the FUTEX_WAIT.
+  *
+  * lock_page() might sleep, the caller should not hold a spinlock.
+  */
+@@ -659,8 +704,6 @@ again:
+ 		key->private.mm = mm;
+ 		key->private.address = address;
+ 
+-		get_futex_key_refs(key); /* implies smp_mb(); (B) */
+-
+ 	} else {
+ 		struct inode *inode;
+ 
+@@ -692,40 +735,14 @@ again:
+ 			goto again;
+ 		}
+ 
+-		/*
+-		 * Take a reference unless it is about to be freed. Previously
+-		 * this reference was taken by ihold under the page lock
+-		 * pinning the inode in place so i_lock was unnecessary. The
+-		 * only way for this check to fail is if the inode was
+-		 * truncated in parallel which is almost certainly an
+-		 * application bug. In such a case, just retry.
+-		 *
+-		 * We are not calling into get_futex_key_refs() in file-backed
+-		 * cases, therefore a successful atomic_inc return below will
+-		 * guarantee that get_futex_key() will still imply smp_mb(); (B).
+-		 */
+-		if (!atomic_inc_not_zero(&inode->i_count)) {
+-			rcu_read_unlock();
+-			put_page(page);
+-
+-			goto again;
+-		}
+-
+-		/* Should be impossible but lets be paranoid for now */
+-		if (WARN_ON_ONCE(inode->i_mapping != mapping)) {
+-			err = -EFAULT;
+-			rcu_read_unlock();
+-			iput(inode);
+-
+-			goto out;
+-		}
+-
+ 		key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+-		key->shared.inode = inode;
++		key->shared.i_seq = get_inode_sequence_number(inode);
+ 		key->shared.pgoff = basepage_index(tail);
+ 		rcu_read_unlock();
+ 	}
+ 
++	get_futex_key_refs(key); /* implies smp_mb(); (B) */
++
+ out:
+ 	put_page(page);
+ 	return err;
+diff --git a/kernel/notifier.c b/kernel/notifier.c
+index 63d7501ac638..5989bbb93039 100644
+--- a/kernel/notifier.c
++++ b/kernel/notifier.c
+@@ -519,7 +519,7 @@ NOKPROBE_SYMBOL(notify_die);
+ 
+ int register_die_notifier(struct notifier_block *nb)
+ {
+-	vmalloc_sync_all();
++	vmalloc_sync_mappings();
+ 	return atomic_notifier_chain_register(&die_chain, nb);
+ }
+ EXPORT_SYMBOL_GPL(register_die_notifier);
+diff --git a/mm/madvise.c b/mm/madvise.c
+index bcdb6a042787..1f5dd506778b 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
+ 		}
+ 
+ 		page = pmd_page(orig_pmd);
++
++		/* Do not interfere with other mappings of this page */
++		if (page_mapcount(page) != 1)
++			goto huge_unlock;
++
+ 		if (next - addr != HPAGE_PMD_SIZE) {
+ 			int err;
+ 
+-			if (page_mapcount(page) != 1)
+-				goto huge_unlock;
+-
+ 			get_page(page);
+ 			spin_unlock(ptl);
+ 			lock_page(page);
+@@ -426,6 +428,10 @@ regular_page:
+ 			continue;
+ 		}
+ 
++		/* Do not interfere with other mappings of this page */
++		if (page_mapcount(page) != 1)
++			continue;
++
+ 		VM_BUG_ON_PAGE(PageTransCompound(page), page);
+ 
+ 		if (pte_young(ptent)) {
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index ea1bcd21fefd..c051ca158b1e 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2297,28 +2297,41 @@ static void high_work_func(struct work_struct *work)
+  #define MEMCG_DELAY_SCALING_SHIFT 14
+ 
+ /*
+- * Scheduled by try_charge() to be executed from the userland return path
+- * and reclaims memory over the high limit.
++ * Get the number of jiffies that we should penalise a mischievous cgroup which
++ * is exceeding its memory.high by checking both it and its ancestors.
+  */
+-void mem_cgroup_handle_over_high(void)
++static unsigned long calculate_high_delay(struct mem_cgroup *memcg,
++					  unsigned int nr_pages)
+ {
+-	unsigned long usage, high, clamped_high;
+-	unsigned long pflags;
+-	unsigned long penalty_jiffies, overage;
+-	unsigned int nr_pages = current->memcg_nr_pages_over_high;
+-	struct mem_cgroup *memcg;
++	unsigned long penalty_jiffies;
++	u64 max_overage = 0;
+ 
+-	if (likely(!nr_pages))
+-		return;
++	do {
++		unsigned long usage, high;
++		u64 overage;
+ 
+-	memcg = get_mem_cgroup_from_mm(current->mm);
+-	reclaim_high(memcg, nr_pages, GFP_KERNEL);
+-	current->memcg_nr_pages_over_high = 0;
++		usage = page_counter_read(&memcg->memory);
++		high = READ_ONCE(memcg->high);
++
++		/*
++		 * Prevent division by 0 in overage calculation by acting as if
++		 * it was a threshold of 1 page
++		 */
++		high = max(high, 1UL);
++
++		overage = usage - high;
++		overage <<= MEMCG_DELAY_PRECISION_SHIFT;
++		overage = div64_u64(overage, high);
++
++		if (overage > max_overage)
++			max_overage = overage;
++	} while ((memcg = parent_mem_cgroup(memcg)) &&
++		 !mem_cgroup_is_root(memcg));
++
++	if (!max_overage)
++		return 0;
+ 
+ 	/*
+-	 * memory.high is breached and reclaim is unable to keep up. Throttle
+-	 * allocators proactively to slow down excessive growth.
+-	 *
+ 	 * We use overage compared to memory.high to calculate the number of
+ 	 * jiffies to sleep (penalty_jiffies). Ideally this value should be
+ 	 * fairly lenient on small overages, and increasingly harsh when the
+@@ -2326,24 +2339,9 @@ void mem_cgroup_handle_over_high(void)
+ 	 * its crazy behaviour, so we exponentially increase the delay based on
+ 	 * overage amount.
+ 	 */
+-
+-	usage = page_counter_read(&memcg->memory);
+-	high = READ_ONCE(memcg->high);
+-
+-	if (usage <= high)
+-		goto out;
+-
+-	/*
+-	 * Prevent division by 0 in overage calculation by acting as if it was a
+-	 * threshold of 1 page
+-	 */
+-	clamped_high = max(high, 1UL);
+-
+-	overage = div_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT,
+-			  clamped_high);
+-
+-	penalty_jiffies = ((u64)overage * overage * HZ)
+-		>> (MEMCG_DELAY_PRECISION_SHIFT + MEMCG_DELAY_SCALING_SHIFT);
++	penalty_jiffies = max_overage * max_overage * HZ;
++	penalty_jiffies >>= MEMCG_DELAY_PRECISION_SHIFT;
++	penalty_jiffies >>= MEMCG_DELAY_SCALING_SHIFT;
+ 
+ 	/*
+ 	 * Factor in the task's own contribution to the overage, such that four
+@@ -2360,7 +2358,32 @@ void mem_cgroup_handle_over_high(void)
+ 	 * application moving forwards and also permit diagnostics, albeit
+ 	 * extremely slowly.
+ 	 */
+-	penalty_jiffies = min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES);
++	return min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES);
++}
++
++/*
++ * Scheduled by try_charge() to be executed from the userland return path
++ * and reclaims memory over the high limit.
++ */
++void mem_cgroup_handle_over_high(void)
++{
++	unsigned long penalty_jiffies;
++	unsigned long pflags;
++	unsigned int nr_pages = current->memcg_nr_pages_over_high;
++	struct mem_cgroup *memcg;
++
++	if (likely(!nr_pages))
++		return;
++
++	memcg = get_mem_cgroup_from_mm(current->mm);
++	reclaim_high(memcg, nr_pages, GFP_KERNEL);
++	current->memcg_nr_pages_over_high = 0;
++
++	/*
++	 * memory.high is breached and reclaim is unable to keep up. Throttle
++	 * allocators proactively to slow down excessive growth.
++	 */
++	penalty_jiffies = calculate_high_delay(memcg, nr_pages);
+ 
+ 	/*
+ 	 * Don't sleep if the amount of jiffies this memcg owes us is so low
+@@ -4027,7 +4050,7 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
+ 	struct mem_cgroup_thresholds *thresholds;
+ 	struct mem_cgroup_threshold_ary *new;
+ 	unsigned long usage;
+-	int i, j, size;
++	int i, j, size, entries;
+ 
+ 	mutex_lock(&memcg->thresholds_lock);
+ 
+@@ -4047,14 +4070,20 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
+ 	__mem_cgroup_threshold(memcg, type == _MEMSWAP);
+ 
+ 	/* Calculate new number of threshold */
+-	size = 0;
++	size = entries = 0;
+ 	for (i = 0; i < thresholds->primary->size; i++) {
+ 		if (thresholds->primary->entries[i].eventfd != eventfd)
+ 			size++;
++		else
++			entries++;
+ 	}
+ 
+ 	new = thresholds->spare;
+ 
++	/* If no items related to eventfd have been cleared, nothing to do */
++	if (!entries)
++		goto unlock;
++
+ 	/* Set thresholds array to NULL if we don't have thresholds */
+ 	if (!size) {
+ 		kfree(new);
+diff --git a/mm/nommu.c b/mm/nommu.c
+index bd2b4e5ef144..318df4e236c9 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -370,10 +370,14 @@ void vm_unmap_aliases(void)
+ EXPORT_SYMBOL_GPL(vm_unmap_aliases);
+ 
+ /*
+- * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+- * have one.
++ * Implement a stub for vmalloc_sync_[un]mapping() if the architecture
++ * chose not to have one.
+  */
+-void __weak vmalloc_sync_all(void)
++void __weak vmalloc_sync_mappings(void)
++{
++}
++
++void __weak vmalloc_sync_unmappings(void)
+ {
+ }
+ 
+diff --git a/mm/slub.c b/mm/slub.c
+index 0cb8a21b1be6..95534ccefdc2 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1954,8 +1954,6 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
+ 
+ 	if (node == NUMA_NO_NODE)
+ 		searchnode = numa_mem_id();
+-	else if (!node_present_pages(node))
+-		searchnode = node_to_mem_node(node);
+ 
+ 	object = get_partial_node(s, get_node(s, searchnode), c, flags);
+ 	if (object || node != NUMA_NO_NODE)
+@@ -2544,17 +2542,27 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
+ 	struct page *page;
+ 
+ 	page = c->page;
+-	if (!page)
++	if (!page) {
++		/*
++		 * if the node is not online or has no normal memory, just
++		 * ignore the node constraint
++		 */
++		if (unlikely(node != NUMA_NO_NODE &&
++			     !node_state(node, N_NORMAL_MEMORY)))
++			node = NUMA_NO_NODE;
+ 		goto new_slab;
++	}
+ redo:
+ 
+ 	if (unlikely(!node_match(page, node))) {
+-		int searchnode = node;
+-
+-		if (node != NUMA_NO_NODE && !node_present_pages(node))
+-			searchnode = node_to_mem_node(node);
+-
+-		if (unlikely(!node_match(page, searchnode))) {
++		/*
++		 * same as above but node_match() being false already
++		 * implies node != NUMA_NO_NODE
++		 */
++		if (!node_state(node, N_NORMAL_MEMORY)) {
++			node = NUMA_NO_NODE;
++			goto redo;
++		} else {
+ 			stat(s, ALLOC_NODE_MISMATCH);
+ 			deactivate_slab(s, page, c->freelist, c);
+ 			goto new_slab;
+@@ -2978,11 +2986,13 @@ redo:
+ 	barrier();
+ 
+ 	if (likely(page == c->page)) {
+-		set_freepointer(s, tail_obj, c->freelist);
++		void **freelist = READ_ONCE(c->freelist);
++
++		set_freepointer(s, tail_obj, freelist);
+ 
+ 		if (unlikely(!this_cpu_cmpxchg_double(
+ 				s->cpu_slab->freelist, s->cpu_slab->tid,
+-				c->freelist, tid,
++				freelist, tid,
+ 				head, next_tid(tid)))) {
+ 
+ 			note_cmpxchg_failure("slab_free", s, tid);
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 29d92e7f55c4..3c24708a4dc6 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -744,6 +744,7 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages,
+ 	struct mem_section *ms = __pfn_to_section(pfn);
+ 	bool section_is_early = early_section(ms);
+ 	struct page *memmap = NULL;
++	bool empty;
+ 	unsigned long *subsection_map = ms->usage
+ 		? &ms->usage->subsection_map[0] : NULL;
+ 
+@@ -774,7 +775,8 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages,
+ 	 * For 2/ and 3/ the SPARSEMEM_VMEMMAP={y,n} cases are unified
+ 	 */
+ 	bitmap_xor(subsection_map, map, subsection_map, SUBSECTIONS_PER_SECTION);
+-	if (bitmap_empty(subsection_map, SUBSECTIONS_PER_SECTION)) {
++	empty = bitmap_empty(subsection_map, SUBSECTIONS_PER_SECTION);
++	if (empty) {
+ 		unsigned long section_nr = pfn_to_section_nr(pfn);
+ 
+ 		/*
+@@ -789,13 +791,15 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages,
+ 			ms->usage = NULL;
+ 		}
+ 		memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr);
+-		ms->section_mem_map = (unsigned long)NULL;
+ 	}
+ 
+ 	if (section_is_early && memmap)
+ 		free_map_bootmem(memmap);
+ 	else
+ 		depopulate_section_memmap(pfn, nr_pages, altmap);
++
++	if (empty)
++		ms->section_mem_map = (unsigned long)NULL;
+ }
+ 
+ static struct page * __meminit section_activate(int nid, unsigned long pfn,
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index b29ad17edcf5..7b52fff1c43a 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1287,7 +1287,7 @@ static bool __purge_vmap_area_lazy(unsigned long start, unsigned long end)
+ 	 * First make sure the mappings are removed from all page-tables
+ 	 * before they are freed.
+ 	 */
+-	vmalloc_sync_all();
++	vmalloc_sync_unmappings();
+ 
+ 	/*
+ 	 * TODO: to calculate a flush range without looping.
+@@ -3120,16 +3120,19 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ EXPORT_SYMBOL(remap_vmalloc_range);
+ 
+ /*
+- * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+- * have one.
++ * Implement stubs for vmalloc_sync_[un]mappings () if the architecture chose
++ * not to have one.
+  *
+  * The purpose of this function is to make sure the vmalloc area
+  * mappings are identical in all page-tables in the system.
+  */
+-void __weak vmalloc_sync_all(void)
++void __weak vmalloc_sync_mappings(void)
+ {
+ }
+ 
++void __weak vmalloc_sync_unmappings(void)
++{
++}
+ 
+ static int f(pte_t *pte, unsigned long addr, void *data)
+ {
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index bfb44b265a94..77a69ba9cd19 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -40,3 +40,10 @@ $(error-if,$(success, $(LD) -v | grep -q gold), gold linker '$(LD)' not supporte
+ 
+ # gcc version including patch level
+ gcc-version := $(shell,$(srctree)/scripts/gcc-version.sh $(CC))
++
++# machine bit flags
++#  $(m32-flag): -m32 if the compiler supports it, or an empty string otherwise.
++#  $(m64-flag): -m64 if the compiler supports it, or an empty string otherwise.
++cc-option-bit = $(if-success,$(CC) -Werror $(1) -E -x c /dev/null -o /dev/null,$(1))
++m32-flag := $(cc-option-bit,-m32)
++m64-flag := $(cc-option-bit,-m64)
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index ecddf83ac142..ca08f2fe7c34 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -48,6 +48,7 @@ KBUILD_CFLAGS += -Wno-initializer-overrides
+ KBUILD_CFLAGS += -Wno-format
+ KBUILD_CFLAGS += -Wno-sign-compare
+ KBUILD_CFLAGS += -Wno-format-zero-length
++KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
+ endif
+ 
+ endif
+diff --git a/scripts/export_report.pl b/scripts/export_report.pl
+index 548330e8c4e7..feb3d5542a62 100755
+--- a/scripts/export_report.pl
++++ b/scripts/export_report.pl
+@@ -94,7 +94,7 @@ if (defined $opt{'o'}) {
+ #
+ while ( <$module_symvers> ) {
+ 	chomp;
+-	my (undef, $symbol, $namespace, $module, $gpl) = split('\t');
++	my (undef, $symbol, $module, $gpl, $namespace) = split('\t');
+ 	$SYMBOL { $symbol } =  [ $module , "0" , $symbol, $gpl];
+ }
+ close($module_symvers);
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 6e892c93d104..a06e9e5c1419 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -307,7 +307,8 @@ static const char *sec_name(struct elf_info *elf, int secindex)
+ 
+ static void *sym_get_data(const struct elf_info *info, const Elf_Sym *sym)
+ {
+-	Elf_Shdr *sechdr = &info->sechdrs[sym->st_shndx];
++	unsigned int secindex = get_secindex(info, sym);
++	Elf_Shdr *sechdr = &info->sechdrs[secindex];
+ 	unsigned long offset;
+ 
+ 	offset = sym->st_value;
+@@ -2433,7 +2434,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
+ }
+ 
+ /* parse Module.symvers file. line format:
+- * 0x12345678<tab>symbol<tab>module[[<tab>export]<tab>something]
++ * 0x12345678<tab>symbol<tab>module<tab>export<tab>namespace
+  **/
+ static void read_dump(const char *fname, unsigned int kernel)
+ {
+@@ -2446,7 +2447,7 @@ static void read_dump(const char *fname, unsigned int kernel)
+ 		return;
+ 
+ 	while ((line = get_next_line(&pos, file, size))) {
+-		char *symname, *namespace, *modname, *d, *export, *end;
++		char *symname, *namespace, *modname, *d, *export;
+ 		unsigned int crc;
+ 		struct module *mod;
+ 		struct symbol *s;
+@@ -2454,16 +2455,16 @@ static void read_dump(const char *fname, unsigned int kernel)
+ 		if (!(symname = strchr(line, '\t')))
+ 			goto fail;
+ 		*symname++ = '\0';
+-		if (!(namespace = strchr(symname, '\t')))
+-			goto fail;
+-		*namespace++ = '\0';
+-		if (!(modname = strchr(namespace, '\t')))
++		if (!(modname = strchr(symname, '\t')))
+ 			goto fail;
+ 		*modname++ = '\0';
+-		if ((export = strchr(modname, '\t')) != NULL)
+-			*export++ = '\0';
+-		if (export && ((end = strchr(export, '\t')) != NULL))
+-			*end = '\0';
++		if (!(export = strchr(modname, '\t')))
++			goto fail;
++		*export++ = '\0';
++		if (!(namespace = strchr(export, '\t')))
++			goto fail;
++		*namespace++ = '\0';
++
+ 		crc = strtoul(line, &d, 16);
+ 		if (*symname == '\0' || *modname == '\0' || *d != '\0')
+ 			goto fail;
+@@ -2514,9 +2515,9 @@ static void write_dump(const char *fname)
+ 				namespace = symbol->namespace;
+ 				buf_printf(&buf, "0x%08x\t%s\t%s\t%s\t%s\n",
+ 					   symbol->crc, symbol->name,
+-					   namespace ? namespace : "",
+ 					   symbol->module->name,
+-					   export_str(symbol->export));
++					   export_str(symbol->export),
++					   namespace ? namespace : "");
+ 			}
+ 			symbol = symbol->next;
+ 		}
+diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl
+old mode 100644
+new mode 100755
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 31cb2acf8afc..732bbede7ebf 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ 		while (plugin->next) {
+ 			if (plugin->dst_frames)
+ 				frames = plugin->dst_frames(plugin, frames);
+-			if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
++			if ((snd_pcm_sframes_t)frames <= 0)
+ 				return -ENXIO;
+ 			plugin = plugin->next;
+ 			err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ 		while (plugin->prev) {
+ 			if (plugin->src_frames)
+ 				frames = plugin->src_frames(plugin, frames);
+-			if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
++			if ((snd_pcm_sframes_t)frames <= 0)
+ 				return -ENXIO;
+ 			plugin = plugin->prev;
+ 			err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -209,6 +209,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ 	if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ 		plugin = snd_pcm_plug_last(plug);
+ 		while (plugin && drv_frames > 0) {
++			if (drv_frames > plugin->buf_frames)
++				drv_frames = plugin->buf_frames;
+ 			plugin_prev = plugin->prev;
+ 			if (plugin->src_frames)
+ 				drv_frames = plugin->src_frames(plugin, drv_frames);
+@@ -220,6 +222,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ 			plugin_next = plugin->next;
+ 			if (plugin->dst_frames)
+ 				drv_frames = plugin->dst_frames(plugin, drv_frames);
++			if (drv_frames > plugin->buf_frames)
++				drv_frames = plugin->buf_frames;
+ 			plugin = plugin_next;
+ 		}
+ 	} else
+@@ -248,11 +252,15 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc
+ 				if (frames < 0)
+ 					return frames;
+ 			}
++			if (frames > plugin->buf_frames)
++				frames = plugin->buf_frames;
+ 			plugin = plugin_next;
+ 		}
+ 	} else if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ 		plugin = snd_pcm_plug_last(plug);
+ 		while (plugin) {
++			if (frames > plugin->buf_frames)
++				frames = plugin->buf_frames;
+ 			plugin_prev = plugin->prev;
+ 			if (plugin->src_frames) {
+ 				frames = plugin->src_frames(plugin, frames);
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index a88c235b2ea3..2ddfe2226651 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -602,6 +602,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq
+ 		len = snd_seq_oss_timer_start(dp->timer);
+ 	if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
+ 		snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
++		snd_midi_event_reset_decode(mdev->coder);
+ 	} else {
+ 		len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
+ 		if (len > 0)
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index 626d87c1539b..77d7037d1476 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -81,6 +81,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ 			if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+ 				continue;
+ 			snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
++			snd_midi_event_reset_decode(vmidi->parser);
+ 		} else {
+ 			len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
+ 			if (len > 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 835af7d2bbd4..f44d8e258933 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8051,6 +8051,8 @@ static int patch_alc269(struct hda_codec *codec)
+ 		spec->gen.mixer_nid = 0;
+ 		break;
+ 	case 0x10ec0225:
++		codec->power_save_node = 1;
++		/* fall through */
+ 	case 0x10ec0295:
+ 	case 0x10ec0299:
+ 		spec->codec_variant = ALC269_TYPE_ALC225;
+@@ -8610,6 +8612,8 @@ enum {
+ 	ALC669_FIXUP_ACER_ASPIRE_ETHOS,
+ 	ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET,
+ 	ALC671_FIXUP_HP_HEADSET_MIC2,
++	ALC662_FIXUP_ACER_X2660G_HEADSET_MODE,
++	ALC662_FIXUP_ACER_NITRO_HEADSET_MODE,
+ };
+ 
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -8955,6 +8959,25 @@ static const struct hda_fixup alc662_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc671_fixup_hp_headset_mic2,
+ 	},
++	[ALC662_FIXUP_ACER_X2660G_HEADSET_MODE] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x1a, 0x02a1113c }, /* use as headset mic, without its own jack detect */
++			{ }
++		},
++		.chained = true,
++		.chain_id = ALC662_FIXUP_USI_FUNC
++	},
++	[ALC662_FIXUP_ACER_NITRO_HEADSET_MODE] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x1a, 0x01a11140 }, /* use as headset mic, without its own jack detect */
++			{ 0x1b, 0x0221144f },
++			{ }
++		},
++		.chained = true,
++		.chain_id = ALC662_FIXUP_USI_FUNC
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -8966,6 +8989,8 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
++	SND_PCI_QUIRK(0x1025, 0x123c, "Acer Nitro N50-600", ALC662_FIXUP_ACER_NITRO_HEADSET_MODE),
++	SND_PCI_QUIRK(0x1025, 0x124e, "Acer 2660G", ALC662_FIXUP_ACER_X2660G_HEADSET_MODE),
+ 	SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x05fe, "Dell XPS 15", ALC668_FIXUP_DELL_XPS13),
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 30bcd5d3a32a..10eb4b8e8e7e 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -1543,20 +1543,20 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = devm_snd_soc_register_component(&pdev->dev, &stm32_component,
+-					      &sai->cpu_dai_drv, 1);
++	ret = snd_dmaengine_pcm_register(&pdev->dev, conf, 0);
++	if (ret) {
++		dev_err(&pdev->dev, "Could not register pcm dma\n");
++		return ret;
++	}
++
++	ret = snd_soc_register_component(&pdev->dev, &stm32_component,
++					 &sai->cpu_dai_drv, 1);
+ 	if (ret)
+ 		return ret;
+ 
+ 	if (STM_SAI_PROTOCOL_IS_SPDIF(sai))
+ 		conf = &stm32_sai_pcm_config_spdif;
+ 
+-	ret = devm_snd_dmaengine_pcm_register(&pdev->dev, conf, 0);
+-	if (ret) {
+-		dev_err(&pdev->dev, "Could not register pcm dma\n");
+-		return ret;
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -1565,6 +1565,8 @@ static int stm32_sai_sub_remove(struct platform_device *pdev)
+ 	struct stm32_sai_sub_data *sai = dev_get_drvdata(&pdev->dev);
+ 
+ 	clk_unprepare(sai->pdata->pclk);
++	snd_dmaengine_pcm_unregister(&pdev->dev);
++	snd_soc_unregister_component(&pdev->dev);
+ 
+ 	return 0;
+ }
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index b5a3f754a4f1..4f096685ed65 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -305,7 +305,7 @@ static void line6_data_received(struct urb *urb)
+ 				line6_midibuf_read(mb, line6->buffer_message,
+ 						LINE6_MIDI_MESSAGE_MAXLEN);
+ 
+-			if (done == 0)
++			if (done <= 0)
+ 				break;
+ 
+ 			line6->message_length = done;
+diff --git a/sound/usb/line6/midibuf.c b/sound/usb/line6/midibuf.c
+index 8d6eefa0d936..6a70463f82c4 100644
+--- a/sound/usb/line6/midibuf.c
++++ b/sound/usb/line6/midibuf.c
+@@ -159,7 +159,7 @@ int line6_midibuf_read(struct midi_buffer *this, unsigned char *data,
+ 			int midi_length_prev =
+ 			    midibuf_message_length(this->command_prev);
+ 
+-			if (midi_length_prev > 0) {
++			if (midi_length_prev > 1) {
+ 				midi_length = midi_length_prev - 1;
+ 				repeat = 1;
+ 			} else