diff options
author | Mike Pagano <mpagano@gentoo.org> | 2022-09-08 06:45:14 -0400 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2022-09-08 06:45:14 -0400 |
commit | 036eac410993ee6f8ed2440ba5bf687f2733eda5 (patch) | |
tree | f0c6b541dccc6400cf1c9489b95cc153df5385df | |
parent | Linux patch 5.19.7 (diff) | |
download | linux-patches-036eac41.tar.gz linux-patches-036eac41.tar.bz2 linux-patches-036eac41.zip |
Linux patch 5.19.85.19-10
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1007_linux-5.19.8.patch | 6128 |
2 files changed, 6132 insertions, 0 deletions
diff --git a/0000_README b/0000_README index e6423950..d9225608 100644 --- a/0000_README +++ b/0000_README @@ -71,6 +71,10 @@ Patch: 1006_linux-5.19.7.patch From: http://www.kernel.org Desc: Linux 5.19.7 +Patch: 1007_linux-5.19.8.patch +From: http://www.kernel.org +Desc: Linux 5.19.8 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1007_linux-5.19.8.patch b/1007_linux-5.19.8.patch new file mode 100644 index 00000000..7bcf0c97 --- /dev/null +++ b/1007_linux-5.19.8.patch @@ -0,0 +1,6128 @@ +diff --git a/Makefile b/Makefile +index 3d88923df694e..e361c6230e9e5 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 19 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Superb Owl + +diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c +index 889951291cc0f..a11a6e14ba89f 100644 +--- a/arch/arm64/kernel/machine_kexec_file.c ++++ b/arch/arm64/kernel/machine_kexec_file.c +@@ -47,7 +47,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz) + u64 i; + phys_addr_t start, end; + +- nr_ranges = 1; /* for exclusion of crashkernel region */ ++ nr_ranges = 2; /* for exclusion of crashkernel region */ + for_each_mem_range(i, &start, &end) + nr_ranges++; + +diff --git a/arch/powerpc/include/asm/firmware.h b/arch/powerpc/include/asm/firmware.h +index 8dddd34b8ecf1..fabc82f5e935d 100644 +--- a/arch/powerpc/include/asm/firmware.h ++++ b/arch/powerpc/include/asm/firmware.h +@@ -82,6 +82,8 @@ enum { + FW_FEATURE_POWERNV_ALWAYS = 0, + FW_FEATURE_PS3_POSSIBLE = FW_FEATURE_LPAR | FW_FEATURE_PS3_LV1, + FW_FEATURE_PS3_ALWAYS = FW_FEATURE_LPAR | FW_FEATURE_PS3_LV1, ++ FW_FEATURE_NATIVE_POSSIBLE = 0, ++ FW_FEATURE_NATIVE_ALWAYS = 0, + FW_FEATURE_POSSIBLE = + #ifdef CONFIG_PPC_PSERIES + FW_FEATURE_PSERIES_POSSIBLE | +@@ -91,6 +93,9 @@ enum { + #endif + #ifdef CONFIG_PPC_PS3 + FW_FEATURE_PS3_POSSIBLE | ++#endif ++#ifdef CONFIG_PPC_HASH_MMU_NATIVE ++ FW_FEATURE_NATIVE_ALWAYS | + #endif + 0, + FW_FEATURE_ALWAYS = +@@ -102,6 +107,9 @@ enum { + #endif + #ifdef CONFIG_PPC_PS3 + FW_FEATURE_PS3_ALWAYS & ++#endif ++#ifdef CONFIG_PPC_HASH_MMU_NATIVE ++ FW_FEATURE_NATIVE_ALWAYS & + #endif + FW_FEATURE_POSSIBLE, + +diff --git a/arch/powerpc/kernel/rtas_entry.S b/arch/powerpc/kernel/rtas_entry.S +index 9a434d42e660a..6ce95ddadbcdb 100644 +--- a/arch/powerpc/kernel/rtas_entry.S ++++ b/arch/powerpc/kernel/rtas_entry.S +@@ -109,8 +109,12 @@ __enter_rtas: + * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S] + * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if + * MSR[S] is set, it will remain when entering RTAS. ++ * If we're in HV mode, RTAS must also run in HV mode, so extract MSR_HV ++ * from the saved MSR value and insert into the value RTAS will use. + */ ++ extrdi r0, r6, 1, 63 - MSR_HV_LG + LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI) ++ insrdi r6, r0, 1, 63 - MSR_HV_LG + + li r0,0 + mtmsrd r0,1 /* disable RI before using SRR0/1 */ +diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S +index cb3358886203e..6c1db3b6de2dc 100644 +--- a/arch/powerpc/kernel/systbl.S ++++ b/arch/powerpc/kernel/systbl.S +@@ -18,6 +18,7 @@ + .p2align 3 + #define __SYSCALL(nr, entry) .8byte entry + #else ++ .p2align 2 + #define __SYSCALL(nr, entry) .long entry + #endif + +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 82cae08976bcd..92074a6c49d43 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -124,9 +124,6 @@ struct papr_scm_priv { + + /* The bits which needs to be overridden */ + u64 health_bitmap_inject_mask; +- +- /* array to have event_code and stat_id mappings */ +- u8 *nvdimm_events_map; + }; + + static int papr_scm_pmem_flush(struct nd_region *nd_region, +@@ -350,6 +347,25 @@ static ssize_t drc_pmem_query_stats(struct papr_scm_priv *p, + #ifdef CONFIG_PERF_EVENTS + #define to_nvdimm_pmu(_pmu) container_of(_pmu, struct nvdimm_pmu, pmu) + ++static const char * const nvdimm_events_map[] = { ++ [1] = "CtlResCt", ++ [2] = "CtlResTm", ++ [3] = "PonSecs ", ++ [4] = "MemLife ", ++ [5] = "CritRscU", ++ [6] = "HostLCnt", ++ [7] = "HostSCnt", ++ [8] = "HostSDur", ++ [9] = "HostLDur", ++ [10] = "MedRCnt ", ++ [11] = "MedWCnt ", ++ [12] = "MedRDur ", ++ [13] = "MedWDur ", ++ [14] = "CchRHCnt", ++ [15] = "CchWHCnt", ++ [16] = "FastWCnt", ++}; ++ + static int papr_scm_pmu_get_value(struct perf_event *event, struct device *dev, u64 *count) + { + struct papr_scm_perf_stat *stat; +@@ -357,11 +373,15 @@ static int papr_scm_pmu_get_value(struct perf_event *event, struct device *dev, + struct papr_scm_priv *p = (struct papr_scm_priv *)dev->driver_data; + int rc, size; + ++ /* Invalid eventcode */ ++ if (event->attr.config == 0 || event->attr.config >= ARRAY_SIZE(nvdimm_events_map)) ++ return -EINVAL; ++ + /* Allocate request buffer enough to hold single performance stat */ + size = sizeof(struct papr_scm_perf_stats) + + sizeof(struct papr_scm_perf_stat); + +- if (!p || !p->nvdimm_events_map) ++ if (!p) + return -EINVAL; + + stats = kzalloc(size, GFP_KERNEL); +@@ -370,7 +390,7 @@ static int papr_scm_pmu_get_value(struct perf_event *event, struct device *dev, + + stat = &stats->scm_statistic[0]; + memcpy(&stat->stat_id, +- &p->nvdimm_events_map[event->attr.config * sizeof(stat->stat_id)], ++ nvdimm_events_map[event->attr.config], + sizeof(stat->stat_id)); + stat->stat_val = 0; + +@@ -458,56 +478,6 @@ static void papr_scm_pmu_del(struct perf_event *event, int flags) + papr_scm_pmu_read(event); + } + +-static int papr_scm_pmu_check_events(struct papr_scm_priv *p, struct nvdimm_pmu *nd_pmu) +-{ +- struct papr_scm_perf_stat *stat; +- struct papr_scm_perf_stats *stats; +- u32 available_events; +- int index, rc = 0; +- +- if (!p->stat_buffer_len) +- return -ENOENT; +- +- available_events = (p->stat_buffer_len - sizeof(struct papr_scm_perf_stats)) +- / sizeof(struct papr_scm_perf_stat); +- if (available_events == 0) +- return -EOPNOTSUPP; +- +- /* Allocate the buffer for phyp where stats are written */ +- stats = kzalloc(p->stat_buffer_len, GFP_KERNEL); +- if (!stats) { +- rc = -ENOMEM; +- return rc; +- } +- +- /* Called to get list of events supported */ +- rc = drc_pmem_query_stats(p, stats, 0); +- if (rc) +- goto out; +- +- /* +- * Allocate memory and populate nvdimm_event_map. +- * Allocate an extra element for NULL entry +- */ +- p->nvdimm_events_map = kcalloc(available_events + 1, +- sizeof(stat->stat_id), +- GFP_KERNEL); +- if (!p->nvdimm_events_map) { +- rc = -ENOMEM; +- goto out; +- } +- +- /* Copy all stat_ids to event map */ +- for (index = 0, stat = stats->scm_statistic; +- index < available_events; index++, ++stat) { +- memcpy(&p->nvdimm_events_map[index * sizeof(stat->stat_id)], +- &stat->stat_id, sizeof(stat->stat_id)); +- } +-out: +- kfree(stats); +- return rc; +-} +- + static void papr_scm_pmu_register(struct papr_scm_priv *p) + { + struct nvdimm_pmu *nd_pmu; +@@ -519,9 +489,10 @@ static void papr_scm_pmu_register(struct papr_scm_priv *p) + goto pmu_err_print; + } + +- rc = papr_scm_pmu_check_events(p, nd_pmu); +- if (rc) ++ if (!p->stat_buffer_len) { ++ rc = -ENOENT; + goto pmu_check_events_err; ++ } + + nd_pmu->pmu.task_ctx_nr = perf_invalid_context; + nd_pmu->pmu.name = nvdimm_name(p->nvdimm); +@@ -539,7 +510,7 @@ static void papr_scm_pmu_register(struct papr_scm_priv *p) + + rc = register_nvdimm_pmu(nd_pmu, p->pdev); + if (rc) +- goto pmu_register_err; ++ goto pmu_check_events_err; + + /* + * Set archdata.priv value to nvdimm_pmu structure, to handle the +@@ -548,8 +519,6 @@ static void papr_scm_pmu_register(struct papr_scm_priv *p) + p->pdev->archdata.priv = nd_pmu; + return; + +-pmu_register_err: +- kfree(p->nvdimm_events_map); + pmu_check_events_err: + kfree(nd_pmu); + pmu_err_print: +@@ -1560,7 +1529,6 @@ static int papr_scm_remove(struct platform_device *pdev) + unregister_nvdimm_pmu(pdev->archdata.priv); + + pdev->archdata.priv = NULL; +- kfree(p->nvdimm_events_map); + kfree(p->bus_desc.provider_name); + kfree(p); + +diff --git a/arch/riscv/include/asm/kvm_vcpu_sbi.h b/arch/riscv/include/asm/kvm_vcpu_sbi.h +index 83d6d4d2b1dff..26a446a34057b 100644 +--- a/arch/riscv/include/asm/kvm_vcpu_sbi.h ++++ b/arch/riscv/include/asm/kvm_vcpu_sbi.h +@@ -33,4 +33,16 @@ void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu, + u32 type, u64 flags); + const struct kvm_vcpu_sbi_extension *kvm_vcpu_sbi_find_ext(unsigned long extid); + ++#ifdef CONFIG_RISCV_SBI_V01 ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_v01; ++#endif ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_base; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_time; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_ipi; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_rfence; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_srst; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_hsm; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_experimental; ++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_vendor; ++ + #endif /* __RISCV_KVM_VCPU_SBI_H__ */ +diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c +index d45e7da3f0d32..f96991d230bfc 100644 +--- a/arch/riscv/kvm/vcpu_sbi.c ++++ b/arch/riscv/kvm/vcpu_sbi.c +@@ -32,23 +32,13 @@ static int kvm_linux_err_map_sbi(int err) + }; + } + +-#ifdef CONFIG_RISCV_SBI_V01 +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_v01; +-#else ++#ifndef CONFIG_RISCV_SBI_V01 + static const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_v01 = { + .extid_start = -1UL, + .extid_end = -1UL, + .handler = NULL, + }; + #endif +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_base; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_time; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_ipi; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_rfence; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_srst; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_hsm; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_experimental; +-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_vendor; + + static const struct kvm_vcpu_sbi_extension *sbi_ext[] = { + &vcpu_sbi_ext_v01, +diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c +index 5e49e4b4a4ccc..86c56616e5dea 100644 +--- a/arch/riscv/mm/pageattr.c ++++ b/arch/riscv/mm/pageattr.c +@@ -118,10 +118,10 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, + if (!numpages) + return 0; + +- mmap_read_lock(&init_mm); ++ mmap_write_lock(&init_mm); + ret = walk_page_range_novma(&init_mm, start, end, &pageattr_ops, NULL, + &masks); +- mmap_read_unlock(&init_mm); ++ mmap_write_unlock(&init_mm); + + flush_tlb_kernel_range(start, end); + +diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h +index f22beda9e6d5c..ccdbccfde148c 100644 +--- a/arch/s390/include/asm/hugetlb.h ++++ b/arch/s390/include/asm/hugetlb.h +@@ -28,9 +28,11 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, + static inline int prepare_hugepage_range(struct file *file, + unsigned long addr, unsigned long len) + { +- if (len & ~HPAGE_MASK) ++ struct hstate *h = hstate_file(file); ++ ++ if (len & ~huge_page_mask(h)) + return -EINVAL; +- if (addr & ~HPAGE_MASK) ++ if (addr & ~huge_page_mask(h)) + return -EINVAL; + return 0; + } +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 2e526f11b91e2..5ea3830af0ccf 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -131,6 +131,7 @@ SECTIONS + /* + * Table with the patch locations to undo expolines + */ ++ . = ALIGN(4); + .nospec_call_table : { + __nospec_call_start = . ; + *(.s390_indirect*) +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 0aaea87a14597..b09a50e0af29d 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -835,8 +835,7 @@ static bool msr_write_intercepted(struct vcpu_vmx *vmx, u32 msr) + if (!(exec_controls_get(vmx) & CPU_BASED_USE_MSR_BITMAPS)) + return true; + +- return vmx_test_msr_bitmap_write(vmx->loaded_vmcs->msr_bitmap, +- MSR_IA32_SPEC_CTRL); ++ return vmx_test_msr_bitmap_write(vmx->loaded_vmcs->msr_bitmap, msr); + } + + unsigned int __vmx_vcpu_run_flags(struct vcpu_vmx *vmx) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index bc411d19dac08..55de0d1981e52 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1570,12 +1570,32 @@ static const u32 msr_based_features_all[] = { + static u32 msr_based_features[ARRAY_SIZE(msr_based_features_all)]; + static unsigned int num_msr_based_features; + ++/* ++ * Some IA32_ARCH_CAPABILITIES bits have dependencies on MSRs that KVM ++ * does not yet virtualize. These include: ++ * 10 - MISC_PACKAGE_CTRLS ++ * 11 - ENERGY_FILTERING_CTL ++ * 12 - DOITM ++ * 18 - FB_CLEAR_CTRL ++ * 21 - XAPIC_DISABLE_STATUS ++ * 23 - OVERCLOCKING_STATUS ++ */ ++ ++#define KVM_SUPPORTED_ARCH_CAP \ ++ (ARCH_CAP_RDCL_NO | ARCH_CAP_IBRS_ALL | ARCH_CAP_RSBA | \ ++ ARCH_CAP_SKIP_VMENTRY_L1DFLUSH | ARCH_CAP_SSB_NO | ARCH_CAP_MDS_NO | \ ++ ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \ ++ ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \ ++ ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO) ++ + static u64 kvm_get_arch_capabilities(void) + { + u64 data = 0; + +- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) ++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) { + rdmsrl(MSR_IA32_ARCH_CAPABILITIES, data); ++ data &= KVM_SUPPORTED_ARCH_CAP; ++ } + + /* + * If nx_huge_pages is enabled, KVM's shadow paging will ensure that +@@ -1623,9 +1643,6 @@ static u64 kvm_get_arch_capabilities(void) + */ + } + +- /* Guests don't need to know "Fill buffer clear control" exists */ +- data &= ~ARCH_CAP_FB_CLEAR_CTRL; +- + return data; + } + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 54ac94fed0151..8bac11d8e618a 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -1385,6 +1385,18 @@ static int binder_inc_ref_for_node(struct binder_proc *proc, + } + ret = binder_inc_ref_olocked(ref, strong, target_list); + *rdata = ref->data; ++ if (ret && ref == new_ref) { ++ /* ++ * Cleanup the failed reference here as the target ++ * could now be dead and have already released its ++ * references by now. Calling on the new reference ++ * with strong=0 and a tmp_refs will not decrement ++ * the node. The new_ref gets kfree'd below. ++ */ ++ binder_cleanup_ref_olocked(new_ref); ++ ref = NULL; ++ } ++ + binder_proc_unlock(proc); + if (new_ref && ref != new_ref) + /* +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 5d437c0c842cb..53797453a6ee8 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -322,7 +322,6 @@ static inline void binder_alloc_set_vma(struct binder_alloc *alloc, + */ + if (vma) { + vm_start = vma->vm_start; +- alloc->vma_vm_mm = vma->vm_mm; + mmap_assert_write_locked(alloc->vma_vm_mm); + } else { + mmap_assert_locked(alloc->vma_vm_mm); +@@ -795,7 +794,6 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, + binder_insert_free_buffer(alloc, buffer); + alloc->free_async_space = alloc->buffer_size / 2; + binder_alloc_set_vma(alloc, vma); +- mmgrab(alloc->vma_vm_mm); + + return 0; + +@@ -1091,6 +1089,8 @@ static struct shrinker binder_shrinker = { + void binder_alloc_init(struct binder_alloc *alloc) + { + alloc->pid = current->group_leader->pid; ++ alloc->vma_vm_mm = current->mm; ++ mmgrab(alloc->vma_vm_mm); + mutex_init(&alloc->mutex); + INIT_LIST_HEAD(&alloc->buffers); + } +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index b766968a873ce..2ccbde111c352 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -897,6 +897,11 @@ static int __device_attach_driver(struct device_driver *drv, void *_data) + dev_dbg(dev, "Device match requests probe deferral\n"); + dev->can_match = true; + driver_deferred_probe_add(dev); ++ /* ++ * Device can't match with a driver right now, so don't attempt ++ * to match or bind with other drivers on the bus. ++ */ ++ return ret; + } else if (ret < 0) { + dev_dbg(dev, "Bus failed to match device: %d\n", ret); + return ret; +@@ -1136,6 +1141,11 @@ static int __driver_attach(struct device *dev, void *data) + dev_dbg(dev, "Device match requests probe deferral\n"); + dev->can_match = true; + driver_deferred_probe_add(dev); ++ /* ++ * Driver could not match with device, but may match with ++ * another device on the bus. ++ */ ++ return 0; + } else if (ret < 0) { + dev_dbg(dev, "Bus failed to match device: %d\n", ret); + return ret; +diff --git a/drivers/base/firmware_loader/sysfs.c b/drivers/base/firmware_loader/sysfs.c +index 5b0b85b70b6f2..28b9cbb8a6dd3 100644 +--- a/drivers/base/firmware_loader/sysfs.c ++++ b/drivers/base/firmware_loader/sysfs.c +@@ -93,10 +93,9 @@ static void fw_dev_release(struct device *dev) + { + struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); + +- if (fw_sysfs->fw_upload_priv) { +- free_fw_priv(fw_sysfs->fw_priv); +- kfree(fw_sysfs->fw_upload_priv); +- } ++ if (fw_sysfs->fw_upload_priv) ++ fw_upload_free(fw_sysfs); ++ + kfree(fw_sysfs); + } + +diff --git a/drivers/base/firmware_loader/sysfs.h b/drivers/base/firmware_loader/sysfs.h +index 5d8ff1675c794..df1d5add698f1 100644 +--- a/drivers/base/firmware_loader/sysfs.h ++++ b/drivers/base/firmware_loader/sysfs.h +@@ -106,12 +106,17 @@ extern struct device_attribute dev_attr_cancel; + extern struct device_attribute dev_attr_remaining_size; + + int fw_upload_start(struct fw_sysfs *fw_sysfs); ++void fw_upload_free(struct fw_sysfs *fw_sysfs); + umode_t fw_upload_is_visible(struct kobject *kobj, struct attribute *attr, int n); + #else + static inline int fw_upload_start(struct fw_sysfs *fw_sysfs) + { + return 0; + } ++ ++static inline void fw_upload_free(struct fw_sysfs *fw_sysfs) ++{ ++} + #endif + + #endif /* __FIRMWARE_SYSFS_H */ +diff --git a/drivers/base/firmware_loader/sysfs_upload.c b/drivers/base/firmware_loader/sysfs_upload.c +index 87044d52322aa..a0af8f5f13d88 100644 +--- a/drivers/base/firmware_loader/sysfs_upload.c ++++ b/drivers/base/firmware_loader/sysfs_upload.c +@@ -264,6 +264,15 @@ int fw_upload_start(struct fw_sysfs *fw_sysfs) + return 0; + } + ++void fw_upload_free(struct fw_sysfs *fw_sysfs) ++{ ++ struct fw_upload_priv *fw_upload_priv = fw_sysfs->fw_upload_priv; ++ ++ free_fw_priv(fw_sysfs->fw_priv); ++ kfree(fw_upload_priv->fw_upload); ++ kfree(fw_upload_priv); ++} ++ + /** + * firmware_upload_register() - register for the firmware upload sysfs API + * @module: kernel module of this device +@@ -377,6 +386,7 @@ void firmware_upload_unregister(struct fw_upload *fw_upload) + { + struct fw_sysfs *fw_sysfs = fw_upload->priv; + struct fw_upload_priv *fw_upload_priv = fw_sysfs->fw_upload_priv; ++ struct module *module = fw_upload_priv->module; + + mutex_lock(&fw_upload_priv->lock); + if (fw_upload_priv->progress == FW_UPLOAD_PROG_IDLE) { +@@ -392,6 +402,6 @@ void firmware_upload_unregister(struct fw_upload *fw_upload) + + unregister: + device_unregister(&fw_sysfs->dev); +- module_put(fw_upload_priv->module); ++ module_put(module); + } + EXPORT_SYMBOL_GPL(firmware_upload_unregister); +diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h +index bda5c815e4415..a28473470e662 100644 +--- a/drivers/block/xen-blkback/common.h ++++ b/drivers/block/xen-blkback/common.h +@@ -226,6 +226,9 @@ struct xen_vbd { + sector_t size; + unsigned int flush_support:1; + unsigned int discard_secure:1; ++ /* Connect-time cached feature_persistent parameter value */ ++ unsigned int feature_gnt_persistent_parm:1; ++ /* Persistent grants feature negotiation result */ + unsigned int feature_gnt_persistent:1; + unsigned int overflow_max_grants:1; + }; +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index ee7ad2fb432d1..c0227dfa46887 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -907,7 +907,7 @@ again: + xen_blkbk_barrier(xbt, be, be->blkif->vbd.flush_support); + + err = xenbus_printf(xbt, dev->nodename, "feature-persistent", "%u", +- be->blkif->vbd.feature_gnt_persistent); ++ be->blkif->vbd.feature_gnt_persistent_parm); + if (err) { + xenbus_dev_fatal(dev, err, "writing %s/feature-persistent", + dev->nodename); +@@ -1085,7 +1085,9 @@ static int connect_ring(struct backend_info *be) + return -ENOSYS; + } + +- blkif->vbd.feature_gnt_persistent = feature_persistent && ++ blkif->vbd.feature_gnt_persistent_parm = feature_persistent; ++ blkif->vbd.feature_gnt_persistent = ++ blkif->vbd.feature_gnt_persistent_parm && + xenbus_read_unsigned(dev->otherend, "feature-persistent", 0); + + blkif->vbd.overflow_max_grants = 0; +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index 4e763701b3720..1f85750f981e5 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -213,6 +213,9 @@ struct blkfront_info + unsigned int feature_fua:1; + unsigned int feature_discard:1; + unsigned int feature_secdiscard:1; ++ /* Connect-time cached feature_persistent parameter */ ++ unsigned int feature_persistent_parm:1; ++ /* Persistent grants feature negotiation result */ + unsigned int feature_persistent:1; + unsigned int bounce:1; + unsigned int discard_granularity; +@@ -1756,6 +1759,12 @@ abort_transaction: + return err; + } + ++/* Enable the persistent grants feature. */ ++static bool feature_persistent = true; ++module_param(feature_persistent, bool, 0644); ++MODULE_PARM_DESC(feature_persistent, ++ "Enables the persistent grants feature"); ++ + /* Common code used when first setting up, and when resuming. */ + static int talk_to_blkback(struct xenbus_device *dev, + struct blkfront_info *info) +@@ -1847,8 +1856,9 @@ again: + message = "writing protocol"; + goto abort_transaction; + } ++ info->feature_persistent_parm = feature_persistent; + err = xenbus_printf(xbt, dev->nodename, "feature-persistent", "%u", +- info->feature_persistent); ++ info->feature_persistent_parm); + if (err) + dev_warn(&dev->dev, + "writing persistent grants feature to xenbus"); +@@ -1916,12 +1926,6 @@ static int negotiate_mq(struct blkfront_info *info) + return 0; + } + +-/* Enable the persistent grants feature. */ +-static bool feature_persistent = true; +-module_param(feature_persistent, bool, 0644); +-MODULE_PARM_DESC(feature_persistent, +- "Enables the persistent grants feature"); +- + /* + * Entry point to this code when a new device is created. Allocate the basic + * structures and the ring buffer for communication with the backend, and +@@ -2281,7 +2285,7 @@ static void blkfront_gather_backend_features(struct blkfront_info *info) + if (xenbus_read_unsigned(info->xbdev->otherend, "feature-discard", 0)) + blkfront_setup_discard(info); + +- if (feature_persistent) ++ if (info->feature_persistent_parm) + info->feature_persistent = + !!xenbus_read_unsigned(info->xbdev->otherend, + "feature-persistent", 0); +diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c +index 73518009a0f20..4df921d1e21ca 100644 +--- a/drivers/clk/bcm/clk-raspberrypi.c ++++ b/drivers/clk/bcm/clk-raspberrypi.c +@@ -203,7 +203,7 @@ static unsigned long raspberrypi_fw_get_rate(struct clk_hw *hw, + ret = raspberrypi_clock_property(rpi->firmware, data, + RPI_FIRMWARE_GET_CLOCK_RATE, &val); + if (ret) +- return ret; ++ return 0; + + return val; + } +@@ -220,7 +220,7 @@ static int raspberrypi_fw_set_rate(struct clk_hw *hw, unsigned long rate, + ret = raspberrypi_clock_property(rpi->firmware, data, + RPI_FIRMWARE_SET_CLOCK_RATE, &_rate); + if (ret) +- dev_err_ratelimited(rpi->dev, "Failed to change %s frequency: %d", ++ dev_err_ratelimited(rpi->dev, "Failed to change %s frequency: %d\n", + clk_hw_get_name(hw), ret); + + return ret; +@@ -288,7 +288,7 @@ static struct clk_hw *raspberrypi_clk_register(struct raspberrypi_clk *rpi, + RPI_FIRMWARE_GET_MIN_CLOCK_RATE, + &min_rate); + if (ret) { +- dev_err(rpi->dev, "Failed to get clock %d min freq: %d", ++ dev_err(rpi->dev, "Failed to get clock %d min freq: %d\n", + id, ret); + return ERR_PTR(ret); + } +@@ -344,8 +344,13 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi, + struct rpi_firmware_get_clocks_response *clks; + int ret; + ++ /* ++ * The firmware doesn't guarantee that the last element of ++ * RPI_FIRMWARE_GET_CLOCKS is zeroed. So allocate an additional ++ * zero element as sentinel. ++ */ + clks = devm_kcalloc(rpi->dev, +- RPI_FIRMWARE_NUM_CLK_ID, sizeof(*clks), ++ RPI_FIRMWARE_NUM_CLK_ID + 1, sizeof(*clks), + GFP_KERNEL); + if (!clks) + return -ENOMEM; +@@ -360,7 +365,7 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi, + struct raspberrypi_clk_variant *variant; + + if (clks->id > RPI_FIRMWARE_NUM_CLK_ID) { +- dev_err(rpi->dev, "Unknown clock id: %u", clks->id); ++ dev_err(rpi->dev, "Unknown clock id: %u\n", clks->id); + return -EINVAL; + } + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index f00d4c1158d72..f246d66f8261f 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -840,10 +840,9 @@ static void clk_core_unprepare(struct clk_core *core) + if (core->ops->unprepare) + core->ops->unprepare(core->hw); + +- clk_pm_runtime_put(core); +- + trace_clk_unprepare_complete(core); + clk_core_unprepare(core->parent); ++ clk_pm_runtime_put(core); + } + + static void clk_core_unprepare_lock(struct clk_core *core) +diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c +index 3463579220b51..121d8610beb15 100644 +--- a/drivers/clk/ti/clk.c ++++ b/drivers/clk/ti/clk.c +@@ -143,6 +143,7 @@ static struct device_node *ti_find_clock_provider(struct device_node *from, + continue; + + if (!strncmp(n, tmp, strlen(tmp))) { ++ of_node_get(np); + found = true; + break; + } +diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c +index 205acb2c744de..e3885c90a3acb 100644 +--- a/drivers/dma-buf/dma-resv.c ++++ b/drivers/dma-buf/dma-resv.c +@@ -295,7 +295,8 @@ void dma_resv_add_fence(struct dma_resv *obj, struct dma_fence *fence, + enum dma_resv_usage old_usage; + + dma_resv_list_entry(fobj, i, obj, &old, &old_usage); +- if ((old->context == fence->context && old_usage >= usage) || ++ if ((old->context == fence->context && old_usage >= usage && ++ dma_fence_is_later(fence, old)) || + dma_fence_is_signaled(old)) { + dma_resv_list_set(fobj, i, fence, usage); + dma_fence_put(old); +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index ecd7d169470b0..2925f4d8cef36 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -1175,7 +1175,9 @@ static int pca953x_suspend(struct device *dev) + { + struct pca953x_chip *chip = dev_get_drvdata(dev); + ++ mutex_lock(&chip->i2c_lock); + regcache_cache_only(chip->regmap, true); ++ mutex_unlock(&chip->i2c_lock); + + if (atomic_read(&chip->wakeup_path)) + device_set_wakeup_path(dev); +@@ -1198,13 +1200,17 @@ static int pca953x_resume(struct device *dev) + } + } + ++ mutex_lock(&chip->i2c_lock); + regcache_cache_only(chip->regmap, false); + regcache_mark_dirty(chip->regmap); + ret = pca953x_regcache_sync(dev); +- if (ret) ++ if (ret) { ++ mutex_unlock(&chip->i2c_lock); + return ret; ++ } + + ret = regcache_sync(chip->regmap); ++ mutex_unlock(&chip->i2c_lock); + if (ret) { + dev_err(dev, "Failed to restore register map: %d\n", ret); + return ret; +diff --git a/drivers/gpio/gpio-realtek-otto.c b/drivers/gpio/gpio-realtek-otto.c +index 63dcf42f7c206..d6418f89d3f63 100644 +--- a/drivers/gpio/gpio-realtek-otto.c ++++ b/drivers/gpio/gpio-realtek-otto.c +@@ -46,10 +46,20 @@ + * @lock: Lock for accessing the IRQ registers and values + * @intr_mask: Mask for interrupts lines + * @intr_type: Interrupt type selection ++ * @bank_read: Read a bank setting as a single 32-bit value ++ * @bank_write: Write a bank setting as a single 32-bit value ++ * @imr_line_pos: Bit shift of an IRQ line's IMR value. ++ * ++ * The DIR, DATA, and ISR registers consist of four 8-bit port values, packed ++ * into a single 32-bit register. Use @bank_read (@bank_write) to get (assign) ++ * a value from (to) these registers. The IMR register consists of four 16-bit ++ * port values, packed into two 32-bit registers. Use @imr_line_pos to get the ++ * bit shift of the 2-bit field for a line's IMR settings. Shifts larger than ++ * 32 overflow into the second register. + * + * Because the interrupt mask register (IMR) combines the function of IRQ type + * selection and masking, two extra values are stored. @intr_mask is used to +- * mask/unmask the interrupts for a GPIO port, and @intr_type is used to store ++ * mask/unmask the interrupts for a GPIO line, and @intr_type is used to store + * the selected interrupt types. The logical AND of these values is written to + * IMR on changes. + */ +@@ -59,10 +69,11 @@ struct realtek_gpio_ctrl { + void __iomem *cpumask_base; + struct cpumask cpu_irq_maskable; + raw_spinlock_t lock; +- u16 intr_mask[REALTEK_GPIO_PORTS_PER_BANK]; +- u16 intr_type[REALTEK_GPIO_PORTS_PER_BANK]; +- unsigned int (*port_offset_u8)(unsigned int port); +- unsigned int (*port_offset_u16)(unsigned int port); ++ u8 intr_mask[REALTEK_GPIO_MAX]; ++ u8 intr_type[REALTEK_GPIO_MAX]; ++ u32 (*bank_read)(void __iomem *reg); ++ void (*bank_write)(void __iomem *reg, u32 value); ++ unsigned int (*line_imr_pos)(unsigned int line); + }; + + /* Expand with more flags as devices with other quirks are added */ +@@ -101,14 +112,22 @@ static struct realtek_gpio_ctrl *irq_data_to_ctrl(struct irq_data *data) + * port. The two interrupt mask registers store two bits per GPIO, so use u16 + * values. + */ +-static unsigned int realtek_gpio_port_offset_u8(unsigned int port) ++static u32 realtek_gpio_bank_read_swapped(void __iomem *reg) + { +- return port; ++ return ioread32be(reg); + } + +-static unsigned int realtek_gpio_port_offset_u16(unsigned int port) ++static void realtek_gpio_bank_write_swapped(void __iomem *reg, u32 value) + { +- return 2 * port; ++ iowrite32be(value, reg); ++} ++ ++static unsigned int realtek_gpio_line_imr_pos_swapped(unsigned int line) ++{ ++ unsigned int port_pin = line % 8; ++ unsigned int port = line / 8; ++ ++ return 2 * (8 * (port ^ 1) + port_pin); + } + + /* +@@ -119,66 +138,67 @@ static unsigned int realtek_gpio_port_offset_u16(unsigned int port) + * per GPIO, so use u16 values. The first register contains ports 1 and 0, the + * second ports 3 and 2. + */ +-static unsigned int realtek_gpio_port_offset_u8_rev(unsigned int port) ++static u32 realtek_gpio_bank_read(void __iomem *reg) + { +- return 3 - port; ++ return ioread32(reg); + } + +-static unsigned int realtek_gpio_port_offset_u16_rev(unsigned int port) ++static void realtek_gpio_bank_write(void __iomem *reg, u32 value) + { +- return 2 * (port ^ 1); ++ iowrite32(value, reg); + } + +-static void realtek_gpio_write_imr(struct realtek_gpio_ctrl *ctrl, +- unsigned int port, u16 irq_type, u16 irq_mask) ++static unsigned int realtek_gpio_line_imr_pos(unsigned int line) + { +- iowrite16(irq_type & irq_mask, +- ctrl->base + REALTEK_GPIO_REG_IMR + ctrl->port_offset_u16(port)); ++ return 2 * line; + } + +-static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl, +- unsigned int port, u8 mask) ++static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl, u32 mask) + { +- iowrite8(mask, ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port)); ++ ctrl->bank_write(ctrl->base + REALTEK_GPIO_REG_ISR, mask); + } + +-static u8 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl, unsigned int port) ++static u32 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl) + { +- return ioread8(ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port)); ++ return ctrl->bank_read(ctrl->base + REALTEK_GPIO_REG_ISR); + } + +-/* Set the rising and falling edge mask bits for a GPIO port pin */ +-static u16 realtek_gpio_imr_bits(unsigned int pin, u16 value) ++/* Set the rising and falling edge mask bits for a GPIO pin */ ++static void realtek_gpio_update_line_imr(struct realtek_gpio_ctrl *ctrl, unsigned int line) + { +- return (value & REALTEK_GPIO_IMR_LINE_MASK) << 2 * pin; ++ void __iomem *reg = ctrl->base + REALTEK_GPIO_REG_IMR; ++ unsigned int line_shift = ctrl->line_imr_pos(line); ++ unsigned int shift = line_shift % 32; ++ u32 irq_type = ctrl->intr_type[line]; ++ u32 irq_mask = ctrl->intr_mask[line]; ++ u32 reg_val; ++ ++ reg += 4 * (line_shift / 32); ++ reg_val = ioread32(reg); ++ reg_val &= ~(REALTEK_GPIO_IMR_LINE_MASK << shift); ++ reg_val |= (irq_type & irq_mask & REALTEK_GPIO_IMR_LINE_MASK) << shift; ++ iowrite32(reg_val, reg); + } + + static void realtek_gpio_irq_ack(struct irq_data *data) + { + struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data); + irq_hw_number_t line = irqd_to_hwirq(data); +- unsigned int port = line / 8; +- unsigned int port_pin = line % 8; + +- realtek_gpio_clear_isr(ctrl, port, BIT(port_pin)); ++ realtek_gpio_clear_isr(ctrl, BIT(line)); + } + + static void realtek_gpio_irq_unmask(struct irq_data *data) + { + struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data); + unsigned int line = irqd_to_hwirq(data); +- unsigned int port = line / 8; +- unsigned int port_pin = line % 8; + unsigned long flags; +- u16 m; + + gpiochip_enable_irq(&ctrl->gc, line); + + raw_spin_lock_irqsave(&ctrl->lock, flags); +- m = ctrl->intr_mask[port]; +- m |= realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK); +- ctrl->intr_mask[port] = m; +- realtek_gpio_write_imr(ctrl, port, ctrl->intr_type[port], m); ++ ctrl->intr_mask[line] = REALTEK_GPIO_IMR_LINE_MASK; ++ realtek_gpio_update_line_imr(ctrl, line); + raw_spin_unlock_irqrestore(&ctrl->lock, flags); + } + +@@ -186,16 +206,11 @@ static void realtek_gpio_irq_mask(struct irq_data *data) + { + struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data); + unsigned int line = irqd_to_hwirq(data); +- unsigned int port = line / 8; +- unsigned int port_pin = line % 8; + unsigned long flags; +- u16 m; + + raw_spin_lock_irqsave(&ctrl->lock, flags); +- m = ctrl->intr_mask[port]; +- m &= ~realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK); +- ctrl->intr_mask[port] = m; +- realtek_gpio_write_imr(ctrl, port, ctrl->intr_type[port], m); ++ ctrl->intr_mask[line] = 0; ++ realtek_gpio_update_line_imr(ctrl, line); + raw_spin_unlock_irqrestore(&ctrl->lock, flags); + + gpiochip_disable_irq(&ctrl->gc, line); +@@ -205,10 +220,8 @@ static int realtek_gpio_irq_set_type(struct irq_data *data, unsigned int flow_ty + { + struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data); + unsigned int line = irqd_to_hwirq(data); +- unsigned int port = line / 8; +- unsigned int port_pin = line % 8; + unsigned long flags; +- u16 type, t; ++ u8 type; + + switch (flow_type & IRQ_TYPE_SENSE_MASK) { + case IRQ_TYPE_EDGE_FALLING: +@@ -227,11 +240,8 @@ static int realtek_gpio_irq_set_type(struct irq_data *data, unsigned int flow_ty + irq_set_handler_locked(data, handle_edge_irq); + + raw_spin_lock_irqsave(&ctrl->lock, flags); +- t = ctrl->intr_type[port]; +- t &= ~realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK); +- t |= realtek_gpio_imr_bits(port_pin, type); +- ctrl->intr_type[port] = t; +- realtek_gpio_write_imr(ctrl, port, t, ctrl->intr_mask[port]); ++ ctrl->intr_type[line] = type; ++ realtek_gpio_update_line_imr(ctrl, line); + raw_spin_unlock_irqrestore(&ctrl->lock, flags); + + return 0; +@@ -242,28 +252,21 @@ static void realtek_gpio_irq_handler(struct irq_desc *desc) + struct gpio_chip *gc = irq_desc_get_handler_data(desc); + struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc); + struct irq_chip *irq_chip = irq_desc_get_chip(desc); +- unsigned int lines_done; +- unsigned int port_pin_count; + unsigned long status; + int offset; + + chained_irq_enter(irq_chip, desc); + +- for (lines_done = 0; lines_done < gc->ngpio; lines_done += 8) { +- status = realtek_gpio_read_isr(ctrl, lines_done / 8); +- port_pin_count = min(gc->ngpio - lines_done, 8U); +- for_each_set_bit(offset, &status, port_pin_count) +- generic_handle_domain_irq(gc->irq.domain, offset + lines_done); +- } ++ status = realtek_gpio_read_isr(ctrl); ++ for_each_set_bit(offset, &status, gc->ngpio) ++ generic_handle_domain_irq(gc->irq.domain, offset); + + chained_irq_exit(irq_chip, desc); + } + +-static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl, +- unsigned int port, int cpu) ++static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl, int cpu) + { +- return ctrl->cpumask_base + ctrl->port_offset_u8(port) + +- REALTEK_GPIO_PORTS_PER_BANK * cpu; ++ return ctrl->cpumask_base + REALTEK_GPIO_PORTS_PER_BANK * cpu; + } + + static int realtek_gpio_irq_set_affinity(struct irq_data *data, +@@ -271,12 +274,10 @@ static int realtek_gpio_irq_set_affinity(struct irq_data *data, + { + struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data); + unsigned int line = irqd_to_hwirq(data); +- unsigned int port = line / 8; +- unsigned int port_pin = line % 8; + void __iomem *irq_cpu_mask; + unsigned long flags; + int cpu; +- u8 v; ++ u32 v; + + if (!ctrl->cpumask_base) + return -ENXIO; +@@ -284,15 +285,15 @@ static int realtek_gpio_irq_set_affinity(struct irq_data *data, + raw_spin_lock_irqsave(&ctrl->lock, flags); + + for_each_cpu(cpu, &ctrl->cpu_irq_maskable) { +- irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, port, cpu); +- v = ioread8(irq_cpu_mask); ++ irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, cpu); ++ v = ctrl->bank_read(irq_cpu_mask); + + if (cpumask_test_cpu(cpu, dest)) +- v |= BIT(port_pin); ++ v |= BIT(line); + else +- v &= ~BIT(port_pin); ++ v &= ~BIT(line); + +- iowrite8(v, irq_cpu_mask); ++ ctrl->bank_write(irq_cpu_mask, v); + } + + raw_spin_unlock_irqrestore(&ctrl->lock, flags); +@@ -305,16 +306,17 @@ static int realtek_gpio_irq_set_affinity(struct irq_data *data, + static int realtek_gpio_irq_init(struct gpio_chip *gc) + { + struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc); +- unsigned int port; ++ u32 mask_all = GENMASK(gc->ngpio - 1, 0); ++ unsigned int line; + int cpu; + +- for (port = 0; (port * 8) < gc->ngpio; port++) { +- realtek_gpio_write_imr(ctrl, port, 0, 0); +- realtek_gpio_clear_isr(ctrl, port, GENMASK(7, 0)); ++ for (line = 0; line < gc->ngpio; line++) ++ realtek_gpio_update_line_imr(ctrl, line); + +- for_each_cpu(cpu, &ctrl->cpu_irq_maskable) +- iowrite8(GENMASK(7, 0), realtek_gpio_irq_cpu_mask(ctrl, port, cpu)); +- } ++ realtek_gpio_clear_isr(ctrl, mask_all); ++ ++ for_each_cpu(cpu, &ctrl->cpu_irq_maskable) ++ ctrl->bank_write(realtek_gpio_irq_cpu_mask(ctrl, cpu), mask_all); + + return 0; + } +@@ -387,12 +389,14 @@ static int realtek_gpio_probe(struct platform_device *pdev) + + if (dev_flags & GPIO_PORTS_REVERSED) { + bgpio_flags = 0; +- ctrl->port_offset_u8 = realtek_gpio_port_offset_u8_rev; +- ctrl->port_offset_u16 = realtek_gpio_port_offset_u16_rev; ++ ctrl->bank_read = realtek_gpio_bank_read; ++ ctrl->bank_write = realtek_gpio_bank_write; ++ ctrl->line_imr_pos = realtek_gpio_line_imr_pos; + } else { + bgpio_flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER; +- ctrl->port_offset_u8 = realtek_gpio_port_offset_u8; +- ctrl->port_offset_u16 = realtek_gpio_port_offset_u16; ++ ctrl->bank_read = realtek_gpio_bank_read_swapped; ++ ctrl->bank_write = realtek_gpio_bank_write_swapped; ++ ctrl->line_imr_pos = realtek_gpio_line_imr_pos_swapped; + } + + err = bgpio_init(&ctrl->gc, dev, 4, +diff --git a/drivers/gpu/drm/i915/display/intel_backlight.c b/drivers/gpu/drm/i915/display/intel_backlight.c +index c8e1fc53a881f..3e200a2e4ba29 100644 +--- a/drivers/gpu/drm/i915/display/intel_backlight.c ++++ b/drivers/gpu/drm/i915/display/intel_backlight.c +@@ -15,6 +15,7 @@ + #include "intel_dsi_dcs_backlight.h" + #include "intel_panel.h" + #include "intel_pci_config.h" ++#include "intel_pps.h" + + /** + * scale - scale values from one range to another +@@ -970,26 +971,24 @@ int intel_backlight_device_register(struct intel_connector *connector) + if (!name) + return -ENOMEM; + +- bd = backlight_device_register(name, connector->base.kdev, connector, +- &intel_backlight_device_ops, &props); +- +- /* +- * Using the same name independent of the drm device or connector +- * prevents registration of multiple backlight devices in the +- * driver. However, we need to use the default name for backward +- * compatibility. Use unique names for subsequent backlight devices as a +- * fallback when the default name already exists. +- */ +- if (IS_ERR(bd) && PTR_ERR(bd) == -EEXIST) { ++ bd = backlight_device_get_by_name(name); ++ if (bd) { ++ put_device(&bd->dev); ++ /* ++ * Using the same name independent of the drm device or connector ++ * prevents registration of multiple backlight devices in the ++ * driver. However, we need to use the default name for backward ++ * compatibility. Use unique names for subsequent backlight devices as a ++ * fallback when the default name already exists. ++ */ + kfree(name); + name = kasprintf(GFP_KERNEL, "card%d-%s-backlight", + i915->drm.primary->index, connector->base.name); + if (!name) + return -ENOMEM; +- +- bd = backlight_device_register(name, connector->base.kdev, connector, +- &intel_backlight_device_ops, &props); + } ++ bd = backlight_device_register(name, connector->base.kdev, connector, ++ &intel_backlight_device_ops, &props); + + if (IS_ERR(bd)) { + drm_err(&i915->drm, +@@ -1771,9 +1770,13 @@ void intel_backlight_init_funcs(struct intel_panel *panel) + panel->backlight.pwm_funcs = &i9xx_pwm_funcs; + } + +- if (connector->base.connector_type == DRM_MODE_CONNECTOR_eDP && +- intel_dp_aux_init_backlight_funcs(connector) == 0) +- return; ++ if (connector->base.connector_type == DRM_MODE_CONNECTOR_eDP) { ++ if (intel_dp_aux_init_backlight_funcs(connector) == 0) ++ return; ++ ++ if (!(dev_priv->quirks & QUIRK_NO_PPS_BACKLIGHT_POWER_HOOK)) ++ connector->panel.backlight.power = intel_pps_backlight_power; ++ } + + /* We're using a standard PWM backlight interface */ + panel->backlight.funcs = &pwm_bl_funcs; +diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c +index 37bd7b17f3d0b..f2fad199e2e0b 100644 +--- a/drivers/gpu/drm/i915/display/intel_bw.c ++++ b/drivers/gpu/drm/i915/display/intel_bw.c +@@ -404,15 +404,17 @@ static int tgl_get_bw_info(struct drm_i915_private *dev_priv, const struct intel + int clpchgroup; + int j; + +- if (i < num_groups - 1) +- bi_next = &dev_priv->max_bw[i + 1]; +- + clpchgroup = (sa->deburst * qi.deinterleave / num_channels) << i; + +- if (i < num_groups - 1 && clpchgroup < clperchgroup) +- bi_next->num_planes = (ipqdepth - clpchgroup) / clpchgroup + 1; +- else +- bi_next->num_planes = 0; ++ if (i < num_groups - 1) { ++ bi_next = &dev_priv->max_bw[i + 1]; ++ ++ if (clpchgroup < clperchgroup) ++ bi_next->num_planes = (ipqdepth - clpchgroup) / ++ clpchgroup + 1; ++ else ++ bi_next->num_planes = 0; ++ } + + bi->num_qgv_points = qi.num_points; + bi->num_psf_gv_points = qi.num_psf_points; +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index ff67899522cf7..41aaa6c98114f 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -5248,8 +5248,6 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp, + + intel_panel_init(intel_connector); + +- if (!(dev_priv->quirks & QUIRK_NO_PPS_BACKLIGHT_POWER_HOOK)) +- intel_connector->panel.backlight.power = intel_pps_backlight_power; + intel_backlight_setup(intel_connector, pipe); + + intel_edp_add_properties(intel_dp); +diff --git a/drivers/gpu/drm/i915/display/intel_quirks.c b/drivers/gpu/drm/i915/display/intel_quirks.c +index c8488f5ebd044..e415cd7c0b84b 100644 +--- a/drivers/gpu/drm/i915/display/intel_quirks.c ++++ b/drivers/gpu/drm/i915/display/intel_quirks.c +@@ -191,6 +191,9 @@ static struct intel_quirk intel_quirks[] = { + /* ASRock ITX*/ + { 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time }, + { 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time }, ++ /* ECS Liva Q2 */ ++ { 0x3185, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time }, ++ { 0x3184, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time }, + }; + + void intel_init_quirks(struct drm_i915_private *i915) +diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c +index 2b10b96b17b5b..933648cc90ff9 100644 +--- a/drivers/gpu/drm/i915/gt/intel_migrate.c ++++ b/drivers/gpu/drm/i915/gt/intel_migrate.c +@@ -638,9 +638,9 @@ static int emit_copy(struct i915_request *rq, + return 0; + } + +-static int scatter_list_length(struct scatterlist *sg) ++static u64 scatter_list_length(struct scatterlist *sg) + { +- int len = 0; ++ u64 len = 0; + + while (sg && sg_dma_len(sg)) { + len += sg_dma_len(sg); +@@ -650,28 +650,26 @@ static int scatter_list_length(struct scatterlist *sg) + return len; + } + +-static void ++static int + calculate_chunk_sz(struct drm_i915_private *i915, bool src_is_lmem, +- int *src_sz, u32 bytes_to_cpy, u32 ccs_bytes_to_cpy) ++ u64 bytes_to_cpy, u64 ccs_bytes_to_cpy) + { +- if (ccs_bytes_to_cpy) { +- if (!src_is_lmem) +- /* +- * When CHUNK_SZ is passed all the pages upto CHUNK_SZ +- * will be taken for the blt. in Flat-ccs supported +- * platform Smem obj will have more pages than required +- * for main meory hence limit it to the required size +- * for main memory +- */ +- *src_sz = min_t(int, bytes_to_cpy, CHUNK_SZ); +- } else { /* ccs handling is not required */ +- *src_sz = CHUNK_SZ; +- } ++ if (ccs_bytes_to_cpy && !src_is_lmem) ++ /* ++ * When CHUNK_SZ is passed all the pages upto CHUNK_SZ ++ * will be taken for the blt. in Flat-ccs supported ++ * platform Smem obj will have more pages than required ++ * for main meory hence limit it to the required size ++ * for main memory ++ */ ++ return min_t(u64, bytes_to_cpy, CHUNK_SZ); ++ else ++ return CHUNK_SZ; + } + +-static void get_ccs_sg_sgt(struct sgt_dma *it, u32 bytes_to_cpy) ++static void get_ccs_sg_sgt(struct sgt_dma *it, u64 bytes_to_cpy) + { +- u32 len; ++ u64 len; + + do { + GEM_BUG_ON(!it->sg || !sg_dma_len(it->sg)); +@@ -702,12 +700,12 @@ intel_context_migrate_copy(struct intel_context *ce, + { + struct sgt_dma it_src = sg_sgt(src), it_dst = sg_sgt(dst), it_ccs; + struct drm_i915_private *i915 = ce->engine->i915; +- u32 ccs_bytes_to_cpy = 0, bytes_to_cpy; ++ u64 ccs_bytes_to_cpy = 0, bytes_to_cpy; + enum i915_cache_level ccs_cache_level; + u32 src_offset, dst_offset; + u8 src_access, dst_access; + struct i915_request *rq; +- int src_sz, dst_sz; ++ u64 src_sz, dst_sz; + bool ccs_is_src, overwrite_ccs; + int err; + +@@ -790,8 +788,8 @@ intel_context_migrate_copy(struct intel_context *ce, + if (err) + goto out_rq; + +- calculate_chunk_sz(i915, src_is_lmem, &src_sz, +- bytes_to_cpy, ccs_bytes_to_cpy); ++ src_sz = calculate_chunk_sz(i915, src_is_lmem, ++ bytes_to_cpy, ccs_bytes_to_cpy); + + len = emit_pte(rq, &it_src, src_cache_level, src_is_lmem, + src_offset, src_sz); +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 2d9f5f1c79d3a..26a051ef119df 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -4010,6 +4010,13 @@ static inline void guc_init_lrc_mapping(struct intel_guc *guc) + /* make sure all descriptors are clean... */ + xa_destroy(&guc->context_lookup); + ++ /* ++ * A reset might have occurred while we had a pending stalled request, ++ * so make sure we clean that up. ++ */ ++ guc->stalled_request = NULL; ++ guc->submission_stall_reason = STALL_NONE; ++ + /* + * Some contexts might have been pinned before we enabled GuC + * submission, so we need to add them to the GuC bookeeping. +diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c +index beea5895e4992..73e74a6a76037 100644 +--- a/drivers/gpu/drm/i915/gvt/handlers.c ++++ b/drivers/gpu/drm/i915/gvt/handlers.c +@@ -905,7 +905,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu, + else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX) + index = FDI_RX_IMR_TO_PIPE(offset); + else { +- gvt_vgpu_err("Unsupport registers %x\n", offset); ++ gvt_vgpu_err("Unsupported registers %x\n", offset); + return -EINVAL; + } + +diff --git a/drivers/gpu/drm/i915/intel_gvt_mmio_table.c b/drivers/gpu/drm/i915/intel_gvt_mmio_table.c +index 72dac1718f3e7..6163aeaee9b98 100644 +--- a/drivers/gpu/drm/i915/intel_gvt_mmio_table.c ++++ b/drivers/gpu/drm/i915/intel_gvt_mmio_table.c +@@ -1074,7 +1074,8 @@ static int iterate_skl_plus_mmio(struct intel_gvt_mmio_table_iter *iter) + MMIO_D(GEN8_HDC_CHICKEN1); + MMIO_D(GEN9_WM_CHICKEN3); + +- if (IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) ++ if (IS_KABYLAKE(dev_priv) || ++ IS_COFFEELAKE(dev_priv) || IS_COMETLAKE(dev_priv)) + MMIO_D(GAMT_CHKN_BIT_REG); + if (!IS_BROXTON(dev_priv)) + MMIO_D(GEN9_CTX_PREEMPT_REG); +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 5735915facc51..7d5803f2343a9 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -6560,7 +6560,10 @@ void skl_wm_get_hw_state(struct drm_i915_private *dev_priv) + enum plane_id plane_id; + u8 slices; + +- skl_pipe_wm_get_hw_state(crtc, &crtc_state->wm.skl.optimal); ++ memset(&crtc_state->wm.skl.optimal, 0, ++ sizeof(crtc_state->wm.skl.optimal)); ++ if (crtc_state->hw.active) ++ skl_pipe_wm_get_hw_state(crtc, &crtc_state->wm.skl.optimal); + crtc_state->wm.skl.raw = crtc_state->wm.skl.optimal; + + memset(&dbuf_state->ddb[pipe], 0, sizeof(dbuf_state->ddb[pipe])); +@@ -6571,6 +6574,9 @@ void skl_wm_get_hw_state(struct drm_i915_private *dev_priv) + struct skl_ddb_entry *ddb_y = + &crtc_state->wm.skl.plane_ddb_y[plane_id]; + ++ if (!crtc_state->hw.active) ++ continue; ++ + skl_ddb_get_hw_plane_state(dev_priv, crtc->pipe, + plane_id, ddb, ddb_y); + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 9b4df3084366b..d98c7f7da7c08 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -1998,6 +1998,12 @@ void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc) + + intf_cfg.stream_sel = 0; /* Don't care value for video mode */ + intf_cfg.mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc); ++ ++ if (phys_enc->hw_intf) ++ intf_cfg.intf = phys_enc->hw_intf->idx; ++ if (phys_enc->hw_wb) ++ intf_cfg.wb = phys_enc->hw_wb->idx; ++ + if (phys_enc->hw_pp->merge_3d) + intf_cfg.merge_3d = phys_enc->hw_pp->merge_3d->idx; + +diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c +index 703249384e7c7..45aa06a31a9fd 100644 +--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c ++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c +@@ -1214,7 +1214,7 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl, + if (ret) + return ret; + +- dp_ctrl_train_pattern_set(ctrl, pattern | DP_RECOVERED_CLOCK_OUT_EN); ++ dp_ctrl_train_pattern_set(ctrl, pattern); + + for (tries = 0; tries <= maximum_retries; tries++) { + drm_dp_link_train_channel_eq_delay(ctrl->aux, ctrl->panel->dpcd); +diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +index 2c23324a2296b..72c018e26f47f 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +@@ -109,7 +109,7 @@ static const char * const dsi_8996_bus_clk_names[] = { + static const struct msm_dsi_config msm8996_dsi_cfg = { + .io_offset = DSI_6G_REG_SHIFT, + .reg_cfg = { +- .num = 2, ++ .num = 3, + .regs = { + {"vdda", 18160, 1 }, /* 1.25 V */ + {"vcca", 17000, 32 }, /* 0.925 V */ +@@ -148,7 +148,7 @@ static const char * const dsi_sdm660_bus_clk_names[] = { + static const struct msm_dsi_config sdm660_dsi_cfg = { + .io_offset = DSI_6G_REG_SHIFT, + .reg_cfg = { +- .num = 2, ++ .num = 1, + .regs = { + {"vdda", 12560, 4 }, /* 1.2 V */ + }, +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +index a39de3bdc7faf..56dfa2d24be1f 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +@@ -347,7 +347,7 @@ int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing, + } else { + timing->shared_timings.clk_pre = + linear_inter(tmax, tmin, pcnt2, 0, false); +- timing->shared_timings.clk_pre_inc_by_2 = 0; ++ timing->shared_timings.clk_pre_inc_by_2 = 0; + } + + timing->ta_go = 3; +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 14ab9a627d8b0..7c0314d6566af 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -424,6 +424,8 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) + } + } + ++ drm_helper_move_panel_connectors_to_head(ddev); ++ + ddev->mode_config.funcs = &mode_config_funcs; + ddev->mode_config.helper_private = &mode_config_helper_funcs; + +diff --git a/drivers/gpu/drm/msm/msm_gpu_devfreq.c b/drivers/gpu/drm/msm/msm_gpu_devfreq.c +index ea94bc18e72eb..89cc93eb67557 100644 +--- a/drivers/gpu/drm/msm/msm_gpu_devfreq.c ++++ b/drivers/gpu/drm/msm/msm_gpu_devfreq.c +@@ -213,6 +213,8 @@ void msm_devfreq_init(struct msm_gpu *gpu) + + if (IS_ERR(df->devfreq)) { + DRM_DEV_ERROR(&gpu->pdev->dev, "Couldn't initialize GPU devfreq\n"); ++ dev_pm_qos_remove_request(&df->idle_freq); ++ dev_pm_qos_remove_request(&df->boost_freq); + df->devfreq = NULL; + return; + } +diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c +index befe989ca7b94..fbf3f5a4ecb67 100644 +--- a/drivers/hwmon/gpio-fan.c ++++ b/drivers/hwmon/gpio-fan.c +@@ -391,6 +391,9 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev, + if (!fan_data) + return -EINVAL; + ++ if (state >= fan_data->num_speed) ++ return -EINVAL; ++ + set_fan_speed(fan_data, state); + return 0; + } +diff --git a/drivers/iio/adc/ad7292.c b/drivers/iio/adc/ad7292.c +index 92c68d467c505..a2f9fda25ff34 100644 +--- a/drivers/iio/adc/ad7292.c ++++ b/drivers/iio/adc/ad7292.c +@@ -287,10 +287,8 @@ static int ad7292_probe(struct spi_device *spi) + + ret = devm_add_action_or_reset(&spi->dev, + ad7292_regulator_disable, st); +- if (ret) { +- regulator_disable(st->reg); ++ if (ret) + return ret; +- } + + ret = regulator_get_voltage(st->reg); + if (ret < 0) +diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c +index 1cb4590fe4125..890af7dca62de 100644 +--- a/drivers/iio/adc/mcp3911.c ++++ b/drivers/iio/adc/mcp3911.c +@@ -40,8 +40,8 @@ + #define MCP3911_CHANNEL(x) (MCP3911_REG_CHANNEL0 + x * 3) + #define MCP3911_OFFCAL(x) (MCP3911_REG_OFFCAL_CH0 + x * 6) + +-/* Internal voltage reference in uV */ +-#define MCP3911_INT_VREF_UV 1200000 ++/* Internal voltage reference in mV */ ++#define MCP3911_INT_VREF_MV 1200 + + #define MCP3911_REG_READ(reg, id) ((((reg) << 1) | ((id) << 5) | (1 << 0)) & 0xff) + #define MCP3911_REG_WRITE(reg, id) ((((reg) << 1) | ((id) << 5) | (0 << 0)) & 0xff) +@@ -113,6 +113,8 @@ static int mcp3911_read_raw(struct iio_dev *indio_dev, + if (ret) + goto out; + ++ *val = sign_extend32(*val, 23); ++ + ret = IIO_VAL_INT; + break; + +@@ -137,11 +139,18 @@ static int mcp3911_read_raw(struct iio_dev *indio_dev, + + *val = ret / 1000; + } else { +- *val = MCP3911_INT_VREF_UV; ++ *val = MCP3911_INT_VREF_MV; + } + +- *val2 = 24; +- ret = IIO_VAL_FRACTIONAL_LOG2; ++ /* ++ * For 24bit Conversion ++ * Raw = ((Voltage)/(Vref) * 2^23 * Gain * 1.5 ++ * Voltage = Raw * (Vref)/(2^23 * Gain * 1.5) ++ */ ++ ++ /* val2 = (2^23 * 1.5) */ ++ *val2 = 12582912; ++ ret = IIO_VAL_FRACTIONAL; + break; + } + +@@ -208,7 +217,14 @@ static int mcp3911_config(struct mcp3911 *adc) + u32 configreg; + int ret; + +- device_property_read_u32(dev, "device-addr", &adc->dev_addr); ++ ret = device_property_read_u32(dev, "microchip,device-addr", &adc->dev_addr); ++ ++ /* ++ * Fallback to "device-addr" due to historical mismatch between ++ * dt-bindings and implementation ++ */ ++ if (ret) ++ device_property_read_u32(dev, "device-addr", &adc->dev_addr); + if (adc->dev_addr > 3) { + dev_err(&adc->spi->dev, + "invalid device address (%i). Must be in range 0-3.\n", +diff --git a/drivers/iio/light/cm3605.c b/drivers/iio/light/cm3605.c +index 50d34a98839c0..a68b95a79d482 100644 +--- a/drivers/iio/light/cm3605.c ++++ b/drivers/iio/light/cm3605.c +@@ -226,8 +226,10 @@ static int cm3605_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (irq < 0) +- return dev_err_probe(dev, irq, "failed to get irq\n"); ++ if (irq < 0) { ++ ret = dev_err_probe(dev, irq, "failed to get irq\n"); ++ goto out_disable_aset; ++ } + + ret = devm_request_threaded_irq(dev, irq, cm3605_prox_irq, + NULL, 0, "cm3605", indio_dev); +diff --git a/drivers/input/joystick/iforce/iforce-serio.c b/drivers/input/joystick/iforce/iforce-serio.c +index f95a81b9fac72..2380546d79782 100644 +--- a/drivers/input/joystick/iforce/iforce-serio.c ++++ b/drivers/input/joystick/iforce/iforce-serio.c +@@ -39,7 +39,7 @@ static void iforce_serio_xmit(struct iforce *iforce) + + again: + if (iforce->xmit.head == iforce->xmit.tail) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ iforce_clear_xmit_and_wake(iforce); + spin_unlock_irqrestore(&iforce->xmit_lock, flags); + return; + } +@@ -64,7 +64,7 @@ again: + if (test_and_clear_bit(IFORCE_XMIT_AGAIN, iforce->xmit_flags)) + goto again; + +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ iforce_clear_xmit_and_wake(iforce); + + spin_unlock_irqrestore(&iforce->xmit_lock, flags); + } +@@ -169,7 +169,7 @@ static irqreturn_t iforce_serio_irq(struct serio *serio, + iforce_serio->cmd_response_len = iforce_serio->len; + + /* Signal that command is done */ +- wake_up(&iforce->wait); ++ wake_up_all(&iforce->wait); + } else if (likely(iforce->type)) { + iforce_process_packet(iforce, iforce_serio->id, + iforce_serio->data_in, +diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c +index ea58805c480fa..cba92bd590a8d 100644 +--- a/drivers/input/joystick/iforce/iforce-usb.c ++++ b/drivers/input/joystick/iforce/iforce-usb.c +@@ -30,7 +30,7 @@ static void __iforce_usb_xmit(struct iforce *iforce) + spin_lock_irqsave(&iforce->xmit_lock, flags); + + if (iforce->xmit.head == iforce->xmit.tail) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ iforce_clear_xmit_and_wake(iforce); + spin_unlock_irqrestore(&iforce->xmit_lock, flags); + return; + } +@@ -58,9 +58,9 @@ static void __iforce_usb_xmit(struct iforce *iforce) + XMIT_INC(iforce->xmit.tail, n); + + if ( (n=usb_submit_urb(iforce_usb->out, GFP_ATOMIC)) ) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); + dev_warn(&iforce_usb->intf->dev, + "usb_submit_urb failed %d\n", n); ++ iforce_clear_xmit_and_wake(iforce); + } + + /* The IFORCE_XMIT_RUNNING bit is not cleared here. That's intended. +@@ -175,15 +175,15 @@ static void iforce_usb_out(struct urb *urb) + struct iforce *iforce = &iforce_usb->iforce; + + if (urb->status) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); + dev_dbg(&iforce_usb->intf->dev, "urb->status %d, exiting\n", + urb->status); ++ iforce_clear_xmit_and_wake(iforce); + return; + } + + __iforce_usb_xmit(iforce); + +- wake_up(&iforce->wait); ++ wake_up_all(&iforce->wait); + } + + static int iforce_usb_probe(struct usb_interface *intf, +diff --git a/drivers/input/joystick/iforce/iforce.h b/drivers/input/joystick/iforce/iforce.h +index 6aa761ebbdf77..9ccb9107ccbef 100644 +--- a/drivers/input/joystick/iforce/iforce.h ++++ b/drivers/input/joystick/iforce/iforce.h +@@ -119,6 +119,12 @@ static inline int iforce_get_id_packet(struct iforce *iforce, u8 id, + response_data, response_len); + } + ++static inline void iforce_clear_xmit_and_wake(struct iforce *iforce) ++{ ++ clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ wake_up_all(&iforce->wait); ++} ++ + /* Public functions */ + /* iforce-main.c */ + int iforce_init_device(struct device *parent, u16 bustype, +diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-pwrkey.c +index 3fb64dbda1a21..76873aa005b41 100644 +--- a/drivers/input/misc/rk805-pwrkey.c ++++ b/drivers/input/misc/rk805-pwrkey.c +@@ -98,6 +98,7 @@ static struct platform_driver rk805_pwrkey_driver = { + }; + module_platform_driver(rk805_pwrkey_driver); + ++MODULE_ALIAS("platform:rk805-pwrkey"); + MODULE_AUTHOR("Joseph Chen <chenjh@rock-chips.com>"); + MODULE_DESCRIPTION("RK805 PMIC Power Key driver"); + MODULE_LICENSE("GPL"); +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index 0834d5f866fd8..39d2b03e26317 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1416,42 +1416,37 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) + { + int ret; + struct device *dev = ir->dev; +- char *data; +- +- data = kzalloc(USB_CTRL_MSG_SZ, GFP_KERNEL); +- if (!data) { +- dev_err(dev, "%s: memory allocation failed!", __func__); +- return; +- } ++ char data[USB_CTRL_MSG_SZ]; + + /* + * This is a strange one. Windows issues a set address to the device + * on the receive control pipe and expect a certain value pair back + */ +- ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0), +- USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0, +- data, USB_CTRL_MSG_SZ, 3000); ++ ret = usb_control_msg_recv(ir->usbdev, 0, USB_REQ_SET_ADDRESS, ++ USB_DIR_IN | USB_TYPE_VENDOR, ++ 0, 0, data, USB_CTRL_MSG_SZ, 3000, ++ GFP_KERNEL); + dev_dbg(dev, "set address - ret = %d", ret); + dev_dbg(dev, "set address - data[0] = %d, data[1] = %d", + data[0], data[1]); + + /* set feature: bit rate 38400 bps */ +- ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), +- USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, +- 0xc04e, 0x0000, NULL, 0, 3000); ++ ret = usb_control_msg_send(ir->usbdev, 0, ++ USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, ++ 0xc04e, 0x0000, NULL, 0, 3000, GFP_KERNEL); + + dev_dbg(dev, "set feature - ret = %d", ret); + + /* bRequest 4: set char length to 8 bits */ +- ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), +- 4, USB_TYPE_VENDOR, +- 0x0808, 0x0000, NULL, 0, 3000); ++ ret = usb_control_msg_send(ir->usbdev, 0, ++ 4, USB_TYPE_VENDOR, ++ 0x0808, 0x0000, NULL, 0, 3000, GFP_KERNEL); + dev_dbg(dev, "set char length - retB = %d", ret); + + /* bRequest 2: set handshaking to use DTR/DSR */ +- ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), +- 2, USB_TYPE_VENDOR, +- 0x0000, 0x0100, NULL, 0, 3000); ++ ret = usb_control_msg_send(ir->usbdev, 0, ++ 2, USB_TYPE_VENDOR, ++ 0x0000, 0x0100, NULL, 0, 3000, GFP_KERNEL); + dev_dbg(dev, "set handshake - retC = %d", ret); + + /* device resume */ +@@ -1459,8 +1454,6 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) + + /* get hw/sw revision? */ + mce_command_out(ir, GET_REVISION, sizeof(GET_REVISION)); +- +- kfree(data); + } + + static void mceusb_gen2_init(struct mceusb_dev *ir) +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 93ebd174d8487..6e312ac856686 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1943,7 +1943,12 @@ static int fastrpc_cb_probe(struct platform_device *pdev) + of_property_read_u32(dev->of_node, "qcom,nsessions", &sessions); + + spin_lock_irqsave(&cctx->lock, flags); +- sess = &cctx->session[cctx->sesscount]; ++ if (cctx->sesscount >= FASTRPC_MAX_SESSIONS) { ++ dev_err(&pdev->dev, "too many sessions\n"); ++ spin_unlock_irqrestore(&cctx->lock, flags); ++ return -ENOSPC; ++ } ++ sess = &cctx->session[cctx->sesscount++]; + sess->used = false; + sess->valid = true; + sess->dev = dev; +@@ -1956,13 +1961,12 @@ static int fastrpc_cb_probe(struct platform_device *pdev) + struct fastrpc_session_ctx *dup_sess; + + for (i = 1; i < sessions; i++) { +- if (cctx->sesscount++ >= FASTRPC_MAX_SESSIONS) ++ if (cctx->sesscount >= FASTRPC_MAX_SESSIONS) + break; +- dup_sess = &cctx->session[cctx->sesscount]; ++ dup_sess = &cctx->session[cctx->sesscount++]; + memcpy(dup_sess, sess, sizeof(*dup_sess)); + } + } +- cctx->sesscount++; + spin_unlock_irqrestore(&cctx->lock, flags); + rc = dma_set_mask(dev, DMA_BIT_MASK(32)); + if (rc) { +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index c5f1df6ce4c0a..5e4e2d2182d91 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -949,15 +949,16 @@ int mmc_sd_setup_card(struct mmc_host *host, struct mmc_card *card, + + /* Erase init depends on CSD and SSR */ + mmc_init_erase(card); +- +- /* +- * Fetch switch information from card. +- */ +- err = mmc_read_switch(card); +- if (err) +- return err; + } + ++ /* ++ * Fetch switch information from card. Note, sd3_bus_mode can change if ++ * voltage switch outcome changes, so do this always. ++ */ ++ err = mmc_read_switch(card); ++ if (err) ++ return err; ++ + /* + * For SPI, enable CRC as appropriate. + * This CRC enable is located AFTER the reading of the +@@ -1480,26 +1481,15 @@ retry: + if (!v18_fixup_failed && !mmc_host_is_spi(host) && mmc_host_uhs(host) && + mmc_sd_card_using_v18(card) && + host->ios.signal_voltage != MMC_SIGNAL_VOLTAGE_180) { +- /* +- * Re-read switch information in case it has changed since +- * oldcard was initialized. +- */ +- if (oldcard) { +- err = mmc_read_switch(card); +- if (err) +- goto free_card; +- } +- if (mmc_sd_card_using_v18(card)) { +- if (mmc_host_set_uhs_voltage(host) || +- mmc_sd_init_uhs_card(card)) { +- v18_fixup_failed = true; +- mmc_power_cycle(host, ocr); +- if (!oldcard) +- mmc_remove_card(card); +- goto retry; +- } +- goto done; ++ if (mmc_host_set_uhs_voltage(host) || ++ mmc_sd_init_uhs_card(card)) { ++ v18_fixup_failed = true; ++ mmc_power_cycle(host, ocr); ++ if (!oldcard) ++ mmc_remove_card(card); ++ goto retry; + } ++ goto cont; + } + + /* Initialization sequence for UHS-I cards */ +@@ -1534,7 +1524,7 @@ retry: + mmc_set_bus_width(host, MMC_BUS_WIDTH_4); + } + } +- ++cont: + if (!oldcard) { + /* Read/parse the extension registers. */ + err = sd_read_ext_regs(card); +@@ -1566,7 +1556,7 @@ retry: + err = -EINVAL; + goto free_card; + } +-done: ++ + host->card = card; + return 0; + +diff --git a/drivers/net/dsa/xrs700x/xrs700x.c b/drivers/net/dsa/xrs700x/xrs700x.c +index 3887ed33c5fe2..fa622639d6401 100644 +--- a/drivers/net/dsa/xrs700x/xrs700x.c ++++ b/drivers/net/dsa/xrs700x/xrs700x.c +@@ -109,6 +109,7 @@ static void xrs700x_read_port_counters(struct xrs700x *priv, int port) + { + struct xrs700x_port *p = &priv->ports[port]; + struct rtnl_link_stats64 stats; ++ unsigned long flags; + int i; + + memset(&stats, 0, sizeof(stats)); +@@ -138,9 +139,9 @@ static void xrs700x_read_port_counters(struct xrs700x *priv, int port) + */ + stats.rx_packets += stats.multicast; + +- u64_stats_update_begin(&p->syncp); ++ flags = u64_stats_update_begin_irqsave(&p->syncp); + p->stats64 = stats; +- u64_stats_update_end(&p->syncp); ++ u64_stats_update_end_irqrestore(&p->syncp, flags); + + mutex_unlock(&p->mib_mutex); + } +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 9e6de2f968fa3..6dae768671e3d 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -1919,7 +1919,7 @@ static void gmac_get_stats64(struct net_device *netdev, + + /* Racing with RX NAPI */ + do { +- start = u64_stats_fetch_begin(&port->rx_stats_syncp); ++ start = u64_stats_fetch_begin_irq(&port->rx_stats_syncp); + + stats->rx_packets = port->stats.rx_packets; + stats->rx_bytes = port->stats.rx_bytes; +@@ -1931,11 +1931,11 @@ static void gmac_get_stats64(struct net_device *netdev, + stats->rx_crc_errors = port->stats.rx_crc_errors; + stats->rx_frame_errors = port->stats.rx_frame_errors; + +- } while (u64_stats_fetch_retry(&port->rx_stats_syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&port->rx_stats_syncp, start)); + + /* Racing with MIB and TX completion interrupts */ + do { +- start = u64_stats_fetch_begin(&port->ir_stats_syncp); ++ start = u64_stats_fetch_begin_irq(&port->ir_stats_syncp); + + stats->tx_errors = port->stats.tx_errors; + stats->tx_packets = port->stats.tx_packets; +@@ -1945,15 +1945,15 @@ static void gmac_get_stats64(struct net_device *netdev, + stats->rx_missed_errors = port->stats.rx_missed_errors; + stats->rx_fifo_errors = port->stats.rx_fifo_errors; + +- } while (u64_stats_fetch_retry(&port->ir_stats_syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&port->ir_stats_syncp, start)); + + /* Racing with hard_start_xmit */ + do { +- start = u64_stats_fetch_begin(&port->tx_stats_syncp); ++ start = u64_stats_fetch_begin_irq(&port->tx_stats_syncp); + + stats->tx_dropped = port->stats.tx_dropped; + +- } while (u64_stats_fetch_retry(&port->tx_stats_syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&port->tx_stats_syncp, start)); + + stats->rx_dropped += stats->rx_missed_errors; + } +@@ -2031,18 +2031,18 @@ static void gmac_get_ethtool_stats(struct net_device *netdev, + /* Racing with MIB interrupt */ + do { + p = values; +- start = u64_stats_fetch_begin(&port->ir_stats_syncp); ++ start = u64_stats_fetch_begin_irq(&port->ir_stats_syncp); + + for (i = 0; i < RX_STATS_NUM; i++) + *p++ = port->hw_stats[i]; + +- } while (u64_stats_fetch_retry(&port->ir_stats_syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&port->ir_stats_syncp, start)); + values = p; + + /* Racing with RX NAPI */ + do { + p = values; +- start = u64_stats_fetch_begin(&port->rx_stats_syncp); ++ start = u64_stats_fetch_begin_irq(&port->rx_stats_syncp); + + for (i = 0; i < RX_STATUS_NUM; i++) + *p++ = port->rx_stats[i]; +@@ -2050,13 +2050,13 @@ static void gmac_get_ethtool_stats(struct net_device *netdev, + *p++ = port->rx_csum_stats[i]; + *p++ = port->rx_napi_exits; + +- } while (u64_stats_fetch_retry(&port->rx_stats_syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&port->rx_stats_syncp, start)); + values = p; + + /* Racing with TX start_xmit */ + do { + p = values; +- start = u64_stats_fetch_begin(&port->tx_stats_syncp); ++ start = u64_stats_fetch_begin_irq(&port->tx_stats_syncp); + + for (i = 0; i < TX_MAX_FRAGS; i++) { + *values++ = port->tx_frag_stats[i]; +@@ -2065,7 +2065,7 @@ static void gmac_get_ethtool_stats(struct net_device *netdev, + *values++ = port->tx_frags_linearized; + *values++ = port->tx_hw_csummed; + +- } while (u64_stats_fetch_retry(&port->tx_stats_syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&port->tx_stats_syncp, start)); + } + + static int gmac_get_ksettings(struct net_device *netdev, +diff --git a/drivers/net/ethernet/fungible/funeth/funeth_txrx.h b/drivers/net/ethernet/fungible/funeth/funeth_txrx.h +index 8708e2895946d..6b125ed04bbad 100644 +--- a/drivers/net/ethernet/fungible/funeth/funeth_txrx.h ++++ b/drivers/net/ethernet/fungible/funeth/funeth_txrx.h +@@ -205,9 +205,9 @@ struct funeth_rxq { + + #define FUN_QSTAT_READ(q, seq, stats_copy) \ + do { \ +- seq = u64_stats_fetch_begin(&(q)->syncp); \ ++ seq = u64_stats_fetch_begin_irq(&(q)->syncp); \ + stats_copy = (q)->stats; \ +- } while (u64_stats_fetch_retry(&(q)->syncp, (seq))) ++ } while (u64_stats_fetch_retry_irq(&(q)->syncp, (seq))) + + #define FUN_INT_NAME_LEN (IFNAMSIZ + 16) + +diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c +index 50b384910c839..7b9a2d9d96243 100644 +--- a/drivers/net/ethernet/google/gve/gve_ethtool.c ++++ b/drivers/net/ethernet/google/gve/gve_ethtool.c +@@ -177,14 +177,14 @@ gve_get_ethtool_stats(struct net_device *netdev, + struct gve_rx_ring *rx = &priv->rx[ring]; + + start = +- u64_stats_fetch_begin(&priv->rx[ring].statss); ++ u64_stats_fetch_begin_irq(&priv->rx[ring].statss); + tmp_rx_pkts = rx->rpackets; + tmp_rx_bytes = rx->rbytes; + tmp_rx_skb_alloc_fail = rx->rx_skb_alloc_fail; + tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail; + tmp_rx_desc_err_dropped_pkt = + rx->rx_desc_err_dropped_pkt; +- } while (u64_stats_fetch_retry(&priv->rx[ring].statss, ++ } while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss, + start)); + rx_pkts += tmp_rx_pkts; + rx_bytes += tmp_rx_bytes; +@@ -198,10 +198,10 @@ gve_get_ethtool_stats(struct net_device *netdev, + if (priv->tx) { + do { + start = +- u64_stats_fetch_begin(&priv->tx[ring].statss); ++ u64_stats_fetch_begin_irq(&priv->tx[ring].statss); + tmp_tx_pkts = priv->tx[ring].pkt_done; + tmp_tx_bytes = priv->tx[ring].bytes_done; +- } while (u64_stats_fetch_retry(&priv->tx[ring].statss, ++ } while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss, + start)); + tx_pkts += tmp_tx_pkts; + tx_bytes += tmp_tx_bytes; +@@ -259,13 +259,13 @@ gve_get_ethtool_stats(struct net_device *netdev, + data[i++] = rx->fill_cnt - rx->cnt; + do { + start = +- u64_stats_fetch_begin(&priv->rx[ring].statss); ++ u64_stats_fetch_begin_irq(&priv->rx[ring].statss); + tmp_rx_bytes = rx->rbytes; + tmp_rx_skb_alloc_fail = rx->rx_skb_alloc_fail; + tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail; + tmp_rx_desc_err_dropped_pkt = + rx->rx_desc_err_dropped_pkt; +- } while (u64_stats_fetch_retry(&priv->rx[ring].statss, ++ } while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss, + start)); + data[i++] = tmp_rx_bytes; + data[i++] = rx->rx_cont_packet_cnt; +@@ -331,9 +331,9 @@ gve_get_ethtool_stats(struct net_device *netdev, + } + do { + start = +- u64_stats_fetch_begin(&priv->tx[ring].statss); ++ u64_stats_fetch_begin_irq(&priv->tx[ring].statss); + tmp_tx_bytes = tx->bytes_done; +- } while (u64_stats_fetch_retry(&priv->tx[ring].statss, ++ } while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss, + start)); + data[i++] = tmp_tx_bytes; + data[i++] = tx->wake_queue; +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index 6cafee55efc32..044db3ebb071c 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -51,10 +51,10 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + for (ring = 0; ring < priv->rx_cfg.num_queues; ring++) { + do { + start = +- u64_stats_fetch_begin(&priv->rx[ring].statss); ++ u64_stats_fetch_begin_irq(&priv->rx[ring].statss); + packets = priv->rx[ring].rpackets; + bytes = priv->rx[ring].rbytes; +- } while (u64_stats_fetch_retry(&priv->rx[ring].statss, ++ } while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss, + start)); + s->rx_packets += packets; + s->rx_bytes += bytes; +@@ -64,10 +64,10 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + for (ring = 0; ring < priv->tx_cfg.num_queues; ring++) { + do { + start = +- u64_stats_fetch_begin(&priv->tx[ring].statss); ++ u64_stats_fetch_begin_irq(&priv->tx[ring].statss); + packets = priv->tx[ring].pkt_done; + bytes = priv->tx[ring].bytes_done; +- } while (u64_stats_fetch_retry(&priv->tx[ring].statss, ++ } while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss, + start)); + s->tx_packets += packets; + s->tx_bytes += bytes; +@@ -1274,9 +1274,9 @@ void gve_handle_report_stats(struct gve_priv *priv) + } + + do { +- start = u64_stats_fetch_begin(&priv->tx[idx].statss); ++ start = u64_stats_fetch_begin_irq(&priv->tx[idx].statss); + tx_bytes = priv->tx[idx].bytes_done; +- } while (u64_stats_fetch_retry(&priv->tx[idx].statss, start)); ++ } while (u64_stats_fetch_retry_irq(&priv->tx[idx].statss, start)); + stats[stats_idx++] = (struct stats) { + .stat_name = cpu_to_be32(TX_WAKE_CNT), + .value = cpu_to_be64(priv->tx[idx].wake_queue), +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c +index a866bea651103..e5828a658caf4 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c +@@ -74,14 +74,14 @@ void hinic_rxq_get_stats(struct hinic_rxq *rxq, struct hinic_rxq_stats *stats) + unsigned int start; + + do { +- start = u64_stats_fetch_begin(&rxq_stats->syncp); ++ start = u64_stats_fetch_begin_irq(&rxq_stats->syncp); + stats->pkts = rxq_stats->pkts; + stats->bytes = rxq_stats->bytes; + stats->errors = rxq_stats->csum_errors + + rxq_stats->other_errors; + stats->csum_errors = rxq_stats->csum_errors; + stats->other_errors = rxq_stats->other_errors; +- } while (u64_stats_fetch_retry(&rxq_stats->syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&rxq_stats->syncp, start)); + } + + /** +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c +index 5051cdff2384b..3b6c7b5857376 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c +@@ -99,14 +99,14 @@ void hinic_txq_get_stats(struct hinic_txq *txq, struct hinic_txq_stats *stats) + unsigned int start; + + do { +- start = u64_stats_fetch_begin(&txq_stats->syncp); ++ start = u64_stats_fetch_begin_irq(&txq_stats->syncp); + stats->pkts = txq_stats->pkts; + stats->bytes = txq_stats->bytes; + stats->tx_busy = txq_stats->tx_busy; + stats->tx_wake = txq_stats->tx_wake; + stats->tx_dropped = txq_stats->tx_dropped; + stats->big_frags_pkts = txq_stats->big_frags_pkts; +- } while (u64_stats_fetch_retry(&txq_stats->syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&txq_stats->syncp, start)); + } + + /** +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +index 5fdf9b7179f55..5a1027b072155 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +@@ -75,6 +75,7 @@ struct mlxbf_gige { + struct net_device *netdev; + struct platform_device *pdev; + void __iomem *mdio_io; ++ void __iomem *clk_io; + struct mii_bus *mdiobus; + spinlock_t lock; /* for packet processing indices */ + u16 rx_q_entries; +@@ -137,7 +138,8 @@ enum mlxbf_gige_res { + MLXBF_GIGE_RES_MDIO9, + MLXBF_GIGE_RES_GPIO0, + MLXBF_GIGE_RES_LLU, +- MLXBF_GIGE_RES_PLU ++ MLXBF_GIGE_RES_PLU, ++ MLXBF_GIGE_RES_CLK + }; + + /* Version of register data returned by mlxbf_gige_get_regs() */ +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c +index 2e6c1b7af0964..85155cd9405c5 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c +@@ -22,10 +22,23 @@ + #include <linux/property.h> + + #include "mlxbf_gige.h" ++#include "mlxbf_gige_regs.h" + + #define MLXBF_GIGE_MDIO_GW_OFFSET 0x0 + #define MLXBF_GIGE_MDIO_CFG_OFFSET 0x4 + ++#define MLXBF_GIGE_MDIO_FREQ_REFERENCE 156250000ULL ++#define MLXBF_GIGE_MDIO_COREPLL_CONST 16384ULL ++#define MLXBF_GIGE_MDC_CLK_NS 400 ++#define MLXBF_GIGE_MDIO_PLL_I1CLK_REG1 0x4 ++#define MLXBF_GIGE_MDIO_PLL_I1CLK_REG2 0x8 ++#define MLXBF_GIGE_MDIO_CORE_F_SHIFT 0 ++#define MLXBF_GIGE_MDIO_CORE_F_MASK GENMASK(25, 0) ++#define MLXBF_GIGE_MDIO_CORE_R_SHIFT 26 ++#define MLXBF_GIGE_MDIO_CORE_R_MASK GENMASK(31, 26) ++#define MLXBF_GIGE_MDIO_CORE_OD_SHIFT 0 ++#define MLXBF_GIGE_MDIO_CORE_OD_MASK GENMASK(3, 0) ++ + /* Support clause 22 */ + #define MLXBF_GIGE_MDIO_CL22_ST1 0x1 + #define MLXBF_GIGE_MDIO_CL22_WRITE 0x1 +@@ -50,27 +63,76 @@ + #define MLXBF_GIGE_MDIO_CFG_MDIO_IN_SAMP_MASK GENMASK(23, 16) + #define MLXBF_GIGE_MDIO_CFG_MDIO_OUT_SAMP_MASK GENMASK(31, 24) + ++#define MLXBF_GIGE_MDIO_CFG_VAL (FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_MODE_MASK, 1) | \ ++ FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO3_3_MASK, 1) | \ ++ FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_FULL_DRIVE_MASK, 1) | \ ++ FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_IN_SAMP_MASK, 6) | \ ++ FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_OUT_SAMP_MASK, 13)) ++ ++#define MLXBF_GIGE_BF2_COREPLL_ADDR 0x02800c30 ++#define MLXBF_GIGE_BF2_COREPLL_SIZE 0x0000000c ++ ++static struct resource corepll_params[] = { ++ [MLXBF_GIGE_VERSION_BF2] = { ++ .start = MLXBF_GIGE_BF2_COREPLL_ADDR, ++ .end = MLXBF_GIGE_BF2_COREPLL_ADDR + MLXBF_GIGE_BF2_COREPLL_SIZE - 1, ++ .name = "COREPLL_RES" ++ }, ++}; ++ ++/* Returns core clock i1clk in Hz */ ++static u64 calculate_i1clk(struct mlxbf_gige *priv) ++{ ++ u8 core_od, core_r; ++ u64 freq_output; ++ u32 reg1, reg2; ++ u32 core_f; ++ ++ reg1 = readl(priv->clk_io + MLXBF_GIGE_MDIO_PLL_I1CLK_REG1); ++ reg2 = readl(priv->clk_io + MLXBF_GIGE_MDIO_PLL_I1CLK_REG2); ++ ++ core_f = (reg1 & MLXBF_GIGE_MDIO_CORE_F_MASK) >> ++ MLXBF_GIGE_MDIO_CORE_F_SHIFT; ++ core_r = (reg1 & MLXBF_GIGE_MDIO_CORE_R_MASK) >> ++ MLXBF_GIGE_MDIO_CORE_R_SHIFT; ++ core_od = (reg2 & MLXBF_GIGE_MDIO_CORE_OD_MASK) >> ++ MLXBF_GIGE_MDIO_CORE_OD_SHIFT; ++ ++ /* Compute PLL output frequency as follow: ++ * ++ * CORE_F / 16384 ++ * freq_output = freq_reference * ---------------------------- ++ * (CORE_R + 1) * (CORE_OD + 1) ++ */ ++ freq_output = div_u64((MLXBF_GIGE_MDIO_FREQ_REFERENCE * core_f), ++ MLXBF_GIGE_MDIO_COREPLL_CONST); ++ freq_output = div_u64(freq_output, (core_r + 1) * (core_od + 1)); ++ ++ return freq_output; ++} ++ + /* Formula for encoding the MDIO period. The encoded value is + * passed to the MDIO config register. + * +- * mdc_clk = 2*(val + 1)*i1clk ++ * mdc_clk = 2*(val + 1)*(core clock in sec) + * +- * 400 ns = 2*(val + 1)*(((1/430)*1000) ns) ++ * i1clk is in Hz: ++ * 400 ns = 2*(val + 1)*(1/i1clk) + * +- * val = (((400 * 430 / 1000) / 2) - 1) ++ * val = (((400/10^9) / (1/i1clk) / 2) - 1) ++ * val = (400/2 * i1clk)/10^9 - 1 + */ +-#define MLXBF_GIGE_I1CLK_MHZ 430 +-#define MLXBF_GIGE_MDC_CLK_NS 400 ++static u8 mdio_period_map(struct mlxbf_gige *priv) ++{ ++ u8 mdio_period; ++ u64 i1clk; + +-#define MLXBF_GIGE_MDIO_PERIOD (((MLXBF_GIGE_MDC_CLK_NS * MLXBF_GIGE_I1CLK_MHZ / 1000) / 2) - 1) ++ i1clk = calculate_i1clk(priv); + +-#define MLXBF_GIGE_MDIO_CFG_VAL (FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_MODE_MASK, 1) | \ +- FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO3_3_MASK, 1) | \ +- FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_FULL_DRIVE_MASK, 1) | \ +- FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDC_PERIOD_MASK, \ +- MLXBF_GIGE_MDIO_PERIOD) | \ +- FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_IN_SAMP_MASK, 6) | \ +- FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_OUT_SAMP_MASK, 13)) ++ mdio_period = div_u64((MLXBF_GIGE_MDC_CLK_NS >> 1) * i1clk, 1000000000) - 1; ++ ++ return mdio_period; ++} + + static u32 mlxbf_gige_mdio_create_cmd(u16 data, int phy_add, + int phy_reg, u32 opcode) +@@ -124,9 +186,9 @@ static int mlxbf_gige_mdio_write(struct mii_bus *bus, int phy_add, + int phy_reg, u16 val) + { + struct mlxbf_gige *priv = bus->priv; ++ u32 temp; + u32 cmd; + int ret; +- u32 temp; + + if (phy_reg & MII_ADDR_C45) + return -EOPNOTSUPP; +@@ -144,18 +206,44 @@ static int mlxbf_gige_mdio_write(struct mii_bus *bus, int phy_add, + return ret; + } + ++static void mlxbf_gige_mdio_cfg(struct mlxbf_gige *priv) ++{ ++ u8 mdio_period; ++ u32 val; ++ ++ mdio_period = mdio_period_map(priv); ++ ++ val = MLXBF_GIGE_MDIO_CFG_VAL; ++ val |= FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDC_PERIOD_MASK, mdio_period); ++ writel(val, priv->mdio_io + MLXBF_GIGE_MDIO_CFG_OFFSET); ++} ++ + int mlxbf_gige_mdio_probe(struct platform_device *pdev, struct mlxbf_gige *priv) + { + struct device *dev = &pdev->dev; ++ struct resource *res; + int ret; + + priv->mdio_io = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MDIO9); + if (IS_ERR(priv->mdio_io)) + return PTR_ERR(priv->mdio_io); + +- /* Configure mdio parameters */ +- writel(MLXBF_GIGE_MDIO_CFG_VAL, +- priv->mdio_io + MLXBF_GIGE_MDIO_CFG_OFFSET); ++ /* clk resource shared with other drivers so cannot use ++ * devm_platform_ioremap_resource ++ */ ++ res = platform_get_resource(pdev, IORESOURCE_MEM, MLXBF_GIGE_RES_CLK); ++ if (!res) { ++ /* For backward compatibility with older ACPI tables, also keep ++ * CLK resource internal to the driver. ++ */ ++ res = &corepll_params[MLXBF_GIGE_VERSION_BF2]; ++ } ++ ++ priv->clk_io = devm_ioremap(dev, res->start, resource_size(res)); ++ if (IS_ERR(priv->clk_io)) ++ return PTR_ERR(priv->clk_io); ++ ++ mlxbf_gige_mdio_cfg(priv); + + priv->mdiobus = devm_mdiobus_alloc(dev); + if (!priv->mdiobus) { +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h +index 5fb33c9294bf9..7be3a793984d5 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h +@@ -8,6 +8,8 @@ + #ifndef __MLXBF_GIGE_REGS_H__ + #define __MLXBF_GIGE_REGS_H__ + ++#define MLXBF_GIGE_VERSION 0x0000 ++#define MLXBF_GIGE_VERSION_BF2 0x0 + #define MLXBF_GIGE_STATUS 0x0010 + #define MLXBF_GIGE_STATUS_READY BIT(0) + #define MLXBF_GIGE_INT_STATUS 0x0028 +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +index fe663b0ab7086..68d87e61bdc05 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +@@ -423,7 +423,8 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, + + parms = mlxsw_sp_ipip_netdev_parms4(to_dev); + ip_tunnel_init_flow(&fl4, parms.iph.protocol, *daddrp, *saddrp, +- 0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0); ++ 0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0, ++ 0); + + rt = ip_route_output_key(tun->net, &fl4); + if (IS_ERR(rt)) +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +index 6dea7f8c14814..51f8a08163777 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +@@ -425,7 +425,8 @@ static struct sk_buff *lan966x_fdma_rx_get_frame(struct lan966x_rx *rx) + lan966x_ifh_get_src_port(skb->data, &src_port); + lan966x_ifh_get_timestamp(skb->data, ×tamp); + +- WARN_ON(src_port >= lan966x->num_phys_ports); ++ if (WARN_ON(src_port >= lan966x->num_phys_ports)) ++ goto free_skb; + + skb->dev = lan966x->ports[src_port]->dev; + skb_pull(skb, IFH_LEN * sizeof(u32)); +@@ -449,6 +450,8 @@ static struct sk_buff *lan966x_fdma_rx_get_frame(struct lan966x_rx *rx) + + return skb; + ++free_skb: ++ kfree_skb(skb); + unmap_page: + dma_unmap_page(lan966x->dev, (dma_addr_t)db->dataptr, + FDMA_DCB_STATUS_BLOCKL(db->status), +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c b/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c +index 304f84aadc36b..21844beba72df 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c +@@ -113,6 +113,8 @@ static void sparx5_xtr_grp(struct sparx5 *sparx5, u8 grp, bool byte_swap) + /* This assumes STATUS_WORD_POS == 1, Status + * just after last data + */ ++ if (!byte_swap) ++ val = ntohl((__force __be32)val); + byte_cnt -= (4 - XTR_VALID_BYTES(val)); + eof_flag = true; + break; +diff --git a/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c b/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c +index 3206ba83b1aaa..de2ef5bf8c694 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c +@@ -127,10 +127,11 @@ static int nfp_policer_validate(const struct flow_action *action, + return -EOPNOTSUPP; + } + +- if (act->police.notexceed.act_id != FLOW_ACTION_PIPE && ++ if (act->police.notexceed.act_id != FLOW_ACTION_CONTINUE && ++ act->police.notexceed.act_id != FLOW_ACTION_PIPE && + act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) { + NL_SET_ERR_MSG_MOD(extack, +- "Offload not supported when conform action is not pipe or ok"); ++ "Offload not supported when conform action is not continue, pipe or ok"); + return -EOPNOTSUPP; + } + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +index 4e56a99087fab..32d46f07ea851 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -1629,21 +1629,21 @@ static void nfp_net_stat64(struct net_device *netdev, + unsigned int start; + + do { +- start = u64_stats_fetch_begin(&r_vec->rx_sync); ++ start = u64_stats_fetch_begin_irq(&r_vec->rx_sync); + data[0] = r_vec->rx_pkts; + data[1] = r_vec->rx_bytes; + data[2] = r_vec->rx_drops; +- } while (u64_stats_fetch_retry(&r_vec->rx_sync, start)); ++ } while (u64_stats_fetch_retry_irq(&r_vec->rx_sync, start)); + stats->rx_packets += data[0]; + stats->rx_bytes += data[1]; + stats->rx_dropped += data[2]; + + do { +- start = u64_stats_fetch_begin(&r_vec->tx_sync); ++ start = u64_stats_fetch_begin_irq(&r_vec->tx_sync); + data[0] = r_vec->tx_pkts; + data[1] = r_vec->tx_bytes; + data[2] = r_vec->tx_errors; +- } while (u64_stats_fetch_retry(&r_vec->tx_sync, start)); ++ } while (u64_stats_fetch_retry_irq(&r_vec->tx_sync, start)); + stats->tx_packets += data[0]; + stats->tx_bytes += data[1]; + stats->tx_errors += data[2]; +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index e6ee45afd80c7..2d7d30ec54301 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -494,7 +494,7 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data) + unsigned int start; + + do { +- start = u64_stats_fetch_begin(&nn->r_vecs[i].rx_sync); ++ start = u64_stats_fetch_begin_irq(&nn->r_vecs[i].rx_sync); + data[0] = nn->r_vecs[i].rx_pkts; + tmp[0] = nn->r_vecs[i].hw_csum_rx_ok; + tmp[1] = nn->r_vecs[i].hw_csum_rx_inner_ok; +@@ -502,10 +502,10 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data) + tmp[3] = nn->r_vecs[i].hw_csum_rx_error; + tmp[4] = nn->r_vecs[i].rx_replace_buf_alloc_fail; + tmp[5] = nn->r_vecs[i].hw_tls_rx; +- } while (u64_stats_fetch_retry(&nn->r_vecs[i].rx_sync, start)); ++ } while (u64_stats_fetch_retry_irq(&nn->r_vecs[i].rx_sync, start)); + + do { +- start = u64_stats_fetch_begin(&nn->r_vecs[i].tx_sync); ++ start = u64_stats_fetch_begin_irq(&nn->r_vecs[i].tx_sync); + data[1] = nn->r_vecs[i].tx_pkts; + data[2] = nn->r_vecs[i].tx_busy; + tmp[6] = nn->r_vecs[i].hw_csum_tx; +@@ -515,7 +515,7 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data) + tmp[10] = nn->r_vecs[i].hw_tls_tx; + tmp[11] = nn->r_vecs[i].tls_tx_fallback; + tmp[12] = nn->r_vecs[i].tls_tx_no_fallback; +- } while (u64_stats_fetch_retry(&nn->r_vecs[i].tx_sync, start)); ++ } while (u64_stats_fetch_retry_irq(&nn->r_vecs[i].tx_sync, start)); + + data += NN_RVEC_PER_Q_STATS; + +diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c +index bc70c6abd6a5b..58cf7cc54f408 100644 +--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c ++++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c +@@ -1273,7 +1273,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *ofdpa_port, + bool removing; + int err = 0; + +- entry = kzalloc(sizeof(*entry), GFP_KERNEL); ++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); + if (!entry) + return -ENOMEM; + +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c +index 3bf20211cceb4..3829c2805b16c 100644 +--- a/drivers/net/ethernet/smsc/smsc911x.c ++++ b/drivers/net/ethernet/smsc/smsc911x.c +@@ -1037,6 +1037,8 @@ static int smsc911x_mii_probe(struct net_device *dev) + return ret; + } + ++ /* Indicate that the MAC is responsible for managing PHY PM */ ++ phydev->mac_managed_pm = true; + phy_attached_info(phydev); + + phy_set_max_speed(phydev, SPEED_100); +@@ -2587,6 +2589,8 @@ static int smsc911x_suspend(struct device *dev) + if (netif_running(ndev)) { + netif_stop_queue(ndev); + netif_device_detach(ndev); ++ if (!device_may_wakeup(dev)) ++ phy_stop(ndev->phydev); + } + + /* enable wake on LAN, energy detection and the external PME +@@ -2628,6 +2632,8 @@ static int smsc911x_resume(struct device *dev) + if (netif_running(ndev)) { + netif_device_attach(ndev); + netif_start_queue(ndev); ++ if (!device_may_wakeup(dev)) ++ phy_start(ndev->phydev); + } + + return 0; +diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c +index 6afdf1622944e..5cf218c674a5a 100644 +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -1310,10 +1310,11 @@ static void adf7242_remove(struct spi_device *spi) + + debugfs_remove_recursive(lp->debugfs_root); + ++ ieee802154_unregister_hw(lp->hw); ++ + cancel_delayed_work_sync(&lp->work); + destroy_workqueue(lp->wqueue); + +- ieee802154_unregister_hw(lp->hw); + mutex_destroy(&lp->bmux); + ieee802154_free_hw(lp->hw); + } +diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c +index e470e3398abc2..9a1a5b2036240 100644 +--- a/drivers/net/netdevsim/netdev.c ++++ b/drivers/net/netdevsim/netdev.c +@@ -67,10 +67,10 @@ nsim_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats) + unsigned int start; + + do { +- start = u64_stats_fetch_begin(&ns->syncp); ++ start = u64_stats_fetch_begin_irq(&ns->syncp); + stats->tx_bytes = ns->tx_bytes; + stats->tx_packets = ns->tx_packets; +- } while (u64_stats_fetch_retry(&ns->syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&ns->syncp, start)); + } + + static int +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 22139901f01c7..34483a4bd688a 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -2838,12 +2838,18 @@ static int lan8814_config_init(struct phy_device *phydev) + return 0; + } + ++/* It is expected that there will not be any 'lan8814_take_coma_mode' ++ * function called in suspend. Because the GPIO line can be shared, so if one of ++ * the phys goes back in coma mode, then all the other PHYs will go, which is ++ * wrong. ++ */ + static int lan8814_release_coma_mode(struct phy_device *phydev) + { + struct gpio_desc *gpiod; + + gpiod = devm_gpiod_get_optional(&phydev->mdio.dev, "coma-mode", +- GPIOD_OUT_HIGH_OPEN_DRAIN); ++ GPIOD_OUT_HIGH_OPEN_DRAIN | ++ GPIOD_FLAGS_BIT_NONEXCLUSIVE); + if (IS_ERR(gpiod)) + return PTR_ERR(gpiod); + +diff --git a/drivers/peci/controller/peci-aspeed.c b/drivers/peci/controller/peci-aspeed.c +index 1925ddc13f002..731c5d8f75c66 100644 +--- a/drivers/peci/controller/peci-aspeed.c ++++ b/drivers/peci/controller/peci-aspeed.c +@@ -523,7 +523,7 @@ static int aspeed_peci_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + + priv->irq = platform_get_irq(pdev, 0); +- if (!priv->irq) ++ if (priv->irq < 0) + return priv->irq; + + ret = devm_request_irq(&pdev->dev, priv->irq, aspeed_peci_irq_handler, +diff --git a/drivers/platform/mellanox/mlxreg-lc.c b/drivers/platform/mellanox/mlxreg-lc.c +index 55834ccb4ac7c..e578c7bc060bb 100644 +--- a/drivers/platform/mellanox/mlxreg-lc.c ++++ b/drivers/platform/mellanox/mlxreg-lc.c +@@ -460,8 +460,6 @@ static int mlxreg_lc_power_on_off(struct mlxreg_lc *mlxreg_lc, u8 action) + u32 regval; + int err; + +- mutex_lock(&mlxreg_lc->lock); +- + err = regmap_read(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_pwr, ®val); + if (err) + goto regmap_read_fail; +@@ -474,7 +472,6 @@ static int mlxreg_lc_power_on_off(struct mlxreg_lc *mlxreg_lc, u8 action) + err = regmap_write(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_pwr, regval); + + regmap_read_fail: +- mutex_unlock(&mlxreg_lc->lock); + return err; + } + +@@ -491,8 +488,6 @@ static int mlxreg_lc_enable_disable(struct mlxreg_lc *mlxreg_lc, bool action) + * line card which is already has been enabled. Disabling does not affect the disabled line + * card. + */ +- mutex_lock(&mlxreg_lc->lock); +- + err = regmap_read(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_ena, ®val); + if (err) + goto regmap_read_fail; +@@ -505,7 +500,6 @@ static int mlxreg_lc_enable_disable(struct mlxreg_lc *mlxreg_lc, bool action) + err = regmap_write(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_ena, regval); + + regmap_read_fail: +- mutex_unlock(&mlxreg_lc->lock); + return err; + } + +@@ -537,6 +531,15 @@ mlxreg_lc_sn4800_c16_config_init(struct mlxreg_lc *mlxreg_lc, void *regmap, + + static void + mlxreg_lc_state_update(struct mlxreg_lc *mlxreg_lc, enum mlxreg_lc_state state, u8 action) ++{ ++ if (action) ++ mlxreg_lc->state |= state; ++ else ++ mlxreg_lc->state &= ~state; ++} ++ ++static void ++mlxreg_lc_state_update_locked(struct mlxreg_lc *mlxreg_lc, enum mlxreg_lc_state state, u8 action) + { + mutex_lock(&mlxreg_lc->lock); + +@@ -560,8 +563,11 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind, + dev_info(mlxreg_lc->dev, "linecard#%d state %d event kind %d action %d\n", + mlxreg_lc->data->slot, mlxreg_lc->state, kind, action); + +- if (!(mlxreg_lc->state & MLXREG_LC_INITIALIZED)) ++ mutex_lock(&mlxreg_lc->lock); ++ if (!(mlxreg_lc->state & MLXREG_LC_INITIALIZED)) { ++ mutex_unlock(&mlxreg_lc->lock); + return 0; ++ } + + switch (kind) { + case MLXREG_HOTPLUG_LC_SYNCED: +@@ -574,7 +580,7 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind, + if (!(mlxreg_lc->state & MLXREG_LC_POWERED) && action) { + err = mlxreg_lc_power_on_off(mlxreg_lc, 1); + if (err) +- return err; ++ goto mlxreg_lc_power_on_off_fail; + } + /* In case line card is configured - enable it. */ + if (mlxreg_lc->state & MLXREG_LC_CONFIGURED && action) +@@ -588,12 +594,13 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind, + /* In case line card is configured - enable it. */ + if (mlxreg_lc->state & MLXREG_LC_CONFIGURED) + err = mlxreg_lc_enable_disable(mlxreg_lc, 1); ++ mutex_unlock(&mlxreg_lc->lock); + return err; + } + err = mlxreg_lc_create_static_devices(mlxreg_lc, mlxreg_lc->main_devs, + mlxreg_lc->main_devs_num); + if (err) +- return err; ++ goto mlxreg_lc_create_static_devices_fail; + + /* In case line card is already in ready state - enable it. */ + if (mlxreg_lc->state & MLXREG_LC_CONFIGURED) +@@ -620,6 +627,10 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind, + break; + } + ++mlxreg_lc_power_on_off_fail: ++mlxreg_lc_create_static_devices_fail: ++ mutex_unlock(&mlxreg_lc->lock); ++ + return err; + } + +@@ -665,7 +676,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent, + if (err) + goto mlxreg_lc_create_static_devices_failed; + +- mlxreg_lc_state_update(mlxreg_lc, MLXREG_LC_POWERED, 1); ++ mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_POWERED, 1); + } + + /* Verify if line card is synchronized. */ +@@ -676,7 +687,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent, + /* Power on line card if necessary. */ + if (regval & mlxreg_lc->data->mask) { + mlxreg_lc->state |= MLXREG_LC_SYNCED; +- mlxreg_lc_state_update(mlxreg_lc, MLXREG_LC_SYNCED, 1); ++ mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_SYNCED, 1); + if (mlxreg_lc->state & ~MLXREG_LC_POWERED) { + err = mlxreg_lc_power_on_off(mlxreg_lc, 1); + if (err) +@@ -684,7 +695,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent, + } + } + +- mlxreg_lc_state_update(mlxreg_lc, MLXREG_LC_INITIALIZED, 1); ++ mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_INITIALIZED, 1); + + return 0; + +@@ -863,7 +874,6 @@ static int mlxreg_lc_probe(struct platform_device *pdev) + if (err) { + dev_err(&pdev->dev, "Failed to sync regmap for client %s at bus %d at addr 0x%02x\n", + data->hpdev.brdinfo->type, data->hpdev.nr, data->hpdev.brdinfo->addr); +- err = PTR_ERR(regmap); + goto regcache_sync_fail; + } + +@@ -905,6 +915,8 @@ static int mlxreg_lc_remove(struct platform_device *pdev) + struct mlxreg_core_data *data = dev_get_platdata(&pdev->dev); + struct mlxreg_lc *mlxreg_lc = platform_get_drvdata(pdev); + ++ mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_INITIALIZED, 0); ++ + /* + * Probing and removing are invoked by hotplug events raised upon line card insertion and + * removing. If probing procedure fails all data is cleared. However, hotplug event still +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index 154317e9910d2..5c757c7f64dee 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -232,7 +232,7 @@ static void pmc_power_off(void) + pm1_cnt_port = acpi_base_addr + PM1_CNT; + + pm1_cnt_value = inl(pm1_cnt_port); +- pm1_cnt_value &= SLEEP_TYPE_MASK; ++ pm1_cnt_value &= ~SLEEP_TYPE_MASK; + pm1_cnt_value |= SLEEP_TYPE_S5; + pm1_cnt_value |= SLEEP_ENABLE; + +diff --git a/drivers/platform/x86/x86-android-tablets.c b/drivers/platform/x86/x86-android-tablets.c +index 4803759774358..4acd6fa8d43b8 100644 +--- a/drivers/platform/x86/x86-android-tablets.c ++++ b/drivers/platform/x86/x86-android-tablets.c +@@ -663,9 +663,23 @@ static const struct x86_i2c_client_info chuwi_hi8_i2c_clients[] __initconst = { + }, + }; + ++static int __init chuwi_hi8_init(void) ++{ ++ /* ++ * Avoid the acpi_unregister_gsi() call in x86_acpi_irq_helper_get() ++ * breaking the touchscreen + logging various errors when the Windows ++ * BIOS is used. ++ */ ++ if (acpi_dev_present("MSSL0001", NULL, 1)) ++ return -ENODEV; ++ ++ return 0; ++} ++ + static const struct x86_dev_info chuwi_hi8_info __initconst = { + .i2c_client_info = chuwi_hi8_i2c_clients, + .i2c_client_count = ARRAY_SIZE(chuwi_hi8_i2c_clients), ++ .init = chuwi_hi8_init, + }; + + #define CZC_EC_EXTRA_PORT 0x68 +diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c +index b5ec7726592c8..71d2931cb885c 100644 +--- a/drivers/soundwire/qcom.c ++++ b/drivers/soundwire/qcom.c +@@ -167,7 +167,7 @@ struct qcom_swrm_ctrl { + u8 wcmd_id; + struct qcom_swrm_port_config pconfig[QCOM_SDW_MAX_PORTS]; + struct sdw_stream_runtime *sruntime[SWRM_MAX_DAIS]; +- enum sdw_slave_status status[SDW_MAX_DEVICES]; ++ enum sdw_slave_status status[SDW_MAX_DEVICES + 1]; + int (*reg_read)(struct qcom_swrm_ctrl *ctrl, int reg, u32 *val); + int (*reg_write)(struct qcom_swrm_ctrl *ctrl, int reg, int val); + u32 slave_status; +@@ -411,7 +411,7 @@ static int qcom_swrm_get_alert_slave_dev_num(struct qcom_swrm_ctrl *ctrl) + + ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val); + +- for (dev_num = 0; dev_num < SDW_MAX_DEVICES; dev_num++) { ++ for (dev_num = 0; dev_num <= SDW_MAX_DEVICES; dev_num++) { + status = (val >> (dev_num * SWRM_MCP_SLV_STATUS_SZ)); + + if ((status & SWRM_MCP_SLV_STATUS_MASK) == SDW_SLAVE_ALERT) { +@@ -431,7 +431,7 @@ static void qcom_swrm_get_device_status(struct qcom_swrm_ctrl *ctrl) + ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val); + ctrl->slave_status = val; + +- for (i = 0; i < SDW_MAX_DEVICES; i++) { ++ for (i = 0; i <= SDW_MAX_DEVICES; i++) { + u32 s; + + s = (val >> (i * 2)); +diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c +index cac9553666e6d..aa100b5141e1e 100644 +--- a/drivers/staging/r8188eu/os_dep/os_intfs.c ++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c +@@ -18,6 +18,7 @@ MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Realtek Wireless Lan Driver"); + MODULE_AUTHOR("Realtek Semiconductor Corp."); + MODULE_VERSION(DRIVERVERSION); ++MODULE_FIRMWARE("rtlwifi/rtl8188eufw.bin"); + + #define CONFIG_BR_EXT_BRNAME "br0" + #define RTW_NOTCH_FILTER 0 /* 0:Disable, 1:Enable, */ +diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c +index 68869c5daeff8..e5dc977d2fa21 100644 +--- a/drivers/staging/r8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/r8188eu/os_dep/usb_intf.c +@@ -28,6 +28,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + /*=== Realtek demoboard ===*/ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8179)}, /* 8188EUS */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */ ++ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill USB-N150 Nano */ + /*=== Customer ID ===*/ + /****** 8188EUS ********/ + {USB_DEVICE(0x07B8, 0x8179)}, /* Abocom - Abocom */ +diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c +index 2326aae6709e2..bb7db96ed8219 100644 +--- a/drivers/staging/rtl8712/rtl8712_cmd.c ++++ b/drivers/staging/rtl8712/rtl8712_cmd.c +@@ -117,34 +117,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf) + kfree(pdrvcmd->pbuf); + } + +-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) +-{ +- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); +- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; +- +- /* invoke cmd->callback function */ +- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; +- if (!pcmd_callback) +- r8712_free_cmd_obj(pcmd); +- else +- pcmd_callback(padapter, pcmd); +- return H2C_SUCCESS; +-} +- +-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) +-{ +- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); +- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; +- +- /* invoke cmd->callback function */ +- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; +- if (!pcmd_callback) +- r8712_free_cmd_obj(pcmd); +- else +- pcmd_callback(padapter, pcmd); +- return H2C_SUCCESS; +-} +- + static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) + { + struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; +@@ -213,14 +185,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter, + pcmd_r = NULL; + + switch (pcmd->cmdcode) { +- case GEN_CMD_CODE(_Read_MACREG): +- read_macreg_hdl(padapter, (u8 *)pcmd); +- pcmd_r = pcmd; +- break; +- case GEN_CMD_CODE(_Write_MACREG): +- write_macreg_hdl(padapter, (u8 *)pcmd); +- pcmd_r = pcmd; +- break; + case GEN_CMD_CODE(_Read_BBREG): + read_bbreg_hdl(padapter, (u8 *)pcmd); + break; +diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c +index e92c658dba1c6..3f7827d72c480 100644 +--- a/drivers/thunderbolt/ctl.c ++++ b/drivers/thunderbolt/ctl.c +@@ -407,7 +407,7 @@ static void tb_ctl_rx_submit(struct ctl_pkg *pkg) + + static int tb_async_error(const struct ctl_pkg *pkg) + { +- const struct cfg_error_pkg *error = (const struct cfg_error_pkg *)pkg; ++ const struct cfg_error_pkg *error = pkg->buffer; + + if (pkg->frame.eof != TB_CFG_PKG_ERROR) + return false; +diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c +index 561e1d77240e2..64f0aec7e70ae 100644 +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -3781,14 +3781,18 @@ int tb_switch_pcie_l1_enable(struct tb_switch *sw) + */ + int tb_switch_xhci_connect(struct tb_switch *sw) + { +- bool usb_port1, usb_port3, xhci_port1, xhci_port3; + struct tb_port *port1, *port3; + int ret; + ++ if (sw->generation != 3) ++ return 0; ++ + port1 = &sw->ports[1]; + port3 = &sw->ports[3]; + + if (tb_switch_is_alpine_ridge(sw)) { ++ bool usb_port1, usb_port3, xhci_port1, xhci_port3; ++ + usb_port1 = tb_lc_is_usb_plugged(port1); + usb_port3 = tb_lc_is_usb_plugged(port3); + xhci_port1 = tb_lc_is_xhci_connected(port1); +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index caa5c14ed57f0..01c112e2e2142 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -248,7 +248,7 @@ struct gsm_mux { + bool constipated; /* Asked by remote to shut up */ + bool has_devices; /* Devices were registered */ + +- spinlock_t tx_lock; ++ struct mutex tx_mutex; + unsigned int tx_bytes; /* TX data outstanding */ + #define TX_THRESH_HI 8192 + #define TX_THRESH_LO 2048 +@@ -256,7 +256,7 @@ struct gsm_mux { + struct list_head tx_data_list; /* Pending data packets */ + + /* Control messages */ +- struct timer_list kick_timer; /* Kick TX queuing on timeout */ ++ struct delayed_work kick_timeout; /* Kick TX queuing on timeout */ + struct timer_list t2_timer; /* Retransmit timer for commands */ + int cretries; /* Command retry counter */ + struct gsm_control *pending_cmd;/* Our current pending command */ +@@ -680,7 +680,6 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control) + struct gsm_msg *msg; + u8 *dp; + int ocr; +- unsigned long flags; + + msg = gsm_data_alloc(gsm, addr, 0, control); + if (!msg) +@@ -702,10 +701,10 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control) + + gsm_print_packet("Q->", addr, cr, control, NULL, 0); + +- spin_lock_irqsave(&gsm->tx_lock, flags); ++ mutex_lock(&gsm->tx_mutex); + list_add_tail(&msg->list, &gsm->tx_ctrl_list); + gsm->tx_bytes += msg->len; +- spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ mutex_unlock(&gsm->tx_mutex); + gsmld_write_trigger(gsm); + + return 0; +@@ -730,7 +729,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci) + spin_unlock_irqrestore(&dlci->lock, flags); + + /* Clear data packets in MUX write queue */ +- spin_lock_irqsave(&gsm->tx_lock, flags); ++ mutex_lock(&gsm->tx_mutex); + list_for_each_entry_safe(msg, nmsg, &gsm->tx_data_list, list) { + if (msg->addr != addr) + continue; +@@ -738,7 +737,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci) + list_del(&msg->list); + kfree(msg); + } +- spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ mutex_unlock(&gsm->tx_mutex); + } + + /** +@@ -1009,7 +1008,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) + gsm->tx_bytes += msg->len; + + gsmld_write_trigger(gsm); +- mod_timer(&gsm->kick_timer, jiffies + 10 * gsm->t1 * HZ / 100); ++ schedule_delayed_work(&gsm->kick_timeout, 10 * gsm->t1 * HZ / 100); + } + + /** +@@ -1024,10 +1023,9 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) + + static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) + { +- unsigned long flags; +- spin_lock_irqsave(&dlci->gsm->tx_lock, flags); ++ mutex_lock(&dlci->gsm->tx_mutex); + __gsm_data_queue(dlci, msg); +- spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); ++ mutex_unlock(&dlci->gsm->tx_mutex); + } + + /** +@@ -1039,7 +1037,7 @@ static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) + * is data. Keep to the MRU of the mux. This path handles the usual tty + * interface which is a byte stream with optional modem data. + * +- * Caller must hold the tx_lock of the mux. ++ * Caller must hold the tx_mutex of the mux. + */ + + static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) +@@ -1099,7 +1097,7 @@ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) + * is data. Keep to the MRU of the mux. This path handles framed data + * queued as skbuffs to the DLCI. + * +- * Caller must hold the tx_lock of the mux. ++ * Caller must hold the tx_mutex of the mux. + */ + + static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, +@@ -1115,7 +1113,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, + if (dlci->adaption == 4) + overhead = 1; + +- /* dlci->skb is locked by tx_lock */ ++ /* dlci->skb is locked by tx_mutex */ + if (dlci->skb == NULL) { + dlci->skb = skb_dequeue_tail(&dlci->skb_list); + if (dlci->skb == NULL) +@@ -1169,7 +1167,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, + * Push an empty frame in to the transmit queue to update the modem status + * bits and to transmit an optional break. + * +- * Caller must hold the tx_lock of the mux. ++ * Caller must hold the tx_mutex of the mux. + */ + + static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci, +@@ -1283,13 +1281,12 @@ static int gsm_dlci_data_sweep(struct gsm_mux *gsm) + + static void gsm_dlci_data_kick(struct gsm_dlci *dlci) + { +- unsigned long flags; + int sweep; + + if (dlci->constipated) + return; + +- spin_lock_irqsave(&dlci->gsm->tx_lock, flags); ++ mutex_lock(&dlci->gsm->tx_mutex); + /* If we have nothing running then we need to fire up */ + sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO); + if (dlci->gsm->tx_bytes == 0) { +@@ -1300,7 +1297,7 @@ static void gsm_dlci_data_kick(struct gsm_dlci *dlci) + } + if (sweep) + gsm_dlci_data_sweep(dlci->gsm); +- spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); ++ mutex_unlock(&dlci->gsm->tx_mutex); + } + + /* +@@ -1984,24 +1981,23 @@ static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len) + } + + /** +- * gsm_kick_timer - transmit if possible +- * @t: timer contained in our gsm object ++ * gsm_kick_timeout - transmit if possible ++ * @work: work contained in our gsm object + * + * Transmit data from DLCIs if the queue is empty. We can't rely on + * a tty wakeup except when we filled the pipe so we need to fire off + * new data ourselves in other cases. + */ +-static void gsm_kick_timer(struct timer_list *t) ++static void gsm_kick_timeout(struct work_struct *work) + { +- struct gsm_mux *gsm = from_timer(gsm, t, kick_timer); +- unsigned long flags; ++ struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); + int sent = 0; + +- spin_lock_irqsave(&gsm->tx_lock, flags); ++ mutex_lock(&gsm->tx_mutex); + /* If we have nothing running then we need to fire up */ + if (gsm->tx_bytes < TX_THRESH_LO) + sent = gsm_dlci_data_sweep(gsm); +- spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ mutex_unlock(&gsm->tx_mutex); + + if (sent && debug & 4) + pr_info("%s TX queue stalled\n", __func__); +@@ -2458,7 +2454,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) + } + + /* Finish outstanding timers, making sure they are done */ +- del_timer_sync(&gsm->kick_timer); ++ cancel_delayed_work_sync(&gsm->kick_timeout); + del_timer_sync(&gsm->t2_timer); + + /* Finish writing to ldisc */ +@@ -2501,13 +2497,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm) + if (dlci == NULL) + return -ENOMEM; + +- timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); +- timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); +- INIT_WORK(&gsm->tx_work, gsmld_write_task); +- init_waitqueue_head(&gsm->event); +- spin_lock_init(&gsm->control_lock); +- spin_lock_init(&gsm->tx_lock); +- + if (gsm->encoding == 0) + gsm->receive = gsm0_receive; + else +@@ -2538,6 +2527,7 @@ static void gsm_free_mux(struct gsm_mux *gsm) + break; + } + } ++ mutex_destroy(&gsm->tx_mutex); + mutex_destroy(&gsm->mutex); + kfree(gsm->txframe); + kfree(gsm->buf); +@@ -2609,9 +2599,15 @@ static struct gsm_mux *gsm_alloc_mux(void) + } + spin_lock_init(&gsm->lock); + mutex_init(&gsm->mutex); ++ mutex_init(&gsm->tx_mutex); + kref_init(&gsm->ref); + INIT_LIST_HEAD(&gsm->tx_ctrl_list); + INIT_LIST_HEAD(&gsm->tx_data_list); ++ INIT_DELAYED_WORK(&gsm->kick_timeout, gsm_kick_timeout); ++ timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); ++ INIT_WORK(&gsm->tx_work, gsmld_write_task); ++ init_waitqueue_head(&gsm->event); ++ spin_lock_init(&gsm->control_lock); + + gsm->t1 = T1; + gsm->t2 = T2; +@@ -2636,6 +2632,7 @@ static struct gsm_mux *gsm_alloc_mux(void) + } + spin_unlock(&gsm_mux_lock); + if (i == MAX_MUX) { ++ mutex_destroy(&gsm->tx_mutex); + mutex_destroy(&gsm->mutex); + kfree(gsm->txframe); + kfree(gsm->buf); +@@ -2791,17 +2788,16 @@ static void gsmld_write_trigger(struct gsm_mux *gsm) + static void gsmld_write_task(struct work_struct *work) + { + struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work); +- unsigned long flags; + int i, ret; + + /* All outstanding control channel and control messages and one data + * frame is sent. + */ + ret = -ENODEV; +- spin_lock_irqsave(&gsm->tx_lock, flags); ++ mutex_lock(&gsm->tx_mutex); + if (gsm->tty) + ret = gsm_data_kick(gsm); +- spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ mutex_unlock(&gsm->tx_mutex); + + if (ret >= 0) + for (i = 0; i < NUM_DLCI; i++) +@@ -2858,7 +2854,8 @@ static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp, + flags = *fp++; + switch (flags) { + case TTY_NORMAL: +- gsm->receive(gsm, *cp); ++ if (gsm->receive) ++ gsm->receive(gsm, *cp); + break; + case TTY_OVERRUN: + case TTY_BREAK: +@@ -2946,10 +2943,6 @@ static int gsmld_open(struct tty_struct *tty) + + gsmld_attach_gsm(tty, gsm); + +- timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); +- timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); +- INIT_WORK(&gsm->tx_work, gsmld_write_task); +- + return 0; + } + +@@ -3012,7 +3005,6 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, + const unsigned char *buf, size_t nr) + { + struct gsm_mux *gsm = tty->disc_data; +- unsigned long flags; + int space; + int ret; + +@@ -3020,13 +3012,13 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, + return -ENODEV; + + ret = -ENOBUFS; +- spin_lock_irqsave(&gsm->tx_lock, flags); ++ mutex_lock(&gsm->tx_mutex); + space = tty_write_room(tty); + if (space >= nr) + ret = tty->ops->write(tty, buf, nr); + else + set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); +- spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ mutex_unlock(&gsm->tx_mutex); + + return ret; + } +@@ -3323,14 +3315,13 @@ static struct tty_ldisc_ops tty_ldisc_packet = { + static void gsm_modem_upd_via_data(struct gsm_dlci *dlci, u8 brk) + { + struct gsm_mux *gsm = dlci->gsm; +- unsigned long flags; + + if (dlci->state != DLCI_OPEN || dlci->adaption != 2) + return; + +- spin_lock_irqsave(&gsm->tx_lock, flags); ++ mutex_lock(&gsm->tx_mutex); + gsm_dlci_modem_output(gsm, dlci, brk); +- spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ mutex_unlock(&gsm->tx_mutex); + } + + /** +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index dd1c7e4bd1c95..400a1686a6b26 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -296,9 +296,6 @@ static int atmel_config_rs485(struct uart_port *port, + + mode = atmel_uart_readl(port, ATMEL_US_MR); + +- /* Resetting serial mode to RS232 (0x0) */ +- mode &= ~ATMEL_US_USMODE; +- + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); + if (rs485conf->flags & SER_RS485_RX_DURING_TX) +@@ -308,6 +305,7 @@ static int atmel_config_rs485(struct uart_port *port, + + atmel_uart_writel(port, ATMEL_US_TTGR, + rs485conf->delay_rts_after_send); ++ mode &= ~ATMEL_US_USMODE; + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 561d6d0b7c945..2945c1b890880 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1381,9 +1381,9 @@ static int lpuart_config_rs485(struct uart_port *port, + * Note: UART is assumed to be active high. + */ + if (rs485->flags & SER_RS485_RTS_ON_SEND) +- modem &= ~UARTMODEM_TXRTSPOL; +- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem |= UARTMODEM_TXRTSPOL; ++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) ++ modem &= ~UARTMODEM_TXRTSPOL; + } + + writeb(modem, sport->port.membase + UARTMODEM); +@@ -2182,6 +2182,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, + uart_update_timeout(port, termios->c_cflag, baud); + + /* wait transmit engin complete */ ++ lpuart32_write(&sport->port, 0, UARTMODIR); + lpuart32_wait_bit_set(&sport->port, UARTSTAT, UARTSTAT_TC); + + /* disable transmit and receive */ +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 6eaf8eb846619..b8f5bc19416d9 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4662,9 +4662,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) + console_lock(); + if (vc->vc_mode != KD_TEXT) + rc = -EINVAL; +- else if (vc->vc_sw->con_font_set) ++ else if (vc->vc_sw->con_font_set) { ++ if (vc_is_sel(vc)) ++ clear_selection(); + rc = vc->vc_sw->con_font_set(vc, &font, op->flags); +- else ++ } else + rc = -ENOSYS; + console_unlock(); + kfree(font.data); +@@ -4691,9 +4693,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) + console_unlock(); + return -EINVAL; + } +- if (vc->vc_sw->con_font_default) ++ if (vc->vc_sw->con_font_default) { ++ if (vc_is_sel(vc)) ++ clear_selection(); + rc = vc->vc_sw->con_font_default(vc, &font, s); +- else ++ } else + rc = -ENOSYS; + console_unlock(); + if (!rc) { +diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c +index d21b69997e750..5adcb349718c3 100644 +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -1530,7 +1530,8 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev, + TRB_LEN(le32_to_cpu(trb->length)); + + if (priv_req->num_of_trb > 1 && +- le32_to_cpu(trb->control) & TRB_SMM) ++ le32_to_cpu(trb->control) & TRB_SMM && ++ le32_to_cpu(trb->control) & TRB_CHAIN) + transfer_end = true; + + cdns3_ep_inc_deq(priv_ep); +@@ -1690,6 +1691,7 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep) + ep_cfg &= ~EP_CFG_ENABLE; + writel(ep_cfg, &priv_dev->regs->ep_cfg); + priv_ep->flags &= ~EP_QUIRK_ISO_OUT_EN; ++ priv_ep->flags |= EP_UPDATE_EP_TRBADDR; + } + cdns3_transfer_completed(priv_dev, priv_ep); + } else if (!(priv_ep->flags & EP_STALLED) && +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 9b9aea24d58c4..f3c6aad277895 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1810,6 +1810,9 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ + .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ + }, ++ { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */ ++ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ ++ }, + { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ + }, +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 68e9121c18788..dfef85a18eb55 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -6048,6 +6048,11 @@ re_enumerate: + * the reset is over (using their post_reset method). + * + * Return: The same as for usb_reset_and_verify_device(). ++ * However, if a reset is already in progress (for instance, if a ++ * driver doesn't have pre_ or post_reset() callbacks, and while ++ * being unbound or re-bound during the ongoing reset its disconnect() ++ * or probe() routine tries to perform a second, nested reset), the ++ * routine returns -EINPROGRESS. + * + * Note: + * The caller must own the device lock. For example, it's safe to use +@@ -6081,6 +6086,10 @@ int usb_reset_device(struct usb_device *udev) + return -EISDIR; + } + ++ if (udev->reset_in_progress) ++ return -EINPROGRESS; ++ udev->reset_in_progress = 1; ++ + port_dev = hub->ports[udev->portnum - 1]; + + /* +@@ -6145,6 +6154,7 @@ int usb_reset_device(struct usb_device *udev) + + usb_autosuspend_device(udev); + memalloc_noio_restore(noio_flag); ++ udev->reset_in_progress = 0; + return ret; + } + EXPORT_SYMBOL_GPL(usb_reset_device); +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index c8ba87df7abef..fd0ccf6f3ec5a 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -154,9 +154,9 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg) + } else if (hsotg->plat && hsotg->plat->phy_init) { + ret = hsotg->plat->phy_init(pdev, hsotg->plat->phy_type); + } else { +- ret = phy_power_on(hsotg->phy); ++ ret = phy_init(hsotg->phy); + if (ret == 0) +- ret = phy_init(hsotg->phy); ++ ret = phy_power_on(hsotg->phy); + } + + return ret; +@@ -188,9 +188,9 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg) + } else if (hsotg->plat && hsotg->plat->phy_exit) { + ret = hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type); + } else { +- ret = phy_exit(hsotg->phy); ++ ret = phy_power_off(hsotg->phy); + if (ret == 0) +- ret = phy_power_off(hsotg->phy); ++ ret = phy_exit(hsotg->phy); + } + if (ret) + return ret; +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index ba2fa91be1d64..1db9f51f98aef 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -833,15 +833,16 @@ static void dwc3_core_exit(struct dwc3 *dwc) + { + dwc3_event_buffers_cleanup(dwc); + ++ usb_phy_set_suspend(dwc->usb2_phy, 1); ++ usb_phy_set_suspend(dwc->usb3_phy, 1); ++ phy_power_off(dwc->usb2_generic_phy); ++ phy_power_off(dwc->usb3_generic_phy); ++ + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); + +- usb_phy_set_suspend(dwc->usb2_phy, 1); +- usb_phy_set_suspend(dwc->usb3_phy, 1); +- phy_power_off(dwc->usb2_generic_phy); +- phy_power_off(dwc->usb3_generic_phy); + dwc3_clk_disable(dwc); + reset_control_assert(dwc->reset); + } +@@ -1844,16 +1845,16 @@ err5: + dwc3_debugfs_exit(dwc); + dwc3_event_buffers_cleanup(dwc); + +- usb_phy_shutdown(dwc->usb2_phy); +- usb_phy_shutdown(dwc->usb3_phy); +- phy_exit(dwc->usb2_generic_phy); +- phy_exit(dwc->usb3_generic_phy); +- + usb_phy_set_suspend(dwc->usb2_phy, 1); + usb_phy_set_suspend(dwc->usb3_phy, 1); + phy_power_off(dwc->usb2_generic_phy); + phy_power_off(dwc->usb3_generic_phy); + ++ usb_phy_shutdown(dwc->usb2_phy); ++ usb_phy_shutdown(dwc->usb3_phy); ++ phy_exit(dwc->usb2_generic_phy); ++ phy_exit(dwc->usb3_generic_phy); ++ + dwc3_ulpi_exit(dwc); + + err4: +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 6b018048fe2e1..4ee4ca09873af 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -44,6 +44,7 @@ + #define PCI_DEVICE_ID_INTEL_ADLP 0x51ee + #define PCI_DEVICE_ID_INTEL_ADLM 0x54ee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 ++#define PCI_DEVICE_ID_INTEL_RPL 0x460e + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e +@@ -456,6 +457,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPL), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 52d5a7c81362a..886fab0008a75 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2538,9 +2538,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + + is_on = !!is_on; + +- if (dwc->pullups_connected == is_on) +- return 0; +- + dwc->softconnect = is_on; + + /* +@@ -2565,6 +2562,11 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + return 0; + } + ++ if (dwc->pullups_connected == is_on) { ++ pm_runtime_put(dwc->dev); ++ return 0; ++ } ++ + if (!is_on) { + ret = dwc3_gadget_soft_disconnect(dwc); + } else { +diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c +index f56c30cf151e4..06b3d988fbf32 100644 +--- a/drivers/usb/dwc3/host.c ++++ b/drivers/usb/dwc3/host.c +@@ -11,8 +11,13 @@ + #include <linux/of.h> + #include <linux/platform_device.h> + ++#include "../host/xhci-plat.h" + #include "core.h" + ++static const struct xhci_plat_priv dwc3_xhci_plat_priv = { ++ .quirks = XHCI_SKIP_PHY_INIT, ++}; ++ + static void dwc3_host_fill_xhci_irq_res(struct dwc3 *dwc, + int irq, char *name) + { +@@ -92,6 +97,11 @@ int dwc3_host_init(struct dwc3 *dwc) + goto err; + } + ++ ret = platform_device_add_data(xhci, &dwc3_xhci_plat_priv, ++ sizeof(dwc3_xhci_plat_priv)); ++ if (ret) ++ goto err; ++ + memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props)); + + if (dwc->usb3_lpm_capable) +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index 1905a8d8e0c9f..08726e4c68a56 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -291,6 +291,12 @@ static struct usb_endpoint_descriptor ss_ep_int_desc = { + .bInterval = 4, + }; + ++static struct usb_ss_ep_comp_descriptor ss_ep_int_desc_comp = { ++ .bLength = sizeof(ss_ep_int_desc_comp), ++ .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, ++ .wBytesPerInterval = cpu_to_le16(6), ++}; ++ + /* Audio Streaming OUT Interface - Alt0 */ + static struct usb_interface_descriptor std_as_out_if0_desc = { + .bLength = sizeof std_as_out_if0_desc, +@@ -604,7 +610,8 @@ static struct usb_descriptor_header *ss_audio_desc[] = { + (struct usb_descriptor_header *)&in_feature_unit_desc, + (struct usb_descriptor_header *)&io_out_ot_desc, + +- (struct usb_descriptor_header *)&ss_ep_int_desc, ++ (struct usb_descriptor_header *)&ss_ep_int_desc, ++ (struct usb_descriptor_header *)&ss_ep_int_desc_comp, + + (struct usb_descriptor_header *)&std_as_out_if0_desc, + (struct usb_descriptor_header *)&std_as_out_if1_desc, +@@ -800,6 +807,7 @@ static void setup_headers(struct f_uac2_opts *opts, + struct usb_ss_ep_comp_descriptor *epout_desc_comp = NULL; + struct usb_ss_ep_comp_descriptor *epin_desc_comp = NULL; + struct usb_ss_ep_comp_descriptor *epin_fback_desc_comp = NULL; ++ struct usb_ss_ep_comp_descriptor *ep_int_desc_comp = NULL; + struct usb_endpoint_descriptor *epout_desc; + struct usb_endpoint_descriptor *epin_desc; + struct usb_endpoint_descriptor *epin_fback_desc; +@@ -827,6 +835,7 @@ static void setup_headers(struct f_uac2_opts *opts, + epin_fback_desc = &ss_epin_fback_desc; + epin_fback_desc_comp = &ss_epin_fback_desc_comp; + ep_int_desc = &ss_ep_int_desc; ++ ep_int_desc_comp = &ss_ep_int_desc_comp; + } + + i = 0; +@@ -855,8 +864,11 @@ static void setup_headers(struct f_uac2_opts *opts, + if (EPOUT_EN(opts)) + headers[i++] = USBDHDR(&io_out_ot_desc); + +- if (FUOUT_EN(opts) || FUIN_EN(opts)) ++ if (FUOUT_EN(opts) || FUIN_EN(opts)) { + headers[i++] = USBDHDR(ep_int_desc); ++ if (ep_int_desc_comp) ++ headers[i++] = USBDHDR(ep_int_desc_comp); ++ } + + if (EPOUT_EN(opts)) { + headers[i++] = USBDHDR(&std_as_out_if0_desc); +diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c +index b859a158a4140..e122050eebaf1 100644 +--- a/drivers/usb/gadget/function/storage_common.c ++++ b/drivers/usb/gadget/function/storage_common.c +@@ -294,8 +294,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); + void store_cdrom_address(u8 *dest, int msf, u32 addr) + { + if (msf) { +- /* Convert to Minutes-Seconds-Frames */ +- addr >>= 2; /* Convert to 2048-byte frames */ ++ /* ++ * Convert to Minutes-Seconds-Frames. ++ * Sector size is already set to 2048 bytes. ++ */ + addr += 2*75; /* Lead-in occupies 2 seconds */ + dest[3] = addr % 75; /* Frames */ + addr /= 75; +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index cafcf260394cd..c63c0c2cf649d 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -736,7 +736,10 @@ int usb_gadget_disconnect(struct usb_gadget *gadget) + ret = gadget->ops->pullup(gadget, 0); + if (!ret) { + gadget->connected = 0; +- gadget->udc->driver->disconnect(gadget); ++ mutex_lock(&udc_lock); ++ if (gadget->udc->driver) ++ gadget->udc->driver->disconnect(gadget); ++ mutex_unlock(&udc_lock); + } + + out: +@@ -1489,7 +1492,6 @@ static int gadget_bind_driver(struct device *dev) + + usb_gadget_udc_set_speed(udc, driver->max_speed); + +- mutex_lock(&udc_lock); + ret = driver->bind(udc->gadget, driver); + if (ret) + goto err_bind; +@@ -1499,7 +1501,6 @@ static int gadget_bind_driver(struct device *dev) + goto err_start; + usb_gadget_enable_async_callbacks(udc); + usb_udc_connect_control(udc); +- mutex_unlock(&udc_lock); + + kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); + return 0; +@@ -1512,6 +1513,7 @@ static int gadget_bind_driver(struct device *dev) + dev_err(&udc->dev, "failed to start %s: %d\n", + driver->function, ret); + ++ mutex_lock(&udc_lock); + udc->driver = NULL; + driver->is_bound = false; + mutex_unlock(&udc_lock); +@@ -1529,7 +1531,6 @@ static void gadget_unbind_driver(struct device *dev) + + kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); + +- mutex_lock(&udc_lock); + usb_gadget_disconnect(gadget); + usb_gadget_disable_async_callbacks(udc); + if (gadget->irq) +@@ -1537,6 +1538,7 @@ static void gadget_unbind_driver(struct device *dev) + udc->driver->unbind(gadget); + usb_gadget_udc_stop(udc); + ++ mutex_lock(&udc_lock); + driver->is_bound = false; + udc->driver = NULL; + mutex_unlock(&udc_lock); +@@ -1612,7 +1614,7 @@ static ssize_t soft_connect_store(struct device *dev, + struct usb_udc *udc = container_of(dev, struct usb_udc, dev); + ssize_t ret; + +- mutex_lock(&udc_lock); ++ device_lock(&udc->gadget->dev); + if (!udc->driver) { + dev_err(dev, "soft-connect without a gadget driver\n"); + ret = -EOPNOTSUPP; +@@ -1633,7 +1635,7 @@ static ssize_t soft_connect_store(struct device *dev, + + ret = n; + out: +- mutex_unlock(&udc_lock); ++ device_unlock(&udc->gadget->dev); + return ret; + } + static DEVICE_ATTR_WO(soft_connect); +@@ -1652,11 +1654,15 @@ static ssize_t function_show(struct device *dev, struct device_attribute *attr, + char *buf) + { + struct usb_udc *udc = container_of(dev, struct usb_udc, dev); +- struct usb_gadget_driver *drv = udc->driver; ++ struct usb_gadget_driver *drv; ++ int rc = 0; + +- if (!drv || !drv->function) +- return 0; +- return scnprintf(buf, PAGE_SIZE, "%s\n", drv->function); ++ mutex_lock(&udc_lock); ++ drv = udc->driver; ++ if (drv && drv->function) ++ rc = scnprintf(buf, PAGE_SIZE, "%s\n", drv->function); ++ mutex_unlock(&udc_lock); ++ return rc; + } + static DEVICE_ATTR_RO(function); + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 0fdc014c94011..4619d5e89d5be 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -652,7 +652,7 @@ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd) + * It will release and re-aquire the lock while calling ACPI + * method. + */ +-void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, ++static void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, + u16 index, bool on, unsigned long *flags) + __must_hold(&xhci->lock) + { +@@ -1648,6 +1648,17 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + + status = bus_state->resuming_ports; + ++ /* ++ * SS devices are only visible to roothub after link training completes. ++ * Keep polling roothubs for a grace period after xHC start ++ */ ++ if (xhci->run_graceperiod) { ++ if (time_before(jiffies, xhci->run_graceperiod)) ++ status = 1; ++ else ++ xhci->run_graceperiod = 0; ++ } ++ + mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; + + /* For each port, did anything change? If so, set that bit in buf. */ +diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c +index 06a6b19acaae6..579899eb24c15 100644 +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -425,7 +425,6 @@ static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset) + + static int check_sch_tt(struct mu3h_sch_ep_info *sch_ep, u32 offset) + { +- u32 extra_cs_count; + u32 start_ss, last_ss; + u32 start_cs, last_cs; + +@@ -461,18 +460,12 @@ static int check_sch_tt(struct mu3h_sch_ep_info *sch_ep, u32 offset) + if (last_cs > 7) + return -ESCH_CS_OVERFLOW; + +- if (sch_ep->ep_type == ISOC_IN_EP) +- extra_cs_count = (last_cs == 7) ? 1 : 2; +- else /* ep_type : INTR IN / INTR OUT */ +- extra_cs_count = 1; +- +- cs_count += extra_cs_count; + if (cs_count > 7) + cs_count = 7; /* HW limit */ + + sch_ep->cs_count = cs_count; +- /* one for ss, the other for idle */ +- sch_ep->num_budget_microframes = cs_count + 2; ++ /* ss, idle are ignored */ ++ sch_ep->num_budget_microframes = cs_count; + + /* + * if interval=1, maxp >752, num_budge_micoframe is larger +@@ -771,8 +764,8 @@ int xhci_mtk_drop_ep(struct usb_hcd *hcd, struct usb_device *udev, + if (ret) + return ret; + +- if (ep->hcpriv) +- drop_ep_quirk(hcd, udev, ep); ++ /* needn't check @ep->hcpriv, xhci_endpoint_disable set it NULL */ ++ drop_ep_quirk(hcd, udev, ep); + + return 0; + } +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 044855818cb11..a8641b6536eea 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -398,12 +398,17 @@ static int xhci_plat_remove(struct platform_device *dev) + pm_runtime_get_sync(&dev->dev); + xhci->xhc_state |= XHCI_STATE_REMOVING; + +- usb_remove_hcd(shared_hcd); +- xhci->shared_hcd = NULL; ++ if (shared_hcd) { ++ usb_remove_hcd(shared_hcd); ++ xhci->shared_hcd = NULL; ++ } ++ + usb_phy_shutdown(hcd->usb_phy); + + usb_remove_hcd(hcd); +- usb_put_hcd(shared_hcd); ++ ++ if (shared_hcd) ++ usb_put_hcd(shared_hcd); + + clk_disable_unprepare(clk); + clk_disable_unprepare(reg_clk); +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 65858f6074377..38649284ff889 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -151,9 +151,11 @@ int xhci_start(struct xhci_hcd *xhci) + xhci_err(xhci, "Host took too long to start, " + "waited %u microseconds.\n", + XHCI_MAX_HALT_USEC); +- if (!ret) ++ if (!ret) { + /* clear state flags. Including dying, halted or removing */ + xhci->xhc_state = 0; ++ xhci->run_graceperiod = jiffies + msecs_to_jiffies(500); ++ } + + return ret; + } +@@ -791,8 +793,6 @@ static void xhci_stop(struct usb_hcd *hcd) + void xhci_shutdown(struct usb_hcd *hcd) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); +- unsigned long flags; +- int i; + + if (xhci->quirks & XHCI_SPURIOUS_REBOOT) + usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); +@@ -808,21 +808,12 @@ void xhci_shutdown(struct usb_hcd *hcd) + del_timer_sync(&xhci->shared_hcd->rh_timer); + } + +- spin_lock_irqsave(&xhci->lock, flags); ++ spin_lock_irq(&xhci->lock); + xhci_halt(xhci); +- +- /* Power off USB2 ports*/ +- for (i = 0; i < xhci->usb2_rhub.num_ports; i++) +- xhci_set_port_power(xhci, xhci->main_hcd, i, false, &flags); +- +- /* Power off USB3 ports*/ +- for (i = 0; i < xhci->usb3_rhub.num_ports; i++) +- xhci_set_port_power(xhci, xhci->shared_hcd, i, false, &flags); +- + /* Workaround for spurious wakeups at shutdown with HSW */ + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) + xhci_reset(xhci, XHCI_RESET_SHORT_USEC); +- spin_unlock_irqrestore(&xhci->lock, flags); ++ spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); + +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 1960b47acfb28..7caa0db5e826d 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1826,7 +1826,7 @@ struct xhci_hcd { + + /* Host controller watchdog timer structures */ + unsigned int xhc_state; +- ++ unsigned long run_graceperiod; + u32 command; + struct s3_save s3; + /* Host controller is dying - not responding to commands. "I'm not dead yet!" +@@ -2196,8 +2196,6 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex, + int xhci_hub_status_data(struct usb_hcd *hcd, char *buf); + int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1); + struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd); +-void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, u16 index, +- bool on, unsigned long *flags); + + void xhci_hc_died(struct xhci_hcd *xhci); + +diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig +index 4d61df6a9b5c8..70693cae83efb 100644 +--- a/drivers/usb/musb/Kconfig ++++ b/drivers/usb/musb/Kconfig +@@ -86,7 +86,7 @@ config USB_MUSB_TUSB6010 + tristate "TUSB6010" + depends on HAS_IOMEM + depends on ARCH_OMAP2PLUS || COMPILE_TEST +- depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules ++ depends on NOP_USB_XCEIV!=m || USB_MUSB_HDRC=m + + config USB_MUSB_OMAP2PLUS + tristate "OMAP2430 and onwards" +diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c +index 2798fca712612..af01a462cc43c 100644 +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -97,7 +97,10 @@ struct ch341_private { + u8 mcr; + u8 msr; + u8 lcr; ++ + unsigned long quirks; ++ u8 version; ++ + unsigned long break_end; + }; + +@@ -250,8 +253,12 @@ static int ch341_set_baudrate_lcr(struct usb_device *dev, + /* + * CH341A buffers data until a full endpoint-size packet (32 bytes) + * has been received unless bit 7 is set. ++ * ++ * At least one device with version 0x27 appears to have this bit ++ * inverted. + */ +- val |= BIT(7); ++ if (priv->version > 0x27) ++ val |= BIT(7); + + r = ch341_control_out(dev, CH341_REQ_WRITE_REG, + CH341_REG_DIVISOR << 8 | CH341_REG_PRESCALER, +@@ -265,6 +272,9 @@ static int ch341_set_baudrate_lcr(struct usb_device *dev, + * (stop bits, parity and word length). Version 0x30 and above use + * CH341_REG_LCR only and CH341_REG_LCR2 is always set to zero. + */ ++ if (priv->version < 0x30) ++ return 0; ++ + r = ch341_control_out(dev, CH341_REQ_WRITE_REG, + CH341_REG_LCR2 << 8 | CH341_REG_LCR, lcr); + if (r) +@@ -308,7 +318,9 @@ static int ch341_configure(struct usb_device *dev, struct ch341_private *priv) + r = ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size); + if (r) + return r; +- dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]); ++ ++ priv->version = buffer[0]; ++ dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version); + + r = ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0); + if (r < 0) +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index c374620a486f0..a34957c4b64c0 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -130,6 +130,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ + { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */ + { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ ++ { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */ + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index d5a3986dfee75..52d59be920342 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1045,6 +1045,8 @@ static const struct usb_device_id id_table_combined[] = { + /* IDS GmbH devices */ + { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, + { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, ++ /* Omron devices */ ++ { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) }, + /* U-Blox devices */ + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 4e92c165c86bf..31c8ccabbbb78 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -661,6 +661,12 @@ + #define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */ + #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */ + ++/* ++ * Omron corporation (https://www.omron.com) ++ */ ++ #define OMRON_VID 0x0590 ++ #define OMRON_CS1W_CIF31_PID 0x00b2 ++ + /* + * Acton Research Corp. + */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index de59fa919540a..a5e8374a8d710 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -253,6 +253,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM05G 0x030a ++#define QUECTEL_PRODUCT_EM060K 0x030b + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 +@@ -438,6 +439,8 @@ static void option_instat_callback(struct urb *urb); + #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9 + #define CINTERION_PRODUCT_MV32_WA 0x00f1 + #define CINTERION_PRODUCT_MV32_WB 0x00f2 ++#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3 ++#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -573,6 +576,10 @@ static void option_instat_callback(struct urb *urb); + #define WETELECOM_PRODUCT_6802 0x6802 + #define WETELECOM_PRODUCT_WMD300 0x6803 + ++/* OPPO products */ ++#define OPPO_VENDOR_ID 0x22d9 ++#define OPPO_PRODUCT_R11 0x276c ++ + + /* Device flags */ + +@@ -1138,6 +1145,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), + .driver_info = RSVD(6) | ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, +@@ -1993,8 +2003,12 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(0)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), + .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff), ++ .driver_info = RSVD(0) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), + .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff), ++ .driver_info = RSVD(0) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), + .driver_info = RSVD(4) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), +@@ -2155,6 +2169,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ ++ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 1a05e3dcfec8a..4993227ab2930 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2294,6 +2294,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), + ++/* Reported by Witold Lipieta <witold.lipieta@thaumatec.com> */ ++UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100, ++ "NXP Semiconductors", ++ "PN7462AU", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_IGNORE_RESIDUE ), ++ + /* Supplied with some Castlewood ORB removable drives */ + UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, + "Double-H Technology", +diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c +index c1d8c23baa399..de66a2949e33b 100644 +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -99,8 +99,8 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con) + case DP_STATUS_CON_UFP_D: + case DP_STATUS_CON_BOTH: /* NOTE: First acting as DP source */ + conf |= DP_CONF_UFP_U_AS_UFP_D; +- pin_assign = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo) & +- DP_CAP_UFP_D_PIN_ASSIGN(dp->port->vdo); ++ pin_assign = DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo) & ++ DP_CAP_PIN_ASSIGN_DFP_D(dp->port->vdo); + break; + default: + break; +diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c +index 47b733f78fb0d..a8e273fe204ab 100644 +--- a/drivers/usb/typec/mux/intel_pmc_mux.c ++++ b/drivers/usb/typec/mux/intel_pmc_mux.c +@@ -571,9 +571,11 @@ err_unregister_switch: + + static int is_memory(struct acpi_resource *res, void *data) + { +- struct resource r; ++ struct resource_win win = {}; ++ struct resource *r = &win.res; + +- return !acpi_dev_resource_memory(res, &r); ++ return !(acpi_dev_resource_memory(res, r) || ++ acpi_dev_resource_address_space(res, &win)); + } + + /* IOM ACPI IDs and IOM_PORT_STATUS_OFFSET */ +@@ -583,6 +585,9 @@ static const struct acpi_device_id iom_acpi_ids[] = { + + /* AlderLake */ + { "INTC1079", 0x160, }, ++ ++ /* Meteor Lake */ ++ { "INTC107A", 0x160, }, + {} + }; + +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 3bc2f4ebd1feb..984a13a9efc22 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -6191,6 +6191,13 @@ static int tcpm_psy_set_prop(struct power_supply *psy, + struct tcpm_port *port = power_supply_get_drvdata(psy); + int ret; + ++ /* ++ * All the properties below are related to USB PD. The check needs to be ++ * property specific when a non-pd related property is added. ++ */ ++ if (!port->pd_supported) ++ return -EOPNOTSUPP; ++ + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: + ret = tcpm_psy_set_online(port, val); +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 1aea46493b852..7f2624f427241 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1200,32 +1200,6 @@ out_unlock: + return ret; + } + +-static void ucsi_unregister_connectors(struct ucsi *ucsi) +-{ +- struct ucsi_connector *con; +- int i; +- +- if (!ucsi->connector) +- return; +- +- for (i = 0; i < ucsi->cap.num_connectors; i++) { +- con = &ucsi->connector[i]; +- +- if (!con->wq) +- break; +- +- cancel_work_sync(&con->work); +- ucsi_unregister_partner(con); +- ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); +- ucsi_unregister_port_psy(con); +- destroy_workqueue(con->wq); +- typec_unregister_port(con->port); +- } +- +- kfree(ucsi->connector); +- ucsi->connector = NULL; +-} +- + /** + * ucsi_init - Initialize UCSI interface + * @ucsi: UCSI to be initialized +@@ -1234,6 +1208,7 @@ static void ucsi_unregister_connectors(struct ucsi *ucsi) + */ + static int ucsi_init(struct ucsi *ucsi) + { ++ struct ucsi_connector *con; + u64 command; + int ret; + int i; +@@ -1264,7 +1239,7 @@ static int ucsi_init(struct ucsi *ucsi) + } + + /* Allocate the connectors. Released in ucsi_unregister() */ +- ucsi->connector = kcalloc(ucsi->cap.num_connectors, ++ ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1, + sizeof(*ucsi->connector), GFP_KERNEL); + if (!ucsi->connector) { + ret = -ENOMEM; +@@ -1288,7 +1263,15 @@ static int ucsi_init(struct ucsi *ucsi) + return 0; + + err_unregister: +- ucsi_unregister_connectors(ucsi); ++ for (con = ucsi->connector; con->port; con++) { ++ ucsi_unregister_partner(con); ++ ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); ++ ucsi_unregister_port_psy(con); ++ if (con->wq) ++ destroy_workqueue(con->wq); ++ typec_unregister_port(con->port); ++ con->port = NULL; ++ } + + err_reset: + memset(&ucsi->cap, 0, sizeof(ucsi->cap)); +@@ -1402,6 +1385,7 @@ EXPORT_SYMBOL_GPL(ucsi_register); + void ucsi_unregister(struct ucsi *ucsi) + { + u64 cmd = UCSI_SET_NOTIFICATION_ENABLE; ++ int i; + + /* Make sure that we are not in the middle of driver initialization */ + cancel_delayed_work_sync(&ucsi->work); +@@ -1409,7 +1393,18 @@ void ucsi_unregister(struct ucsi *ucsi) + /* Disable notifications */ + ucsi->ops->async_write(ucsi, UCSI_CONTROL, &cmd, sizeof(cmd)); + +- ucsi_unregister_connectors(ucsi); ++ for (i = 0; i < ucsi->cap.num_connectors; i++) { ++ cancel_work_sync(&ucsi->connector[i].work); ++ ucsi_unregister_partner(&ucsi->connector[i]); ++ ucsi_unregister_altmodes(&ucsi->connector[i], ++ UCSI_RECIPIENT_CON); ++ ucsi_unregister_port_psy(&ucsi->connector[i]); ++ if (ucsi->connector[i].wq) ++ destroy_workqueue(ucsi->connector[i].wq); ++ typec_unregister_port(ucsi->connector[i].port); ++ } ++ ++ kfree(ucsi->connector); + } + EXPORT_SYMBOL_GPL(ucsi_unregister); + +diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c +index 738029de3c672..e1ec725c2819d 100644 +--- a/drivers/xen/grant-table.c ++++ b/drivers/xen/grant-table.c +@@ -1047,6 +1047,9 @@ int gnttab_dma_alloc_pages(struct gnttab_dma_alloc_args *args) + size_t size; + int i, ret; + ++ if (args->nr_pages < 0 || args->nr_pages > (INT_MAX >> PAGE_SHIFT)) ++ return -ENOMEM; ++ + size = args->nr_pages << PAGE_SHIFT; + if (args->coherent) + args->vaddr = dma_alloc_coherent(args->dev, size, +diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h +index 6cba2c6de2f96..2ad58c4652084 100644 +--- a/fs/cachefiles/internal.h ++++ b/fs/cachefiles/internal.h +@@ -111,6 +111,7 @@ struct cachefiles_cache { + char *tag; /* cache binding tag */ + refcount_t unbind_pincount;/* refcount to do daemon unbind */ + struct xarray reqs; /* xarray of pending on-demand requests */ ++ unsigned long req_id_next; + struct xarray ondemand_ids; /* xarray for ondemand_id allocation */ + u32 ondemand_id_next; + }; +diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c +index 1fee702d55293..0254ed39f68ce 100644 +--- a/fs/cachefiles/ondemand.c ++++ b/fs/cachefiles/ondemand.c +@@ -158,9 +158,13 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) + + /* fail OPEN request if daemon reports an error */ + if (size < 0) { +- if (!IS_ERR_VALUE(size)) +- size = -EINVAL; +- req->error = size; ++ if (!IS_ERR_VALUE(size)) { ++ req->error = -EINVAL; ++ ret = -EINVAL; ++ } else { ++ req->error = size; ++ ret = 0; ++ } + goto out; + } + +@@ -238,14 +242,19 @@ ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache, + unsigned long id = 0; + size_t n; + int ret = 0; +- XA_STATE(xas, &cache->reqs, 0); ++ XA_STATE(xas, &cache->reqs, cache->req_id_next); + + /* +- * Search for a request that has not ever been processed, to prevent +- * requests from being processed repeatedly. ++ * Cyclically search for a request that has not ever been processed, ++ * to prevent requests from being processed repeatedly, and make ++ * request distribution fair. + */ + xa_lock(&cache->reqs); + req = xas_find_marked(&xas, UINT_MAX, CACHEFILES_REQ_NEW); ++ if (!req && cache->req_id_next > 0) { ++ xas_set(&xas, 0); ++ req = xas_find_marked(&xas, cache->req_id_next - 1, CACHEFILES_REQ_NEW); ++ } + if (!req) { + xa_unlock(&cache->reqs); + return 0; +@@ -260,6 +269,7 @@ ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache, + } + + xas_clear_mark(&xas, CACHEFILES_REQ_NEW); ++ cache->req_id_next = xas.xa_index + 1; + xa_unlock(&cache->reqs); + + id = xas.xa_index; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c7614ade875b5..ba58d7fd54f9e 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -964,16 +964,17 @@ SMB2_negotiate(const unsigned int xid, + } else if (rc != 0) + goto neg_exit; + ++ rc = -EIO; + if (strcmp(server->vals->version_string, + SMB3ANY_VERSION_STRING) == 0) { + if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { + cifs_server_dbg(VFS, + "SMB2 dialect returned but not requested\n"); +- return -EIO; ++ goto neg_exit; + } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { + cifs_server_dbg(VFS, + "SMB2.1 dialect returned but not requested\n"); +- return -EIO; ++ goto neg_exit; + } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { + /* ops set to 3.0 by default for default so update */ + server->ops = &smb311_operations; +@@ -984,7 +985,7 @@ SMB2_negotiate(const unsigned int xid, + if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { + cifs_server_dbg(VFS, + "SMB2 dialect returned but not requested\n"); +- return -EIO; ++ goto neg_exit; + } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { + /* ops set to 3.0 by default for default so update */ + server->ops = &smb21_operations; +@@ -998,7 +999,7 @@ SMB2_negotiate(const unsigned int xid, + /* if requested single dialect ensure returned dialect matched */ + cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", + le16_to_cpu(rsp->DialectRevision)); +- return -EIO; ++ goto neg_exit; + } + + cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); +@@ -1016,9 +1017,10 @@ SMB2_negotiate(const unsigned int xid, + else { + cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", + le16_to_cpu(rsp->DialectRevision)); +- rc = -EIO; + goto neg_exit; + } ++ ++ rc = 0; + server->dialect = le16_to_cpu(rsp->DialectRevision); + + /* +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 7424cf234ae03..ed352c00330cd 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -398,6 +398,9 @@ enum bpf_type_flag { + /* DYNPTR points to a ringbuf record. */ + DYNPTR_TYPE_RINGBUF = BIT(9 + BPF_BASE_TYPE_BITS), + ++ /* Size is known at compile time. */ ++ MEM_FIXED_SIZE = BIT(10 + BPF_BASE_TYPE_BITS), ++ + __BPF_TYPE_FLAG_MAX, + __BPF_TYPE_LAST_FLAG = __BPF_TYPE_FLAG_MAX - 1, + }; +@@ -461,6 +464,8 @@ enum bpf_arg_type { + * all bytes or clear them in error case. + */ + ARG_PTR_TO_UNINIT_MEM = MEM_UNINIT | ARG_PTR_TO_MEM, ++ /* Pointer to valid memory of size known at compile time. */ ++ ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM, + + /* This must be the last entry. Its purpose is to ensure the enum is + * wide enough to hold the higher bits reserved for bpf_type_flag. +@@ -526,6 +531,14 @@ struct bpf_func_proto { + u32 *arg5_btf_id; + }; + u32 *arg_btf_id[5]; ++ struct { ++ size_t arg1_size; ++ size_t arg2_size; ++ size_t arg3_size; ++ size_t arg4_size; ++ size_t arg5_size; ++ }; ++ size_t arg_size[5]; + }; + int *ret_btf_id; /* return value btf_id */ + bool (*allowed)(const struct bpf_prog *prog); +diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/platform_data/x86/pmc_atom.h +index 6807839c718bd..ea01dd80153b3 100644 +--- a/include/linux/platform_data/x86/pmc_atom.h ++++ b/include/linux/platform_data/x86/pmc_atom.h +@@ -7,6 +7,8 @@ + #ifndef PMC_ATOM_H + #define PMC_ATOM_H + ++#include <linux/bits.h> ++ + /* ValleyView Power Control Unit PCI Device ID */ + #define PCI_DEVICE_ID_VLV_PMC 0x0F1C + /* CherryTrail Power Control Unit PCI Device ID */ +@@ -139,9 +141,9 @@ + #define ACPI_MMIO_REG_LEN 0x100 + + #define PM1_CNT 0x4 +-#define SLEEP_TYPE_MASK 0xFFFFECFF ++#define SLEEP_TYPE_MASK GENMASK(12, 10) + #define SLEEP_TYPE_S5 0x1C00 +-#define SLEEP_ENABLE 0x2000 ++#define SLEEP_ENABLE BIT(13) + + extern int pmc_atom_read(int offset, u32 *value); + +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 60bee864d8977..1a664ab2ebc66 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -575,6 +575,7 @@ struct usb3_lpm_parameters { + * @devaddr: device address, XHCI: assigned by HW, others: same as devnum + * @can_submit: URBs may be submitted + * @persist_enabled: USB_PERSIST enabled for this device ++ * @reset_in_progress: the device is being reset + * @have_langid: whether string_langid is valid + * @authorized: policy has said we can use it; + * (user space) policy determines if we authorize this device to be +@@ -661,6 +662,7 @@ struct usb_device { + + unsigned can_submit:1; + unsigned persist_enabled:1; ++ unsigned reset_in_progress:1; + unsigned have_langid:1; + unsigned authorized:1; + unsigned authenticated:1; +diff --git a/include/linux/usb/typec_dp.h b/include/linux/usb/typec_dp.h +index cfb916cccd316..8d09c2f0a9b80 100644 +--- a/include/linux/usb/typec_dp.h ++++ b/include/linux/usb/typec_dp.h +@@ -73,6 +73,11 @@ enum { + #define DP_CAP_USB BIT(7) + #define DP_CAP_DFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(15, 8)) >> 8) + #define DP_CAP_UFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(23, 16)) >> 16) ++/* Get pin assignment taking plug & receptacle into consideration */ ++#define DP_CAP_PIN_ASSIGN_UFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \ ++ DP_CAP_UFP_D_PIN_ASSIGN(_cap_) : DP_CAP_DFP_D_PIN_ASSIGN(_cap_)) ++#define DP_CAP_PIN_ASSIGN_DFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \ ++ DP_CAP_DFP_D_PIN_ASSIGN(_cap_) : DP_CAP_UFP_D_PIN_ASSIGN(_cap_)) + + /* DisplayPort Status Update VDO bits */ + #define DP_STATUS_CONNECTION(_status_) ((_status_) & 3) +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 20f60d9da7418..cf1f22c01ed3d 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -246,7 +246,8 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, + __be32 daddr, __be32 saddr, + __be32 key, __u8 tos, + struct net *net, int oif, +- __u32 mark, __u32 tun_inner_hash) ++ __u32 mark, __u32 tun_inner_hash, ++ __u8 flow_flags) + { + memset(fl4, 0, sizeof(*fl4)); + +@@ -263,6 +264,7 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, + fl4->fl4_gre_key = key; + fl4->flowi4_mark = mark; + fl4->flowi4_multipath_hash = tun_inner_hash; ++ fl4->flowi4_flags = flow_flags; + } + + int ip_tunnel_init(struct net_device *dev); +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index 7a394f7c205c4..34dfa45ef4f3b 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -762,8 +762,10 @@ static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *prog, + pos++; + } + } ++ ++ /* no link or prog match, skip the cgroup of this layer */ ++ continue; + found: +- BUG_ON(!cg); + progs = rcu_dereference_protected( + desc->bpf.effective[atype], + lockdep_is_held(&cgroup_mutex)); +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index fb6bd57228a84..cf44ff50b1f23 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -1005,7 +1005,7 @@ pure_initcall(bpf_jit_charge_init); + + int bpf_jit_charge_modmem(u32 size) + { +- if (atomic_long_add_return(size, &bpf_jit_current) > bpf_jit_limit) { ++ if (atomic_long_add_return(size, &bpf_jit_current) > READ_ONCE(bpf_jit_limit)) { + if (!bpf_capable()) { + atomic_long_sub(size, &bpf_jit_current); + return -EPERM; +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 82e83cfb4114a..dd0fc2a86ce17 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -5153,7 +5153,7 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) + { + switch (func_id) { + case BPF_FUNC_sys_bpf: +- return &bpf_sys_bpf_proto; ++ return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto; + case BPF_FUNC_btf_find_by_name_kind: + return &bpf_btf_find_by_name_kind_proto; + case BPF_FUNC_sys_close: +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 0e45d405f151c..339147061127a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -5533,17 +5533,6 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type) + type == ARG_CONST_SIZE_OR_ZERO; + } + +-static bool arg_type_is_alloc_size(enum bpf_arg_type type) +-{ +- return type == ARG_CONST_ALLOC_SIZE_OR_ZERO; +-} +- +-static bool arg_type_is_int_ptr(enum bpf_arg_type type) +-{ +- return type == ARG_PTR_TO_INT || +- type == ARG_PTR_TO_LONG; +-} +- + static bool arg_type_is_release(enum bpf_arg_type type) + { + return type & OBJ_RELEASE; +@@ -5847,6 +5836,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, + struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno]; + enum bpf_arg_type arg_type = fn->arg_type[arg]; + enum bpf_reg_type type = reg->type; ++ u32 *arg_btf_id = NULL; + int err = 0; + + if (arg_type == ARG_DONTCARE) +@@ -5883,7 +5873,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, + */ + goto skip_type_check; + +- err = check_reg_type(env, regno, arg_type, fn->arg_btf_id[arg], meta); ++ /* arg_btf_id and arg_size are in a union. */ ++ if (base_type(arg_type) == ARG_PTR_TO_BTF_ID) ++ arg_btf_id = fn->arg_btf_id[arg]; ++ ++ err = check_reg_type(env, regno, arg_type, arg_btf_id, meta); + if (err) + return err; + +@@ -5924,7 +5918,8 @@ skip_type_check: + meta->ref_obj_id = reg->ref_obj_id; + } + +- if (arg_type == ARG_CONST_MAP_PTR) { ++ switch (base_type(arg_type)) { ++ case ARG_CONST_MAP_PTR: + /* bpf_map_xxx(map_ptr) call: remember that map_ptr */ + if (meta->map_ptr) { + /* Use map_uid (which is unique id of inner map) to reject: +@@ -5949,7 +5944,8 @@ skip_type_check: + } + meta->map_ptr = reg->map_ptr; + meta->map_uid = reg->map_uid; +- } else if (arg_type == ARG_PTR_TO_MAP_KEY) { ++ break; ++ case ARG_PTR_TO_MAP_KEY: + /* bpf_map_xxx(..., map_ptr, ..., key) call: + * check that [key, key + map->key_size) are within + * stack limits and initialized +@@ -5966,7 +5962,8 @@ skip_type_check: + err = check_helper_mem_access(env, regno, + meta->map_ptr->key_size, false, + NULL); +- } else if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE) { ++ break; ++ case ARG_PTR_TO_MAP_VALUE: + if (type_may_be_null(arg_type) && register_is_null(reg)) + return 0; + +@@ -5982,14 +5979,16 @@ skip_type_check: + err = check_helper_mem_access(env, regno, + meta->map_ptr->value_size, false, + meta); +- } else if (arg_type == ARG_PTR_TO_PERCPU_BTF_ID) { ++ break; ++ case ARG_PTR_TO_PERCPU_BTF_ID: + if (!reg->btf_id) { + verbose(env, "Helper has invalid btf_id in R%d\n", regno); + return -EACCES; + } + meta->ret_btf = reg->btf; + meta->ret_btf_id = reg->btf_id; +- } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) { ++ break; ++ case ARG_PTR_TO_SPIN_LOCK: + if (meta->func_id == BPF_FUNC_spin_lock) { + if (process_spin_lock(env, regno, true)) + return -EACCES; +@@ -6000,21 +5999,32 @@ skip_type_check: + verbose(env, "verifier internal error\n"); + return -EFAULT; + } +- } else if (arg_type == ARG_PTR_TO_TIMER) { ++ break; ++ case ARG_PTR_TO_TIMER: + if (process_timer_func(env, regno, meta)) + return -EACCES; +- } else if (arg_type == ARG_PTR_TO_FUNC) { ++ break; ++ case ARG_PTR_TO_FUNC: + meta->subprogno = reg->subprogno; +- } else if (base_type(arg_type) == ARG_PTR_TO_MEM) { ++ break; ++ case ARG_PTR_TO_MEM: + /* The access to this pointer is only checked when we hit the + * next is_mem_size argument below. + */ + meta->raw_mode = arg_type & MEM_UNINIT; +- } else if (arg_type_is_mem_size(arg_type)) { +- bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO); +- +- err = check_mem_size_reg(env, reg, regno, zero_size_allowed, meta); +- } else if (arg_type_is_dynptr(arg_type)) { ++ if (arg_type & MEM_FIXED_SIZE) { ++ err = check_helper_mem_access(env, regno, ++ fn->arg_size[arg], false, ++ meta); ++ } ++ break; ++ case ARG_CONST_SIZE: ++ err = check_mem_size_reg(env, reg, regno, false, meta); ++ break; ++ case ARG_CONST_SIZE_OR_ZERO: ++ err = check_mem_size_reg(env, reg, regno, true, meta); ++ break; ++ case ARG_PTR_TO_DYNPTR: + if (arg_type & MEM_UNINIT) { + if (!is_dynptr_reg_valid_uninit(env, reg)) { + verbose(env, "Dynptr has to be an uninitialized dynptr\n"); +@@ -6048,21 +6058,31 @@ skip_type_check: + err_extra, arg + 1); + return -EINVAL; + } +- } else if (arg_type_is_alloc_size(arg_type)) { ++ break; ++ case ARG_CONST_ALLOC_SIZE_OR_ZERO: + if (!tnum_is_const(reg->var_off)) { + verbose(env, "R%d is not a known constant'\n", + regno); + return -EACCES; + } + meta->mem_size = reg->var_off.value; +- } else if (arg_type_is_int_ptr(arg_type)) { ++ err = mark_chain_precision(env, regno); ++ if (err) ++ return err; ++ break; ++ case ARG_PTR_TO_INT: ++ case ARG_PTR_TO_LONG: ++ { + int size = int_ptr_type_to_size(arg_type); + + err = check_helper_mem_access(env, regno, size, false, meta); + if (err) + return err; + err = check_ptr_alignment(env, reg, 0, size, true); +- } else if (arg_type == ARG_PTR_TO_CONST_STR) { ++ break; ++ } ++ case ARG_PTR_TO_CONST_STR: ++ { + struct bpf_map *map = reg->map_ptr; + int map_off; + u64 map_addr; +@@ -6101,9 +6121,12 @@ skip_type_check: + verbose(env, "string is not zero-terminated\n"); + return -EINVAL; + } +- } else if (arg_type == ARG_PTR_TO_KPTR) { ++ break; ++ } ++ case ARG_PTR_TO_KPTR: + if (process_kptr_func(env, regno, meta)) + return -EACCES; ++ break; + } + + return err; +@@ -6400,11 +6423,19 @@ static bool check_raw_mode_ok(const struct bpf_func_proto *fn) + return count <= 1; + } + +-static bool check_args_pair_invalid(enum bpf_arg_type arg_curr, +- enum bpf_arg_type arg_next) ++static bool check_args_pair_invalid(const struct bpf_func_proto *fn, int arg) + { +- return (base_type(arg_curr) == ARG_PTR_TO_MEM) != +- arg_type_is_mem_size(arg_next); ++ bool is_fixed = fn->arg_type[arg] & MEM_FIXED_SIZE; ++ bool has_size = fn->arg_size[arg] != 0; ++ bool is_next_size = false; ++ ++ if (arg + 1 < ARRAY_SIZE(fn->arg_type)) ++ is_next_size = arg_type_is_mem_size(fn->arg_type[arg + 1]); ++ ++ if (base_type(fn->arg_type[arg]) != ARG_PTR_TO_MEM) ++ return is_next_size; ++ ++ return has_size == is_next_size || is_next_size == is_fixed; + } + + static bool check_arg_pair_ok(const struct bpf_func_proto *fn) +@@ -6415,11 +6446,11 @@ static bool check_arg_pair_ok(const struct bpf_func_proto *fn) + * helper function specification. + */ + if (arg_type_is_mem_size(fn->arg1_type) || +- base_type(fn->arg5_type) == ARG_PTR_TO_MEM || +- check_args_pair_invalid(fn->arg1_type, fn->arg2_type) || +- check_args_pair_invalid(fn->arg2_type, fn->arg3_type) || +- check_args_pair_invalid(fn->arg3_type, fn->arg4_type) || +- check_args_pair_invalid(fn->arg4_type, fn->arg5_type)) ++ check_args_pair_invalid(fn, 0) || ++ check_args_pair_invalid(fn, 1) || ++ check_args_pair_invalid(fn, 2) || ++ check_args_pair_invalid(fn, 3) || ++ check_args_pair_invalid(fn, 4)) + return false; + + return true; +@@ -6460,7 +6491,10 @@ static bool check_btf_id_ok(const struct bpf_func_proto *fn) + if (base_type(fn->arg_type[i]) == ARG_PTR_TO_BTF_ID && !fn->arg_btf_id[i]) + return false; + +- if (base_type(fn->arg_type[i]) != ARG_PTR_TO_BTF_ID && fn->arg_btf_id[i]) ++ if (base_type(fn->arg_type[i]) != ARG_PTR_TO_BTF_ID && fn->arg_btf_id[i] && ++ /* arg_btf_id and arg_size are in a union. */ ++ (base_type(fn->arg_type[i]) != ARG_PTR_TO_MEM || ++ !(fn->arg_type[i] & MEM_FIXED_SIZE))) + return false; + } + +diff --git a/mm/pagewalk.c b/mm/pagewalk.c +index 9b3db11a4d1db..fa7a3d21a7518 100644 +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -110,7 +110,7 @@ static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end, + do { + again: + next = pmd_addr_end(addr, end); +- if (pmd_none(*pmd) || (!walk->vma && !walk->no_vma)) { ++ if (pmd_none(*pmd)) { + if (ops->pte_hole) + err = ops->pte_hole(addr, next, depth, walk); + if (err) +@@ -171,7 +171,7 @@ static int walk_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end, + do { + again: + next = pud_addr_end(addr, end); +- if (pud_none(*pud) || (!walk->vma && !walk->no_vma)) { ++ if (pud_none(*pud)) { + if (ops->pte_hole) + err = ops->pte_hole(addr, next, depth, walk); + if (err) +@@ -366,19 +366,19 @@ static int __walk_page_range(unsigned long start, unsigned long end, + struct vm_area_struct *vma = walk->vma; + const struct mm_walk_ops *ops = walk->ops; + +- if (vma && ops->pre_vma) { ++ if (ops->pre_vma) { + err = ops->pre_vma(start, end, walk); + if (err) + return err; + } + +- if (vma && is_vm_hugetlb_page(vma)) { ++ if (is_vm_hugetlb_page(vma)) { + if (ops->hugetlb_entry) + err = walk_hugetlb_range(start, end, walk); + } else + err = walk_pgd_range(start, end, walk); + +- if (vma && ops->post_vma) ++ if (ops->post_vma) + ops->post_vma(walk); + + return err; +@@ -450,9 +450,13 @@ int walk_page_range(struct mm_struct *mm, unsigned long start, + if (!vma) { /* after the last vma */ + walk.vma = NULL; + next = end; ++ if (ops->pte_hole) ++ err = ops->pte_hole(start, next, -1, &walk); + } else if (start < vma->vm_start) { /* outside vma */ + walk.vma = NULL; + next = min(end, vma->vm_start); ++ if (ops->pte_hole) ++ err = ops->pte_hole(start, next, -1, &walk); + } else { /* inside vma */ + walk.vma = vma; + next = min(end, vma->vm_end); +@@ -470,9 +474,8 @@ int walk_page_range(struct mm_struct *mm, unsigned long start, + } + if (err < 0) + break; +- } +- if (walk.vma || walk.ops->pte_hole) + err = __walk_page_range(start, next, &walk); ++ } + if (err) + break; + } while (start = next, start < end); +@@ -501,9 +504,9 @@ int walk_page_range_novma(struct mm_struct *mm, unsigned long start, + if (start >= end || !walk.mm) + return -EINVAL; + +- mmap_assert_locked(walk.mm); ++ mmap_assert_write_locked(walk.mm); + +- return __walk_page_range(start, end, &walk); ++ return walk_pgd_range(start, end, &walk); + } + + int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops, +diff --git a/mm/ptdump.c b/mm/ptdump.c +index eea3d28d173c2..8adab455a68b3 100644 +--- a/mm/ptdump.c ++++ b/mm/ptdump.c +@@ -152,13 +152,13 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd) + { + const struct ptdump_range *range = st->range; + +- mmap_read_lock(mm); ++ mmap_write_lock(mm); + while (range->start != range->end) { + walk_page_range_novma(mm, range->start, range->end, + &ptdump_ops, pgd, st); + range++; + } +- mmap_read_unlock(mm); ++ mmap_write_unlock(mm); + + /* Flush out the last page */ + st->note_page(st, 0, -1, 0); +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 77c3adf40e504..dbd4b6f9b0e79 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -420,6 +420,28 @@ kmem_cache_create(const char *name, unsigned int size, unsigned int align, + } + EXPORT_SYMBOL(kmem_cache_create); + ++#ifdef SLAB_SUPPORTS_SYSFS ++/* ++ * For a given kmem_cache, kmem_cache_destroy() should only be called ++ * once or there will be a use-after-free problem. The actual deletion ++ * and release of the kobject does not need slab_mutex or cpu_hotplug_lock ++ * protection. So they are now done without holding those locks. ++ * ++ * Note that there will be a slight delay in the deletion of sysfs files ++ * if kmem_cache_release() is called indrectly from a work function. ++ */ ++static void kmem_cache_release(struct kmem_cache *s) ++{ ++ sysfs_slab_unlink(s); ++ sysfs_slab_release(s); ++} ++#else ++static void kmem_cache_release(struct kmem_cache *s) ++{ ++ slab_kmem_cache_release(s); ++} ++#endif ++ + static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work) + { + LIST_HEAD(to_destroy); +@@ -446,11 +468,7 @@ static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work) + list_for_each_entry_safe(s, s2, &to_destroy, list) { + debugfs_slab_release(s); + kfence_shutdown_cache(s); +-#ifdef SLAB_SUPPORTS_SYSFS +- sysfs_slab_release(s); +-#else +- slab_kmem_cache_release(s); +-#endif ++ kmem_cache_release(s); + } + } + +@@ -465,20 +483,11 @@ static int shutdown_cache(struct kmem_cache *s) + list_del(&s->list); + + if (s->flags & SLAB_TYPESAFE_BY_RCU) { +-#ifdef SLAB_SUPPORTS_SYSFS +- sysfs_slab_unlink(s); +-#endif + list_add_tail(&s->list, &slab_caches_to_rcu_destroy); + schedule_work(&slab_caches_to_rcu_destroy_work); + } else { + kfence_shutdown_cache(s); + debugfs_slab_release(s); +-#ifdef SLAB_SUPPORTS_SYSFS +- sysfs_slab_unlink(s); +- sysfs_slab_release(s); +-#else +- slab_kmem_cache_release(s); +-#endif + } + + return 0; +@@ -493,14 +502,16 @@ void slab_kmem_cache_release(struct kmem_cache *s) + + void kmem_cache_destroy(struct kmem_cache *s) + { ++ int refcnt; ++ + if (unlikely(!s) || !kasan_check_byte(s)) + return; + + cpus_read_lock(); + mutex_lock(&slab_mutex); + +- s->refcount--; +- if (s->refcount) ++ refcnt = --s->refcount; ++ if (refcnt) + goto out_unlock; + + WARN(shutdown_cache(s), +@@ -509,6 +520,8 @@ void kmem_cache_destroy(struct kmem_cache *s) + out_unlock: + mutex_unlock(&slab_mutex); + cpus_read_unlock(); ++ if (!refcnt && !(s->flags & SLAB_TYPESAFE_BY_RCU)) ++ kmem_cache_release(s); + } + EXPORT_SYMBOL(kmem_cache_destroy); + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 7cb956d3abb26..2c320a8fe70d7 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3998,6 +3998,17 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data, + } + } + ++ if (i == ARRAY_SIZE(hci_cc_table)) { ++ /* Unknown opcode, assume byte 0 contains the status, so ++ * that e.g. __hci_cmd_sync() properly returns errors ++ * for vendor specific commands send by HCI drivers. ++ * If a vendor doesn't actually follow this convention we may ++ * need to introduce a vendor CC table in order to properly set ++ * the status. ++ */ ++ *status = skb->data[0]; ++ } ++ + handle_cmd_cnt_and_timer(hdev, ev->ncmd); + + hci_req_cmd_complete(hdev, *opcode, *status, req_complete, +@@ -5557,7 +5568,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + */ + hci_dev_clear_flag(hdev, HCI_LE_ADV); + +- conn = hci_lookup_le_connect(hdev); ++ conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr); + if (!conn) { + /* In case of error status and there is no connection pending + * just unlock as there is nothing to cleanup. +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index b5e7d4b8ab24a..3b4cee67bbd60 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4452,9 +4452,11 @@ static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, + /* Cleanup hci_conn object if it cannot be cancelled as it + * likelly means the controller and host stack are out of sync. + */ +- if (err) ++ if (err) { ++ hci_dev_lock(hdev); + hci_conn_failed(conn, err); +- ++ hci_dev_unlock(hdev); ++ } + return err; + case BT_CONNECT2: + return hci_reject_conn_sync(hdev, conn, reason); +@@ -4967,17 +4969,21 @@ int hci_suspend_sync(struct hci_dev *hdev) + /* Prevent disconnects from causing scanning to be re-enabled */ + hci_pause_scan_sync(hdev); + +- /* Soft disconnect everything (power off) */ +- err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF); +- if (err) { +- /* Set state to BT_RUNNING so resume doesn't notify */ +- hdev->suspend_state = BT_RUNNING; +- hci_resume_sync(hdev); +- return err; +- } ++ if (hci_conn_count(hdev)) { ++ /* Soft disconnect everything (power off) */ ++ err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF); ++ if (err) { ++ /* Set state to BT_RUNNING so resume doesn't notify */ ++ hdev->suspend_state = BT_RUNNING; ++ hci_resume_sync(hdev); ++ return err; ++ } + +- /* Update event mask so only the allowed event can wakeup the host */ +- hci_set_event_mask_sync(hdev); ++ /* Update event mask so only the allowed event can wakeup the ++ * host. ++ */ ++ hci_set_event_mask_sync(hdev); ++ } + + /* Only configure accept list if disconnect succeeded and wake + * isn't being prevented. +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 84209e661171e..69ac686c7cae3 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -462,7 +462,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, + + if (copied == len) + break; +- } while (!sg_is_last(sge)); ++ } while ((i != msg_rx->sg.end) && !sg_is_last(sge)); + + if (unlikely(peek)) { + msg_rx = sk_psock_next_msg(psock, msg_rx); +@@ -472,7 +472,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, + } + + msg_rx->sg.start = i; +- if (!sge->length && sg_is_last(sge)) { ++ if (!sge->length && (i == msg_rx->sg.end || sg_is_last(sge))) { + msg_rx = sk_psock_dequeue_msg(psock); + kfree_sk_msg(msg_rx); + } +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index f361d3d56be27..943edf4ad4db0 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -389,7 +389,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, + dev_match = dev_match || (res.type == RTN_LOCAL && + dev == net->loopback_dev); + if (dev_match) { +- ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST; ++ ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_LINK; + return ret; + } + if (no_addr) +@@ -401,7 +401,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, + ret = 0; + if (fib_lookup(net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE) == 0) { + if (res.type == RTN_UNICAST) +- ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST; ++ ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_LINK; + } + return ret; + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 5c58e21f724e9..f866d6282b2b3 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -609,7 +609,7 @@ static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) + ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src, + tunnel_id_to_key32(key->tun_id), + key->tos & ~INET_ECN_MASK, dev_net(dev), 0, +- skb->mark, skb_get_hash(skb)); ++ skb->mark, skb_get_hash(skb), key->flow_flags); + rt = ip_route_output_key(dev_net(dev), &fl4); + if (IS_ERR(rt)) + return PTR_ERR(rt); +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 94017a8c39945..1ad8809fc2e3b 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -295,7 +295,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) + ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr, + iph->saddr, tunnel->parms.o_key, + RT_TOS(iph->tos), dev_net(dev), +- tunnel->parms.link, tunnel->fwmark, 0); ++ tunnel->parms.link, tunnel->fwmark, 0, 0); + rt = ip_route_output_key(tunnel->net, &fl4); + + if (!IS_ERR(rt)) { +@@ -570,7 +570,8 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + } + ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, + tunnel_id_to_key32(key->tun_id), RT_TOS(tos), +- dev_net(dev), 0, skb->mark, skb_get_hash(skb)); ++ dev_net(dev), 0, skb->mark, skb_get_hash(skb), ++ key->flow_flags); + if (tunnel->encap.type != TUNNEL_ENCAP_NONE) + goto tx_error; + +@@ -728,7 +729,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr, + tunnel->parms.o_key, RT_TOS(tos), + dev_net(dev), tunnel->parms.link, +- tunnel->fwmark, skb_get_hash(skb)); ++ tunnel->fwmark, skb_get_hash(skb), 0); + + if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0) + goto tx_error; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index b1637990d5708..e5435156e545d 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3630,11 +3630,11 @@ static void tcp_send_challenge_ack(struct sock *sk) + + /* Then check host-wide RFC 5961 rate limit. */ + now = jiffies / HZ; +- if (now != challenge_timestamp) { ++ if (now != READ_ONCE(challenge_timestamp)) { + u32 ack_limit = READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit); + u32 half = (ack_limit + 1) >> 1; + +- challenge_timestamp = now; ++ WRITE_ONCE(challenge_timestamp, now); + WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit)); + } + count = READ_ONCE(challenge_count); +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 71899e5a5a111..1215c863e1c41 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + psock->sk = csk; + psock->bpf_prog = prog; + +- err = strp_init(&psock->strp, csk, &cb); +- if (err) { +- kmem_cache_free(kcm_psockp, psock); +- goto out; +- } +- + write_lock_bh(&csk->sk_callback_lock); + + /* Check if sk_user_data is already by KCM or someone else. +@@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + */ + if (csk->sk_user_data) { + write_unlock_bh(&csk->sk_callback_lock); +- strp_stop(&psock->strp); +- strp_done(&psock->strp); + kmem_cache_free(kcm_psockp, psock); + err = -EALREADY; + goto out; + } + ++ err = strp_init(&psock->strp, csk, &cb); ++ if (err) { ++ write_unlock_bh(&csk->sk_callback_lock); ++ kmem_cache_free(kcm_psockp, psock); ++ goto out; ++ } ++ + psock->save_data_ready = csk->sk_data_ready; + psock->save_write_space = csk->sk_write_space; + psock->save_state_change = csk->sk_state_change; +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index 8ff547ff351ed..4e4c9df637354 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -534,6 +534,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata) + + sdata_assert_lock(sdata); + ++ /* When not connected/joined, sending CSA doesn't make sense. */ ++ if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) ++ return -ENOLINK; ++ + /* update cfg80211 bss information with the new channel */ + if (!is_zero_ether_addr(ifibss->bssid)) { + cbss = cfg80211_get_bss(sdata->local->hw.wiphy, +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index b698756887eb5..e692a2487eb5d 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -465,16 +465,19 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) + scan_req = rcu_dereference_protected(local->scan_req, + lockdep_is_held(&local->mtx)); + +- if (scan_req != local->int_scan_req) { +- local->scan_info.aborted = aborted; +- cfg80211_scan_done(scan_req, &local->scan_info); +- } + RCU_INIT_POINTER(local->scan_req, NULL); + RCU_INIT_POINTER(local->scan_sdata, NULL); + + local->scanning = 0; + local->scan_chandef.chan = NULL; + ++ synchronize_rcu(); ++ ++ if (scan_req != local->int_scan_req) { ++ local->scan_info.aborted = aborted; ++ cfg80211_scan_done(scan_req, &local->scan_info); ++ } ++ + /* Set power back to normal operating levels. */ + ieee80211_hw_config(local, 0); + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index c0b2ce70e101c..fef9ad44d82ec 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2221,9 +2221,9 @@ static inline u64 sta_get_tidstats_msdu(struct ieee80211_sta_rx_stats *rxstats, + u64 value; + + do { +- start = u64_stats_fetch_begin(&rxstats->syncp); ++ start = u64_stats_fetch_begin_irq(&rxstats->syncp); + value = rxstats->msdu[tid]; +- } while (u64_stats_fetch_retry(&rxstats->syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&rxstats->syncp, start)); + + return value; + } +@@ -2289,9 +2289,9 @@ static inline u64 sta_get_stats_bytes(struct ieee80211_sta_rx_stats *rxstats) + u64 value; + + do { +- start = u64_stats_fetch_begin(&rxstats->syncp); ++ start = u64_stats_fetch_begin_irq(&rxstats->syncp); + value = rxstats->bytes; +- } while (u64_stats_fetch_retry(&rxstats->syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&rxstats->syncp, start)); + + return value; + } +diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c +index b8ce84618a55b..c439125ef2b91 100644 +--- a/net/mac802154/rx.c ++++ b/net/mac802154/rx.c +@@ -44,7 +44,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata, + + switch (mac_cb(skb)->dest.mode) { + case IEEE802154_ADDR_NONE: +- if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE) ++ if (hdr->source.mode != IEEE802154_ADDR_NONE) + /* FIXME: check if we are PAN coordinator */ + skb->pkt_type = PACKET_OTHERHOST; + else +diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c +index 35b5f806fdda1..b52afe316dc41 100644 +--- a/net/mpls/af_mpls.c ++++ b/net/mpls/af_mpls.c +@@ -1079,9 +1079,9 @@ static void mpls_get_stats(struct mpls_dev *mdev, + + p = per_cpu_ptr(mdev->stats, i); + do { +- start = u64_stats_fetch_begin(&p->syncp); ++ start = u64_stats_fetch_begin_irq(&p->syncp); + local = p->stats; +- } while (u64_stats_fetch_retry(&p->syncp, start)); ++ } while (u64_stats_fetch_retry_irq(&p->syncp, start)); + + stats->rx_packets += local.rx_packets; + stats->rx_bytes += local.rx_bytes; +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 7e8a39a356271..6c9d153afbeee 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -1802,7 +1802,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) + ovs_dp_reset_user_features(skb, info); + } + +- goto err_unlock_and_destroy_meters; ++ goto err_destroy_portids; + } + + err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid, +@@ -1817,6 +1817,8 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) + ovs_notify(&dp_datapath_genl_family, reply, info); + return 0; + ++err_destroy_portids: ++ kfree(rcu_dereference_raw(dp->upcall_portids)); + err_unlock_and_destroy_meters: + ovs_unlock(); + ovs_meters_exit(dp); +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index a64c3c1541118..b3596d4bd14a2 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -1125,6 +1125,21 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue, + } + EXPORT_SYMBOL(dev_graft_qdisc); + ++static void shutdown_scheduler_queue(struct net_device *dev, ++ struct netdev_queue *dev_queue, ++ void *_qdisc_default) ++{ ++ struct Qdisc *qdisc = dev_queue->qdisc_sleeping; ++ struct Qdisc *qdisc_default = _qdisc_default; ++ ++ if (qdisc) { ++ rcu_assign_pointer(dev_queue->qdisc, qdisc_default); ++ dev_queue->qdisc_sleeping = qdisc_default; ++ ++ qdisc_put(qdisc); ++ } ++} ++ + static void attach_one_default_qdisc(struct net_device *dev, + struct netdev_queue *dev_queue, + void *_unused) +@@ -1172,6 +1187,7 @@ static void attach_default_qdiscs(struct net_device *dev) + if (qdisc == &noop_qdisc) { + netdev_warn(dev, "default qdisc (%s) fail, fallback to %s\n", + default_qdisc_ops->id, noqueue_qdisc_ops.id); ++ netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc); + dev->priv_flags |= IFF_NO_QUEUE; + netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL); + qdisc = txq->qdisc_sleeping; +@@ -1450,21 +1466,6 @@ void dev_init_scheduler(struct net_device *dev) + timer_setup(&dev->watchdog_timer, dev_watchdog, 0); + } + +-static void shutdown_scheduler_queue(struct net_device *dev, +- struct netdev_queue *dev_queue, +- void *_qdisc_default) +-{ +- struct Qdisc *qdisc = dev_queue->qdisc_sleeping; +- struct Qdisc *qdisc_default = _qdisc_default; +- +- if (qdisc) { +- rcu_assign_pointer(dev_queue->qdisc, qdisc_default); +- dev_queue->qdisc_sleeping = qdisc_default; +- +- qdisc_put(qdisc); +- } +-} +- + void dev_shutdown(struct net_device *dev) + { + netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc); +diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c +index 72102277449e1..36079fdde2cb5 100644 +--- a/net/sched/sch_tbf.c ++++ b/net/sched/sch_tbf.c +@@ -356,6 +356,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt, + struct nlattr *tb[TCA_TBF_MAX + 1]; + struct tc_tbf_qopt *qopt; + struct Qdisc *child = NULL; ++ struct Qdisc *old = NULL; + struct psched_ratecfg rate; + struct psched_ratecfg peak; + u64 max_size; +@@ -447,7 +448,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt, + sch_tree_lock(sch); + if (child) { + qdisc_tree_flush_backlog(q->qdisc); +- qdisc_put(q->qdisc); ++ old = q->qdisc; + q->qdisc = child; + } + q->limit = qopt->limit; +@@ -467,6 +468,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt, + memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg)); + + sch_tree_unlock(sch); ++ qdisc_put(old); + err = 0; + + tbf_offload_change(sch); +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 433bb5a7df31e..a51d5ed2ad764 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1812,7 +1812,6 @@ static void smc_listen_out_connected(struct smc_sock *new_smc) + { + struct sock *newsmcsk = &new_smc->sk; + +- sk_refcnt_debug_inc(newsmcsk); + if (newsmcsk->sk_state == SMC_INIT) + newsmcsk->sk_state = SMC_ACTIVE; + +diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c +index aab43469a2f04..0878b162890af 100644 +--- a/net/wireless/debugfs.c ++++ b/net/wireless/debugfs.c +@@ -65,9 +65,10 @@ static ssize_t ht40allow_map_read(struct file *file, + { + struct wiphy *wiphy = file->private_data; + char *buf; +- unsigned int offset = 0, buf_size = PAGE_SIZE, i, r; ++ unsigned int offset = 0, buf_size = PAGE_SIZE, i; + enum nl80211_band band; + struct ieee80211_supported_band *sband; ++ ssize_t r; + + buf = kzalloc(buf_size, GFP_KERNEL); + if (!buf) +diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c +index f70112176b7c1..a71a8c6edf553 100644 +--- a/net/xdp/xsk_buff_pool.c ++++ b/net/xdp/xsk_buff_pool.c +@@ -379,6 +379,16 @@ static void xp_check_dma_contiguity(struct xsk_dma_map *dma_map) + + static int xp_init_dma_info(struct xsk_buff_pool *pool, struct xsk_dma_map *dma_map) + { ++ if (!pool->unaligned) { ++ u32 i; ++ ++ for (i = 0; i < pool->heads_cnt; i++) { ++ struct xdp_buff_xsk *xskb = &pool->heads[i]; ++ ++ xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr); ++ } ++ } ++ + pool->dma_pages = kvcalloc(dma_map->dma_pages_cnt, sizeof(*pool->dma_pages), GFP_KERNEL); + if (!pool->dma_pages) + return -ENOMEM; +@@ -428,12 +438,6 @@ int xp_dma_map(struct xsk_buff_pool *pool, struct device *dev, + + if (pool->unaligned) + xp_check_dma_contiguity(dma_map); +- else +- for (i = 0; i < pool->heads_cnt; i++) { +- struct xdp_buff_xsk *xskb = &pool->heads[i]; +- +- xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr); +- } + + err = xp_init_dma_info(pool, dma_map); + if (err) { +diff --git a/security/landlock/fs.c b/security/landlock/fs.c +index ec5a6247cd3e7..a9dbd99d9ee76 100644 +--- a/security/landlock/fs.c ++++ b/security/landlock/fs.c +@@ -149,6 +149,16 @@ retry: + LANDLOCK_ACCESS_FS_READ_FILE) + /* clang-format on */ + ++/* ++ * All access rights that are denied by default whether they are handled or not ++ * by a ruleset/layer. This must be ORed with all ruleset->fs_access_masks[] ++ * entries when we need to get the absolute handled access masks. ++ */ ++/* clang-format off */ ++#define ACCESS_INITIALLY_DENIED ( \ ++ LANDLOCK_ACCESS_FS_REFER) ++/* clang-format on */ ++ + /* + * @path: Should have been checked by get_path_from_fd(). + */ +@@ -167,7 +177,9 @@ int landlock_append_fs_rule(struct landlock_ruleset *const ruleset, + return -EINVAL; + + /* Transforms relative access rights to absolute ones. */ +- access_rights |= LANDLOCK_MASK_ACCESS_FS & ~ruleset->fs_access_masks[0]; ++ access_rights |= ++ LANDLOCK_MASK_ACCESS_FS & ++ ~(ruleset->fs_access_masks[0] | ACCESS_INITIALLY_DENIED); + object = get_inode_object(d_backing_inode(path->dentry)); + if (IS_ERR(object)) + return PTR_ERR(object); +@@ -277,23 +289,12 @@ static inline bool is_nouser_or_private(const struct dentry *dentry) + static inline access_mask_t + get_handled_accesses(const struct landlock_ruleset *const domain) + { +- access_mask_t access_dom = 0; +- unsigned long access_bit; +- +- for (access_bit = 0; access_bit < LANDLOCK_NUM_ACCESS_FS; +- access_bit++) { +- size_t layer_level; ++ access_mask_t access_dom = ACCESS_INITIALLY_DENIED; ++ size_t layer_level; + +- for (layer_level = 0; layer_level < domain->num_layers; +- layer_level++) { +- if (domain->fs_access_masks[layer_level] & +- BIT_ULL(access_bit)) { +- access_dom |= BIT_ULL(access_bit); +- break; +- } +- } +- } +- return access_dom; ++ for (layer_level = 0; layer_level < domain->num_layers; layer_level++) ++ access_dom |= domain->fs_access_masks[layer_level]; ++ return access_dom & LANDLOCK_MASK_ACCESS_FS; + } + + static inline access_mask_t +@@ -316,8 +317,13 @@ init_layer_masks(const struct landlock_ruleset *const domain, + + for_each_set_bit(access_bit, &access_req, + ARRAY_SIZE(*layer_masks)) { +- if (domain->fs_access_masks[layer_level] & +- BIT_ULL(access_bit)) { ++ /* ++ * Artificially handles all initially denied by default ++ * access rights. ++ */ ++ if (BIT_ULL(access_bit) & ++ (domain->fs_access_masks[layer_level] | ++ ACCESS_INITIALLY_DENIED)) { + (*layer_masks)[access_bit] |= + BIT_ULL(layer_level); + handled_accesses |= BIT_ULL(access_bit); +@@ -857,10 +863,6 @@ static int current_check_refer_path(struct dentry *const old_dentry, + NULL, NULL); + } + +- /* Backward compatibility: no reparenting support. */ +- if (!(get_handled_accesses(dom) & LANDLOCK_ACCESS_FS_REFER)) +- return -EXDEV; +- + access_request_parent1 |= LANDLOCK_ACCESS_FS_REFER; + access_request_parent2 |= LANDLOCK_ACCESS_FS_REFER; + +diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c +index 8cfdaee779050..55b3c49ba61de 100644 +--- a/sound/core/memalloc.c ++++ b/sound/core/memalloc.c +@@ -20,6 +20,13 @@ + + static const struct snd_malloc_ops *snd_dma_get_ops(struct snd_dma_buffer *dmab); + ++#ifdef CONFIG_SND_DMA_SGBUF ++static void *do_alloc_fallback_pages(struct device *dev, size_t size, ++ dma_addr_t *addr, bool wc); ++static void do_free_fallback_pages(void *p, size_t size, bool wc); ++static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size); ++#endif ++ + /* a cast to gfp flag from the dev pointer; for CONTINUOUS and VMALLOC types */ + static inline gfp_t snd_mem_get_gfp_flags(const struct snd_dma_buffer *dmab, + gfp_t default_gfp) +@@ -269,16 +276,21 @@ EXPORT_SYMBOL(snd_sgbuf_get_chunk_size); + /* + * Continuous pages allocator + */ +-static void *snd_dma_continuous_alloc(struct snd_dma_buffer *dmab, size_t size) ++static void *do_alloc_pages(size_t size, dma_addr_t *addr, gfp_t gfp) + { +- gfp_t gfp = snd_mem_get_gfp_flags(dmab, GFP_KERNEL); + void *p = alloc_pages_exact(size, gfp); + + if (p) +- dmab->addr = page_to_phys(virt_to_page(p)); ++ *addr = page_to_phys(virt_to_page(p)); + return p; + } + ++static void *snd_dma_continuous_alloc(struct snd_dma_buffer *dmab, size_t size) ++{ ++ return do_alloc_pages(size, &dmab->addr, ++ snd_mem_get_gfp_flags(dmab, GFP_KERNEL)); ++} ++ + static void snd_dma_continuous_free(struct snd_dma_buffer *dmab) + { + free_pages_exact(dmab->area, dmab->bytes); +@@ -455,6 +467,25 @@ static const struct snd_malloc_ops snd_dma_dev_ops = { + /* + * Write-combined pages + */ ++/* x86-specific allocations */ ++#ifdef CONFIG_SND_DMA_SGBUF ++static void *snd_dma_wc_alloc(struct snd_dma_buffer *dmab, size_t size) ++{ ++ return do_alloc_fallback_pages(dmab->dev.dev, size, &dmab->addr, true); ++} ++ ++static void snd_dma_wc_free(struct snd_dma_buffer *dmab) ++{ ++ do_free_fallback_pages(dmab->area, dmab->bytes, true); ++} ++ ++static int snd_dma_wc_mmap(struct snd_dma_buffer *dmab, ++ struct vm_area_struct *area) ++{ ++ area->vm_page_prot = pgprot_writecombine(area->vm_page_prot); ++ return snd_dma_continuous_mmap(dmab, area); ++} ++#else + static void *snd_dma_wc_alloc(struct snd_dma_buffer *dmab, size_t size) + { + return dma_alloc_wc(dmab->dev.dev, size, &dmab->addr, DEFAULT_GFP); +@@ -471,6 +502,7 @@ static int snd_dma_wc_mmap(struct snd_dma_buffer *dmab, + return dma_mmap_wc(dmab->dev.dev, area, + dmab->area, dmab->addr, dmab->bytes); + } ++#endif /* CONFIG_SND_DMA_SGBUF */ + + static const struct snd_malloc_ops snd_dma_wc_ops = { + .alloc = snd_dma_wc_alloc, +@@ -478,10 +510,6 @@ static const struct snd_malloc_ops snd_dma_wc_ops = { + .mmap = snd_dma_wc_mmap, + }; + +-#ifdef CONFIG_SND_DMA_SGBUF +-static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size); +-#endif +- + /* + * Non-contiguous pages allocator + */ +@@ -661,6 +689,37 @@ static const struct snd_malloc_ops snd_dma_sg_wc_ops = { + .get_chunk_size = snd_dma_noncontig_get_chunk_size, + }; + ++/* manual page allocations with wc setup */ ++static void *do_alloc_fallback_pages(struct device *dev, size_t size, ++ dma_addr_t *addr, bool wc) ++{ ++ gfp_t gfp = GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN; ++ void *p; ++ ++ again: ++ p = do_alloc_pages(size, addr, gfp); ++ if (!p || (*addr + size - 1) & ~dev->coherent_dma_mask) { ++ if (IS_ENABLED(CONFIG_ZONE_DMA32) && !(gfp & GFP_DMA32)) { ++ gfp |= GFP_DMA32; ++ goto again; ++ } ++ if (IS_ENABLED(CONFIG_ZONE_DMA) && !(gfp & GFP_DMA)) { ++ gfp = (gfp & ~GFP_DMA32) | GFP_DMA; ++ goto again; ++ } ++ } ++ if (p && wc) ++ set_memory_wc((unsigned long)(p), size >> PAGE_SHIFT); ++ return p; ++} ++ ++static void do_free_fallback_pages(void *p, size_t size, bool wc) ++{ ++ if (wc) ++ set_memory_wb((unsigned long)(p), size >> PAGE_SHIFT); ++ free_pages_exact(p, size); ++} ++ + /* Fallback SG-buffer allocations for x86 */ + struct snd_dma_sg_fallback { + size_t count; +@@ -671,14 +730,11 @@ struct snd_dma_sg_fallback { + static void __snd_dma_sg_fallback_free(struct snd_dma_buffer *dmab, + struct snd_dma_sg_fallback *sgbuf) + { ++ bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; + size_t i; + +- if (sgbuf->count && dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK) +- set_pages_array_wb(sgbuf->pages, sgbuf->count); + for (i = 0; i < sgbuf->count && sgbuf->pages[i]; i++) +- dma_free_coherent(dmab->dev.dev, PAGE_SIZE, +- page_address(sgbuf->pages[i]), +- sgbuf->addrs[i]); ++ do_free_fallback_pages(page_address(sgbuf->pages[i]), PAGE_SIZE, wc); + kvfree(sgbuf->pages); + kvfree(sgbuf->addrs); + kfree(sgbuf); +@@ -690,6 +746,7 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size) + struct page **pages; + size_t i, count; + void *p; ++ bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; + + sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL); + if (!sgbuf) +@@ -704,15 +761,13 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size) + goto error; + + for (i = 0; i < count; sgbuf->count++, i++) { +- p = dma_alloc_coherent(dmab->dev.dev, PAGE_SIZE, +- &sgbuf->addrs[i], DEFAULT_GFP); ++ p = do_alloc_fallback_pages(dmab->dev.dev, PAGE_SIZE, ++ &sgbuf->addrs[i], wc); + if (!p) + goto error; + sgbuf->pages[i] = virt_to_page(p); + } + +- if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK) +- set_pages_array_wc(pages, count); + p = vmap(pages, count, VM_MAP, PAGE_KERNEL); + if (!p) + goto error; +diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c +index 1e3bf086f8671..07efb38f58ac1 100644 +--- a/sound/core/seq/oss/seq_oss_midi.c ++++ b/sound/core/seq/oss/seq_oss_midi.c +@@ -270,7 +270,9 @@ snd_seq_oss_midi_clear_all(void) + void + snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp) + { ++ spin_lock_irq(®ister_lock); + dp->max_mididev = max_midi_devs; ++ spin_unlock_irq(®ister_lock); + } + + /* +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 2e9d695d336c9..2d707afa1ef1c 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -121,13 +121,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) + spin_unlock_irqrestore(&clients_lock, flags); + #ifdef CONFIG_MODULES + if (!in_interrupt()) { +- static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS]; +- static char card_requested[SNDRV_CARDS]; ++ static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); ++ static DECLARE_BITMAP(card_requested, SNDRV_CARDS); ++ + if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) { + int idx; + +- if (!client_requested[clientid]) { +- client_requested[clientid] = 1; ++ if (!test_and_set_bit(clientid, client_requested)) { + for (idx = 0; idx < 15; idx++) { + if (seq_client_load[idx] < 0) + break; +@@ -142,10 +142,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid) + int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / + SNDRV_SEQ_CLIENTS_PER_CARD; + if (card < snd_ecards_limit) { +- if (! card_requested[card]) { +- card_requested[card] = 1; ++ if (!test_and_set_bit(card, card_requested)) + snd_request_card(card); +- } + snd_seq_device_load_drivers(); + } + } +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index 9db5ccd9aa2db..13bb0ccfb36c0 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -55,16 +55,22 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + + /* find max number of channels based on format_configuration */ + if (fmt_configs->fmt_count) { ++ struct nhlt_fmt_cfg *fmt_cfg = fmt_configs->fmt_config; ++ + dev_dbg(dev, "found %d format definitions\n", + fmt_configs->fmt_count); + + for (i = 0; i < fmt_configs->fmt_count; i++) { + struct wav_fmt_ext *fmt_ext; + +- fmt_ext = &fmt_configs->fmt_config[i].fmt_ext; ++ fmt_ext = &fmt_cfg->fmt_ext; + + if (fmt_ext->fmt.channels > max_ch) + max_ch = fmt_ext->fmt.channels; ++ ++ /* Move to the next nhlt_fmt_cfg */ ++ fmt_cfg = (struct nhlt_fmt_cfg *)(fmt_cfg->config.caps + ++ fmt_cfg->config.size); + } + dev_dbg(dev, "max channels found %d\n", max_ch); + } else { +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b44b882f8378c..799f6bf266dd0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4689,6 +4689,48 @@ static void alc236_fixup_hp_mute_led_micmute_vref(struct hda_codec *codec, + alc236_fixup_hp_micmute_led_vref(codec, fix, action); + } + ++static inline void alc298_samsung_write_coef_pack(struct hda_codec *codec, ++ const unsigned short coefs[2]) ++{ ++ alc_write_coef_idx(codec, 0x23, coefs[0]); ++ alc_write_coef_idx(codec, 0x25, coefs[1]); ++ alc_write_coef_idx(codec, 0x26, 0xb011); ++} ++ ++struct alc298_samsung_amp_desc { ++ unsigned char nid; ++ unsigned short init_seq[2][2]; ++}; ++ ++static void alc298_fixup_samsung_amp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ int i, j; ++ static const unsigned short init_seq[][2] = { ++ { 0x19, 0x00 }, { 0x20, 0xc0 }, { 0x22, 0x44 }, { 0x23, 0x08 }, ++ { 0x24, 0x85 }, { 0x25, 0x41 }, { 0x35, 0x40 }, { 0x36, 0x01 }, ++ { 0x38, 0x81 }, { 0x3a, 0x03 }, { 0x3b, 0x81 }, { 0x40, 0x3e }, ++ { 0x41, 0x07 }, { 0x400, 0x1 } ++ }; ++ static const struct alc298_samsung_amp_desc amps[] = { ++ { 0x3a, { { 0x18, 0x1 }, { 0x26, 0x0 } } }, ++ { 0x39, { { 0x18, 0x2 }, { 0x26, 0x1 } } } ++ }; ++ ++ if (action != HDA_FIXUP_ACT_INIT) ++ return; ++ ++ for (i = 0; i < ARRAY_SIZE(amps); i++) { ++ alc_write_coef_idx(codec, 0x22, amps[i].nid); ++ ++ for (j = 0; j < ARRAY_SIZE(amps[i].init_seq); j++) ++ alc298_samsung_write_coef_pack(codec, amps[i].init_seq[j]); ++ ++ for (j = 0; j < ARRAY_SIZE(init_seq); j++) ++ alc298_samsung_write_coef_pack(codec, init_seq[j]); ++ } ++} ++ + #if IS_REACHABLE(CONFIG_INPUT) + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) +@@ -7000,6 +7042,7 @@ enum { + ALC236_FIXUP_HP_GPIO_LED, + ALC236_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF, ++ ALC298_FIXUP_SAMSUNG_AMP, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, +@@ -8365,6 +8408,12 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc236_fixup_hp_mute_led_micmute_vref, + }, ++ [ALC298_FIXUP_SAMSUNG_AMP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_samsung_amp, ++ .chained = true, ++ .chain_id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ++ }, + [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -9307,13 +9356,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10ec, 0x1254, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE), + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), +- SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), +- SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), +- SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), +- SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_AMP), ++ SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_AMP), ++ SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP), ++ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), +- SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), +- SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP), ++ SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), +@@ -9679,7 +9728,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, +- {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, ++ {.id = ALC298_FIXUP_SAMSUNG_AMP, .name = "alc298-samsung-amp"}, + {.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"}, + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, +diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c +index 21a2ce8fa739d..45de42a027c54 100644 +--- a/tools/testing/selftests/landlock/fs_test.c ++++ b/tools/testing/selftests/landlock/fs_test.c +@@ -4,7 +4,7 @@ + * + * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> + * Copyright © 2020 ANSSI +- * Copyright © 2020-2021 Microsoft Corporation ++ * Copyright © 2020-2022 Microsoft Corporation + */ + + #define _GNU_SOURCE +@@ -371,6 +371,13 @@ TEST_F_FORK(layout1, inval) + ASSERT_EQ(EINVAL, errno); + path_beneath.allowed_access &= ~LANDLOCK_ACCESS_FS_EXECUTE; + ++ /* Tests with denied-by-default access right. */ ++ path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_REFER; ++ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, ++ &path_beneath, 0)); ++ ASSERT_EQ(EINVAL, errno); ++ path_beneath.allowed_access &= ~LANDLOCK_ACCESS_FS_REFER; ++ + /* Test with unknown (64-bits) value. */ + path_beneath.allowed_access |= (1ULL << 60); + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, +@@ -1826,6 +1833,20 @@ TEST_F_FORK(layout1, link) + ASSERT_EQ(0, link(file1_s1d3, file2_s1d3)); + } + ++static int test_rename(const char *const oldpath, const char *const newpath) ++{ ++ if (rename(oldpath, newpath)) ++ return errno; ++ return 0; ++} ++ ++static int test_exchange(const char *const oldpath, const char *const newpath) ++{ ++ if (renameat2(AT_FDCWD, oldpath, AT_FDCWD, newpath, RENAME_EXCHANGE)) ++ return errno; ++ return 0; ++} ++ + TEST_F_FORK(layout1, rename_file) + { + const struct rule rules[] = { +@@ -1867,10 +1888,10 @@ TEST_F_FORK(layout1, rename_file) + * to a different directory (which allows file removal). + */ + ASSERT_EQ(-1, rename(file1_s2d1, file1_s1d3)); +- ASSERT_EQ(EXDEV, errno); ++ ASSERT_EQ(EACCES, errno); + ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s2d1, AT_FDCWD, file1_s1d3, + RENAME_EXCHANGE)); +- ASSERT_EQ(EXDEV, errno); ++ ASSERT_EQ(EACCES, errno); + ASSERT_EQ(-1, renameat2(AT_FDCWD, dir_s2d2, AT_FDCWD, file1_s1d3, + RENAME_EXCHANGE)); + ASSERT_EQ(EXDEV, errno); +@@ -1894,7 +1915,7 @@ TEST_F_FORK(layout1, rename_file) + ASSERT_EQ(EXDEV, errno); + ASSERT_EQ(0, unlink(file1_s1d3)); + ASSERT_EQ(-1, rename(file1_s2d1, file1_s1d3)); +- ASSERT_EQ(EXDEV, errno); ++ ASSERT_EQ(EACCES, errno); + + /* Exchanges and renames files with same parent. */ + ASSERT_EQ(0, renameat2(AT_FDCWD, file2_s2d3, AT_FDCWD, file1_s2d3, +@@ -2014,6 +2035,115 @@ TEST_F_FORK(layout1, reparent_refer) + ASSERT_EQ(0, rename(dir_s1d3, dir_s2d3)); + } + ++/* Checks renames beneath dir_s1d1. */ ++static void refer_denied_by_default(struct __test_metadata *const _metadata, ++ const struct rule layer1[], ++ const int layer1_err, ++ const struct rule layer2[]) ++{ ++ int ruleset_fd; ++ ++ ASSERT_EQ(0, unlink(file1_s1d2)); ++ ++ ruleset_fd = create_ruleset(_metadata, layer1[0].access, layer1); ++ ASSERT_LE(0, ruleset_fd); ++ enforce_ruleset(_metadata, ruleset_fd); ++ ASSERT_EQ(0, close(ruleset_fd)); ++ ++ /* ++ * If the first layer handles LANDLOCK_ACCESS_FS_REFER (according to ++ * layer1_err), then it allows some different-parent renames and links. ++ */ ++ ASSERT_EQ(layer1_err, test_rename(file1_s1d1, file1_s1d2)); ++ if (layer1_err == 0) ++ ASSERT_EQ(layer1_err, test_rename(file1_s1d2, file1_s1d1)); ++ ASSERT_EQ(layer1_err, test_exchange(file2_s1d1, file2_s1d2)); ++ ASSERT_EQ(layer1_err, test_exchange(file2_s1d2, file2_s1d1)); ++ ++ ruleset_fd = create_ruleset(_metadata, layer2[0].access, layer2); ++ ASSERT_LE(0, ruleset_fd); ++ enforce_ruleset(_metadata, ruleset_fd); ++ ASSERT_EQ(0, close(ruleset_fd)); ++ ++ /* ++ * Now, either the first or the second layer does not handle ++ * LANDLOCK_ACCESS_FS_REFER, which means that any different-parent ++ * renames and links are denied, thus making the layer handling ++ * LANDLOCK_ACCESS_FS_REFER null and void. ++ */ ++ ASSERT_EQ(EXDEV, test_rename(file1_s1d1, file1_s1d2)); ++ ASSERT_EQ(EXDEV, test_exchange(file2_s1d1, file2_s1d2)); ++ ASSERT_EQ(EXDEV, test_exchange(file2_s1d2, file2_s1d1)); ++} ++ ++const struct rule layer_dir_s1d1_refer[] = { ++ { ++ .path = dir_s1d1, ++ .access = LANDLOCK_ACCESS_FS_REFER, ++ }, ++ {}, ++}; ++ ++const struct rule layer_dir_s1d1_execute[] = { ++ { ++ /* Matches a parent directory. */ ++ .path = dir_s1d1, ++ .access = LANDLOCK_ACCESS_FS_EXECUTE, ++ }, ++ {}, ++}; ++ ++const struct rule layer_dir_s2d1_execute[] = { ++ { ++ /* Does not match a parent directory. */ ++ .path = dir_s2d1, ++ .access = LANDLOCK_ACCESS_FS_EXECUTE, ++ }, ++ {}, ++}; ++ ++/* ++ * Tests precedence over renames: denied by default for different parent ++ * directories, *with* a rule matching a parent directory, but not directly ++ * denying access (with MAKE_REG nor REMOVE). ++ */ ++TEST_F_FORK(layout1, refer_denied_by_default1) ++{ ++ refer_denied_by_default(_metadata, layer_dir_s1d1_refer, 0, ++ layer_dir_s1d1_execute); ++} ++ ++/* ++ * Same test but this time turning around the ABI version order: the first ++ * layer does not handle LANDLOCK_ACCESS_FS_REFER. ++ */ ++TEST_F_FORK(layout1, refer_denied_by_default2) ++{ ++ refer_denied_by_default(_metadata, layer_dir_s1d1_execute, EXDEV, ++ layer_dir_s1d1_refer); ++} ++ ++/* ++ * Tests precedence over renames: denied by default for different parent ++ * directories, *without* a rule matching a parent directory, but not directly ++ * denying access (with MAKE_REG nor REMOVE). ++ */ ++TEST_F_FORK(layout1, refer_denied_by_default3) ++{ ++ refer_denied_by_default(_metadata, layer_dir_s1d1_refer, 0, ++ layer_dir_s2d1_execute); ++} ++ ++/* ++ * Same test but this time turning around the ABI version order: the first ++ * layer does not handle LANDLOCK_ACCESS_FS_REFER. ++ */ ++TEST_F_FORK(layout1, refer_denied_by_default4) ++{ ++ refer_denied_by_default(_metadata, layer_dir_s2d1_execute, EXDEV, ++ layer_dir_s1d1_refer); ++} ++ + TEST_F_FORK(layout1, reparent_link) + { + const struct rule layer1[] = { +@@ -2336,11 +2466,12 @@ TEST_F_FORK(layout1, reparent_exdev_layers_rename1) + ASSERT_EQ(EXDEV, errno); + + /* +- * However, moving the file2_s1d3 file below dir_s2d3 is allowed +- * because it cannot inherit MAKE_REG nor MAKE_DIR rights (which are +- * dedicated to directories). ++ * Moving the file2_s1d3 file below dir_s2d3 is denied because the ++ * second layer does not handle REFER, which is always denied by ++ * default. + */ +- ASSERT_EQ(0, rename(file2_s1d3, file1_s2d3)); ++ ASSERT_EQ(-1, rename(file2_s1d3, file1_s2d3)); ++ ASSERT_EQ(EXDEV, errno); + } + + TEST_F_FORK(layout1, reparent_exdev_layers_rename2) +@@ -2373,8 +2504,12 @@ TEST_F_FORK(layout1, reparent_exdev_layers_rename2) + ASSERT_EQ(EACCES, errno); + ASSERT_EQ(-1, rename(file1_s1d1, file1_s2d3)); + ASSERT_EQ(EXDEV, errno); +- /* Modify layout! */ +- ASSERT_EQ(0, rename(file2_s1d2, file1_s2d3)); ++ /* ++ * Modifying the layout is now denied because the second layer does not ++ * handle REFER, which is always denied by default. ++ */ ++ ASSERT_EQ(-1, rename(file2_s1d2, file1_s2d3)); ++ ASSERT_EQ(EXDEV, errno); + + /* Without REFER source, EACCES wins over EXDEV. */ + ASSERT_EQ(-1, rename(dir_s1d1, file1_s2d2)); |