diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2024-07-05 06:48:23 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2024-07-05 06:48:23 -0400 |
| commit | 5b9c7d2bab733a9f743196f1268796a1de83d7e4 (patch) | |
| tree | c0988d6f7bab8d70742b19d8805fcd89e067c0e0 | |
| parent | BMQ v6.9-r0 (diff) | |
| download | linux-patches-5b9c7d2bab733a9f743196f1268796a1de83d7e4.tar.gz linux-patches-5b9c7d2bab733a9f743196f1268796a1de83d7e4.tar.bz2 linux-patches-5b9c7d2bab733a9f743196f1268796a1de83d7e4.zip | |
Linux patch 6.9.86.9-9
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1007_linux-6.9.8.patch | 8262 |
2 files changed, 8266 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 3b52f37f..8008738f 100644 --- a/0000_README +++ b/0000_README @@ -71,6 +71,10 @@ Patch: 1006_linux-6.9.7.patch From: https://www.kernel.org Desc: Linux 6.9.7 +Patch: 1007_linux-6.9.8.patch +From: https://www.kernel.org +Desc: Linux 6.9.8 + Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch Desc: Enable link security restrictions by default. diff --git a/1007_linux-6.9.8.patch b/1007_linux-6.9.8.patch new file mode 100644 index 00000000..3e9734e4 --- /dev/null +++ b/1007_linux-6.9.8.patch @@ -0,0 +1,8262 @@ +diff --git a/Documentation/kbuild/modules.rst b/Documentation/kbuild/modules.rst +index a1f3eb7a43e23..131863142cbb3 100644 +--- a/Documentation/kbuild/modules.rst ++++ b/Documentation/kbuild/modules.rst +@@ -128,7 +128,7 @@ executed to make module versioning work. + + modules_install + Install the external module(s). The default location is +- /lib/modules/<kernel_release>/extra/, but a prefix may ++ /lib/modules/<kernel_release>/updates/, but a prefix may + be added with INSTALL_MOD_PATH (discussed in section 5). + + clean +@@ -417,7 +417,7 @@ directory: + + And external modules are installed in: + +- /lib/modules/$(KERNELRELEASE)/extra/ ++ /lib/modules/$(KERNELRELEASE)/updates/ + + 5.1 INSTALL_MOD_PATH + -------------------- +@@ -438,10 +438,10 @@ And external modules are installed in: + ------------------- + + External modules are by default installed to a directory under +- /lib/modules/$(KERNELRELEASE)/extra/, but you may wish to ++ /lib/modules/$(KERNELRELEASE)/updates/, but you may wish to + locate modules for a specific functionality in a separate + directory. For this purpose, use INSTALL_MOD_DIR to specify an +- alternative name to "extra.":: ++ alternative name to "updates.":: + + $ make INSTALL_MOD_DIR=gandalf -C $KDIR \ + M=$PWD modules_install +diff --git a/Makefile b/Makefile +index 17dc3e55323e7..060e20dba35e5 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 9 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +diff --git a/arch/arm/boot/dts/rockchip/rk3066a.dtsi b/arch/arm/boot/dts/rockchip/rk3066a.dtsi +index 30139f21de64d..15cbd94d7ec05 100644 +--- a/arch/arm/boot/dts/rockchip/rk3066a.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3066a.dtsi +@@ -128,6 +128,7 @@ hdmi: hdmi@10116000 { + pinctrl-0 = <&hdmii2c_xfer>, <&hdmi_hpd>; + power-domains = <&power RK3066_PD_VIO>; + rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + + ports { +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index 72b5cd697f5d9..deeb8f292454b 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -2252,28 +2252,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + /* If building the body of the JITed code fails somehow, + * we fall back to the interpretation. + */ +- if (build_body(&ctx) < 0) { +- image_ptr = NULL; +- bpf_jit_binary_free(header); +- prog = orig_prog; +- goto out_imms; +- } ++ if (build_body(&ctx) < 0) ++ goto out_free; + build_epilogue(&ctx); + + /* 3.) Extra pass to validate JITed Code */ +- if (validate_code(&ctx)) { +- image_ptr = NULL; +- bpf_jit_binary_free(header); +- prog = orig_prog; +- goto out_imms; +- } ++ if (validate_code(&ctx)) ++ goto out_free; + flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx)); + + if (bpf_jit_enable > 1) + /* there are 2 passes here */ + bpf_jit_dump(prog->len, image_size, 2, ctx.target); + +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) ++ goto out_free; + prog->bpf_func = (void *)ctx.target; + prog->jited = 1; + prog->jited_len = image_size; +@@ -2290,5 +2283,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_jit_prog_release_other(prog, prog == orig_prog ? + tmp : orig_prog); + return prog; ++ ++out_free: ++ image_ptr = NULL; ++ bpf_jit_binary_free(header); ++ prog = orig_prog; ++ goto out_imms; + } + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index b47fe02c33fbd..079101cddd65f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -5,6 +5,8 @@ + */ + + /dts-v1/; ++ ++#include <dt-bindings/leds/common.h> + #include "rk3308.dtsi" + + / { +@@ -24,17 +26,21 @@ chosen { + leds { + compatible = "gpio-leds"; + pinctrl-names = "default"; +- pinctrl-0 = <&green_led_gio>, <&heartbeat_led_gpio>; ++ pinctrl-0 = <&green_led>, <&heartbeat_led>; + + green-led { ++ color = <LED_COLOR_ID_GREEN>; + default-state = "on"; ++ function = LED_FUNCTION_POWER; + gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>; + label = "rockpis:green:power"; + linux,default-trigger = "default-on"; + }; + + blue-led { ++ color = <LED_COLOR_ID_BLUE>; + default-state = "on"; ++ function = LED_FUNCTION_HEARTBEAT; + gpios = <&gpio0 RK_PA5 GPIO_ACTIVE_HIGH>; + label = "rockpis:blue:user"; + linux,default-trigger = "heartbeat"; +@@ -126,10 +132,12 @@ &cpu0 { + }; + + &emmc { +- bus-width = <4>; + cap-mmc-highspeed; +- mmc-hs200-1_8v; ++ cap-sd-highspeed; ++ no-sdio; + non-removable; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; + vmmc-supply = <&vcc_io>; + status = "okay"; + }; +@@ -214,11 +222,11 @@ &pinctrl { + pinctrl-0 = <&rtc_32k>; + + leds { +- green_led_gio: green-led-gpio { ++ green_led: green-led { + rockchip,pins = <0 RK_PA6 RK_FUNC_GPIO &pcfg_pull_none>; + }; + +- heartbeat_led_gpio: heartbeat-led-gpio { ++ heartbeat_led: heartbeat-led { + rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts +index f09d60bbe6c4f..a608a219543e5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts +@@ -241,8 +241,8 @@ &i2c1 { + rk805: pmic@18 { + compatible = "rockchip,rk805"; + reg = <0x18>; +- interrupt-parent = <&gpio2>; +- interrupts = <6 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-parent = <&gpio0>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + #clock-cells = <1>; + clock-output-names = "xin32k", "rk805-clkout2"; + gpio-controller; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +index 62af0cb94839b..5ce82b64b6836 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +@@ -793,6 +793,7 @@ spdif: spdif@ff880000 { + dma-names = "tx"; + pinctrl-names = "default"; + pinctrl-0 = <&spdif_tx>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +@@ -804,6 +805,7 @@ i2s_2ch: i2s-2ch@ff890000 { + clocks = <&cru SCLK_I2S_2CH>, <&cru HCLK_I2S_2CH>; + dmas = <&dmac_bus 6>, <&dmac_bus 7>; + dma-names = "tx", "rx"; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +@@ -817,6 +819,7 @@ i2s_8ch: i2s-8ch@ff898000 { + dma-names = "tx", "rx"; + pinctrl-names = "default"; + pinctrl-0 = <&i2s_8ch_bus>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +index 789fd0dcc88ba..3cd63d1e8f15b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +@@ -450,7 +450,7 @@ da7219_aad { + dlg,btn-cfg = <50>; + dlg,mic-det-thr = <500>; + dlg,jack-ins-deb = <20>; +- dlg,jack-det-rate = "32ms_64ms"; ++ dlg,jack-det-rate = "32_64"; + dlg,jack-rem-deb = <1>; + + dlg,a-d-btn-thr = <0xa>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts +index 1a604429fb266..e74871491ef56 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts +@@ -444,6 +444,7 @@ &sdhci { + &sdmmc { + bus-width = <4>; + cap-sd-highspeed; ++ cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; + disable-wp; + max-frequency = <150000000>; + no-sdio; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-quartzpro64.dts b/arch/arm64/boot/dts/rockchip/rk3588-quartzpro64.dts +index 22bbfbe729c11..b6628889b707e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-quartzpro64.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-quartzpro64.dts +@@ -429,6 +429,7 @@ &sdhci { + &sdmmc { + bus-width = <4>; + cap-sd-highspeed; ++ cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; + disable-wp; + max-frequency = <150000000>; + no-sdio; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts +index 1fe8b2a0ed75e..9b7bf6cec8bd1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts +@@ -378,6 +378,7 @@ &sdmmc { + bus-width = <4>; + cap-mmc-highspeed; + cap-sd-highspeed; ++ cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; + disable-wp; + sd-uhs-sdr104; + vmmc-supply = <&vcc_3v3_s3>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi +index 1eb2543a5fde6..64ff1c90afe2c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi +@@ -324,6 +324,11 @@ module_led_pin: module-led-pin { + }; + }; + ++&pwm0 { ++ pinctrl-0 = <&pwm0m1_pins>; ++ pinctrl-names = "default"; ++}; ++ + &saradc { + vref-supply = <&vcc_1v8_s0>; + status = "okay"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts b/arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts +index e037bf9db75af..adba82c6e2e1e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts +@@ -283,9 +283,9 @@ &i2c7 { + pinctrl-0 = <&i2c7m0_xfer>; + status = "okay"; + +- es8316: audio-codec@11 { ++ es8316: audio-codec@10 { + compatible = "everest,es8316"; +- reg = <0x11>; ++ reg = <0x10>; + assigned-clocks = <&cru I2S0_8CH_MCLKOUT>; + assigned-clock-rates = <12288000>; + clocks = <&cru I2S0_8CH_MCLKOUT>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts +index 00afb90d4eb10..ef776aec9d4b5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts +@@ -366,6 +366,7 @@ &sdmmc { + bus-width = <4>; + cap-mmc-highspeed; + cap-sd-highspeed; ++ cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; + disable-wp; + max-frequency = <150000000>; + no-sdio; +@@ -393,6 +394,7 @@ pmic@0 { + pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>, + <&rk806_dvs2_null>, <&rk806_dvs3_null>; + spi-max-frequency = <1000000>; ++ system-power-controller; + + vcc1-supply = <&vcc5v0_sys>; + vcc2-supply = <&vcc5v0_sys>; +diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h +index 7118282d1c797..9ee1ffded2638 100644 +--- a/arch/arm64/include/asm/unistd32.h ++++ b/arch/arm64/include/asm/unistd32.h +@@ -840,7 +840,7 @@ __SYSCALL(__NR_pselect6_time64, compat_sys_pselect6_time64) + #define __NR_ppoll_time64 414 + __SYSCALL(__NR_ppoll_time64, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SYSCALL(__NR_io_pgetevents_time64, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SYSCALL(__NR_recvmmsg_time64, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +diff --git a/arch/arm64/kernel/pi/map_kernel.c b/arch/arm64/kernel/pi/map_kernel.c +index 5fa08e13e17e5..f374a3e5a5fe1 100644 +--- a/arch/arm64/kernel/pi/map_kernel.c ++++ b/arch/arm64/kernel/pi/map_kernel.c +@@ -173,7 +173,7 @@ static void __init remap_idmap_for_lpa2(void) + * Don't bother with the FDT, we no longer need it after this. + */ + memset(init_idmap_pg_dir, 0, +- (u64)init_idmap_pg_dir - (u64)init_idmap_pg_end); ++ (u64)init_idmap_pg_end - (u64)init_idmap_pg_dir); + + create_init_idmap(init_idmap_pg_dir, mask); + dsb(ishst); +diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c +index ad198262b9817..7230f6e20ab8b 100644 +--- a/arch/arm64/kernel/syscall.c ++++ b/arch/arm64/kernel/syscall.c +@@ -53,17 +53,15 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, + syscall_set_return_value(current, regs, 0, ret); + + /* +- * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), +- * but not enough for arm64 stack utilization comfort. To keep +- * reasonable stack head room, reduce the maximum offset to 9 bits. ++ * This value will get limited by KSTACK_OFFSET_MAX(), which is 10 ++ * bits. The actual entropy will be further reduced by the compiler ++ * when applying stack alignment constraints: the AAPCS mandates a ++ * 16-byte aligned SP at function boundaries, which will remove the ++ * 4 low bits from any entropy chosen here. + * +- * The actual entropy will be further reduced by the compiler when +- * applying stack alignment constraints: the AAPCS mandates a +- * 16-byte (i.e. 4-bit) aligned SP at function boundaries. +- * +- * The resulting 5 bits of entropy is seen in SP[8:4]. ++ * The resulting 6 bits of entropy is seen in SP[9:4]. + */ +- choose_random_kstack_offset(get_random_u16() & 0x1FF); ++ choose_random_kstack_offset(get_random_u16()); + } + + static inline bool has_syscall_work(unsigned long flags) +diff --git a/arch/csky/include/uapi/asm/unistd.h b/arch/csky/include/uapi/asm/unistd.h +index 7ff6a2466af10..e0594b6370a65 100644 +--- a/arch/csky/include/uapi/asm/unistd.h ++++ b/arch/csky/include/uapi/asm/unistd.h +@@ -6,6 +6,7 @@ + #define __ARCH_WANT_SYS_CLONE3 + #define __ARCH_WANT_SET_GET_RLIMIT + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYNC_FILE_RANGE2 + #include <asm-generic/unistd.h> + + #define __NR_set_thread_area (__NR_arch_specific_syscall + 0) +diff --git a/arch/hexagon/include/asm/syscalls.h b/arch/hexagon/include/asm/syscalls.h +new file mode 100644 +index 0000000000000..40f2d08bec92c +--- /dev/null ++++ b/arch/hexagon/include/asm/syscalls.h +@@ -0,0 +1,6 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++ ++#include <asm-generic/syscalls.h> ++ ++asmlinkage long sys_hexagon_fadvise64_64(int fd, int advice, ++ u32 a2, u32 a3, u32 a4, u32 a5); +diff --git a/arch/hexagon/include/uapi/asm/unistd.h b/arch/hexagon/include/uapi/asm/unistd.h +index 432c4db1b6239..21ae22306b5dc 100644 +--- a/arch/hexagon/include/uapi/asm/unistd.h ++++ b/arch/hexagon/include/uapi/asm/unistd.h +@@ -36,5 +36,6 @@ + #define __ARCH_WANT_SYS_VFORK + #define __ARCH_WANT_SYS_FORK + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYNC_FILE_RANGE2 + + #include <asm-generic/unistd.h> +diff --git a/arch/hexagon/kernel/syscalltab.c b/arch/hexagon/kernel/syscalltab.c +index 0fadd582cfc77..5d98bdc494ec2 100644 +--- a/arch/hexagon/kernel/syscalltab.c ++++ b/arch/hexagon/kernel/syscalltab.c +@@ -14,6 +14,13 @@ + #undef __SYSCALL + #define __SYSCALL(nr, call) [nr] = (call), + ++SYSCALL_DEFINE6(hexagon_fadvise64_64, int, fd, int, advice, ++ SC_ARG64(offset), SC_ARG64(len)) ++{ ++ return ksys_fadvise64_64(fd, SC_VAL64(loff_t, offset), SC_VAL64(loff_t, len), advice); ++} ++#define sys_fadvise64_64 sys_hexagon_fadvise64_64 ++ + void *sys_call_table[__NR_syscalls] = { + #include <asm/unistd.h> + }; +diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c +index e73323d759d0b..7dbefd4ba2107 100644 +--- a/arch/loongarch/net/bpf_jit.c ++++ b/arch/loongarch/net/bpf_jit.c +@@ -1294,16 +1294,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + flush_icache_range((unsigned long)header, (unsigned long)(ctx.image + ctx.idx)); + + if (!prog->is_func || extra_pass) { ++ int err; ++ + if (extra_pass && ctx.idx != jit_data->ctx.idx) { + pr_err_once("multi-func JIT bug %d != %d\n", + ctx.idx, jit_data->ctx.idx); +- bpf_jit_binary_free(header); +- prog->bpf_func = NULL; +- prog->jited = 0; +- prog->jited_len = 0; +- goto out_offset; ++ goto out_free; ++ } ++ err = bpf_jit_binary_lock_ro(header); ++ if (err) { ++ pr_err_once("bpf_jit_binary_lock_ro() returned %d\n", ++ err); ++ goto out_free; + } +- bpf_jit_binary_lock_ro(header); + } else { + jit_data->ctx = ctx; + jit_data->image = image_ptr; +@@ -1334,6 +1337,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + out_offset = -1; + + return prog; ++ ++out_free: ++ bpf_jit_binary_free(header); ++ prog->bpf_func = NULL; ++ prog->jited = 0; ++ prog->jited_len = 0; ++ goto out_offset; + } + + /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */ +diff --git a/arch/mips/kernel/syscalls/syscall_n32.tbl b/arch/mips/kernel/syscalls/syscall_n32.tbl +index 83cfc9eb6b88e..c5e1cacd2ab6a 100644 +--- a/arch/mips/kernel/syscalls/syscall_n32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_n32.tbl +@@ -354,7 +354,7 @@ + 412 n32 utimensat_time64 sys_utimensat + 413 n32 pselect6_time64 compat_sys_pselect6_time64 + 414 n32 ppoll_time64 compat_sys_ppoll_time64 +-416 n32 io_pgetevents_time64 sys_io_pgetevents ++416 n32 io_pgetevents_time64 compat_sys_io_pgetevents_time64 + 417 n32 recvmmsg_time64 compat_sys_recvmmsg_time64 + 418 n32 mq_timedsend_time64 sys_mq_timedsend + 419 n32 mq_timedreceive_time64 sys_mq_timedreceive +diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl +index f45c9530ea93a..0352c07c608e9 100644 +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -403,7 +403,7 @@ + 412 o32 utimensat_time64 sys_utimensat sys_utimensat + 413 o32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 o32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 o32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 o32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 o32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 o32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 o32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c +index a40d926b65139..e355dfca44008 100644 +--- a/arch/mips/net/bpf_jit_comp.c ++++ b/arch/mips/net/bpf_jit_comp.c +@@ -1012,7 +1012,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_prog_fill_jited_linfo(prog, &ctx.descriptors[1]); + + /* Set as read-only exec and flush instruction cache */ +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) ++ goto out_err; + flush_icache_range((unsigned long)header, + (unsigned long)&ctx.target[ctx.jit_index]); + +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index daafeb20f9937..dc9b902de8ea9 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -16,6 +16,7 @@ config PARISC + select ARCH_HAS_UBSAN + select ARCH_HAS_PTE_SPECIAL + select ARCH_NO_SG_CHAIN ++ select ARCH_SPLIT_ARG64 if !64BIT + select ARCH_SUPPORTS_HUGETLBFS if PA20 + select ARCH_SUPPORTS_MEMORY_FAILURE + select ARCH_STACKWALK +diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c +index 2a12a547b447b..826c8e51b5853 100644 +--- a/arch/parisc/kernel/sys_parisc32.c ++++ b/arch/parisc/kernel/sys_parisc32.c +@@ -23,12 +23,3 @@ asmlinkage long sys32_unimplemented(int r26, int r25, int r24, int r23, + current->comm, current->pid, r20); + return -ENOSYS; + } +- +-asmlinkage long sys32_fanotify_mark(compat_int_t fanotify_fd, compat_uint_t flags, +- compat_uint_t mask0, compat_uint_t mask1, compat_int_t dfd, +- const char __user * pathname) +-{ +- return sys_fanotify_mark(fanotify_fd, flags, +- ((__u64)mask1 << 32) | mask0, +- dfd, pathname); +-} +diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl +index b236a84c4e127..0f631cb2cdea7 100644 +--- a/arch/parisc/kernel/syscalls/syscall.tbl ++++ b/arch/parisc/kernel/syscalls/syscall.tbl +@@ -108,7 +108,7 @@ + 95 common fchown sys_fchown + 96 common getpriority sys_getpriority + 97 common setpriority sys_setpriority +-98 common recv sys_recv ++98 common recv sys_recv compat_sys_recv + 99 common statfs sys_statfs compat_sys_statfs + 100 common fstatfs sys_fstatfs compat_sys_fstatfs + 101 common stat64 sys_stat64 +@@ -135,7 +135,7 @@ + 120 common clone sys_clone_wrapper + 121 common setdomainname sys_setdomainname + 122 common sendfile sys_sendfile compat_sys_sendfile +-123 common recvfrom sys_recvfrom ++123 common recvfrom sys_recvfrom compat_sys_recvfrom + 124 32 adjtimex sys_adjtimex_time32 + 124 64 adjtimex sys_adjtimex + 125 common mprotect sys_mprotect +@@ -364,7 +364,7 @@ + 320 common accept4 sys_accept4 + 321 common prlimit64 sys_prlimit64 + 322 common fanotify_init sys_fanotify_init +-323 common fanotify_mark sys_fanotify_mark sys32_fanotify_mark ++323 common fanotify_mark sys_fanotify_mark compat_sys_fanotify_mark + 324 32 clock_adjtime sys_clock_adjtime32 + 324 64 clock_adjtime sys_clock_adjtime + 325 common name_to_handle_at sys_name_to_handle_at +diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c +index d6ee2fd455503..979f45d4d1fbe 100644 +--- a/arch/parisc/net/bpf_jit_core.c ++++ b/arch/parisc/net/bpf_jit_core.c +@@ -167,7 +167,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns); + + if (!prog->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(jit_data->header); ++ if (bpf_jit_binary_lock_ro(jit_data->header)) { ++ bpf_jit_binary_free(jit_data->header); ++ prog->bpf_func = NULL; ++ prog->jited = 0; ++ prog->jited_len = 0; ++ goto out_offset; ++ } + prologue_len = ctx->epilogue_offset - ctx->body_len; + for (i = 0; i < prog->len; i++) + ctx->offset[i] += prologue_len; +diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl +index 17173b82ca21d..18c49fce49ed1 100644 +--- a/arch/powerpc/kernel/syscalls/syscall.tbl ++++ b/arch/powerpc/kernel/syscalls/syscall.tbl +@@ -230,8 +230,10 @@ + 178 nospu rt_sigsuspend sys_rt_sigsuspend compat_sys_rt_sigsuspend + 179 32 pread64 sys_ppc_pread64 compat_sys_ppc_pread64 + 179 64 pread64 sys_pread64 ++179 spu pread64 sys_pread64 + 180 32 pwrite64 sys_ppc_pwrite64 compat_sys_ppc_pwrite64 + 180 64 pwrite64 sys_pwrite64 ++180 spu pwrite64 sys_pwrite64 + 181 common chown sys_chown + 182 common getcwd sys_getcwd + 183 common capget sys_capget +@@ -246,6 +248,7 @@ + 190 common ugetrlimit sys_getrlimit compat_sys_getrlimit + 191 32 readahead sys_ppc_readahead compat_sys_ppc_readahead + 191 64 readahead sys_readahead ++191 spu readahead sys_readahead + 192 32 mmap2 sys_mmap2 compat_sys_mmap2 + 193 32 truncate64 sys_ppc_truncate64 compat_sys_ppc_truncate64 + 194 32 ftruncate64 sys_ppc_ftruncate64 compat_sys_ppc_ftruncate64 +@@ -293,6 +296,7 @@ + 232 nospu set_tid_address sys_set_tid_address + 233 32 fadvise64 sys_ppc32_fadvise64 compat_sys_ppc32_fadvise64 + 233 64 fadvise64 sys_fadvise64 ++233 spu fadvise64 sys_fadvise64 + 234 nospu exit_group sys_exit_group + 235 nospu lookup_dcookie sys_ni_syscall + 236 common epoll_create sys_epoll_create +@@ -502,7 +506,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/riscv/include/asm/insn.h b/arch/riscv/include/asm/insn.h +index 06e439eeef9ad..09fde95a5e8f7 100644 +--- a/arch/riscv/include/asm/insn.h ++++ b/arch/riscv/include/asm/insn.h +@@ -145,7 +145,7 @@ + + /* parts of opcode for RVF, RVD and RVQ */ + #define RVFDQ_FL_FS_WIDTH_OFF 12 +-#define RVFDQ_FL_FS_WIDTH_MASK GENMASK(3, 0) ++#define RVFDQ_FL_FS_WIDTH_MASK GENMASK(2, 0) + #define RVFDQ_FL_FS_WIDTH_W 2 + #define RVFDQ_FL_FS_WIDTH_D 3 + #define RVFDQ_LS_FS_WIDTH_Q 4 +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 528ec7cc9a622..0d3f00eb0baee 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -156,7 +156,7 @@ unsigned long __get_wchan(struct task_struct *task) + return pc; + } + +-noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, ++noinline noinstr void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, + struct task_struct *task, struct pt_regs *regs) + { + walk_stackframe(task, regs, consume_entry, cookie); +diff --git a/arch/s390/include/asm/entry-common.h b/arch/s390/include/asm/entry-common.h +index 7f5004065e8aa..35555c9446308 100644 +--- a/arch/s390/include/asm/entry-common.h ++++ b/arch/s390/include/asm/entry-common.h +@@ -54,7 +54,7 @@ static __always_inline void arch_exit_to_user_mode(void) + static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, + unsigned long ti_work) + { +- choose_random_kstack_offset(get_tod_clock_fast() & 0xff); ++ choose_random_kstack_offset(get_tod_clock_fast()); + } + + #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare +diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl +index 095bb86339a7d..07a942cab8e50 100644 +--- a/arch/s390/kernel/syscalls/syscall.tbl ++++ b/arch/s390/kernel/syscalls/syscall.tbl +@@ -418,7 +418,7 @@ + 412 32 utimensat_time64 - sys_utimensat + 413 32 pselect6_time64 - compat_sys_pselect6_time64 + 414 32 ppoll_time64 - compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 - sys_io_pgetevents ++416 32 io_pgetevents_time64 - compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 - compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 - sys_mq_timedsend + 419 32 mq_timedreceive_time64 - sys_mq_timedreceive +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 1d168a98ae21b..4be8f5cadd026 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -2112,7 +2112,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + print_fn_code(jit.prg_buf, jit.size_prg); + } + if (!fp->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) { ++ bpf_jit_binary_free(header); ++ fp = orig_fp; ++ goto free_addrs; ++ } + } else { + jit_data->header = header; + jit_data->ctx = jit; +diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c +index ff8f24854c646..0ef83b6ac0db7 100644 +--- a/arch/s390/pci/pci_irq.c ++++ b/arch/s390/pci/pci_irq.c +@@ -410,7 +410,7 @@ static void __init cpu_enable_directed_irq(void *unused) + union zpci_sic_iib iib = {{0}}; + union zpci_sic_iib ziib = {{0}}; + +- iib.cdiib.dibv_addr = (u64) zpci_ibv[smp_processor_id()]->vector; ++ iib.cdiib.dibv_addr = virt_to_phys(zpci_ibv[smp_processor_id()]->vector); + + zpci_set_irq_ctrl(SIC_IRQ_MODE_SET_CPU, 0, &iib); + zpci_set_irq_ctrl(SIC_IRQ_MODE_D_SINGLE, PCI_ISC, &ziib); +diff --git a/arch/sh/kernel/sys_sh32.c b/arch/sh/kernel/sys_sh32.c +index 9dca568509a5e..d6f4afcb0e870 100644 +--- a/arch/sh/kernel/sys_sh32.c ++++ b/arch/sh/kernel/sys_sh32.c +@@ -59,3 +59,14 @@ asmlinkage int sys_fadvise64_64_wrapper(int fd, u32 offset0, u32 offset1, + (u64)len0 << 32 | len1, advice); + #endif + } ++ ++/* ++ * swap the arguments the way that libc wants them instead of ++ * moving flags ahead of the 64-bit nbytes argument ++ */ ++SYSCALL_DEFINE6(sh_sync_file_range6, int, fd, SC_ARG64(offset), ++ SC_ARG64(nbytes), unsigned int, flags) ++{ ++ return ksys_sync_file_range(fd, SC_VAL64(loff_t, offset), ++ SC_VAL64(loff_t, nbytes), flags); ++} +diff --git a/arch/sh/kernel/syscalls/syscall.tbl b/arch/sh/kernel/syscalls/syscall.tbl +index 86fe269f02203..0495a57c1e618 100644 +--- a/arch/sh/kernel/syscalls/syscall.tbl ++++ b/arch/sh/kernel/syscalls/syscall.tbl +@@ -321,7 +321,7 @@ + 311 common set_robust_list sys_set_robust_list + 312 common get_robust_list sys_get_robust_list + 313 common splice sys_splice +-314 common sync_file_range sys_sync_file_range ++314 common sync_file_range sys_sh_sync_file_range6 + 315 common tee sys_tee + 316 common vmsplice sys_vmsplice + 317 common move_pages sys_move_pages +@@ -395,6 +395,7 @@ + 385 common pkey_alloc sys_pkey_alloc + 386 common pkey_free sys_pkey_free + 387 common rseq sys_rseq ++388 common sync_file_range2 sys_sync_file_range2 + # room for arch specific syscalls + 393 common semget sys_semget + 394 common semctl sys_semctl +diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S +index a45f0f31fe51a..a3d308f2043e5 100644 +--- a/arch/sparc/kernel/sys32.S ++++ b/arch/sparc/kernel/sys32.S +@@ -18,224 +18,3 @@ sys32_mmap2: + sethi %hi(sys_mmap), %g1 + jmpl %g1 + %lo(sys_mmap), %g0 + sllx %o5, 12, %o5 +- +- .align 32 +- .globl sys32_socketcall +-sys32_socketcall: /* %o0=call, %o1=args */ +- cmp %o0, 1 +- bl,pn %xcc, do_einval +- cmp %o0, 18 +- bg,pn %xcc, do_einval +- sub %o0, 1, %o0 +- sllx %o0, 5, %o0 +- sethi %hi(__socketcall_table_begin), %g2 +- or %g2, %lo(__socketcall_table_begin), %g2 +- jmpl %g2 + %o0, %g0 +- nop +-do_einval: +- retl +- mov -EINVAL, %o0 +- +- .align 32 +-__socketcall_table_begin: +- +- /* Each entry is exactly 32 bytes. */ +-do_sys_socket: /* sys_socket(int, int, int) */ +-1: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_socket), %g1 +-2: ldswa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_socket), %g0 +-3: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_bind: /* sys_bind(int fd, struct sockaddr *, int) */ +-4: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_bind), %g1 +-5: ldswa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_bind), %g0 +-6: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_connect: /* sys_connect(int, struct sockaddr *, int) */ +-7: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_connect), %g1 +-8: ldswa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_connect), %g0 +-9: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_listen: /* sys_listen(int, int) */ +-10: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_listen), %g1 +- jmpl %g1 + %lo(sys_listen), %g0 +-11: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +- nop +-do_sys_accept: /* sys_accept(int, struct sockaddr *, int *) */ +-12: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_accept), %g1 +-13: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_accept), %g0 +-14: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_getsockname: /* sys_getsockname(int, struct sockaddr *, int *) */ +-15: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_getsockname), %g1 +-16: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_getsockname), %g0 +-17: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_getpeername: /* sys_getpeername(int, struct sockaddr *, int *) */ +-18: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_getpeername), %g1 +-19: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_getpeername), %g0 +-20: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_socketpair: /* sys_socketpair(int, int, int, int *) */ +-21: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_socketpair), %g1 +-22: ldswa [%o1 + 0x8] %asi, %o2 +-23: lduwa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_socketpair), %g0 +-24: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +-do_sys_send: /* sys_send(int, void *, size_t, unsigned int) */ +-25: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_send), %g1 +-26: lduwa [%o1 + 0x8] %asi, %o2 +-27: lduwa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_send), %g0 +-28: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +-do_sys_recv: /* sys_recv(int, void *, size_t, unsigned int) */ +-29: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_recv), %g1 +-30: lduwa [%o1 + 0x8] %asi, %o2 +-31: lduwa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_recv), %g0 +-32: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +-do_sys_sendto: /* sys_sendto(int, u32, compat_size_t, unsigned int, u32, int) */ +-33: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_sendto), %g1 +-34: lduwa [%o1 + 0x8] %asi, %o2 +-35: lduwa [%o1 + 0xc] %asi, %o3 +-36: lduwa [%o1 + 0x10] %asi, %o4 +-37: ldswa [%o1 + 0x14] %asi, %o5 +- jmpl %g1 + %lo(sys_sendto), %g0 +-38: lduwa [%o1 + 0x4] %asi, %o1 +-do_sys_recvfrom: /* sys_recvfrom(int, u32, compat_size_t, unsigned int, u32, u32) */ +-39: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_recvfrom), %g1 +-40: lduwa [%o1 + 0x8] %asi, %o2 +-41: lduwa [%o1 + 0xc] %asi, %o3 +-42: lduwa [%o1 + 0x10] %asi, %o4 +-43: lduwa [%o1 + 0x14] %asi, %o5 +- jmpl %g1 + %lo(sys_recvfrom), %g0 +-44: lduwa [%o1 + 0x4] %asi, %o1 +-do_sys_shutdown: /* sys_shutdown(int, int) */ +-45: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_shutdown), %g1 +- jmpl %g1 + %lo(sys_shutdown), %g0 +-46: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +- nop +-do_sys_setsockopt: /* sys_setsockopt(int, int, int, char *, int) */ +-47: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_setsockopt), %g1 +-48: ldswa [%o1 + 0x8] %asi, %o2 +-49: lduwa [%o1 + 0xc] %asi, %o3 +-50: ldswa [%o1 + 0x10] %asi, %o4 +- jmpl %g1 + %lo(sys_setsockopt), %g0 +-51: ldswa [%o1 + 0x4] %asi, %o1 +- nop +-do_sys_getsockopt: /* sys_getsockopt(int, int, int, u32, u32) */ +-52: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_getsockopt), %g1 +-53: ldswa [%o1 + 0x8] %asi, %o2 +-54: lduwa [%o1 + 0xc] %asi, %o3 +-55: lduwa [%o1 + 0x10] %asi, %o4 +- jmpl %g1 + %lo(sys_getsockopt), %g0 +-56: ldswa [%o1 + 0x4] %asi, %o1 +- nop +-do_sys_sendmsg: /* compat_sys_sendmsg(int, struct compat_msghdr *, unsigned int) */ +-57: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(compat_sys_sendmsg), %g1 +-58: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(compat_sys_sendmsg), %g0 +-59: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int) */ +-60: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(compat_sys_recvmsg), %g1 +-61: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(compat_sys_recvmsg), %g0 +-62: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_accept4: /* sys_accept4(int, struct sockaddr *, int *, int) */ +-63: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_accept4), %g1 +-64: lduwa [%o1 + 0x8] %asi, %o2 +-65: ldswa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_accept4), %g0 +-66: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- +- .section __ex_table,"a" +- .align 4 +- .word 1b, __retl_efault, 2b, __retl_efault +- .word 3b, __retl_efault, 4b, __retl_efault +- .word 5b, __retl_efault, 6b, __retl_efault +- .word 7b, __retl_efault, 8b, __retl_efault +- .word 9b, __retl_efault, 10b, __retl_efault +- .word 11b, __retl_efault, 12b, __retl_efault +- .word 13b, __retl_efault, 14b, __retl_efault +- .word 15b, __retl_efault, 16b, __retl_efault +- .word 17b, __retl_efault, 18b, __retl_efault +- .word 19b, __retl_efault, 20b, __retl_efault +- .word 21b, __retl_efault, 22b, __retl_efault +- .word 23b, __retl_efault, 24b, __retl_efault +- .word 25b, __retl_efault, 26b, __retl_efault +- .word 27b, __retl_efault, 28b, __retl_efault +- .word 29b, __retl_efault, 30b, __retl_efault +- .word 31b, __retl_efault, 32b, __retl_efault +- .word 33b, __retl_efault, 34b, __retl_efault +- .word 35b, __retl_efault, 36b, __retl_efault +- .word 37b, __retl_efault, 38b, __retl_efault +- .word 39b, __retl_efault, 40b, __retl_efault +- .word 41b, __retl_efault, 42b, __retl_efault +- .word 43b, __retl_efault, 44b, __retl_efault +- .word 45b, __retl_efault, 46b, __retl_efault +- .word 47b, __retl_efault, 48b, __retl_efault +- .word 49b, __retl_efault, 50b, __retl_efault +- .word 51b, __retl_efault, 52b, __retl_efault +- .word 53b, __retl_efault, 54b, __retl_efault +- .word 55b, __retl_efault, 56b, __retl_efault +- .word 57b, __retl_efault, 58b, __retl_efault +- .word 59b, __retl_efault, 60b, __retl_efault +- .word 61b, __retl_efault, 62b, __retl_efault +- .word 63b, __retl_efault, 64b, __retl_efault +- .word 65b, __retl_efault, 66b, __retl_efault +- .previous +diff --git a/arch/sparc/kernel/syscalls/syscall.tbl b/arch/sparc/kernel/syscalls/syscall.tbl +index b23d59313589a..72985b705f44b 100644 +--- a/arch/sparc/kernel/syscalls/syscall.tbl ++++ b/arch/sparc/kernel/syscalls/syscall.tbl +@@ -117,7 +117,7 @@ + 90 common dup2 sys_dup2 + 91 32 setfsuid32 sys_setfsuid + 92 common fcntl sys_fcntl compat_sys_fcntl +-93 common select sys_select ++93 common select sys_select compat_sys_select + 94 32 setfsgid32 sys_setfsgid + 95 common fsync sys_fsync + 96 common setpriority sys_setpriority +@@ -155,7 +155,7 @@ + 123 32 fchown sys_fchown16 + 123 64 fchown sys_fchown + 124 common fchmod sys_fchmod +-125 common recvfrom sys_recvfrom ++125 common recvfrom sys_recvfrom compat_sys_recvfrom + 126 32 setreuid sys_setreuid16 + 126 64 setreuid sys_setreuid + 127 32 setregid sys_setregid16 +@@ -247,7 +247,7 @@ + 204 32 readdir sys_old_readdir compat_sys_old_readdir + 204 64 readdir sys_nis_syscall + 205 common readahead sys_readahead compat_sys_readahead +-206 common socketcall sys_socketcall sys32_socketcall ++206 common socketcall sys_socketcall compat_sys_socketcall + 207 common syslog sys_syslog + 208 common lookup_dcookie sys_ni_syscall + 209 common fadvise64 sys_fadvise64 compat_sys_fadvise64 +@@ -461,7 +461,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c +index fa0759bfe498e..73bf0aea8baf1 100644 +--- a/arch/sparc/net/bpf_jit_comp_64.c ++++ b/arch/sparc/net/bpf_jit_comp_64.c +@@ -1602,7 +1602,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_flush_icache(header, (u8 *)header + header->size); + + if (!prog->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) { ++ bpf_jit_binary_free(header); ++ prog = orig_prog; ++ goto out_off; ++ } + } else { + jit_data->ctx = ctx; + jit_data->image = image_ptr; +diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl +index 5f8591ce7f25e..fccb825ca2ca3 100644 +--- a/arch/x86/entry/syscalls/syscall_32.tbl ++++ b/arch/x86/entry/syscalls/syscall_32.tbl +@@ -420,7 +420,7 @@ + 412 i386 utimensat_time64 sys_utimensat + 413 i386 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 i386 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 i386 io_pgetevents_time64 sys_io_pgetevents ++416 i386 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 i386 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 i386 mq_timedsend_time64 sys_mq_timedsend + 419 i386 mq_timedreceive_time64 sys_mq_timedreceive +diff --git a/arch/x86/include/asm/entry-common.h b/arch/x86/include/asm/entry-common.h +index 7e523bb3d2d31..fb2809b20b0ac 100644 +--- a/arch/x86/include/asm/entry-common.h ++++ b/arch/x86/include/asm/entry-common.h +@@ -73,19 +73,16 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, + #endif + + /* +- * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), +- * but not enough for x86 stack utilization comfort. To keep +- * reasonable stack head room, reduce the maximum offset to 8 bits. +- * +- * The actual entropy will be further reduced by the compiler when +- * applying stack alignment constraints (see cc_stack_align4/8 in ++ * This value will get limited by KSTACK_OFFSET_MAX(), which is 10 ++ * bits. The actual entropy will be further reduced by the compiler ++ * when applying stack alignment constraints (see cc_stack_align4/8 in + * arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32) + * low bits from any entropy chosen here. + * +- * Therefore, final stack offset entropy will be 5 (x86_64) or +- * 6 (ia32) bits. ++ * Therefore, final stack offset entropy will be 7 (x86_64) or ++ * 8 (ia32) bits. + */ +- choose_random_kstack_offset(rdtsc() & 0xFF); ++ choose_random_kstack_offset(rdtsc()); + } + #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare + +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index 520deb411a702..1209c7aebb211 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -145,8 +145,8 @@ void restore_fpregs_from_fpstate(struct fpstate *fpstate, u64 mask) + asm volatile( + "fnclex\n\t" + "emms\n\t" +- "fildl %P[addr]" /* set F?P to defined value */ +- : : [addr] "m" (fpstate)); ++ "fildl %[addr]" /* set F?P to defined value */ ++ : : [addr] "m" (*fpstate)); + } + + if (use_xsave()) { +diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c +index e42faa792c079..52e1f3f0b361c 100644 +--- a/arch/x86/kernel/time.c ++++ b/arch/x86/kernel/time.c +@@ -27,25 +27,7 @@ + + unsigned long profile_pc(struct pt_regs *regs) + { +- unsigned long pc = instruction_pointer(regs); +- +- if (!user_mode(regs) && in_lock_functions(pc)) { +-#ifdef CONFIG_FRAME_POINTER +- return *(unsigned long *)(regs->bp + sizeof(long)); +-#else +- unsigned long *sp = (unsigned long *)regs->sp; +- /* +- * Return address is either directly at stack pointer +- * or above a saved flags. Eflags has bits 22-31 zero, +- * kernel addresses don't. +- */ +- if (sp[0] >> 22) +- return sp[0]; +- if (sp[1] >> 22) +- return sp[1]; +-#endif +- } +- return pc; ++ return instruction_pointer(regs); + } + EXPORT_SYMBOL(profile_pc); + +diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c +index c10083a8e68e6..de0f9e5f9f73a 100644 +--- a/arch/x86/net/bpf_jit_comp32.c ++++ b/arch/x86/net/bpf_jit_comp32.c +@@ -2600,8 +2600,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + if (bpf_jit_enable > 1) + bpf_jit_dump(prog->len, proglen, pass + 1, image); + +- if (image) { +- bpf_jit_binary_lock_ro(header); ++ if (image && !bpf_jit_binary_lock_ro(header)) { + prog->bpf_func = (void *)image; + prog->jited = 1; + prog->jited_len = proglen; +diff --git a/crypto/ecdh.c b/crypto/ecdh.c +index 80afee3234fbe..3049f147e0117 100644 +--- a/crypto/ecdh.c ++++ b/crypto/ecdh.c +@@ -33,6 +33,8 @@ static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, + params.key_size > sizeof(u64) * ctx->ndigits) + return -EINVAL; + ++ memset(ctx->private_key, 0, sizeof(ctx->private_key)); ++ + if (!params.key || !params.key_size) + return ecc_gen_privkey(ctx->curve_id, ctx->ndigits, + ctx->private_key); +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 5eb38fbbbecdb..fc6fd583faf8a 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1975,8 +1975,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + n_ports = max(ahci_nr_ports(hpriv->cap), fls(hpriv->port_map)); + + host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports); +- if (!host) +- return -ENOMEM; ++ if (!host) { ++ rc = -ENOMEM; ++ goto err_rm_sysfs_file; ++ } + host->private_data = hpriv; + + if (ahci_init_msi(pdev, n_ports, hpriv) < 0) { +@@ -2031,11 +2033,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + /* initialize adapter */ + rc = ahci_configure_dma_masks(pdev, hpriv); + if (rc) +- return rc; ++ goto err_rm_sysfs_file; + + rc = ahci_pci_reset_controller(host); + if (rc) +- return rc; ++ goto err_rm_sysfs_file; + + ahci_pci_init_controller(host); + ahci_pci_print_info(host); +@@ -2044,10 +2046,15 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + rc = ahci_host_activate(host, &ahci_sht); + if (rc) +- return rc; ++ goto err_rm_sysfs_file; + + pm_runtime_put_noidle(&pdev->dev); + return 0; ++ ++err_rm_sysfs_file: ++ sysfs_remove_file_from_group(&pdev->dev.kobj, ++ &dev_attr_remapped_nvme.attr, NULL); ++ return rc; + } + + static void ahci_shutdown_one(struct pci_dev *pdev) +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 28caed151e05f..d937e6e5cc7ad 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4181,8 +4181,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER BD-RW BDR-205", NULL, ATA_HORKAGE_NOLPM }, + + /* Crucial devices with broken LPM support */ +- { "CT500BX100SSD1", NULL, ATA_HORKAGE_NOLPM }, +- { "CT240BX500SSD1", NULL, ATA_HORKAGE_NOLPM }, ++ { "CT*0BX*00SSD1", NULL, ATA_HORKAGE_NOLPM }, + + /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */ + { "Crucial_CT512MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | +@@ -5534,6 +5533,18 @@ struct ata_port *ata_port_alloc(struct ata_host *host) + return ap; + } + ++void ata_port_free(struct ata_port *ap) ++{ ++ if (!ap) ++ return; ++ ++ kfree(ap->pmp_link); ++ kfree(ap->slave_link); ++ kfree(ap->ncq_sense_buf); ++ kfree(ap); ++} ++EXPORT_SYMBOL_GPL(ata_port_free); ++ + static void ata_devres_release(struct device *gendev, void *res) + { + struct ata_host *host = dev_get_drvdata(gendev); +@@ -5560,12 +5571,7 @@ static void ata_host_release(struct kref *kref) + int i; + + for (i = 0; i < host->n_ports; i++) { +- struct ata_port *ap = host->ports[i]; +- +- kfree(ap->pmp_link); +- kfree(ap->slave_link); +- kfree(ap->ncq_sense_buf); +- kfree(ap); ++ ata_port_free(host->ports[i]); + host->ports[i] = NULL; + } + kfree(host); +@@ -5615,8 +5621,10 @@ struct ata_host *ata_host_alloc(struct device *dev, int max_ports) + if (!host) + return NULL; + +- if (!devres_open_group(dev, NULL, GFP_KERNEL)) +- goto err_free; ++ if (!devres_open_group(dev, NULL, GFP_KERNEL)) { ++ kfree(host); ++ return NULL; ++ } + + dr = devres_alloc(ata_devres_release, 0, GFP_KERNEL); + if (!dr) +@@ -5648,8 +5656,6 @@ struct ata_host *ata_host_alloc(struct device *dev, int max_ports) + + err_out: + devres_release_group(dev, NULL); +- err_free: +- kfree(host); + return NULL; + } + EXPORT_SYMBOL_GPL(ata_host_alloc); +@@ -5948,7 +5954,7 @@ int ata_host_register(struct ata_host *host, const struct scsi_host_template *sh + * allocation time. + */ + for (i = host->n_ports; host->ports[i]; i++) +- kfree(host->ports[i]); ++ ata_port_free(host->ports[i]); + + /* give ports names and add SCSI hosts */ + for (i = 0; i < host->n_ports; i++) { +diff --git a/drivers/counter/ti-eqep.c b/drivers/counter/ti-eqep.c +index b0f24cf3e891d..4d3de4a35801f 100644 +--- a/drivers/counter/ti-eqep.c ++++ b/drivers/counter/ti-eqep.c +@@ -6,6 +6,7 @@ + */ + + #include <linux/bitops.h> ++#include <linux/clk.h> + #include <linux/counter.h> + #include <linux/kernel.h> + #include <linux/mod_devicetable.h> +@@ -376,6 +377,7 @@ static int ti_eqep_probe(struct platform_device *pdev) + struct counter_device *counter; + struct ti_eqep_cnt *priv; + void __iomem *base; ++ struct clk *clk; + int err; + + counter = devm_counter_alloc(dev, sizeof(*priv)); +@@ -415,6 +417,10 @@ static int ti_eqep_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + pm_runtime_get_sync(dev); + ++ clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(clk)) ++ return dev_err_probe(dev, PTR_ERR(clk), "failed to enable clock\n"); ++ + err = counter_add(counter); + if (err < 0) { + pm_runtime_put_sync(dev); +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index dbbf299f42197..3405bf69b1c0d 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -357,15 +357,14 @@ static void intel_pstate_set_itmt_prio(int cpu) + int ret; + + ret = cppc_get_perf_caps(cpu, &cppc_perf); +- if (ret) +- return; +- + /* +- * On some systems with overclocking enabled, CPPC.highest_perf is hardcoded to 0xff. +- * In this case we can't use CPPC.highest_perf to enable ITMT. +- * In this case we can look at MSR_HWP_CAPABILITIES bits [8:0] to decide. ++ * If CPPC is not available, fall back to MSR_HWP_CAPABILITIES bits [8:0]. ++ * ++ * Also, on some systems with overclocking enabled, CPPC.highest_perf is ++ * hardcoded to 0xff, so CPPC.highest_perf cannot be used to enable ITMT. ++ * Fall back to MSR_HWP_CAPABILITIES then too. + */ +- if (cppc_perf.highest_perf == CPPC_MAX_PERF) ++ if (ret || cppc_perf.highest_perf == CPPC_MAX_PERF) + cppc_perf.highest_perf = HWP_HIGHEST_PERF(READ_ONCE(all_cpu_data[cpu]->hwp_cap_cached)); + + /* +diff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h +index bc5a95665aa0a..87008505f8a9e 100644 +--- a/drivers/cxl/core/core.h ++++ b/drivers/cxl/core/core.h +@@ -27,7 +27,14 @@ void cxl_decoder_kill_region(struct cxl_endpoint_decoder *cxled); + int cxl_region_init(void); + void cxl_region_exit(void); + int cxl_get_poison_by_endpoint(struct cxl_port *port); ++struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa); ++ + #else ++static inline ++struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa) ++{ ++ return NULL; ++} + static inline int cxl_get_poison_by_endpoint(struct cxl_port *port) + { + return 0; +diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c +index 7d97790b893d7..e01c16fdc7575 100644 +--- a/drivers/cxl/core/hdm.c ++++ b/drivers/cxl/core/hdm.c +@@ -52,6 +52,14 @@ int devm_cxl_add_passthrough_decoder(struct cxl_port *port) + struct cxl_dport *dport = NULL; + int single_port_map[1]; + unsigned long index; ++ struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev); ++ ++ /* ++ * Capability checks are moot for passthrough decoders, support ++ * any and all possibilities. ++ */ ++ cxlhdm->interleave_mask = ~0U; ++ cxlhdm->iw_cap_mask = ~0UL; + + cxlsd = cxl_switch_decoder_alloc(port, 1); + if (IS_ERR(cxlsd)) +@@ -79,6 +87,11 @@ static void parse_hdm_decoder_caps(struct cxl_hdm *cxlhdm) + cxlhdm->interleave_mask |= GENMASK(11, 8); + if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_14_12, hdm_cap)) + cxlhdm->interleave_mask |= GENMASK(14, 12); ++ cxlhdm->iw_cap_mask = BIT(1) | BIT(2) | BIT(4) | BIT(8); ++ if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_3_6_12_WAY, hdm_cap)) ++ cxlhdm->iw_cap_mask |= BIT(3) | BIT(6) | BIT(12); ++ if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_16_WAY, hdm_cap)) ++ cxlhdm->iw_cap_mask |= BIT(16); + } + + static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info) +diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c +index d4e259f3a7e91..0277726afd049 100644 +--- a/drivers/cxl/core/memdev.c ++++ b/drivers/cxl/core/memdev.c +@@ -251,50 +251,6 @@ int cxl_trigger_poison_list(struct cxl_memdev *cxlmd) + } + EXPORT_SYMBOL_NS_GPL(cxl_trigger_poison_list, CXL); + +-struct cxl_dpa_to_region_context { +- struct cxl_region *cxlr; +- u64 dpa; +-}; +- +-static int __cxl_dpa_to_region(struct device *dev, void *arg) +-{ +- struct cxl_dpa_to_region_context *ctx = arg; +- struct cxl_endpoint_decoder *cxled; +- u64 dpa = ctx->dpa; +- +- if (!is_endpoint_decoder(dev)) +- return 0; +- +- cxled = to_cxl_endpoint_decoder(dev); +- if (!cxled->dpa_res || !resource_size(cxled->dpa_res)) +- return 0; +- +- if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start) +- return 0; +- +- dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa, +- dev_name(&cxled->cxld.region->dev)); +- +- ctx->cxlr = cxled->cxld.region; +- +- return 1; +-} +- +-static struct cxl_region *cxl_dpa_to_region(struct cxl_memdev *cxlmd, u64 dpa) +-{ +- struct cxl_dpa_to_region_context ctx; +- struct cxl_port *port; +- +- ctx = (struct cxl_dpa_to_region_context) { +- .dpa = dpa, +- }; +- port = cxlmd->endpoint; +- if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port)) +- device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region); +- +- return ctx.cxlr; +-} +- + static int cxl_validate_poison_dpa(struct cxl_memdev *cxlmd, u64 dpa) + { + struct cxl_dev_state *cxlds = cxlmd->cxlds; +diff --git a/drivers/cxl/core/pmem.c b/drivers/cxl/core/pmem.c +index e69625a8d6a1d..c00f3a933164f 100644 +--- a/drivers/cxl/core/pmem.c ++++ b/drivers/cxl/core/pmem.c +@@ -62,10 +62,14 @@ static int match_nvdimm_bridge(struct device *dev, void *data) + return is_cxl_nvdimm_bridge(dev); + } + +-struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_memdev *cxlmd) ++/** ++ * cxl_find_nvdimm_bridge() - find a bridge device relative to a port ++ * @port: any descendant port of an nvdimm-bridge associated ++ * root-cxl-port ++ */ ++struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_port *port) + { +- struct cxl_root *cxl_root __free(put_cxl_root) = +- find_cxl_root(cxlmd->endpoint); ++ struct cxl_root *cxl_root __free(put_cxl_root) = find_cxl_root(port); + struct device *dev; + + if (!cxl_root) +@@ -242,18 +246,20 @@ static void cxlmd_release_nvdimm(void *_cxlmd) + + /** + * devm_cxl_add_nvdimm() - add a bridge between a cxl_memdev and an nvdimm ++ * @parent_port: parent port for the (to be added) @cxlmd endpoint port + * @cxlmd: cxl_memdev instance that will perform LIBNVDIMM operations + * + * Return: 0 on success negative error code on failure. + */ +-int devm_cxl_add_nvdimm(struct cxl_memdev *cxlmd) ++int devm_cxl_add_nvdimm(struct cxl_port *parent_port, ++ struct cxl_memdev *cxlmd) + { + struct cxl_nvdimm_bridge *cxl_nvb; + struct cxl_nvdimm *cxl_nvd; + struct device *dev; + int rc; + +- cxl_nvb = cxl_find_nvdimm_bridge(cxlmd); ++ cxl_nvb = cxl_find_nvdimm_bridge(parent_port); + if (!cxl_nvb) + return -ENODEV; + +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index 18b95149640b6..a600feb8a4ed5 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -1101,6 +1101,26 @@ static int cxl_port_attach_region(struct cxl_port *port, + } + cxld = cxl_rr->decoder; + ++ /* ++ * the number of targets should not exceed the target_count ++ * of the decoder ++ */ ++ if (is_switch_decoder(&cxld->dev)) { ++ struct cxl_switch_decoder *cxlsd; ++ ++ cxlsd = to_cxl_switch_decoder(&cxld->dev); ++ if (cxl_rr->nr_targets > cxlsd->nr_targets) { ++ dev_dbg(&cxlr->dev, ++ "%s:%s %s add: %s:%s @ %d overflows targets: %d\n", ++ dev_name(port->uport_dev), dev_name(&port->dev), ++ dev_name(&cxld->dev), dev_name(&cxlmd->dev), ++ dev_name(&cxled->cxld.dev), pos, ++ cxlsd->nr_targets); ++ rc = -ENXIO; ++ goto out_erase; ++ } ++ } ++ + rc = cxl_rr_ep_add(cxl_rr, cxled); + if (rc) { + dev_dbg(&cxlr->dev, +@@ -1210,6 +1230,50 @@ static int check_last_peer(struct cxl_endpoint_decoder *cxled, + return 0; + } + ++static int check_interleave_cap(struct cxl_decoder *cxld, int iw, int ig) ++{ ++ struct cxl_port *port = to_cxl_port(cxld->dev.parent); ++ struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev); ++ unsigned int interleave_mask; ++ u8 eiw; ++ u16 eig; ++ int high_pos, low_pos; ++ ++ if (!test_bit(iw, &cxlhdm->iw_cap_mask)) ++ return -ENXIO; ++ /* ++ * Per CXL specification r3.1(8.2.4.20.13 Decoder Protection), ++ * if eiw < 8: ++ * DPAOFFSET[51: eig + 8] = HPAOFFSET[51: eig + 8 + eiw] ++ * DPAOFFSET[eig + 7: 0] = HPAOFFSET[eig + 7: 0] ++ * ++ * when the eiw is 0, all the bits of HPAOFFSET[51: 0] are used, the ++ * interleave bits are none. ++ * ++ * if eiw >= 8: ++ * DPAOFFSET[51: eig + 8] = HPAOFFSET[51: eig + eiw] / 3 ++ * DPAOFFSET[eig + 7: 0] = HPAOFFSET[eig + 7: 0] ++ * ++ * when the eiw is 8, all the bits of HPAOFFSET[51: 0] are used, the ++ * interleave bits are none. ++ */ ++ ways_to_eiw(iw, &eiw); ++ if (eiw == 0 || eiw == 8) ++ return 0; ++ ++ granularity_to_eig(ig, &eig); ++ if (eiw > 8) ++ high_pos = eiw + eig - 1; ++ else ++ high_pos = eiw + eig + 7; ++ low_pos = eig + 8; ++ interleave_mask = GENMASK(high_pos, low_pos); ++ if (interleave_mask & ~cxlhdm->interleave_mask) ++ return -ENXIO; ++ ++ return 0; ++} ++ + static int cxl_port_setup_targets(struct cxl_port *port, + struct cxl_region *cxlr, + struct cxl_endpoint_decoder *cxled) +@@ -1360,6 +1424,15 @@ static int cxl_port_setup_targets(struct cxl_port *port, + return -ENXIO; + } + } else { ++ rc = check_interleave_cap(cxld, iw, ig); ++ if (rc) { ++ dev_dbg(&cxlr->dev, ++ "%s:%s iw: %d ig: %d is not supported\n", ++ dev_name(port->uport_dev), ++ dev_name(&port->dev), iw, ig); ++ return rc; ++ } ++ + cxld->interleave_ways = iw; + cxld->interleave_granularity = ig; + cxld->hpa_range = (struct range) { +@@ -1796,6 +1869,15 @@ static int cxl_region_attach(struct cxl_region *cxlr, + struct cxl_dport *dport; + int rc = -ENXIO; + ++ rc = check_interleave_cap(&cxled->cxld, p->interleave_ways, ++ p->interleave_granularity); ++ if (rc) { ++ dev_dbg(&cxlr->dev, "%s iw: %d ig: %d is not supported\n", ++ dev_name(&cxled->cxld.dev), p->interleave_ways, ++ p->interleave_granularity); ++ return rc; ++ } ++ + if (cxled->mode != cxlr->mode) { + dev_dbg(&cxlr->dev, "%s region mode: %d mismatch: %d\n", + dev_name(&cxled->cxld.dev), cxlr->mode, cxled->mode); +@@ -2679,28 +2761,78 @@ int cxl_get_poison_by_endpoint(struct cxl_port *port) + return rc; + } + ++struct cxl_dpa_to_region_context { ++ struct cxl_region *cxlr; ++ u64 dpa; ++}; ++ ++static int __cxl_dpa_to_region(struct device *dev, void *arg) ++{ ++ struct cxl_dpa_to_region_context *ctx = arg; ++ struct cxl_endpoint_decoder *cxled; ++ struct cxl_region *cxlr; ++ u64 dpa = ctx->dpa; ++ ++ if (!is_endpoint_decoder(dev)) ++ return 0; ++ ++ cxled = to_cxl_endpoint_decoder(dev); ++ if (!cxled || !cxled->dpa_res || !resource_size(cxled->dpa_res)) ++ return 0; ++ ++ if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start) ++ return 0; ++ ++ /* ++ * Stop the region search (return 1) when an endpoint mapping is ++ * found. The region may not be fully constructed so offering ++ * the cxlr in the context structure is not guaranteed. ++ */ ++ cxlr = cxled->cxld.region; ++ if (cxlr) ++ dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa, ++ dev_name(&cxlr->dev)); ++ else ++ dev_dbg(dev, "dpa:0x%llx mapped in endpoint:%s\n", dpa, ++ dev_name(dev)); ++ ++ ctx->cxlr = cxlr; ++ ++ return 1; ++} ++ ++struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa) ++{ ++ struct cxl_dpa_to_region_context ctx; ++ struct cxl_port *port; ++ ++ ctx = (struct cxl_dpa_to_region_context) { ++ .dpa = dpa, ++ }; ++ port = cxlmd->endpoint; ++ if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port)) ++ device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region); ++ ++ return ctx.cxlr; ++} ++ + static struct lock_class_key cxl_pmem_region_key; + +-static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr) ++static int cxl_pmem_region_alloc(struct cxl_region *cxlr) + { + struct cxl_region_params *p = &cxlr->params; + struct cxl_nvdimm_bridge *cxl_nvb; +- struct cxl_pmem_region *cxlr_pmem; + struct device *dev; + int i; + +- down_read(&cxl_region_rwsem); +- if (p->state != CXL_CONFIG_COMMIT) { +- cxlr_pmem = ERR_PTR(-ENXIO); +- goto out; +- } ++ guard(rwsem_read)(&cxl_region_rwsem); ++ if (p->state != CXL_CONFIG_COMMIT) ++ return -ENXIO; + +- cxlr_pmem = kzalloc(struct_size(cxlr_pmem, mapping, p->nr_targets), +- GFP_KERNEL); +- if (!cxlr_pmem) { +- cxlr_pmem = ERR_PTR(-ENOMEM); +- goto out; +- } ++ struct cxl_pmem_region *cxlr_pmem __free(kfree) = ++ kzalloc(struct_size(cxlr_pmem, mapping, p->nr_targets), GFP_KERNEL); ++ if (!cxlr_pmem) ++ return -ENOMEM; + + cxlr_pmem->hpa_range.start = p->res->start; + cxlr_pmem->hpa_range.end = p->res->end; +@@ -2717,12 +2849,9 @@ static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr) + * bridge for one device is the same for all. + */ + if (i == 0) { +- cxl_nvb = cxl_find_nvdimm_bridge(cxlmd); +- if (!cxl_nvb) { +- kfree(cxlr_pmem); +- cxlr_pmem = ERR_PTR(-ENODEV); +- goto out; +- } ++ cxl_nvb = cxl_find_nvdimm_bridge(cxlmd->endpoint); ++ if (!cxl_nvb) ++ return -ENODEV; + cxlr->cxl_nvb = cxl_nvb; + } + m->cxlmd = cxlmd; +@@ -2733,18 +2862,16 @@ static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr) + } + + dev = &cxlr_pmem->dev; +- cxlr_pmem->cxlr = cxlr; +- cxlr->cxlr_pmem = cxlr_pmem; + device_initialize(dev); + lockdep_set_class(&dev->mutex, &cxl_pmem_region_key); + device_set_pm_not_required(dev); + dev->parent = &cxlr->dev; + dev->bus = &cxl_bus_type; + dev->type = &cxl_pmem_region_type; +-out: +- up_read(&cxl_region_rwsem); ++ cxlr_pmem->cxlr = cxlr; ++ cxlr->cxlr_pmem = no_free_ptr(cxlr_pmem); + +- return cxlr_pmem; ++ return 0; + } + + static void cxl_dax_region_release(struct device *dev) +@@ -2861,9 +2988,10 @@ static int devm_cxl_add_pmem_region(struct cxl_region *cxlr) + struct device *dev; + int rc; + +- cxlr_pmem = cxl_pmem_region_alloc(cxlr); +- if (IS_ERR(cxlr_pmem)) +- return PTR_ERR(cxlr_pmem); ++ rc = cxl_pmem_region_alloc(cxlr); ++ if (rc) ++ return rc; ++ cxlr_pmem = cxlr->cxlr_pmem; + cxl_nvb = cxlr->cxl_nvb; + + dev = &cxlr_pmem->dev; +diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h +index 72fa477407689..6f9270f2faf96 100644 +--- a/drivers/cxl/cxl.h ++++ b/drivers/cxl/cxl.h +@@ -45,6 +45,8 @@ + #define CXL_HDM_DECODER_TARGET_COUNT_MASK GENMASK(7, 4) + #define CXL_HDM_DECODER_INTERLEAVE_11_8 BIT(8) + #define CXL_HDM_DECODER_INTERLEAVE_14_12 BIT(9) ++#define CXL_HDM_DECODER_INTERLEAVE_3_6_12_WAY BIT(11) ++#define CXL_HDM_DECODER_INTERLEAVE_16_WAY BIT(12) + #define CXL_HDM_DECODER_CTRL_OFFSET 0x4 + #define CXL_HDM_DECODER_ENABLE BIT(1) + #define CXL_HDM_DECODER0_BASE_LOW_OFFSET(i) (0x20 * (i) + 0x10) +@@ -848,8 +850,8 @@ struct cxl_nvdimm_bridge *devm_cxl_add_nvdimm_bridge(struct device *host, + struct cxl_nvdimm *to_cxl_nvdimm(struct device *dev); + bool is_cxl_nvdimm(struct device *dev); + bool is_cxl_nvdimm_bridge(struct device *dev); +-int devm_cxl_add_nvdimm(struct cxl_memdev *cxlmd); +-struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_memdev *cxlmd); ++int devm_cxl_add_nvdimm(struct cxl_port *parent_port, struct cxl_memdev *cxlmd); ++struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_port *port); + + #ifdef CONFIG_CXL_REGION + bool is_cxl_pmem_region(struct device *dev); +diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h +index 36cee9c30cebd..07e65a7605f3e 100644 +--- a/drivers/cxl/cxlmem.h ++++ b/drivers/cxl/cxlmem.h +@@ -848,11 +848,21 @@ static inline void cxl_mem_active_dec(void) + + int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd); + ++/** ++ * struct cxl_hdm - HDM Decoder registers and cached / decoded capabilities ++ * @regs: mapped registers, see devm_cxl_setup_hdm() ++ * @decoder_count: number of decoders for this port ++ * @target_count: for switch decoders, max downstream port targets ++ * @interleave_mask: interleave granularity capability, see check_interleave_cap() ++ * @iw_cap_mask: bitmask of supported interleave ways, see check_interleave_cap() ++ * @port: mapped cxl_port, see devm_cxl_setup_hdm() ++ */ + struct cxl_hdm { + struct cxl_component_regs regs; + unsigned int decoder_count; + unsigned int target_count; + unsigned int interleave_mask; ++ unsigned long iw_cap_mask; + struct cxl_port *port; + }; + +diff --git a/drivers/cxl/mem.c b/drivers/cxl/mem.c +index 0c79d9ce877cc..2f1b49bfe162f 100644 +--- a/drivers/cxl/mem.c ++++ b/drivers/cxl/mem.c +@@ -152,6 +152,15 @@ static int cxl_mem_probe(struct device *dev) + return -ENXIO; + } + ++ if (resource_size(&cxlds->pmem_res) && IS_ENABLED(CONFIG_CXL_PMEM)) { ++ rc = devm_cxl_add_nvdimm(parent_port, cxlmd); ++ if (rc) { ++ if (rc == -ENODEV) ++ dev_info(dev, "PMEM disabled by platform\n"); ++ return rc; ++ } ++ } ++ + if (dport->rch) + endpoint_parent = parent_port->uport_dev; + else +@@ -174,14 +183,6 @@ static int cxl_mem_probe(struct device *dev) + if (rc) + return rc; + +- if (resource_size(&cxlds->pmem_res) && IS_ENABLED(CONFIG_CXL_PMEM)) { +- rc = devm_cxl_add_nvdimm(cxlmd); +- if (rc == -ENODEV) +- dev_info(dev, "PMEM disabled by platform\n"); +- else +- return rc; +- } +- + /* + * The kernel may be operating out of CXL memory on this device, + * there is no spec defined way to determine whether this device +diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c +index bb499e3629125..1d0175d6350b7 100644 +--- a/drivers/gpio/gpio-davinci.c ++++ b/drivers/gpio/gpio-davinci.c +@@ -225,6 +225,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) + else + nirq = DIV_ROUND_UP(ngpio, 16); + ++ if (nirq > MAX_INT_PER_BANK) { ++ dev_err(dev, "Too many IRQs!\n"); ++ return -EINVAL; ++ } ++ + chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL); + if (!chips) + return -ENOMEM; +diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c +index 9dad67ea25974..5639abce6ec57 100644 +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -89,6 +89,10 @@ struct linehandle_state { + GPIOHANDLE_REQUEST_OPEN_DRAIN | \ + GPIOHANDLE_REQUEST_OPEN_SOURCE) + ++#define GPIOHANDLE_REQUEST_DIRECTION_FLAGS \ ++ (GPIOHANDLE_REQUEST_INPUT | \ ++ GPIOHANDLE_REQUEST_OUTPUT) ++ + static int linehandle_validate_flags(u32 flags) + { + /* Return an error if an unknown flag is set */ +@@ -169,21 +173,21 @@ static long linehandle_set_config(struct linehandle_state *lh, + if (ret) + return ret; + ++ /* Lines must be reconfigured explicitly as input or output. */ ++ if (!(lflags & GPIOHANDLE_REQUEST_DIRECTION_FLAGS)) ++ return -EINVAL; ++ + for (i = 0; i < lh->num_descs; i++) { + desc = lh->descs[i]; +- linehandle_flags_to_desc_flags(gcnf.flags, &desc->flags); ++ linehandle_flags_to_desc_flags(lflags, &desc->flags); + +- /* +- * Lines have to be requested explicitly for input +- * or output, else the line will be treated "as is". +- */ + if (lflags & GPIOHANDLE_REQUEST_OUTPUT) { + int val = !!gcnf.default_values[i]; + + ret = gpiod_direction_output(desc, val); + if (ret) + return ret; +- } else if (lflags & GPIOHANDLE_REQUEST_INPUT) { ++ } else { + ret = gpiod_direction_input(desc); + if (ret) + return ret; +@@ -1530,12 +1534,14 @@ static long linereq_set_config(struct linereq *lr, void __user *ip) + line = &lr->lines[i]; + desc = lr->lines[i].desc; + flags = gpio_v2_line_config_flags(&lc, i); +- gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags); +- edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS; + /* +- * Lines have to be requested explicitly for input +- * or output, else the line will be treated "as is". ++ * Lines not explicitly reconfigured as input or output ++ * are left unchanged. + */ ++ if (!(flags & GPIO_V2_LINE_DIRECTION_FLAGS)) ++ continue; ++ gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags); ++ edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS; + if (flags & GPIO_V2_LINE_FLAG_OUTPUT) { + int val = gpio_v2_line_config_output_value(&lc, i); + +@@ -1543,7 +1549,7 @@ static long linereq_set_config(struct linereq *lr, void __user *ip) + ret = gpiod_direction_output(desc, val); + if (ret) + return ret; +- } else if (flags & GPIO_V2_LINE_FLAG_INPUT) { ++ } else { + ret = gpiod_direction_input(desc); + if (ret) + return ret; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +index c8c23dbb90916..12b48851820e3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +@@ -399,7 +399,7 @@ amdgpu_atomfirmware_get_vram_info(struct amdgpu_device *adev, + mem_channel_number = vram_info->v30.channel_num; + mem_channel_width = vram_info->v30.channel_width; + if (vram_width) +- *vram_width = mem_channel_number * (1 << mem_channel_width); ++ *vram_width = mem_channel_number * 16; + break; + default: + return -EINVAL; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 941d6e379b8a6..eb8af023326ab 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -5121,11 +5121,14 @@ int amdgpu_device_mode1_reset(struct amdgpu_device *adev) + + dev_info(adev->dev, "GPU mode1 reset\n"); + ++ /* Cache the state before bus master disable. The saved config space ++ * values are used in other cases like restore after mode-2 reset. ++ */ ++ amdgpu_device_cache_pci_state(adev->pdev); ++ + /* disable BM */ + pci_clear_master(adev->pdev); + +- amdgpu_device_cache_pci_state(adev->pdev); +- + if (amdgpu_dpm_is_mode1_reset_supported(adev)) { + dev_info(adev->dev, "GPU smu mode1 reset\n"); + ret = amdgpu_dpm_mode1_reset(adev); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +index 8baa2e0935cc6..ba6d1876ce1c8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +@@ -3,6 +3,7 @@ + #include <drm/drm_atomic_helper.h> + #include <drm/drm_edid.h> + #include <drm/drm_simple_kms_helper.h> ++#include <drm/drm_gem_framebuffer_helper.h> + #include <drm/drm_vblank.h> + + #include "amdgpu.h" +@@ -314,7 +315,13 @@ static int amdgpu_vkms_prepare_fb(struct drm_plane *plane, + return 0; + } + afb = to_amdgpu_framebuffer(new_state->fb); +- obj = new_state->fb->obj[0]; ++ ++ obj = drm_gem_fb_get_obj(new_state->fb, 0); ++ if (!obj) { ++ DRM_ERROR("Failed to get obj from framebuffer\n"); ++ return -EINVAL; ++ } ++ + rbo = gem_to_amdgpu_bo(obj); + adev = amdgpu_ttm_adev(rbo->tbo.bdev); + +@@ -368,12 +375,19 @@ static void amdgpu_vkms_cleanup_fb(struct drm_plane *plane, + struct drm_plane_state *old_state) + { + struct amdgpu_bo *rbo; ++ struct drm_gem_object *obj; + int r; + + if (!old_state->fb) + return; + +- rbo = gem_to_amdgpu_bo(old_state->fb->obj[0]); ++ obj = drm_gem_fb_get_obj(old_state->fb, 0); ++ if (!obj) { ++ DRM_ERROR("Failed to get obj from framebuffer\n"); ++ return; ++ } ++ ++ rbo = gem_to_amdgpu_bo(obj); + r = amdgpu_bo_reserve(rbo, false); + if (unlikely(r)) { + DRM_ERROR("failed to reserve rbo before unpin\n"); +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c +index f15d1dbad6a96..b72ed3e78df05 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c +@@ -327,6 +327,8 @@ void dml2_calculate_rq_and_dlg_params(const struct dc *dc, struct dc_state *cont + dml_pipe_idx = dml2_helper_find_dml_pipe_idx_by_stream_id(in_ctx, context->res_ctx.pipe_ctx[dc_pipe_ctx_index].stream->stream_id); + } + ++ if (dml_pipe_idx == 0xFFFFFFFF) ++ continue; + ASSERT(in_ctx->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[dml_pipe_idx]); + ASSERT(in_ctx->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[dml_pipe_idx] == context->res_ctx.pipe_ctx[dc_pipe_ctx_index].stream->stream_id); + +@@ -468,6 +470,9 @@ bool dml2_verify_det_buffer_configuration(struct dml2_context *in_ctx, struct dc + dml_pipe_idx = find_dml_pipe_idx_by_plane_id(in_ctx, plane_id); + else + dml_pipe_idx = dml2_helper_find_dml_pipe_idx_by_stream_id(in_ctx, display_state->res_ctx.pipe_ctx[i].stream->stream_id); ++ ++ if (dml_pipe_idx == 0xFFFFFFFF) ++ continue; + total_det_allocated += dml_get_det_buffer_size_kbytes(&in_ctx->v20.dml_core_ctx, dml_pipe_idx); + if (total_det_allocated > max_det_size) { + need_recalculation = true; +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +index 289f5d1333424..f608dd3bbac32 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +@@ -1590,9 +1590,17 @@ static bool retrieve_link_cap(struct dc_link *link) + return false; + } + +- if (dp_is_lttpr_present(link)) ++ if (dp_is_lttpr_present(link)) { + configure_lttpr_mode_transparent(link); + ++ // Echo TOTAL_LTTPR_CNT back downstream ++ core_link_write_dpcd( ++ link, ++ DP_TOTAL_LTTPR_CNT, ++ &link->dpcd_caps.lttpr_caps.phy_repeater_cnt, ++ sizeof(link->dpcd_caps.lttpr_caps.phy_repeater_cnt)); ++ } ++ + /* Read DP tunneling information. */ + status = dpcd_get_tunneling_device_data(link); + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +index 04d142f974745..2fb1d00ff9654 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +@@ -892,7 +892,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .disable_z10 = true, + .enable_legacy_fast_update = true, + .enable_z9_disable_interface = true, /* Allow support for the PMFW interface for disable Z9*/ +- .dml_hostvm_override = DML_HOSTVM_OVERRIDE_FALSE, ++ .dml_hostvm_override = DML_HOSTVM_NO_OVERRIDE, + .using_dml2 = false, + }; + +diff --git a/drivers/gpu/drm/amd/display/include/dpcd_defs.h b/drivers/gpu/drm/amd/display/include/dpcd_defs.h +index 914f28e9f2242..aee5170f5fb23 100644 +--- a/drivers/gpu/drm/amd/display/include/dpcd_defs.h ++++ b/drivers/gpu/drm/amd/display/include/dpcd_defs.h +@@ -177,4 +177,9 @@ enum dpcd_psr_sink_states { + #define DP_SINK_PR_PIXEL_DEVIATION_PER_LINE 0x379 + #define DP_SINK_PR_MAX_NUMBER_OF_DEVIATION_LINE 0x37A + ++/* Remove once drm_dp_helper.h is updated upstream */ ++#ifndef DP_TOTAL_LTTPR_CNT ++#define DP_TOTAL_LTTPR_CNT 0xF000A /* 2.1 */ ++#endif ++ + #endif /* __DAL_DPCD_DEFS_H__ */ +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index d612133e2cf7e..117237d3528bd 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -524,6 +524,9 @@ struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper) + if (!info) + return ERR_PTR(-ENOMEM); + ++ if (!drm_leak_fbdev_smem) ++ info->flags |= FBINFO_HIDE_SMEM_START; ++ + ret = fb_alloc_cmap(&info->cmap, 256, 0); + if (ret) + goto err_release; +@@ -1860,9 +1863,6 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper) + info = fb_helper->info; + info->var.pixclock = 0; + +- if (!drm_leak_fbdev_smem) +- info->flags |= FBINFO_HIDE_SMEM_START; +- + /* Need to drop locks to avoid recursive deadlock in + * register_framebuffer. This is ok because the only thing left to do is + * register the fbdev emulation instance in kernel_fb_helper_list. */ +diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c +index 6c9427bb4053b..13cd754af311d 100644 +--- a/drivers/gpu/drm/drm_fbdev_dma.c ++++ b/drivers/gpu/drm/drm_fbdev_dma.c +@@ -130,7 +130,10 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper, + info->flags |= FBINFO_READS_FAST; /* signal caching */ + info->screen_size = sizes->surface_height * fb->pitches[0]; + info->screen_buffer = map.vaddr; +- info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer)); ++ if (!(info->flags & FBINFO_HIDE_SMEM_START)) { ++ if (!drm_WARN_ON(dev, is_vmalloc_addr(info->screen_buffer))) ++ info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer)); ++ } + info->fix.smem_len = info->screen_size; + + return 0; +diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c +index 638ffa4444f51..714e42b051080 100644 +--- a/drivers/gpu/drm/drm_file.c ++++ b/drivers/gpu/drm/drm_file.c +@@ -469,14 +469,12 @@ void drm_file_update_pid(struct drm_file *filp) + + dev = filp->minor->dev; + mutex_lock(&dev->filelist_mutex); ++ get_pid(pid); + old = rcu_replace_pointer(filp->pid, pid, 1); + mutex_unlock(&dev->filelist_mutex); + +- if (pid != old) { +- get_pid(pid); +- synchronize_rcu(); +- put_pid(old); +- } ++ synchronize_rcu(); ++ put_pid(old); + } + + /** +diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +index 40371b8a9bbbd..93bc1cc1ee7e6 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c ++++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +@@ -298,6 +298,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma) + return; + + GEM_BUG_ON(fence->vma != vma); ++ i915_active_wait(&fence->active); + GEM_BUG_ON(!i915_active_is_idle(&fence->active)); + GEM_BUG_ON(atomic_read(&fence->pin_count)); + +diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +index 670c9739e5e18..2033214c4b784 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +@@ -209,6 +209,8 @@ static int nv17_tv_get_ld_modes(struct drm_encoder *encoder, + struct drm_display_mode *mode; + + mode = drm_mode_duplicate(encoder->dev, tv_mode); ++ if (!mode) ++ continue; + + mode->clock = tv_norm->tv_enc_mode.vrefresh * + mode->htotal / 1000 * +@@ -258,6 +260,8 @@ static int nv17_tv_get_hd_modes(struct drm_encoder *encoder, + if (modes[i].hdisplay == output_mode->hdisplay && + modes[i].vdisplay == output_mode->vdisplay) { + mode = drm_mode_duplicate(encoder->dev, output_mode); ++ if (!mode) ++ continue; + mode->type |= DRM_MODE_TYPE_PREFERRED; + + } else { +@@ -265,6 +269,8 @@ static int nv17_tv_get_hd_modes(struct drm_encoder *encoder, + modes[i].vdisplay, 60, false, + (output_mode->flags & + DRM_MODE_FLAG_INTERLACE), false); ++ if (!mode) ++ continue; + } + + /* CVT modes are sometimes unsuitable... */ +diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +index 2ffe5f68a8903..4c8c317191f3c 100644 +--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c ++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +@@ -1080,10 +1080,10 @@ static int ili9881c_prepare(struct drm_panel *panel) + msleep(5); + + /* And reset it */ +- gpiod_set_value(ctx->reset, 1); ++ gpiod_set_value_cansleep(ctx->reset, 1); + msleep(20); + +- gpiod_set_value(ctx->reset, 0); ++ gpiod_set_value_cansleep(ctx->reset, 0); + msleep(20); + + for (i = 0; i < ctx->desc->init_length; i++) { +@@ -1138,7 +1138,7 @@ static int ili9881c_unprepare(struct drm_panel *panel) + + mipi_dsi_dcs_enter_sleep_mode(ctx->dsi); + regulator_disable(ctx->power); +- gpiod_set_value(ctx->reset, 1); ++ gpiod_set_value_cansleep(ctx->reset, 1); + + return 0; + } +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index e8fe5a69454d0..6aac6f2accb43 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2707,6 +2707,7 @@ static const struct display_timing koe_tx26d202vm0bwa_timing = { + .vfront_porch = { 3, 5, 10 }, + .vback_porch = { 2, 5, 10 }, + .vsync_len = { 5, 5, 5 }, ++ .flags = DISPLAY_FLAGS_DE_HIGH, + }; + + static const struct panel_desc koe_tx26d202vm0bwa = { +diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h +index 3e5ff17e3cafb..0999c8eaae94a 100644 +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -132,7 +132,6 @@ extern int radeon_cik_support; + /* RADEON_IB_POOL_SIZE must be a power of 2 */ + #define RADEON_IB_POOL_SIZE 16 + #define RADEON_DEBUGFS_MAX_COMPONENTS 32 +-#define RADEONFB_CONN_LIMIT 4 + #define RADEON_BIOS_NUM_SCRATCH 8 + + /* internal ring indices */ +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index efd18c8d84c83..5f1d24d3120c4 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -683,7 +683,7 @@ static void radeon_crtc_init(struct drm_device *dev, int index) + struct radeon_device *rdev = dev->dev_private; + struct radeon_crtc *radeon_crtc; + +- radeon_crtc = kzalloc(sizeof(struct radeon_crtc) + (RADEONFB_CONN_LIMIT * sizeof(struct drm_connector *)), GFP_KERNEL); ++ radeon_crtc = kzalloc(sizeof(*radeon_crtc), GFP_KERNEL); + if (radeon_crtc == NULL) + return; + +@@ -709,12 +709,6 @@ static void radeon_crtc_init(struct drm_device *dev, int index) + dev->mode_config.cursor_width = radeon_crtc->max_cursor_width; + dev->mode_config.cursor_height = radeon_crtc->max_cursor_height; + +-#if 0 +- radeon_crtc->mode_set.crtc = &radeon_crtc->base; +- radeon_crtc->mode_set.connectors = (struct drm_connector **)(radeon_crtc + 1); +- radeon_crtc->mode_set.num_connectors = 0; +-#endif +- + if (rdev->is_atom_bios && (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom)) + radeon_atombios_init_crtc(dev, radeon_crtc); + else +diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c +index 68d3d623a05bf..ccec291b02ccd 100644 +--- a/drivers/gpu/drm/xe/xe_devcoredump.c ++++ b/drivers/gpu/drm/xe/xe_devcoredump.c +@@ -74,17 +74,19 @@ static ssize_t xe_devcoredump_read(char *buffer, loff_t offset, + size_t count, void *data, size_t datalen) + { + struct xe_devcoredump *coredump = data; +- struct xe_device *xe = coredump_to_xe(coredump); +- struct xe_devcoredump_snapshot *ss = &coredump->snapshot; ++ struct xe_device *xe; ++ struct xe_devcoredump_snapshot *ss; + struct drm_printer p; + struct drm_print_iterator iter; + struct timespec64 ts; + int i; + +- /* Our device is gone already... */ +- if (!data || !coredump_to_xe(coredump)) ++ if (!coredump) + return -ENODEV; + ++ xe = coredump_to_xe(coredump); ++ ss = &coredump->snapshot; ++ + /* Ensure delayed work is captured before continuing */ + flush_work(&ss->work); + +diff --git a/drivers/gpu/drm/xe/xe_pat.c b/drivers/gpu/drm/xe/xe_pat.c +index e148934d554b0..351ab902eb600 100644 +--- a/drivers/gpu/drm/xe/xe_pat.c ++++ b/drivers/gpu/drm/xe/xe_pat.c +@@ -457,7 +457,7 @@ void xe_pat_dump(struct xe_gt *gt, struct drm_printer *p) + { + struct xe_device *xe = gt_to_xe(gt); + +- if (!xe->pat.ops->dump) ++ if (!xe->pat.ops) + return; + + xe->pat.ops->dump(gt, p); +diff --git a/drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c b/drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c +index 3107d2a12426c..fb35e46d68b49 100644 +--- a/drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c ++++ b/drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c +@@ -207,6 +207,11 @@ void xe_ttm_stolen_mgr_init(struct xe_device *xe) + u64 stolen_size, io_size, pgsize; + int err; + ++ if (!mgr) { ++ drm_dbg_kms(&xe->drm, "Stolen mgr init failed\n"); ++ return; ++ } ++ + if (IS_SRIOV_VF(xe)) + stolen_size = 0; + else if (IS_DGFX(xe)) +diff --git a/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c b/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c +index 115ec745e5029..0678faf832126 100644 +--- a/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c ++++ b/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c +@@ -91,7 +91,7 @@ static int xe_ttm_vram_mgr_new(struct ttm_resource_manager *man, + + min_page_size = mgr->default_page_size; + if (tbo->page_alignment) +- min_page_size = tbo->page_alignment << PAGE_SHIFT; ++ min_page_size = (u64)tbo->page_alignment << PAGE_SHIFT; + + if (WARN_ON(min_page_size < mm->chunk_size)) { + err = -EINVAL; +diff --git a/drivers/i2c/i2c-slave-testunit.c b/drivers/i2c/i2c-slave-testunit.c +index a49642bbae4b7..ca43e98cae1b2 100644 +--- a/drivers/i2c/i2c-slave-testunit.c ++++ b/drivers/i2c/i2c-slave-testunit.c +@@ -118,9 +118,12 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client, + queue_delayed_work(system_long_wq, &tu->worker, + msecs_to_jiffies(10 * tu->regs[TU_REG_DELAY])); + } +- fallthrough; ++ break; + + case I2C_SLAVE_WRITE_REQUESTED: ++ if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags)) ++ return -EBUSY; ++ + memset(tu->regs, 0, TU_NUM_REGS); + tu->reg_idx = 0; + break; +diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig +index c2da5066e9a7b..80b57d3ee3a72 100644 +--- a/drivers/iio/accel/Kconfig ++++ b/drivers/iio/accel/Kconfig +@@ -330,6 +330,8 @@ config DMARD10 + config FXLS8962AF + tristate + depends on I2C || !I2C # cannot be built-in for modular I2C ++ select IIO_BUFFER ++ select IIO_KFIFO_BUF + + config FXLS8962AF_I2C + tristate "NXP FXLS8962AF/FXLS8964AF Accelerometer I2C Driver" +diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c +index 468c2656d2be7..98648c679a55c 100644 +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -157,6 +157,8 @@ static int ad7266_read_raw(struct iio_dev *indio_dev, + ret = ad7266_read_single(st, val, chan->address); + iio_device_release_direct_mode(indio_dev); + ++ if (ret < 0) ++ return ret; + *val = (*val >> 2) & 0xfff; + if (chan->scan_type.sign == 's') + *val = sign_extend32(*val, +diff --git a/drivers/iio/adc/xilinx-ams.c b/drivers/iio/adc/xilinx-ams.c +index f0b71a1220e02..f52abf759260f 100644 +--- a/drivers/iio/adc/xilinx-ams.c ++++ b/drivers/iio/adc/xilinx-ams.c +@@ -414,8 +414,12 @@ static void ams_enable_channel_sequence(struct iio_dev *indio_dev) + + /* Run calibration of PS & PL as part of the sequence */ + scan_mask = BIT(0) | BIT(AMS_PS_SEQ_MAX); +- for (i = 0; i < indio_dev->num_channels; i++) +- scan_mask |= BIT_ULL(indio_dev->channels[i].scan_index); ++ for (i = 0; i < indio_dev->num_channels; i++) { ++ const struct iio_chan_spec *chan = &indio_dev->channels[i]; ++ ++ if (chan->scan_index < AMS_CTRL_SEQ_BASE) ++ scan_mask |= BIT_ULL(chan->scan_index); ++ } + + if (ams->ps_base) { + /* put sysmon in a soft reset to change the sequence */ +diff --git a/drivers/iio/chemical/bme680.h b/drivers/iio/chemical/bme680.h +index 4edc5d21cb9fa..f959252a4fe66 100644 +--- a/drivers/iio/chemical/bme680.h ++++ b/drivers/iio/chemical/bme680.h +@@ -54,7 +54,9 @@ + #define BME680_NB_CONV_MASK GENMASK(3, 0) + + #define BME680_REG_MEAS_STAT_0 0x1D ++#define BME680_NEW_DATA_BIT BIT(7) + #define BME680_GAS_MEAS_BIT BIT(6) ++#define BME680_MEAS_BIT BIT(5) + + /* Calibration Parameters */ + #define BME680_T2_LSB_REG 0x8A +diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c +index ef5e0e46fd344..500f56834b01f 100644 +--- a/drivers/iio/chemical/bme680_core.c ++++ b/drivers/iio/chemical/bme680_core.c +@@ -10,6 +10,7 @@ + */ + #include <linux/acpi.h> + #include <linux/bitfield.h> ++#include <linux/delay.h> + #include <linux/device.h> + #include <linux/module.h> + #include <linux/log2.h> +@@ -38,7 +39,7 @@ struct bme680_calib { + s8 par_h3; + s8 par_h4; + s8 par_h5; +- s8 par_h6; ++ u8 par_h6; + s8 par_h7; + s8 par_gh1; + s16 par_gh2; +@@ -342,10 +343,10 @@ static s16 bme680_compensate_temp(struct bme680_data *data, + if (!calib->par_t2) + bme680_read_calib(data, calib); + +- var1 = (adc_temp >> 3) - (calib->par_t1 << 1); ++ var1 = (adc_temp >> 3) - ((s32)calib->par_t1 << 1); + var2 = (var1 * calib->par_t2) >> 11; + var3 = ((var1 >> 1) * (var1 >> 1)) >> 12; +- var3 = (var3 * (calib->par_t3 << 4)) >> 14; ++ var3 = (var3 * ((s32)calib->par_t3 << 4)) >> 14; + data->t_fine = var2 + var3; + calc_temp = (data->t_fine * 5 + 128) >> 8; + +@@ -368,9 +369,9 @@ static u32 bme680_compensate_press(struct bme680_data *data, + var1 = (data->t_fine >> 1) - 64000; + var2 = ((((var1 >> 2) * (var1 >> 2)) >> 11) * calib->par_p6) >> 2; + var2 = var2 + (var1 * calib->par_p5 << 1); +- var2 = (var2 >> 2) + (calib->par_p4 << 16); ++ var2 = (var2 >> 2) + ((s32)calib->par_p4 << 16); + var1 = (((((var1 >> 2) * (var1 >> 2)) >> 13) * +- (calib->par_p3 << 5)) >> 3) + ++ ((s32)calib->par_p3 << 5)) >> 3) + + ((calib->par_p2 * var1) >> 1); + var1 = var1 >> 18; + var1 = ((32768 + var1) * calib->par_p1) >> 15; +@@ -388,7 +389,7 @@ static u32 bme680_compensate_press(struct bme680_data *data, + var3 = ((press_comp >> 8) * (press_comp >> 8) * + (press_comp >> 8) * calib->par_p10) >> 17; + +- press_comp += (var1 + var2 + var3 + (calib->par_p7 << 7)) >> 4; ++ press_comp += (var1 + var2 + var3 + ((s32)calib->par_p7 << 7)) >> 4; + + return press_comp; + } +@@ -414,7 +415,7 @@ static u32 bme680_compensate_humid(struct bme680_data *data, + (((temp_scaled * ((temp_scaled * calib->par_h5) / 100)) + >> 6) / 100) + (1 << 14))) >> 10; + var3 = var1 * var2; +- var4 = calib->par_h6 << 7; ++ var4 = (s32)calib->par_h6 << 7; + var4 = (var4 + ((temp_scaled * calib->par_h7) / 100)) >> 4; + var5 = ((var3 >> 14) * (var3 >> 14)) >> 10; + var6 = (var4 * var5) >> 1; +@@ -532,6 +533,43 @@ static u8 bme680_oversampling_to_reg(u8 val) + return ilog2(val) + 1; + } + ++/* ++ * Taken from Bosch BME680 API: ++ * https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L490 ++ */ ++static int bme680_wait_for_eoc(struct bme680_data *data) ++{ ++ struct device *dev = regmap_get_device(data->regmap); ++ unsigned int check; ++ int ret; ++ /* ++ * (Sum of oversampling ratios * time per oversampling) + ++ * TPH measurement + gas measurement + wait transition from forced mode ++ * + heater duration ++ */ ++ int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press + ++ data->oversampling_humid) * 1936) + (477 * 4) + ++ (477 * 5) + 1000 + (data->heater_dur * 1000); ++ ++ usleep_range(wait_eoc_us, wait_eoc_us + 100); ++ ++ ret = regmap_read(data->regmap, BME680_REG_MEAS_STAT_0, &check); ++ if (ret) { ++ dev_err(dev, "failed to read measurement status register.\n"); ++ return ret; ++ } ++ if (check & BME680_MEAS_BIT) { ++ dev_err(dev, "Device measurement cycle incomplete.\n"); ++ return -EBUSY; ++ } ++ if (!(check & BME680_NEW_DATA_BIT)) { ++ dev_err(dev, "No new data available from the device.\n"); ++ return -ENODATA; ++ } ++ ++ return 0; ++} ++ + static int bme680_chip_config(struct bme680_data *data) + { + struct device *dev = regmap_get_device(data->regmap); +@@ -622,6 +660,10 @@ static int bme680_read_temp(struct bme680_data *data, int *val) + if (ret < 0) + return ret; + ++ ret = bme680_wait_for_eoc(data); ++ if (ret) ++ return ret; ++ + ret = regmap_bulk_read(data->regmap, BME680_REG_TEMP_MSB, + &tmp, 3); + if (ret < 0) { +@@ -678,7 +720,7 @@ static int bme680_read_press(struct bme680_data *data, + } + + *val = bme680_compensate_press(data, adc_press); +- *val2 = 100; ++ *val2 = 1000; + return IIO_VAL_FRACTIONAL; + } + +@@ -738,6 +780,10 @@ static int bme680_read_gas(struct bme680_data *data, + if (ret < 0) + return ret; + ++ ret = bme680_wait_for_eoc(data); ++ if (ret) ++ return ret; ++ + ret = regmap_read(data->regmap, BME680_REG_MEAS_STAT_0, &check); + if (check & BME680_GAS_MEAS_BIT) { + dev_err(dev, "gas measurement incomplete\n"); +diff --git a/drivers/iio/humidity/hdc3020.c b/drivers/iio/humidity/hdc3020.c +index 1e5d0d4797b16..1e702fcc48515 100644 +--- a/drivers/iio/humidity/hdc3020.c ++++ b/drivers/iio/humidity/hdc3020.c +@@ -18,6 +18,7 @@ + #include <linux/i2c.h> + #include <linux/init.h> + #include <linux/interrupt.h> ++#include <linux/math64.h> + #include <linux/module.h> + #include <linux/mutex.h> + #include <linux/units.h> +@@ -63,8 +64,10 @@ + + #define HDC3020_CRC8_POLYNOMIAL 0x31 + +-#define HDC3020_MIN_TEMP -40 +-#define HDC3020_MAX_TEMP 125 ++#define HDC3020_MIN_TEMP_MICRO -39872968 ++#define HDC3020_MAX_TEMP_MICRO 124875639 ++#define HDC3020_MAX_TEMP_HYST_MICRO 164748607 ++#define HDC3020_MAX_HUM_MICRO 99220264 + + struct hdc3020_data { + struct i2c_client *client; +@@ -363,6 +366,105 @@ static int hdc3020_write_raw(struct iio_dev *indio_dev, + return -EINVAL; + } + ++static int hdc3020_thresh_get_temp(u16 thresh) ++{ ++ int temp; ++ ++ /* ++ * Get the temperature threshold from 9 LSBs, shift them to get ++ * the truncated temperature threshold representation and ++ * calculate the threshold according to the formula in the ++ * datasheet. Result is degree celsius scaled by 65535. ++ */ ++ temp = FIELD_GET(HDC3020_THRESH_TEMP_MASK, thresh) << ++ HDC3020_THRESH_TEMP_TRUNC_SHIFT; ++ ++ return -2949075 + (175 * temp); ++} ++ ++static int hdc3020_thresh_get_hum(u16 thresh) ++{ ++ int hum; ++ ++ /* ++ * Get the humidity threshold from 7 MSBs, shift them to get the ++ * truncated humidity threshold representation and calculate the ++ * threshold according to the formula in the datasheet. Result is ++ * percent scaled by 65535. ++ */ ++ hum = FIELD_GET(HDC3020_THRESH_HUM_MASK, thresh) << ++ HDC3020_THRESH_HUM_TRUNC_SHIFT; ++ ++ return hum * 100; ++} ++ ++static u16 hdc3020_thresh_set_temp(int s_temp, u16 curr_thresh) ++{ ++ u64 temp; ++ u16 thresh; ++ ++ /* ++ * Calculate temperature threshold, shift it down to get the ++ * truncated threshold representation in the 9LSBs while keeping ++ * the current humidity threshold in the 7 MSBs. ++ */ ++ temp = (u64)(s_temp + 45000000) * 65535ULL; ++ temp = div_u64(temp, 1000000 * 175) >> HDC3020_THRESH_TEMP_TRUNC_SHIFT; ++ thresh = FIELD_PREP(HDC3020_THRESH_TEMP_MASK, temp); ++ thresh |= (FIELD_GET(HDC3020_THRESH_HUM_MASK, curr_thresh) << ++ HDC3020_THRESH_HUM_TRUNC_SHIFT); ++ ++ return thresh; ++} ++ ++static u16 hdc3020_thresh_set_hum(int s_hum, u16 curr_thresh) ++{ ++ u64 hum; ++ u16 thresh; ++ ++ /* ++ * Calculate humidity threshold, shift it down and up to get the ++ * truncated threshold representation in the 7MSBs while keeping ++ * the current temperature threshold in the 9 LSBs. ++ */ ++ hum = (u64)(s_hum) * 65535ULL; ++ hum = div_u64(hum, 1000000 * 100) >> HDC3020_THRESH_HUM_TRUNC_SHIFT; ++ thresh = FIELD_PREP(HDC3020_THRESH_HUM_MASK, hum); ++ thresh |= FIELD_GET(HDC3020_THRESH_TEMP_MASK, curr_thresh); ++ ++ return thresh; ++} ++ ++static ++int hdc3020_thresh_clr(s64 s_thresh, s64 s_hyst, enum iio_event_direction dir) ++{ ++ s64 s_clr; ++ ++ /* ++ * Include directions when calculation the clear value, ++ * since hysteresis is unsigned by definition and the ++ * clear value is an absolute value which is signed. ++ */ ++ if (dir == IIO_EV_DIR_RISING) ++ s_clr = s_thresh - s_hyst; ++ else ++ s_clr = s_thresh + s_hyst; ++ ++ /* Divide by 65535 to get units of micro */ ++ return div_s64(s_clr, 65535); ++} ++ ++static int _hdc3020_write_thresh(struct hdc3020_data *data, u16 reg, u16 val) ++{ ++ u8 buf[5]; ++ ++ put_unaligned_be16(reg, buf); ++ put_unaligned_be16(val, buf + 2); ++ buf[4] = crc8(hdc3020_crc8_table, buf + 2, 2, CRC8_INIT_VALUE); ++ ++ return hdc3020_write_bytes(data, buf, 5); ++} ++ + static int hdc3020_write_thresh(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, +@@ -371,67 +473,126 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev, + int val, int val2) + { + struct hdc3020_data *data = iio_priv(indio_dev); +- u8 buf[5]; +- u64 tmp; +- u16 reg; +- int ret; +- +- /* Supported temperature range is from –40 to 125 degree celsius */ +- if (val < HDC3020_MIN_TEMP || val > HDC3020_MAX_TEMP) +- return -EINVAL; +- +- /* Select threshold register */ +- if (info == IIO_EV_INFO_VALUE) { +- if (dir == IIO_EV_DIR_RISING) +- reg = HDC3020_S_T_RH_THRESH_HIGH; +- else +- reg = HDC3020_S_T_RH_THRESH_LOW; ++ u16 reg, reg_val, reg_thresh_rd, reg_clr_rd, reg_thresh_wr, reg_clr_wr; ++ s64 s_thresh, s_hyst, s_clr; ++ int s_val, thresh, clr, ret; ++ ++ /* Select threshold registers */ ++ if (dir == IIO_EV_DIR_RISING) { ++ reg_thresh_rd = HDC3020_R_T_RH_THRESH_HIGH; ++ reg_thresh_wr = HDC3020_S_T_RH_THRESH_HIGH; ++ reg_clr_rd = HDC3020_R_T_RH_THRESH_HIGH_CLR; ++ reg_clr_wr = HDC3020_S_T_RH_THRESH_HIGH_CLR; + } else { +- if (dir == IIO_EV_DIR_RISING) +- reg = HDC3020_S_T_RH_THRESH_HIGH_CLR; +- else +- reg = HDC3020_S_T_RH_THRESH_LOW_CLR; ++ reg_thresh_rd = HDC3020_R_T_RH_THRESH_LOW; ++ reg_thresh_wr = HDC3020_S_T_RH_THRESH_LOW; ++ reg_clr_rd = HDC3020_R_T_RH_THRESH_LOW_CLR; ++ reg_clr_wr = HDC3020_S_T_RH_THRESH_LOW_CLR; + } + + guard(mutex)(&data->lock); +- ret = hdc3020_read_be16(data, reg); ++ ret = hdc3020_read_be16(data, reg_thresh_rd); + if (ret < 0) + return ret; + ++ thresh = ret; ++ ret = hdc3020_read_be16(data, reg_clr_rd); ++ if (ret < 0) ++ return ret; ++ ++ clr = ret; ++ /* Scale value to include decimal part into calculations */ ++ s_val = (val < 0) ? (val * 1000000 - val2) : (val * 1000000 + val2); + switch (chan->type) { + case IIO_TEMP: +- /* +- * Calculate temperature threshold, shift it down to get the +- * truncated threshold representation in the 9LSBs while keeping +- * the current humidity threshold in the 7 MSBs. +- */ +- tmp = ((u64)(((val + 45) * MICRO) + val2)) * 65535ULL; +- tmp = div_u64(tmp, MICRO * 175); +- val = tmp >> HDC3020_THRESH_TEMP_TRUNC_SHIFT; +- val = FIELD_PREP(HDC3020_THRESH_TEMP_MASK, val); +- val |= (FIELD_GET(HDC3020_THRESH_HUM_MASK, ret) << +- HDC3020_THRESH_HUM_TRUNC_SHIFT); ++ switch (info) { ++ case IIO_EV_INFO_VALUE: ++ s_val = max(s_val, HDC3020_MIN_TEMP_MICRO); ++ s_val = min(s_val, HDC3020_MAX_TEMP_MICRO); ++ reg = reg_thresh_wr; ++ reg_val = hdc3020_thresh_set_temp(s_val, thresh); ++ ret = _hdc3020_write_thresh(data, reg, reg_val); ++ if (ret < 0) ++ return ret; ++ ++ /* Calculate old hysteresis */ ++ s_thresh = (s64)hdc3020_thresh_get_temp(thresh) * 1000000; ++ s_clr = (s64)hdc3020_thresh_get_temp(clr) * 1000000; ++ s_hyst = div_s64(abs(s_thresh - s_clr), 65535); ++ /* Set new threshold */ ++ thresh = reg_val; ++ /* Set old hysteresis */ ++ s_val = s_hyst; ++ fallthrough; ++ case IIO_EV_INFO_HYSTERESIS: ++ /* ++ * Function hdc3020_thresh_get_temp returns temperature ++ * in degree celsius scaled by 65535. Scale by 1000000 ++ * to be able to subtract scaled hysteresis value. ++ */ ++ s_thresh = (s64)hdc3020_thresh_get_temp(thresh) * 1000000; ++ /* ++ * Units of s_val are in micro degree celsius, scale by ++ * 65535 to get same units as s_thresh. ++ */ ++ s_val = min(abs(s_val), HDC3020_MAX_TEMP_HYST_MICRO); ++ s_hyst = (s64)s_val * 65535; ++ s_clr = hdc3020_thresh_clr(s_thresh, s_hyst, dir); ++ s_clr = max(s_clr, HDC3020_MIN_TEMP_MICRO); ++ s_clr = min(s_clr, HDC3020_MAX_TEMP_MICRO); ++ reg = reg_clr_wr; ++ reg_val = hdc3020_thresh_set_temp(s_clr, clr); ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } + break; + case IIO_HUMIDITYRELATIVE: +- /* +- * Calculate humidity threshold, shift it down and up to get the +- * truncated threshold representation in the 7MSBs while keeping +- * the current temperature threshold in the 9 LSBs. +- */ +- tmp = ((u64)((val * MICRO) + val2)) * 65535ULL; +- tmp = div_u64(tmp, MICRO * 100); +- val = tmp >> HDC3020_THRESH_HUM_TRUNC_SHIFT; +- val = FIELD_PREP(HDC3020_THRESH_HUM_MASK, val); +- val |= FIELD_GET(HDC3020_THRESH_TEMP_MASK, ret); ++ s_val = (s_val < 0) ? 0 : min(s_val, HDC3020_MAX_HUM_MICRO); ++ switch (info) { ++ case IIO_EV_INFO_VALUE: ++ reg = reg_thresh_wr; ++ reg_val = hdc3020_thresh_set_hum(s_val, thresh); ++ ret = _hdc3020_write_thresh(data, reg, reg_val); ++ if (ret < 0) ++ return ret; ++ ++ /* Calculate old hysteresis */ ++ s_thresh = (s64)hdc3020_thresh_get_hum(thresh) * 1000000; ++ s_clr = (s64)hdc3020_thresh_get_hum(clr) * 1000000; ++ s_hyst = div_s64(abs(s_thresh - s_clr), 65535); ++ /* Set new threshold */ ++ thresh = reg_val; ++ /* Try to set old hysteresis */ ++ s_val = min(abs(s_hyst), HDC3020_MAX_HUM_MICRO); ++ fallthrough; ++ case IIO_EV_INFO_HYSTERESIS: ++ /* ++ * Function hdc3020_thresh_get_hum returns relative ++ * humidity in percent scaled by 65535. Scale by 1000000 ++ * to be able to subtract scaled hysteresis value. ++ */ ++ s_thresh = (s64)hdc3020_thresh_get_hum(thresh) * 1000000; ++ /* ++ * Units of s_val are in micro percent, scale by 65535 ++ * to get same units as s_thresh. ++ */ ++ s_hyst = (s64)s_val * 65535; ++ s_clr = hdc3020_thresh_clr(s_thresh, s_hyst, dir); ++ s_clr = max(s_clr, 0); ++ s_clr = min(s_clr, HDC3020_MAX_HUM_MICRO); ++ reg = reg_clr_wr; ++ reg_val = hdc3020_thresh_set_hum(s_clr, clr); ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } + break; + default: + return -EOPNOTSUPP; + } + +- put_unaligned_be16(reg, buf); +- put_unaligned_be16(val, buf + 2); +- buf[4] = crc8(hdc3020_crc8_table, buf + 2, 2, CRC8_INIT_VALUE); +- return hdc3020_write_bytes(data, buf, 5); ++ return _hdc3020_write_thresh(data, reg, reg_val); + } + + static int hdc3020_read_thresh(struct iio_dev *indio_dev, +@@ -442,48 +603,60 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev, + int *val, int *val2) + { + struct hdc3020_data *data = iio_priv(indio_dev); +- u16 reg; +- int ret; ++ u16 reg_thresh, reg_clr; ++ int thresh, clr, ret; + +- /* Select threshold register */ +- if (info == IIO_EV_INFO_VALUE) { +- if (dir == IIO_EV_DIR_RISING) +- reg = HDC3020_R_T_RH_THRESH_HIGH; +- else +- reg = HDC3020_R_T_RH_THRESH_LOW; ++ /* Select threshold registers */ ++ if (dir == IIO_EV_DIR_RISING) { ++ reg_thresh = HDC3020_R_T_RH_THRESH_HIGH; ++ reg_clr = HDC3020_R_T_RH_THRESH_HIGH_CLR; + } else { +- if (dir == IIO_EV_DIR_RISING) +- reg = HDC3020_R_T_RH_THRESH_HIGH_CLR; +- else +- reg = HDC3020_R_T_RH_THRESH_LOW_CLR; ++ reg_thresh = HDC3020_R_T_RH_THRESH_LOW; ++ reg_clr = HDC3020_R_T_RH_THRESH_LOW_CLR; + } + + guard(mutex)(&data->lock); +- ret = hdc3020_read_be16(data, reg); ++ ret = hdc3020_read_be16(data, reg_thresh); + if (ret < 0) + return ret; + + switch (chan->type) { + case IIO_TEMP: +- /* +- * Get the temperature threshold from 9 LSBs, shift them to get +- * the truncated temperature threshold representation and +- * calculate the threshold according to the formula in the +- * datasheet. +- */ +- *val = FIELD_GET(HDC3020_THRESH_TEMP_MASK, ret); +- *val = *val << HDC3020_THRESH_TEMP_TRUNC_SHIFT; +- *val = -2949075 + (175 * (*val)); ++ thresh = hdc3020_thresh_get_temp(ret); ++ switch (info) { ++ case IIO_EV_INFO_VALUE: ++ *val = thresh; ++ break; ++ case IIO_EV_INFO_HYSTERESIS: ++ ret = hdc3020_read_be16(data, reg_clr); ++ if (ret < 0) ++ return ret; ++ ++ clr = hdc3020_thresh_get_temp(ret); ++ *val = abs(thresh - clr); ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } + *val2 = 65535; + return IIO_VAL_FRACTIONAL; + case IIO_HUMIDITYRELATIVE: +- /* +- * Get the humidity threshold from 7 MSBs, shift them to get the +- * truncated humidity threshold representation and calculate the +- * threshold according to the formula in the datasheet. +- */ +- *val = FIELD_GET(HDC3020_THRESH_HUM_MASK, ret); +- *val = (*val << HDC3020_THRESH_HUM_TRUNC_SHIFT) * 100; ++ thresh = hdc3020_thresh_get_hum(ret); ++ switch (info) { ++ case IIO_EV_INFO_VALUE: ++ *val = thresh; ++ break; ++ case IIO_EV_INFO_HYSTERESIS: ++ ret = hdc3020_read_be16(data, reg_clr); ++ if (ret < 0) ++ return ret; ++ ++ clr = hdc3020_thresh_get_hum(ret); ++ *val = abs(thresh - clr); ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } + *val2 = 65535; + return IIO_VAL_FRACTIONAL; + default: +diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c +index 01a499a8b88db..438ed35881752 100644 +--- a/drivers/infiniband/core/restrack.c ++++ b/drivers/infiniband/core/restrack.c +@@ -37,22 +37,6 @@ int rdma_restrack_init(struct ib_device *dev) + return 0; + } + +-static const char *type2str(enum rdma_restrack_type type) +-{ +- static const char * const names[RDMA_RESTRACK_MAX] = { +- [RDMA_RESTRACK_PD] = "PD", +- [RDMA_RESTRACK_CQ] = "CQ", +- [RDMA_RESTRACK_QP] = "QP", +- [RDMA_RESTRACK_CM_ID] = "CM_ID", +- [RDMA_RESTRACK_MR] = "MR", +- [RDMA_RESTRACK_CTX] = "CTX", +- [RDMA_RESTRACK_COUNTER] = "COUNTER", +- [RDMA_RESTRACK_SRQ] = "SRQ", +- }; +- +- return names[type]; +-}; +- + /** + * rdma_restrack_clean() - clean resource tracking + * @dev: IB device +@@ -60,47 +44,14 @@ static const char *type2str(enum rdma_restrack_type type) + void rdma_restrack_clean(struct ib_device *dev) + { + struct rdma_restrack_root *rt = dev->res; +- struct rdma_restrack_entry *e; +- char buf[TASK_COMM_LEN]; +- bool found = false; +- const char *owner; + int i; + + for (i = 0 ; i < RDMA_RESTRACK_MAX; i++) { + struct xarray *xa = &dev->res[i].xa; + +- if (!xa_empty(xa)) { +- unsigned long index; +- +- if (!found) { +- pr_err("restrack: %s", CUT_HERE); +- dev_err(&dev->dev, "BUG: RESTRACK detected leak of resources\n"); +- } +- xa_for_each(xa, index, e) { +- if (rdma_is_kernel_res(e)) { +- owner = e->kern_name; +- } else { +- /* +- * There is no need to call get_task_struct here, +- * because we can be here only if there are more +- * get_task_struct() call than put_task_struct(). +- */ +- get_task_comm(buf, e->task); +- owner = buf; +- } +- +- pr_err("restrack: %s %s object allocated by %s is not freed\n", +- rdma_is_kernel_res(e) ? "Kernel" : +- "User", +- type2str(e->type), owner); +- } +- found = true; +- } ++ WARN_ON(!xa_empty(xa)); + xa_destroy(xa); + } +- if (found) +- pr_err("restrack: %s", CUT_HERE); +- + kfree(rt); + } + +diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c +index 31ffdc2a93f35..79bdb2b109496 100644 +--- a/drivers/input/touchscreen/ili210x.c ++++ b/drivers/input/touchscreen/ili210x.c +@@ -261,8 +261,8 @@ static int ili251x_read_touch_data(struct i2c_client *client, u8 *data) + if (!error && data[0] == 2) { + error = i2c_master_recv(client, data + ILI251X_DATA_SIZE1, + ILI251X_DATA_SIZE2); +- if (error >= 0 && error != ILI251X_DATA_SIZE2) +- error = -EIO; ++ if (error >= 0) ++ error = error == ILI251X_DATA_SIZE2 ? 0 : -EIO; + } + + return error; +diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h +index f482aab420f78..95a161fdbae2c 100644 +--- a/drivers/iommu/amd/amd_iommu.h ++++ b/drivers/iommu/amd/amd_iommu.h +@@ -56,6 +56,7 @@ int amd_iommu_clear_gcr3(struct iommu_dev_data *dev_data, ioasid_t pasid); + void amd_iommu_flush_all_caches(struct amd_iommu *iommu); + void amd_iommu_update_and_flush_device_table(struct protection_domain *domain); + void amd_iommu_domain_update(struct protection_domain *domain); ++void amd_iommu_dev_update_dte(struct iommu_dev_data *dev_data, bool set); + void amd_iommu_domain_flush_complete(struct protection_domain *domain); + void amd_iommu_domain_flush_pages(struct protection_domain *domain, + u64 address, size_t size); +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index e740dc54c4685..21798a0fa9268 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -2784,6 +2784,7 @@ static void early_enable_iommu(struct amd_iommu *iommu) + iommu_enable_command_buffer(iommu); + iommu_enable_event_buffer(iommu); + iommu_set_exclusion_range(iommu); ++ iommu_enable_gt(iommu); + iommu_enable_ga(iommu); + iommu_enable_xt(iommu); + iommu_enable_irtcachedis(iommu); +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index fb727f5b0b82d..e2b900ffbc158 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -2002,6 +2002,21 @@ static void clear_dte_entry(struct amd_iommu *iommu, u16 devid) + amd_iommu_apply_erratum_63(iommu, devid); + } + ++/* Update and flush DTE for the given device */ ++void amd_iommu_dev_update_dte(struct iommu_dev_data *dev_data, bool set) ++{ ++ struct amd_iommu *iommu = get_amd_iommu_from_dev(dev_data->dev); ++ ++ if (set) ++ set_dte_entry(iommu, dev_data); ++ else ++ clear_dte_entry(iommu, dev_data->devid); ++ ++ clone_aliases(iommu, dev_data->dev); ++ device_flush_dte(dev_data); ++ iommu_completion_wait(iommu); ++} ++ + static int do_attach(struct iommu_dev_data *dev_data, + struct protection_domain *domain) + { +@@ -2036,10 +2051,7 @@ static int do_attach(struct iommu_dev_data *dev_data, + } + + /* Update device table */ +- set_dte_entry(iommu, dev_data); +- clone_aliases(iommu, dev_data->dev); +- +- device_flush_dte(dev_data); ++ amd_iommu_dev_update_dte(dev_data, true); + + return ret; + } +@@ -2049,6 +2061,12 @@ static void do_detach(struct iommu_dev_data *dev_data) + struct protection_domain *domain = dev_data->domain; + struct amd_iommu *iommu = get_amd_iommu_from_dev_data(dev_data); + ++ /* Clear DTE and flush the entry */ ++ amd_iommu_dev_update_dte(dev_data, false); ++ ++ /* Flush IOTLB and wait for the flushes to finish */ ++ amd_iommu_domain_flush_all(domain); ++ + /* Clear GCR3 table */ + if (domain->pd_mode == PD_MODE_V2) { + update_gcr3(dev_data, 0, 0, false); +@@ -2058,14 +2076,6 @@ static void do_detach(struct iommu_dev_data *dev_data) + /* Update data structures */ + dev_data->domain = NULL; + list_del(&dev_data->list); +- clear_dte_entry(iommu, dev_data->devid); +- clone_aliases(iommu, dev_data->dev); +- +- /* Flush the DTE entry */ +- device_flush_dte(dev_data); +- +- /* Flush IOTLB and wait for the flushes to finish */ +- amd_iommu_domain_flush_all(domain); + + /* decrease reference counters - needs to happen after the flushes */ + domain->dev_iommu[iommu->index] -= 1; +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c +index 2cd433a9c8a0f..41b44baef15e8 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c +@@ -569,6 +569,9 @@ static int arm_smmu_sva_set_dev_pasid(struct iommu_domain *domain, + int ret = 0; + struct mm_struct *mm = domain->mm; + ++ if (mm_get_enqcmd_pasid(mm) != id) ++ return -EINVAL; ++ + mutex_lock(&sva_lock); + ret = __arm_smmu_sva_bind(dev, id, mm); + mutex_unlock(&sva_lock); +diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig +index 72c07a12f5e18..bfa1d77749f3e 100644 +--- a/drivers/irqchip/Kconfig ++++ b/drivers/irqchip/Kconfig +@@ -568,7 +568,7 @@ config IRQ_LOONGARCH_CPU + bool + select GENERIC_IRQ_CHIP + select IRQ_DOMAIN +- select GENERIC_IRQ_EFFECTIVE_AFF_MASK ++ select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP + select LOONGSON_HTVEC + select LOONGSON_LIOINTC + select LOONGSON_EIOINTC +diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c +index b64cbe3052e84..f2921b26ba84b 100644 +--- a/drivers/irqchip/irq-loongson-eiointc.c ++++ b/drivers/irqchip/irq-loongson-eiointc.c +@@ -15,6 +15,7 @@ + #include <linux/irqchip/chained_irq.h> + #include <linux/kernel.h> + #include <linux/syscore_ops.h> ++#include <asm/numa.h> + + #define EIOINTC_REG_NODEMAP 0x14a0 + #define EIOINTC_REG_IPMAP 0x14c0 +@@ -339,7 +340,7 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header, + int node; + + if (cpu_has_flatmode) +- node = cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE); ++ node = early_cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE); + else + node = eiointc_priv[nr_pics - 1]->node; + +@@ -431,7 +432,7 @@ int __init eiointc_acpi_init(struct irq_domain *parent, + goto out_free_handle; + + if (cpu_has_flatmode) +- node = cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE); ++ node = early_cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE); + else + node = acpi_eiointc->node; + acpi_set_vec_parent(node, priv->eiointc_domain, pch_group); +diff --git a/drivers/irqchip/irq-loongson-liointc.c b/drivers/irqchip/irq-loongson-liointc.c +index e4b33aed1c97b..7c4fe7ab4b830 100644 +--- a/drivers/irqchip/irq-loongson-liointc.c ++++ b/drivers/irqchip/irq-loongson-liointc.c +@@ -28,7 +28,7 @@ + + #define LIOINTC_INTC_CHIP_START 0x20 + +-#define LIOINTC_REG_INTC_STATUS (LIOINTC_INTC_CHIP_START + 0x20) ++#define LIOINTC_REG_INTC_STATUS(core) (LIOINTC_INTC_CHIP_START + 0x20 + (core) * 8) + #define LIOINTC_REG_INTC_EN_STATUS (LIOINTC_INTC_CHIP_START + 0x04) + #define LIOINTC_REG_INTC_ENABLE (LIOINTC_INTC_CHIP_START + 0x08) + #define LIOINTC_REG_INTC_DISABLE (LIOINTC_INTC_CHIP_START + 0x0c) +@@ -217,7 +217,7 @@ static int liointc_init(phys_addr_t addr, unsigned long size, int revision, + goto out_free_priv; + + for (i = 0; i < LIOINTC_NUM_CORES; i++) +- priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS; ++ priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS(i); + + for (i = 0; i < LIOINTC_NUM_PARENT; i++) + priv->handler[i].parent_int_map = parent_int_map[i]; +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 733d0bc4b4cc3..b43695bc51e75 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -956,7 +956,7 @@ int dvb_usercopy(struct file *file, + int (*func)(struct file *file, + unsigned int cmd, void *arg)) + { +- char sbuf[128]; ++ char sbuf[128] = {}; + void *mbuf = NULL; + void *parg = NULL; + int err = -EINVAL; +diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c +index 9a5f75163acae..8ede4ce932714 100644 +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -131,10 +131,12 @@ struct moxart_host { + struct dma_async_tx_descriptor *tx_desc; + struct mmc_host *mmc; + struct mmc_request *mrq; ++ struct scatterlist *cur_sg; + struct completion dma_complete; + struct completion pio_complete; + +- struct sg_mapping_iter sg_miter; ++ u32 num_sg; ++ u32 data_remain; + u32 data_len; + u32 fifo_width; + u32 timeout; +@@ -146,6 +148,35 @@ struct moxart_host { + bool is_removed; + }; + ++static inline void moxart_init_sg(struct moxart_host *host, ++ struct mmc_data *data) ++{ ++ host->cur_sg = data->sg; ++ host->num_sg = data->sg_len; ++ host->data_remain = host->cur_sg->length; ++ ++ if (host->data_remain > host->data_len) ++ host->data_remain = host->data_len; ++} ++ ++static inline int moxart_next_sg(struct moxart_host *host) ++{ ++ int remain; ++ struct mmc_data *data = host->mrq->cmd->data; ++ ++ host->cur_sg++; ++ host->num_sg--; ++ ++ if (host->num_sg > 0) { ++ host->data_remain = host->cur_sg->length; ++ remain = host->data_len - data->bytes_xfered; ++ if (remain > 0 && remain < host->data_remain) ++ host->data_remain = remain; ++ } ++ ++ return host->num_sg; ++} ++ + static int moxart_wait_for_status(struct moxart_host *host, + u32 mask, u32 *status) + { +@@ -278,29 +309,14 @@ static void moxart_transfer_dma(struct mmc_data *data, struct moxart_host *host) + + static void moxart_transfer_pio(struct moxart_host *host) + { +- struct sg_mapping_iter *sgm = &host->sg_miter; + struct mmc_data *data = host->mrq->cmd->data; + u32 *sgp, len = 0, remain, status; + + if (host->data_len == data->bytes_xfered) + return; + +- /* +- * By updating sgm->consumes this will get a proper pointer into the +- * buffer at any time. +- */ +- if (!sg_miter_next(sgm)) { +- /* This shold not happen */ +- dev_err(mmc_dev(host->mmc), "ran out of scatterlist prematurely\n"); +- data->error = -EINVAL; +- complete(&host->pio_complete); +- return; +- } +- sgp = sgm->addr; +- remain = sgm->length; +- if (remain > host->data_len) +- remain = host->data_len; +- sgm->consumed = 0; ++ sgp = sg_virt(host->cur_sg); ++ remain = host->data_remain; + + if (data->flags & MMC_DATA_WRITE) { + while (remain > 0) { +@@ -315,7 +331,6 @@ static void moxart_transfer_pio(struct moxart_host *host) + sgp++; + len += 4; + } +- sgm->consumed += len; + remain -= len; + } + +@@ -332,22 +347,22 @@ static void moxart_transfer_pio(struct moxart_host *host) + sgp++; + len += 4; + } +- sgm->consumed += len; + remain -= len; + } + } + +- data->bytes_xfered += sgm->consumed; +- if (host->data_len == data->bytes_xfered) { ++ data->bytes_xfered += host->data_remain - remain; ++ host->data_remain = remain; ++ ++ if (host->data_len != data->bytes_xfered) ++ moxart_next_sg(host); ++ else + complete(&host->pio_complete); +- return; +- } + } + + static void moxart_prepare_data(struct moxart_host *host) + { + struct mmc_data *data = host->mrq->cmd->data; +- unsigned int flags = SG_MITER_ATOMIC; /* Used from IRQ */ + u32 datactrl; + int blksz_bits; + +@@ -358,19 +373,15 @@ static void moxart_prepare_data(struct moxart_host *host) + blksz_bits = ffs(data->blksz) - 1; + BUG_ON(1 << blksz_bits != data->blksz); + ++ moxart_init_sg(host, data); ++ + datactrl = DCR_DATA_EN | (blksz_bits & DCR_BLK_SIZE); + +- if (data->flags & MMC_DATA_WRITE) { +- flags |= SG_MITER_FROM_SG; ++ if (data->flags & MMC_DATA_WRITE) + datactrl |= DCR_DATA_WRITE; +- } else { +- flags |= SG_MITER_TO_SG; +- } + + if (moxart_use_dma(host)) + datactrl |= DCR_DMA_EN; +- else +- sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags); + + writel(DCR_DATA_FIFO_RESET, host->base + REG_DATA_CONTROL); + writel(MASK_DATA | FIFO_URUN | FIFO_ORUN, host->base + REG_CLEAR); +@@ -443,9 +454,6 @@ static void moxart_request(struct mmc_host *mmc, struct mmc_request *mrq) + } + + request_done: +- if (!moxart_use_dma(host)) +- sg_miter_stop(&host->sg_miter); +- + spin_unlock_irqrestore(&host->lock, flags); + mmc_request_done(host->mmc, mrq); + } +diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c +index 9053526fa212a..150fb477b7cc9 100644 +--- a/drivers/mmc/host/sdhci-brcmstb.c ++++ b/drivers/mmc/host/sdhci-brcmstb.c +@@ -24,6 +24,7 @@ + #define BRCMSTB_MATCH_FLAGS_NO_64BIT BIT(0) + #define BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT BIT(1) + #define BRCMSTB_MATCH_FLAGS_HAS_CLOCK_GATE BIT(2) ++#define BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY BIT(4) + + #define BRCMSTB_PRIV_FLAGS_HAS_CQE BIT(0) + #define BRCMSTB_PRIV_FLAGS_GATE_CLOCK BIT(1) +@@ -384,6 +385,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev) + if (match_priv->flags & BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT) + host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + ++ if (!(match_priv->flags & BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY)) ++ host->mmc_host_ops.card_busy = NULL; ++ + /* Change the base clock frequency if the DT property exists */ + if (device_property_read_u32(&pdev->dev, "clock-frequency", + &priv->base_freq_hz) != 0) +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 025b31aa712ca..9fe40f342d251 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -1326,7 +1326,7 @@ static int jmicron_pmos(struct sdhci_pci_chip *chip, int on) + + ret = pci_read_config_byte(chip->pdev, 0xAE, &scratch); + if (ret) +- return ret; ++ goto fail; + + /* + * Turn PMOS on [bit 0], set over current detection to 2.4 V +@@ -1337,7 +1337,10 @@ static int jmicron_pmos(struct sdhci_pci_chip *chip, int on) + else + scratch &= ~0x47; + +- return pci_write_config_byte(chip->pdev, 0xAE, scratch); ++ ret = pci_write_config_byte(chip->pdev, 0xAE, scratch); ++ ++fail: ++ return pcibios_err_to_errno(ret); + } + + static int jmicron_probe(struct sdhci_pci_chip *chip) +@@ -2202,7 +2205,7 @@ static int sdhci_pci_probe(struct pci_dev *pdev, + + ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &slots); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + + slots = PCI_SLOT_INFO_SLOTS(slots) + 1; + dev_dbg(&pdev->dev, "found %d slot(s)\n", slots); +@@ -2211,7 +2214,7 @@ static int sdhci_pci_probe(struct pci_dev *pdev, + + ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &first_bar); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + + first_bar &= PCI_SLOT_INFO_FIRST_BAR_MASK; + +diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c +index d4a02184784a3..058bef1c7e419 100644 +--- a/drivers/mmc/host/sdhci-pci-o2micro.c ++++ b/drivers/mmc/host/sdhci-pci-o2micro.c +@@ -823,7 +823,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + +@@ -834,7 +834,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_CLKREQ, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x20; + pci_write_config_byte(chip->pdev, O2_SD_CLKREQ, scratch); + +@@ -843,7 +843,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + */ + ret = pci_read_config_byte(chip->pdev, O2_SD_CAPS, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x01; + pci_write_config_byte(chip->pdev, O2_SD_CAPS, scratch); + pci_write_config_byte(chip->pdev, O2_SD_CAPS, 0x73); +@@ -856,7 +856,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_INF_MOD, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x08; + pci_write_config_byte(chip->pdev, O2_SD_INF_MOD, scratch); + +@@ -864,7 +864,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -875,7 +875,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); +@@ -886,7 +886,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + O2_SD_FUNC_REG0, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 = ((scratch_32 & 0xFF000000) >> 24); + + /* Check Whether subId is 0x11 or 0x12 */ +@@ -898,7 +898,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + O2_SD_FUNC_REG4, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + /* Enable Base Clk setting change */ + scratch_32 |= O2_SD_FREG4_ENABLE_CLK_SET; +@@ -921,7 +921,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_CLK_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + scratch_32 &= ~(0xFF00); + scratch_32 |= 0x07E0C800; +@@ -931,14 +931,14 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_CLKREQ, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 |= 0x3; + pci_write_config_dword(chip->pdev, O2_SD_CLKREQ, scratch_32); + + ret = pci_read_config_dword(chip->pdev, + O2_SD_PLL_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + scratch_32 &= ~(0x1F3F070E); + scratch_32 |= 0x18270106; +@@ -949,7 +949,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_CAP_REG2, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 &= ~(0xE0); + pci_write_config_dword(chip->pdev, + O2_SD_CAP_REG2, scratch_32); +@@ -961,7 +961,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -971,7 +971,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); +@@ -979,7 +979,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_PLL_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + if ((scratch_32 & 0xff000000) == 0x01000000) { + scratch_32 &= 0x0000FFFF; +@@ -998,7 +998,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + O2_SD_FUNC_REG4, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 |= (1 << 22); + pci_write_config_dword(chip->pdev, + O2_SD_FUNC_REG4, scratch_32); +@@ -1017,7 +1017,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -1028,7 +1028,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + /* UnLock WP */ + ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + +@@ -1057,13 +1057,16 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + /* Lock WP */ + ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; + } + + return 0; ++ ++read_fail: ++ return pcibios_err_to_errno(ret); + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 746f4cf7ab033..112584aa07723 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2515,26 +2515,29 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio); + + static int sdhci_check_ro(struct sdhci_host *host) + { +- unsigned long flags; ++ bool allow_invert = false; + int is_readonly; + +- spin_lock_irqsave(&host->lock, flags); +- +- if (host->flags & SDHCI_DEVICE_DEAD) ++ if (host->flags & SDHCI_DEVICE_DEAD) { + is_readonly = 0; +- else if (host->ops->get_ro) ++ } else if (host->ops->get_ro) { + is_readonly = host->ops->get_ro(host); +- else if (mmc_can_gpio_ro(host->mmc)) ++ } else if (mmc_can_gpio_ro(host->mmc)) { + is_readonly = mmc_gpio_get_ro(host->mmc); +- else ++ /* Do not invert twice */ ++ allow_invert = !(host->mmc->caps2 & MMC_CAP2_RO_ACTIVE_HIGH); ++ } else { + is_readonly = !(sdhci_readl(host, SDHCI_PRESENT_STATE) + & SDHCI_WRITE_PROTECT); ++ allow_invert = true; ++ } + +- spin_unlock_irqrestore(&host->lock, flags); ++ if (is_readonly >= 0 && ++ allow_invert && ++ (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT)) ++ is_readonly = !is_readonly; + +- /* This quirk needs to be replaced by a callback-function later */ +- return host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT ? +- !is_readonly : is_readonly; ++ return is_readonly; + } + + #define SAMPLE_COUNT 5 +diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c +index a16b42a885816..3b55b676ca6b9 100644 +--- a/drivers/mtd/parsers/redboot.c ++++ b/drivers/mtd/parsers/redboot.c +@@ -102,7 +102,7 @@ static int parse_redboot_partitions(struct mtd_info *master, + offset -= master->erasesize; + } + } else { +- offset = directory * master->erasesize; ++ offset = (unsigned long) directory * master->erasesize; + while (mtd_block_isbad(master, offset)) { + offset += master->erasesize; + if (offset == master->size) +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index bceda85f0dcf6..cb66310c8d76b 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -5773,6 +5773,9 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev, + if (real_dev) { + ret = ethtool_get_ts_info_by_layer(real_dev, info); + } else { ++ info->phc_index = -1; ++ info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE | ++ SOF_TIMESTAMPING_SOFTWARE; + /* Check if all slaves support software tx timestamping */ + rcu_read_lock(); + bond_for_each_slave_rcu(bond, slave, iter) { +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +index 1d9057dc44f25..bf1589aef1fc6 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +@@ -1618,11 +1618,20 @@ static int mcp251xfd_open(struct net_device *ndev) + clear_bit(MCP251XFD_FLAGS_DOWN, priv->flags); + can_rx_offload_enable(&priv->offload); + ++ priv->wq = alloc_ordered_workqueue("%s-mcp251xfd_wq", ++ WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ dev_name(&spi->dev)); ++ if (!priv->wq) { ++ err = -ENOMEM; ++ goto out_can_rx_offload_disable; ++ } ++ INIT_WORK(&priv->tx_work, mcp251xfd_tx_obj_write_sync); ++ + err = request_threaded_irq(spi->irq, NULL, mcp251xfd_irq, + IRQF_SHARED | IRQF_ONESHOT, + dev_name(&spi->dev), priv); + if (err) +- goto out_can_rx_offload_disable; ++ goto out_destroy_workqueue; + + err = mcp251xfd_chip_interrupts_enable(priv); + if (err) +@@ -1634,6 +1643,8 @@ static int mcp251xfd_open(struct net_device *ndev) + + out_free_irq: + free_irq(spi->irq, priv); ++ out_destroy_workqueue: ++ destroy_workqueue(priv->wq); + out_can_rx_offload_disable: + can_rx_offload_disable(&priv->offload); + set_bit(MCP251XFD_FLAGS_DOWN, priv->flags); +@@ -1661,6 +1672,7 @@ static int mcp251xfd_stop(struct net_device *ndev) + hrtimer_cancel(&priv->tx_irq_timer); + mcp251xfd_chip_interrupts_disable(priv); + free_irq(ndev->irq, priv); ++ destroy_workqueue(priv->wq); + can_rx_offload_disable(&priv->offload); + mcp251xfd_timestamp_stop(priv); + mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED); +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c +index 160528d3cc26b..b1de8052a45cc 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c +@@ -131,6 +131,39 @@ mcp251xfd_tx_obj_from_skb(const struct mcp251xfd_priv *priv, + tx_obj->xfer[0].len = len; + } + ++static void mcp251xfd_tx_failure_drop(const struct mcp251xfd_priv *priv, ++ struct mcp251xfd_tx_ring *tx_ring, ++ int err) ++{ ++ struct net_device *ndev = priv->ndev; ++ struct net_device_stats *stats = &ndev->stats; ++ unsigned int frame_len = 0; ++ u8 tx_head; ++ ++ tx_ring->head--; ++ stats->tx_dropped++; ++ tx_head = mcp251xfd_get_tx_head(tx_ring); ++ can_free_echo_skb(ndev, tx_head, &frame_len); ++ netdev_completed_queue(ndev, 1, frame_len); ++ netif_wake_queue(ndev); ++ ++ if (net_ratelimit()) ++ netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err); ++} ++ ++void mcp251xfd_tx_obj_write_sync(struct work_struct *work) ++{ ++ struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv, ++ tx_work); ++ struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj; ++ struct mcp251xfd_tx_ring *tx_ring = priv->tx; ++ int err; ++ ++ err = spi_sync(priv->spi, &tx_obj->msg); ++ if (err) ++ mcp251xfd_tx_failure_drop(priv, tx_ring, err); ++} ++ + static int mcp251xfd_tx_obj_write(const struct mcp251xfd_priv *priv, + struct mcp251xfd_tx_obj *tx_obj) + { +@@ -162,6 +195,11 @@ static bool mcp251xfd_tx_busy(const struct mcp251xfd_priv *priv, + return false; + } + ++static bool mcp251xfd_work_busy(struct work_struct *work) ++{ ++ return work_busy(work); ++} ++ + netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + struct net_device *ndev) + { +@@ -175,7 +213,8 @@ netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + if (can_dev_dropped_skb(ndev, skb)) + return NETDEV_TX_OK; + +- if (mcp251xfd_tx_busy(priv, tx_ring)) ++ if (mcp251xfd_tx_busy(priv, tx_ring) || ++ mcp251xfd_work_busy(&priv->tx_work)) + return NETDEV_TX_BUSY; + + tx_obj = mcp251xfd_get_tx_obj_next(tx_ring); +@@ -193,13 +232,13 @@ netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + netdev_sent_queue(priv->ndev, frame_len); + + err = mcp251xfd_tx_obj_write(priv, tx_obj); +- if (err) +- goto out_err; +- +- return NETDEV_TX_OK; +- +- out_err: +- netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err); ++ if (err == -EBUSY) { ++ netif_stop_queue(ndev); ++ priv->tx_work_obj = tx_obj; ++ queue_work(priv->wq, &priv->tx_work); ++ } else if (err) { ++ mcp251xfd_tx_failure_drop(priv, tx_ring, err); ++ } + + return NETDEV_TX_OK; + } +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +index 24510b3b80203..b35bfebd23f29 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +@@ -633,6 +633,10 @@ struct mcp251xfd_priv { + struct mcp251xfd_rx_ring *rx[MCP251XFD_FIFO_RX_NUM]; + struct mcp251xfd_tx_ring tx[MCP251XFD_FIFO_TX_NUM]; + ++ struct workqueue_struct *wq; ++ struct work_struct tx_work; ++ struct mcp251xfd_tx_obj *tx_work_obj; ++ + DECLARE_BITMAP(flags, __MCP251XFD_FLAGS_SIZE__); + + u8 rx_ring_num; +@@ -952,6 +956,7 @@ void mcp251xfd_skb_set_timestamp(const struct mcp251xfd_priv *priv, + void mcp251xfd_timestamp_init(struct mcp251xfd_priv *priv); + void mcp251xfd_timestamp_stop(struct mcp251xfd_priv *priv); + ++void mcp251xfd_tx_obj_write_sync(struct work_struct *work); + netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + struct net_device *ndev); + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 7f745628c84d1..dde5c65c2c366 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -355,10 +355,8 @@ int ksz9477_reset_switch(struct ksz_device *dev) + SPI_AUTO_EDGE_DETECTION, 0); + + /* default configuration */ +- ksz_read8(dev, REG_SW_LUE_CTRL_1, &data8); +- data8 = SW_AGING_ENABLE | SW_LINK_AUTO_AGING | +- SW_SRC_ADDR_FILTER | SW_FLUSH_STP_TABLE | SW_FLUSH_MSTP_TABLE; +- ksz_write8(dev, REG_SW_LUE_CTRL_1, data8); ++ ksz_write8(dev, REG_SW_LUE_CTRL_1, ++ SW_AGING_ENABLE | SW_LINK_AUTO_AGING | SW_SRC_ADDR_FILTER); + + /* disable interrupts */ + ksz_write32(dev, REG_SW_INT_MASK__4, SWITCH_INT_MASK); +@@ -1305,6 +1303,10 @@ int ksz9477_setup(struct dsa_switch *ds) + /* Enable REG_SW_MTU__2 reg by setting SW_JUMBO_PACKET */ + ksz_cfg(dev, REG_SW_MAC_CTRL_1, SW_JUMBO_PACKET, true); + ++ /* Use collision based back pressure mode. */ ++ ksz_cfg(dev, REG_SW_MAC_CTRL_1, SW_BACK_PRESSURE, ++ SW_BACK_PRESSURE_COLLISION); ++ + /* Now we can configure default MTU value */ + ret = regmap_update_bits(ksz_regmap_16(dev), REG_SW_MTU__2, REG_SW_MTU_MASK, + VLAN_ETH_FRAME_LEN + ETH_FCS_LEN); +diff --git a/drivers/net/dsa/microchip/ksz9477_reg.h b/drivers/net/dsa/microchip/ksz9477_reg.h +index f3a205ee483f2..fb124be8edd30 100644 +--- a/drivers/net/dsa/microchip/ksz9477_reg.h ++++ b/drivers/net/dsa/microchip/ksz9477_reg.h +@@ -247,6 +247,7 @@ + #define REG_SW_MAC_CTRL_1 0x0331 + + #define SW_BACK_PRESSURE BIT(5) ++#define SW_BACK_PRESSURE_COLLISION 0 + #define FAIR_FLOW_CTRL BIT(4) + #define NO_EXC_COLLISION_DROP BIT(3) + #define SW_JUMBO_PACKET BIT(2) +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 2a5861a88d0e6..e54f83a2e7d30 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -2129,7 +2129,7 @@ static void ksz_irq_bus_sync_unlock(struct irq_data *d) + struct ksz_device *dev = kirq->dev; + int ret; + +- ret = ksz_write32(dev, kirq->reg_mask, kirq->masked); ++ ret = ksz_write8(dev, kirq->reg_mask, kirq->masked); + if (ret) + dev_err(dev->dev, "failed to change IRQ mask\n"); + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 888509cf1f210..40e8818295951 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -2896,11 +2896,14 @@ static int dpaa2_eth_xdp_xmit(struct net_device *net_dev, int n, + static int update_xps(struct dpaa2_eth_priv *priv) + { + struct net_device *net_dev = priv->net_dev; +- struct cpumask xps_mask; +- struct dpaa2_eth_fq *fq; + int i, num_queues, netdev_queues; ++ struct dpaa2_eth_fq *fq; ++ cpumask_var_t xps_mask; + int err = 0; + ++ if (!alloc_cpumask_var(&xps_mask, GFP_KERNEL)) ++ return -ENOMEM; ++ + num_queues = dpaa2_eth_queue_count(priv); + netdev_queues = (net_dev->num_tc ? : 1) * num_queues; + +@@ -2910,16 +2913,17 @@ static int update_xps(struct dpaa2_eth_priv *priv) + for (i = 0; i < netdev_queues; i++) { + fq = &priv->fq[i % num_queues]; + +- cpumask_clear(&xps_mask); +- cpumask_set_cpu(fq->target_cpu, &xps_mask); ++ cpumask_clear(xps_mask); ++ cpumask_set_cpu(fq->target_cpu, xps_mask); + +- err = netif_set_xps_queue(net_dev, &xps_mask, i); ++ err = netif_set_xps_queue(net_dev, xps_mask, i); + if (err) { + netdev_warn_once(net_dev, "Error setting XPS queue\n"); + break; + } + } + ++ free_cpumask_var(xps_mask); + return err; + } + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 30c47b8470ade..722bb724361c2 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4057,6 +4057,12 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter, bool do_h_free) + adapter->num_active_tx_scrqs = 0; + } + ++ /* Clean any remaining outstanding SKBs ++ * we freed the irq so we won't be hearing ++ * from them ++ */ ++ clean_tx_pools(adapter); ++ + if (adapter->rx_scrq) { + for (i = 0; i < adapter->num_active_rx_scrqs; i++) { + if (!adapter->rx_scrq[i]) +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 61eef3259cbaa..88d4675cc3428 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -4102,7 +4102,7 @@ bool ice_is_wol_supported(struct ice_hw *hw) + int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) + { + struct ice_pf *pf = vsi->back; +- int err = 0, timeout = 50; ++ int i, err = 0, timeout = 50; + + if (!new_rx && !new_tx) + return -EINVAL; +@@ -4128,6 +4128,14 @@ int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) + + ice_vsi_close(vsi); + ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT); ++ ++ ice_for_each_traffic_class(i) { ++ if (vsi->tc_cfg.ena_tc & BIT(i)) ++ netdev_set_tc_queue(vsi->netdev, ++ vsi->tc_cfg.tc_info[i].netdev_tc, ++ vsi->tc_cfg.tc_info[i].qcount_tx, ++ vsi->tc_cfg.tc_info[i].qoffset); ++ } + ice_pf_dcb_recfg(pf, locked); + ice_vsi_open(vsi); + done: +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c +index f42a1b1c93687..653a47dd43862 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1490,18 +1490,25 @@ static int mlxsw_pci_sys_ready_wait(struct mlxsw_pci *mlxsw_pci, + return -EBUSY; + } + +-static int mlxsw_pci_reset_at_pci_disable(struct mlxsw_pci *mlxsw_pci) ++static int mlxsw_pci_reset_at_pci_disable(struct mlxsw_pci *mlxsw_pci, ++ bool pci_reset_sbr_supported) + { + struct pci_dev *pdev = mlxsw_pci->pdev; + char mrsr_pl[MLXSW_REG_MRSR_LEN]; + int err; + ++ if (!pci_reset_sbr_supported) { ++ pci_dbg(pdev, "Performing PCI hot reset instead of \"all reset\"\n"); ++ goto sbr; ++ } ++ + mlxsw_reg_mrsr_pack(mrsr_pl, + MLXSW_REG_MRSR_COMMAND_RESET_AT_PCI_DISABLE); + err = mlxsw_reg_write(mlxsw_pci->core, MLXSW_REG(mrsr), mrsr_pl); + if (err) + return err; + ++sbr: + device_lock_assert(&pdev->dev); + + pci_cfg_access_lock(pdev); +@@ -1529,6 +1536,7 @@ static int + mlxsw_pci_reset(struct mlxsw_pci *mlxsw_pci, const struct pci_device_id *id) + { + struct pci_dev *pdev = mlxsw_pci->pdev; ++ bool pci_reset_sbr_supported = false; + char mcam_pl[MLXSW_REG_MCAM_LEN]; + bool pci_reset_supported = false; + u32 sys_status; +@@ -1548,13 +1556,17 @@ mlxsw_pci_reset(struct mlxsw_pci *mlxsw_pci, const struct pci_device_id *id) + mlxsw_reg_mcam_pack(mcam_pl, + MLXSW_REG_MCAM_FEATURE_GROUP_ENHANCED_FEATURES); + err = mlxsw_reg_query(mlxsw_pci->core, MLXSW_REG(mcam), mcam_pl); +- if (!err) ++ if (!err) { + mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET, + &pci_reset_supported); ++ mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET_SBR, ++ &pci_reset_sbr_supported); ++ } + + if (pci_reset_supported) { + pci_dbg(pdev, "Starting PCI reset flow\n"); +- err = mlxsw_pci_reset_at_pci_disable(mlxsw_pci); ++ err = mlxsw_pci_reset_at_pci_disable(mlxsw_pci, ++ pci_reset_sbr_supported); + } else { + pci_dbg(pdev, "Starting software reset flow\n"); + err = mlxsw_pci_reset_sw(mlxsw_pci); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h +index 8892654c685f3..010eecab5147a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h +@@ -10668,6 +10668,8 @@ enum mlxsw_reg_mcam_mng_feature_cap_mask_bits { + MLXSW_REG_MCAM_MCIA_128B = 34, + /* If set, MRSR.command=6 is supported. */ + MLXSW_REG_MCAM_PCI_RESET = 48, ++ /* If set, MRSR.command=6 is supported with Secondary Bus Reset. */ ++ MLXSW_REG_MCAM_PCI_RESET_SBR = 67, + }; + + #define MLXSW_REG_BYTES_PER_DWORD 0x4 +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +index c9f1c79f3f9d0..ba090262e27ef 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +@@ -1607,8 +1607,8 @@ static void mlxsw_sp_sb_sr_occ_query_cb(struct mlxsw_core *mlxsw_core, + int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, + unsigned int sb_index) + { ++ u16 local_port, local_port_1, first_local_port, last_local_port; + struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core); +- u16 local_port, local_port_1, last_local_port; + struct mlxsw_sp_sb_sr_occ_query_cb_ctx cb_ctx; + u8 masked_count, current_page = 0; + unsigned long cb_priv = 0; +@@ -1628,6 +1628,7 @@ int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, + masked_count = 0; + mlxsw_reg_sbsr_pack(sbsr_pl, false); + mlxsw_reg_sbsr_port_page_set(sbsr_pl, current_page); ++ first_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE; + last_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE + + MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE - 1; + +@@ -1645,9 +1646,12 @@ int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, + if (local_port != MLXSW_PORT_CPU_PORT) { + /* Ingress quotas are not supported for the CPU port */ + mlxsw_reg_sbsr_ingress_port_mask_set(sbsr_pl, +- local_port, 1); ++ local_port - first_local_port, ++ 1); + } +- mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, local_port, 1); ++ mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, ++ local_port - first_local_port, ++ 1); + for (i = 0; i < mlxsw_sp->sb_vals->pool_count; i++) { + err = mlxsw_sp_sb_pm_occ_query(mlxsw_sp, local_port, i, + &bulk_list); +@@ -1684,7 +1688,7 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, + unsigned int sb_index) + { + struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core); +- u16 local_port, last_local_port; ++ u16 local_port, first_local_port, last_local_port; + LIST_HEAD(bulk_list); + unsigned int masked_count; + u8 current_page = 0; +@@ -1702,6 +1706,7 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, + masked_count = 0; + mlxsw_reg_sbsr_pack(sbsr_pl, true); + mlxsw_reg_sbsr_port_page_set(sbsr_pl, current_page); ++ first_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE; + last_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE + + MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE - 1; + +@@ -1719,9 +1724,12 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, + if (local_port != MLXSW_PORT_CPU_PORT) { + /* Ingress quotas are not supported for the CPU port */ + mlxsw_reg_sbsr_ingress_port_mask_set(sbsr_pl, +- local_port, 1); ++ local_port - first_local_port, ++ 1); + } +- mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, local_port, 1); ++ mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, ++ local_port - first_local_port, ++ 1); + for (i = 0; i < mlxsw_sp->sb_vals->pool_count; i++) { + err = mlxsw_sp_sb_pm_occ_clear(mlxsw_sp, local_port, i, + &bulk_list); +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index d8af5e7e15b4d..191d50ba646d8 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -2800,6 +2800,8 @@ static int add_adev(struct gdma_dev *gd) + if (ret) + goto init_fail; + ++ /* madev is owned by the auxiliary device */ ++ madev = NULL; + ret = auxiliary_device_add(adev); + if (ret) + goto add_fail; +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h +index f30eee4a5a80e..b6c01a88098dc 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h ++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h +@@ -375,7 +375,9 @@ typedef void (*ionic_cq_done_cb)(void *done_arg); + unsigned int ionic_cq_service(struct ionic_cq *cq, unsigned int work_to_do, + ionic_cq_cb cb, ionic_cq_done_cb done_cb, + void *done_arg); +-unsigned int ionic_tx_cq_service(struct ionic_cq *cq, unsigned int work_to_do); ++unsigned int ionic_tx_cq_service(struct ionic_cq *cq, ++ unsigned int work_to_do, ++ bool in_napi); + + int ionic_q_init(struct ionic_lif *lif, struct ionic_dev *idev, + struct ionic_queue *q, unsigned int index, const char *name, +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 0cd819bc4ae35..1dec4ebd708f2 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -1189,7 +1189,7 @@ static int ionic_adminq_napi(struct napi_struct *napi, int budget) + ionic_rx_service, NULL, NULL); + + if (lif->hwstamp_txq) +- tx_work = ionic_tx_cq_service(&lif->hwstamp_txq->cq, budget); ++ tx_work = ionic_tx_cq_service(&lif->hwstamp_txq->cq, budget, !!budget); + + work_done = max(max(n_work, a_work), max(rx_work, tx_work)); + if (work_done < budget && napi_complete_done(napi, work_done)) { +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index 2427610f4306d..9fdd7cd3ef19d 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -23,7 +23,8 @@ static void ionic_tx_desc_unmap_bufs(struct ionic_queue *q, + + static void ionic_tx_clean(struct ionic_queue *q, + struct ionic_tx_desc_info *desc_info, +- struct ionic_txq_comp *comp); ++ struct ionic_txq_comp *comp, ++ bool in_napi); + + static inline void ionic_txq_post(struct ionic_queue *q, bool ring_dbell) + { +@@ -480,6 +481,20 @@ int ionic_xdp_xmit(struct net_device *netdev, int n, + return nxmit; + } + ++static void ionic_xdp_rx_put_bufs(struct ionic_queue *q, ++ struct ionic_buf_info *buf_info, ++ int nbufs) ++{ ++ int i; ++ ++ for (i = 0; i < nbufs; i++) { ++ dma_unmap_page(q->dev, buf_info->dma_addr, ++ IONIC_PAGE_SIZE, DMA_FROM_DEVICE); ++ buf_info->page = NULL; ++ buf_info++; ++ } ++} ++ + static bool ionic_run_xdp(struct ionic_rx_stats *stats, + struct net_device *netdev, + struct bpf_prog *xdp_prog, +@@ -493,6 +508,7 @@ static bool ionic_run_xdp(struct ionic_rx_stats *stats, + struct netdev_queue *nq; + struct xdp_frame *xdpf; + int remain_len; ++ int nbufs = 1; + int frag_len; + int err = 0; + +@@ -542,6 +558,7 @@ static bool ionic_run_xdp(struct ionic_rx_stats *stats, + if (page_is_pfmemalloc(bi->page)) + xdp_buff_set_frag_pfmemalloc(&xdp_buf); + } while (remain_len > 0); ++ nbufs += sinfo->nr_frags; + } + + xdp_action = bpf_prog_run_xdp(xdp_prog, &xdp_buf); +@@ -574,9 +591,6 @@ static bool ionic_run_xdp(struct ionic_rx_stats *stats, + goto out_xdp_abort; + } + +- dma_unmap_page(rxq->dev, buf_info->dma_addr, +- IONIC_PAGE_SIZE, DMA_FROM_DEVICE); +- + err = ionic_xdp_post_frame(txq, xdpf, XDP_TX, + buf_info->page, + buf_info->page_offset, +@@ -586,23 +600,19 @@ static bool ionic_run_xdp(struct ionic_rx_stats *stats, + netdev_dbg(netdev, "tx ionic_xdp_post_frame err %d\n", err); + goto out_xdp_abort; + } +- buf_info->page = NULL; ++ ionic_xdp_rx_put_bufs(rxq, buf_info, nbufs); + stats->xdp_tx++; + + /* the Tx completion will free the buffers */ + break; + + case XDP_REDIRECT: +- /* unmap the pages before handing them to a different device */ +- dma_unmap_page(rxq->dev, buf_info->dma_addr, +- IONIC_PAGE_SIZE, DMA_FROM_DEVICE); +- + err = xdp_do_redirect(netdev, &xdp_buf, xdp_prog); + if (err) { + netdev_dbg(netdev, "xdp_do_redirect err %d\n", err); + goto out_xdp_abort; + } +- buf_info->page = NULL; ++ ionic_xdp_rx_put_bufs(rxq, buf_info, nbufs); + rxq->xdp_flush = true; + stats->xdp_redirect++; + break; +@@ -935,7 +945,7 @@ int ionic_tx_napi(struct napi_struct *napi, int budget) + u32 work_done = 0; + u32 flags = 0; + +- work_done = ionic_tx_cq_service(cq, budget); ++ work_done = ionic_tx_cq_service(cq, budget, !!budget); + + if (unlikely(!budget)) + return budget; +@@ -1019,7 +1029,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) + txqcq = lif->txqcqs[qi]; + txcq = &lif->txqcqs[qi]->cq; + +- tx_work_done = ionic_tx_cq_service(txcq, IONIC_TX_BUDGET_DEFAULT); ++ tx_work_done = ionic_tx_cq_service(txcq, IONIC_TX_BUDGET_DEFAULT, !!budget); + + if (unlikely(!budget)) + return budget; +@@ -1152,7 +1162,8 @@ static void ionic_tx_desc_unmap_bufs(struct ionic_queue *q, + + static void ionic_tx_clean(struct ionic_queue *q, + struct ionic_tx_desc_info *desc_info, +- struct ionic_txq_comp *comp) ++ struct ionic_txq_comp *comp, ++ bool in_napi) + { + struct ionic_tx_stats *stats = q_to_tx_stats(q); + struct ionic_qcq *qcq = q_to_qcq(q); +@@ -1204,11 +1215,13 @@ static void ionic_tx_clean(struct ionic_queue *q, + desc_info->bytes = skb->len; + stats->clean++; + +- napi_consume_skb(skb, 1); ++ napi_consume_skb(skb, likely(in_napi) ? 1 : 0); + } + + static bool ionic_tx_service(struct ionic_cq *cq, +- unsigned int *total_pkts, unsigned int *total_bytes) ++ unsigned int *total_pkts, ++ unsigned int *total_bytes, ++ bool in_napi) + { + struct ionic_tx_desc_info *desc_info; + struct ionic_queue *q = cq->bound_q; +@@ -1230,7 +1243,7 @@ static bool ionic_tx_service(struct ionic_cq *cq, + desc_info->bytes = 0; + index = q->tail_idx; + q->tail_idx = (q->tail_idx + 1) & (q->num_descs - 1); +- ionic_tx_clean(q, desc_info, comp); ++ ionic_tx_clean(q, desc_info, comp, in_napi); + if (desc_info->skb) { + pkts++; + bytes += desc_info->bytes; +@@ -1244,7 +1257,9 @@ static bool ionic_tx_service(struct ionic_cq *cq, + return true; + } + +-unsigned int ionic_tx_cq_service(struct ionic_cq *cq, unsigned int work_to_do) ++unsigned int ionic_tx_cq_service(struct ionic_cq *cq, ++ unsigned int work_to_do, ++ bool in_napi) + { + unsigned int work_done = 0; + unsigned int bytes = 0; +@@ -1253,7 +1268,7 @@ unsigned int ionic_tx_cq_service(struct ionic_cq *cq, unsigned int work_to_do) + if (work_to_do == 0) + return 0; + +- while (ionic_tx_service(cq, &pkts, &bytes)) { ++ while (ionic_tx_service(cq, &pkts, &bytes, in_napi)) { + if (cq->tail_idx == cq->num_descs - 1) + cq->done_color = !cq->done_color; + cq->tail_idx = (cq->tail_idx + 1) & (cq->num_descs - 1); +@@ -1279,7 +1294,7 @@ void ionic_tx_flush(struct ionic_cq *cq) + { + u32 work_done; + +- work_done = ionic_tx_cq_service(cq, cq->num_descs); ++ work_done = ionic_tx_cq_service(cq, cq->num_descs, false); + if (work_done) + ionic_intr_credits(cq->idev->intr_ctrl, cq->bound_intr->index, + work_done, IONIC_INTR_CRED_RESET_COALESCE); +@@ -1296,7 +1311,7 @@ void ionic_tx_empty(struct ionic_queue *q) + desc_info = &q->tx_info[q->tail_idx]; + desc_info->bytes = 0; + q->tail_idx = (q->tail_idx + 1) & (q->num_descs - 1); +- ionic_tx_clean(q, desc_info, NULL); ++ ionic_tx_clean(q, desc_info, NULL, false); + if (desc_info->skb) { + pkts++; + bytes += desc_info->bytes; +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 4b22bb6393e26..4a28b654ce877 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -5094,6 +5094,7 @@ static struct mdio_device_id __maybe_unused micrel_tbl[] = { + { PHY_ID_KSZ8081, MICREL_PHY_ID_MASK }, + { PHY_ID_KSZ8873MLL, MICREL_PHY_ID_MASK }, + { PHY_ID_KSZ886X, MICREL_PHY_ID_MASK }, ++ { PHY_ID_KSZ9477, MICREL_PHY_ID_MASK }, + { PHY_ID_LAN8814, MICREL_PHY_ID_MASK }, + { PHY_ID_LAN8804, MICREL_PHY_ID_MASK }, + { PHY_ID_LAN8841, MICREL_PHY_ID_MASK }, +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 52b71c7e78351..e4b759690c441 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -385,23 +385,18 @@ static void sfp_fixup_rollball(struct sfp *sfp) + sfp->phy_t_retry = msecs_to_jiffies(1000); + } + +-static void sfp_fixup_fs_2_5gt(struct sfp *sfp) ++static void sfp_fixup_fs_10gt(struct sfp *sfp) + { ++ sfp_fixup_10gbaset_30m(sfp); + sfp_fixup_rollball(sfp); + +- /* The RollBall fixup is not enough for FS modules, the PHY chip inside ++ /* The RollBall fixup is not enough for FS modules, the AQR chip inside + * them does not return 0xffff for PHY ID registers in all MMDs for the + * while initializing. They need a 4 second wait before accessing PHY. + */ + sfp->module_t_wait = msecs_to_jiffies(4000); + } + +-static void sfp_fixup_fs_10gt(struct sfp *sfp) +-{ +- sfp_fixup_10gbaset_30m(sfp); +- sfp_fixup_fs_2_5gt(sfp); +-} +- + static void sfp_fixup_halny_gsfp(struct sfp *sfp) + { + /* Ignore the TX_FAULT and LOS signals on this module. +@@ -477,10 +472,6 @@ static const struct sfp_quirk sfp_quirks[] = { + // Rollball protocol to talk to the PHY. + SFP_QUIRK_F("FS", "SFP-10G-T", sfp_fixup_fs_10gt), + +- // Fiberstore SFP-2.5G-T uses Rollball protocol to talk to the PHY and +- // needs 4 sec wait before probing the PHY. +- SFP_QUIRK_F("FS", "SFP-2.5G-T", sfp_fixup_fs_2_5gt), +- + // Fiberstore GPON-ONU-34-20BI can operate at 2500base-X, but report 1.2GBd + // NRZ in their EEPROM + SFP_QUIRK("FS", "GPON-ONU-34-20BI", sfp_quirk_2500basex, +@@ -497,6 +488,9 @@ static const struct sfp_quirk sfp_quirks[] = { + SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), + ++ // FS 2.5G Base-T ++ SFP_QUIRK_M("FS", "SFP-2.5G-T", sfp_quirk_oem_2_5g), ++ + // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report + // 2500MBd NRZ in their EEPROM + SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex), +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 94d8b647f0f57..bb70b56c97295 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -326,7 +326,8 @@ static void ax88179_status(struct usbnet *dev, struct urb *urb) + + if (netif_carrier_ok(dev->net) != link) { + usbnet_link_change(dev, link, 1); +- netdev_info(dev->net, "ax88179 - Link status is: %d\n", link); ++ if (!link) ++ netdev_info(dev->net, "ax88179 - Link status is: 0\n"); + } + } + +@@ -1540,6 +1541,7 @@ static int ax88179_link_reset(struct usbnet *dev) + GMII_PHY_PHYSR, 2, &tmp16); + + if (!(tmp16 & GMII_PHY_PHYSR_LINK)) { ++ netdev_info(dev->net, "ax88179 - Link status is: 0\n"); + return 0; + } else if (GMII_PHY_PHYSR_GIGA == (tmp16 & GMII_PHY_PHYSR_SMASK)) { + mode |= AX_MEDIUM_GIGAMODE | AX_MEDIUM_EN_125MHZ; +@@ -1577,6 +1579,8 @@ static int ax88179_link_reset(struct usbnet *dev) + + netif_carrier_on(dev->net); + ++ netdev_info(dev->net, "ax88179 - Link status is: 1\n"); ++ + return 0; + } + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index b2d054f59f30f..49779ba3c4b7b 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2336,7 +2336,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + struct ip_tunnel_key *pkey; + struct ip_tunnel_key key; + struct vxlan_dev *vxlan = netdev_priv(dev); +- const struct iphdr *old_iph = ip_hdr(skb); ++ const struct iphdr *old_iph; + struct vxlan_metadata _md; + struct vxlan_metadata *md = &_md; + unsigned int pkt_len = skb->len; +@@ -2350,8 +2350,15 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + bool use_cache; + bool udp_sum = false; + bool xnet = !net_eq(vxlan->net, dev_net(vxlan->dev)); ++ bool no_eth_encap; + __be32 vni = 0; + ++ no_eth_encap = flags & VXLAN_F_GPE && skb->protocol != htons(ETH_P_TEB); ++ if (!skb_vlan_inet_prepare(skb, no_eth_encap)) ++ goto drop; ++ ++ old_iph = ip_hdr(skb); ++ + info = skb_tunnel_info(skb); + use_cache = ip_tunnel_dst_cache_usable(skb, info); + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index 185cd339c0855..6c75ebbb21caa 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -1349,13 +1349,12 @@ static void rtw89_fw_prog_cnt_dump(struct rtw89_dev *rtwdev) + static void rtw89_fw_dl_fail_dump(struct rtw89_dev *rtwdev) + { + u32 val32; +- u16 val16; + + val32 = rtw89_read32(rtwdev, R_AX_WCPU_FW_CTRL); + rtw89_err(rtwdev, "[ERR]fwdl 0x1E0 = 0x%x\n", val32); + +- val16 = rtw89_read16(rtwdev, R_AX_BOOT_DBG + 2); +- rtw89_err(rtwdev, "[ERR]fwdl 0x83F2 = 0x%x\n", val16); ++ val32 = rtw89_read32(rtwdev, R_AX_BOOT_DBG); ++ rtw89_err(rtwdev, "[ERR]fwdl 0x83F0 = 0x%x\n", val32); + + rtw89_fw_prog_cnt_dump(rtwdev); + } +@@ -1394,8 +1393,9 @@ static int rtw89_fw_download_suit(struct rtw89_dev *rtwdev, + return 0; + } + +-int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type, +- bool include_bb) ++static ++int __rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type, ++ bool include_bb) + { + const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; + struct rtw89_fw_info *fw_info = &rtwdev->fw; +@@ -1433,7 +1433,7 @@ int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type, + ret = rtw89_fw_check_rdy(rtwdev, RTW89_FWDL_CHECK_FREERTOS_DONE); + if (ret) { + rtw89_warn(rtwdev, "download firmware fail\n"); +- return ret; ++ goto fwdl_err; + } + + return ret; +@@ -1443,6 +1443,21 @@ int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type, + return ret; + } + ++int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type, ++ bool include_bb) ++{ ++ int retry; ++ int ret; ++ ++ for (retry = 0; retry < 5; retry++) { ++ ret = __rtw89_fw_download(rtwdev, type, include_bb); ++ if (!ret) ++ return 0; ++ } ++ ++ return ret; ++} ++ + int rtw89_wait_firmware_completion(struct rtw89_dev *rtwdev) + { + struct rtw89_fw_info *fw = &rtwdev->fw; +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index dfdff6aba6953..d80c3b93d6ce9 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -410,7 +410,29 @@ static ssize_t nvmet_addr_tsas_show(struct config_item *item, + return sprintf(page, "%s\n", nvmet_addr_tsas_rdma[i].name); + } + } +- return sprintf(page, "reserved\n"); ++ return sprintf(page, "\n"); ++} ++ ++static u8 nvmet_addr_tsas_rdma_store(const char *page) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(nvmet_addr_tsas_rdma); i++) { ++ if (sysfs_streq(page, nvmet_addr_tsas_rdma[i].name)) ++ return nvmet_addr_tsas_rdma[i].type; ++ } ++ return NVMF_RDMA_QPTYPE_INVALID; ++} ++ ++static u8 nvmet_addr_tsas_tcp_store(const char *page) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(nvmet_addr_tsas_tcp); i++) { ++ if (sysfs_streq(page, nvmet_addr_tsas_tcp[i].name)) ++ return nvmet_addr_tsas_tcp[i].type; ++ } ++ return NVMF_TCP_SECTYPE_INVALID; + } + + static ssize_t nvmet_addr_tsas_store(struct config_item *item, +@@ -418,20 +440,19 @@ static ssize_t nvmet_addr_tsas_store(struct config_item *item, + { + struct nvmet_port *port = to_nvmet_port(item); + u8 treq = nvmet_port_disc_addr_treq_mask(port); +- u8 sectype; +- int i; ++ u8 sectype, qptype; + + if (nvmet_is_port_enabled(port, __func__)) + return -EACCES; + +- if (port->disc_addr.trtype != NVMF_TRTYPE_TCP) +- return -EINVAL; +- +- for (i = 0; i < ARRAY_SIZE(nvmet_addr_tsas_tcp); i++) { +- if (sysfs_streq(page, nvmet_addr_tsas_tcp[i].name)) { +- sectype = nvmet_addr_tsas_tcp[i].type; ++ if (port->disc_addr.trtype == NVMF_TRTYPE_RDMA) { ++ qptype = nvmet_addr_tsas_rdma_store(page); ++ if (qptype == port->disc_addr.tsas.rdma.qptype) ++ return count; ++ } else if (port->disc_addr.trtype == NVMF_TRTYPE_TCP) { ++ sectype = nvmet_addr_tsas_tcp_store(page); ++ if (sectype != NVMF_TCP_SECTYPE_INVALID) + goto found; +- } + } + + pr_err("Invalid value '%s' for tsas\n", page); +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 337ee1cb09ae6..381b4394731f1 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -148,7 +148,7 @@ struct nvmet_fc_tgt_queue { + struct workqueue_struct *work_q; + struct kref ref; + /* array of fcp_iods */ +- struct nvmet_fc_fcp_iod fod[] __counted_by(sqsize); ++ struct nvmet_fc_fcp_iod fod[] /* __counted_by(sqsize) */; + } __aligned(sizeof(unsigned long long)); + + struct nvmet_fc_hostport { +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index 682fa877478fe..d9d3f57c6f77b 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -349,7 +349,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, + struct irq_affinity *affd) + { + struct irq_affinity_desc *masks = NULL; +- struct msi_desc *entry; ++ struct msi_desc *entry, desc; + int ret; + + /* Reject multi-MSI early on irq domain enabled architectures */ +@@ -374,6 +374,12 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, + /* All MSIs are unmasked by default; mask them all */ + entry = msi_first_desc(&dev->dev, MSI_DESC_ALL); + pci_msi_mask(entry, msi_multi_mask(entry)); ++ /* ++ * Copy the MSI descriptor for the error path because ++ * pci_msi_setup_msi_irqs() will free it for the hierarchical ++ * interrupt domain case. ++ */ ++ memcpy(&desc, entry, sizeof(desc)); + + /* Configure MSI capability structure */ + ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI); +@@ -393,7 +399,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, + goto unlock; + + err: +- pci_msi_unmask(entry, msi_multi_mask(entry)); ++ pci_msi_unmask(&desc, msi_multi_mask(&desc)); + pci_free_msi_irqs(dev); + fail: + dev->msi_enabled = 0; +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index cffeb869130dd..f424a57f00136 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1106,8 +1106,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, + * an -EPROBE_DEFER later, as that is the worst case. + */ + if (ret == -EPROBE_DEFER) { +- pinctrl_free(p, false); + mutex_unlock(&pinctrl_maps_mutex); ++ pinctrl_free(p, false); + return ERR_PTR(ret); + } + } +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 3bedf36a0019d..3f56991f5b892 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -634,23 +634,68 @@ static struct rockchip_mux_recalced_data rk3308_mux_recalced_data[] = { + + static struct rockchip_mux_recalced_data rk3328_mux_recalced_data[] = { + { +- .num = 2, +- .pin = 12, +- .reg = 0x24, +- .bit = 8, +- .mask = 0x3 +- }, { ++ /* gpio2_b7_sel */ + .num = 2, + .pin = 15, + .reg = 0x28, + .bit = 0, + .mask = 0x7 + }, { ++ /* gpio2_c7_sel */ + .num = 2, + .pin = 23, + .reg = 0x30, + .bit = 14, + .mask = 0x3 ++ }, { ++ /* gpio3_b1_sel */ ++ .num = 3, ++ .pin = 9, ++ .reg = 0x44, ++ .bit = 2, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b2_sel */ ++ .num = 3, ++ .pin = 10, ++ .reg = 0x44, ++ .bit = 4, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b3_sel */ ++ .num = 3, ++ .pin = 11, ++ .reg = 0x44, ++ .bit = 6, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b4_sel */ ++ .num = 3, ++ .pin = 12, ++ .reg = 0x44, ++ .bit = 8, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b5_sel */ ++ .num = 3, ++ .pin = 13, ++ .reg = 0x44, ++ .bit = 10, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b6_sel */ ++ .num = 3, ++ .pin = 14, ++ .reg = 0x44, ++ .bit = 12, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b7_sel */ ++ .num = 3, ++ .pin = 15, ++ .reg = 0x44, ++ .bit = 14, ++ .mask = 0x3 + }, + }; + +@@ -2433,6 +2478,7 @@ static int rockchip_get_pull(struct rockchip_pin_bank *bank, int pin_num) + case RK3188: + case RK3288: + case RK3308: ++ case RK3328: + case RK3368: + case RK3399: + case RK3568: +@@ -2491,6 +2537,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank, + case RK3188: + case RK3288: + case RK3308: ++ case RK3328: + case RK3368: + case RK3399: + case RK3568: +@@ -2704,8 +2751,10 @@ static int rockchip_pmx_set(struct pinctrl_dev *pctldev, unsigned selector, + + if (ret) { + /* revert the already done pin settings */ +- for (cnt--; cnt >= 0; cnt--) ++ for (cnt--; cnt >= 0; cnt--) { ++ bank = pin_to_bank(info, pins[cnt]); + rockchip_set_mux(bank, pins[cnt] - bank->pin_base, 0); ++ } + + return ret; + } +@@ -2753,6 +2802,7 @@ static bool rockchip_pinconf_pull_valid(struct rockchip_pin_ctrl *ctrl, + case RK3188: + case RK3288: + case RK3308: ++ case RK3328: + case RK3368: + case RK3399: + case RK3568: +@@ -3763,7 +3813,7 @@ static struct rockchip_pin_bank rk3328_pin_banks[] = { + PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(1, 32, "gpio1", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(2, 32, "gpio2", 0, +- IOMUX_WIDTH_3BIT, ++ 0, + IOMUX_WIDTH_3BIT, + 0), + PIN_BANK_IOMUX_FLAGS(3, 32, "gpio3", +@@ -3777,7 +3827,7 @@ static struct rockchip_pin_ctrl rk3328_pin_ctrl = { + .pin_banks = rk3328_pin_banks, + .nr_banks = ARRAY_SIZE(rk3328_pin_banks), + .label = "RK3328-GPIO", +- .type = RK3288, ++ .type = RK3328, + .grf_mux_offset = 0x0, + .iomux_recalced = rk3328_mux_recalced_data, + .niomux_recalced = ARRAY_SIZE(rk3328_mux_recalced_data), +diff --git a/drivers/pinctrl/pinctrl-rockchip.h b/drivers/pinctrl/pinctrl-rockchip.h +index 4759f336941ef..849266f8b1913 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.h ++++ b/drivers/pinctrl/pinctrl-rockchip.h +@@ -193,6 +193,7 @@ enum rockchip_pinctrl_type { + RK3188, + RK3288, + RK3308, ++ RK3328, + RK3368, + RK3399, + RK3568, +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index f4e2c88a7c822..e61be7d054948 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -1206,7 +1206,6 @@ static const struct of_device_id pmic_gpio_of_match[] = { + { .compatible = "qcom,pm7325-gpio", .data = (void *) 10 }, + { .compatible = "qcom,pm7550ba-gpio", .data = (void *) 8}, + { .compatible = "qcom,pm8005-gpio", .data = (void *) 4 }, +- { .compatible = "qcom,pm8008-gpio", .data = (void *) 2 }, + { .compatible = "qcom,pm8019-gpio", .data = (void *) 6 }, + /* pm8150 has 10 GPIOs with holes on 2, 5, 7 and 8 */ + { .compatible = "qcom,pm8150-gpio", .data = (void *) 10 }, +diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +index 248ab71b9f9da..747b22cd38aea 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -2071,11 +2071,11 @@ static void rzg2l_gpio_irq_restore(struct rzg2l_pinctrl *pctrl) + * This has to be atomically executed to protect against a concurrent + * interrupt. + */ +- raw_spin_lock_irqsave(&pctrl->lock.rlock, flags); ++ spin_lock_irqsave(&pctrl->lock, flags); + ret = rzg2l_gpio_irq_set_type(data, irqd_get_trigger_type(data)); + if (!ret && !irqd_irq_disabled(data)) + rzg2l_gpio_irq_enable(data); +- raw_spin_unlock_irqrestore(&pctrl->lock.rlock, flags); ++ spin_unlock_irqrestore(&pctrl->lock, flags); + + if (ret) + dev_crit(pctrl->dev, "Failed to set IRQ type for virq=%u\n", virq); +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index 0c028d17c0752..5baa487f350e7 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -309,29 +309,43 @@ static int stm32_pwm_capture(struct pwm_chip *chip, struct pwm_device *pwm, + } + + static int stm32_pwm_config(struct stm32_pwm *priv, unsigned int ch, +- int duty_ns, int period_ns) ++ u64 duty_ns, u64 period_ns) + { +- unsigned long long prd, div, dty; +- unsigned int prescaler = 0; ++ unsigned long long prd, dty; ++ unsigned long long prescaler; + u32 ccmr, mask, shift; + +- /* Period and prescaler values depends on clock rate */ +- div = (unsigned long long)clk_get_rate(priv->clk) * period_ns; +- +- do_div(div, NSEC_PER_SEC); +- prd = div; +- +- while (div > priv->max_arr) { +- prescaler++; +- div = prd; +- do_div(div, prescaler + 1); +- } +- +- prd = div; ++ /* ++ * .probe() asserted that clk_get_rate() is not bigger than 1 GHz, so ++ * the calculations here won't overflow. ++ * First we need to find the minimal value for prescaler such that ++ * ++ * period_ns * clkrate ++ * ------------------------------ < max_arr + 1 ++ * NSEC_PER_SEC * (prescaler + 1) ++ * ++ * This equation is equivalent to ++ * ++ * period_ns * clkrate ++ * ---------------------------- < prescaler + 1 ++ * NSEC_PER_SEC * (max_arr + 1) ++ * ++ * Using integer division and knowing that the right hand side is ++ * integer, this is further equivalent to ++ * ++ * (period_ns * clkrate) // (NSEC_PER_SEC * (max_arr + 1)) ≤ prescaler ++ */ + ++ prescaler = mul_u64_u64_div_u64(period_ns, clk_get_rate(priv->clk), ++ (u64)NSEC_PER_SEC * ((u64)priv->max_arr + 1)); + if (prescaler > MAX_TIM_PSC) + return -EINVAL; + ++ prd = mul_u64_u64_div_u64(period_ns, clk_get_rate(priv->clk), ++ (u64)NSEC_PER_SEC * (prescaler + 1)); ++ if (!prd) ++ return -EINVAL; ++ + /* + * All channels share the same prescaler and counter so when two + * channels are active at the same time we can't change them +@@ -351,8 +365,8 @@ static int stm32_pwm_config(struct stm32_pwm *priv, unsigned int ch, + regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE); + + /* Calculate the duty cycles */ +- dty = prd * duty_ns; +- do_div(dty, period_ns); ++ dty = mul_u64_u64_div_u64(duty_ns, clk_get_rate(priv->clk), ++ (u64)NSEC_PER_SEC * (prescaler + 1)); + + regmap_write(priv->regmap, TIM_CCR1 + 4 * ch, dty); + +@@ -656,6 +670,18 @@ static int stm32_pwm_probe(struct platform_device *pdev) + + stm32_pwm_detect_complementary(priv); + ++ ret = devm_clk_rate_exclusive_get(dev, priv->clk); ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to lock clock\n"); ++ ++ /* ++ * With the clk running with not more than 1 GHz the calculations in ++ * .apply() won't overflow. ++ */ ++ if (clk_get_rate(priv->clk) > 1000000000) ++ return dev_err_probe(dev, -EINVAL, "Clock freq too high (%lu)\n", ++ clk_get_rate(priv->clk)); ++ + chip->ops = &stm32pwm_ops; + + /* Initialize clock refcount to number of enabled PWM channels. */ +diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig +index 85b27c42cf65b..f426b4c391796 100644 +--- a/drivers/reset/Kconfig ++++ b/drivers/reset/Kconfig +@@ -68,6 +68,7 @@ config RESET_BRCMSTB_RESCAL + + config RESET_GPIO + tristate "GPIO reset controller" ++ depends on GPIOLIB + help + This enables a generic reset controller for resets attached via + GPIOs. Typically for OF platforms this driver expects "reset-gpios" +diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c +index d7569f3955591..d6491fc84e8c5 100644 +--- a/drivers/s390/virtio/virtio_ccw.c ++++ b/drivers/s390/virtio/virtio_ccw.c +@@ -698,6 +698,7 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs, + dma64_t *indicatorp = NULL; + int ret, i, queue_idx = 0; + struct ccw1 *ccw; ++ dma32_t indicatorp_dma = 0; + + ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw), NULL); + if (!ccw) +@@ -725,7 +726,7 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs, + */ + indicatorp = ccw_device_dma_zalloc(vcdev->cdev, + sizeof(*indicatorp), +- &ccw->cda); ++ &indicatorp_dma); + if (!indicatorp) + goto out; + *indicatorp = indicators_dma(vcdev); +@@ -735,6 +736,7 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs, + /* no error, just fall back to legacy interrupts */ + vcdev->is_thinint = false; + } ++ ccw->cda = indicatorp_dma; + if (!vcdev->is_thinint) { + /* Register queue indicators with host. */ + *indicators(vcdev) = 0; +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index 12e2653846e3f..70891a1e98a01 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -610,15 +610,15 @@ int sas_ata_init(struct domain_device *found_dev) + + rc = ata_sas_tport_add(ata_host->dev, ap); + if (rc) +- goto destroy_port; ++ goto free_port; + + found_dev->sata_dev.ata_host = ata_host; + found_dev->sata_dev.ap = ap; + + return 0; + +-destroy_port: +- kfree(ap); ++free_port: ++ ata_port_free(ap); + free_host: + ata_host_put(ata_host); + return rc; +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index 8fb7c41c09624..48d975c6dbf2c 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -301,7 +301,7 @@ void sas_free_device(struct kref *kref) + + if (dev_is_sata(dev) && dev->sata_dev.ap) { + ata_sas_tport_delete(dev->sata_dev.ap); +- kfree(dev->sata_dev.ap); ++ ata_port_free(dev->sata_dev.ap); + ata_host_put(dev->sata_dev.ata_host); + dev->sata_dev.ata_host = NULL; + dev->sata_dev.ap = NULL; +diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c +index 6a1c6b34c414a..88f774db92084 100644 +--- a/drivers/soc/ti/wkup_m3_ipc.c ++++ b/drivers/soc/ti/wkup_m3_ipc.c +@@ -16,7 +16,6 @@ + #include <linux/irq.h> + #include <linux/module.h> + #include <linux/of.h> +-#include <linux/omap-mailbox.h> + #include <linux/platform_device.h> + #include <linux/remoteproc.h> + #include <linux/suspend.h> +@@ -314,7 +313,6 @@ static irqreturn_t wkup_m3_txev_handler(int irq, void *ipc_data) + static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc) + { + struct device *dev = m3_ipc->dev; +- mbox_msg_t dummy_msg = 0; + int ret; + + if (!m3_ipc->mbox) { +@@ -330,7 +328,7 @@ static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc) + * the RX callback to avoid multiple interrupts being received + * by the CM3. + */ +- ret = mbox_send_message(m3_ipc->mbox, &dummy_msg); ++ ret = mbox_send_message(m3_ipc->mbox, NULL); + if (ret < 0) { + dev_err(dev, "%s: mbox_send_message() failed: %d\n", + __func__, ret); +@@ -352,7 +350,6 @@ static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc) + static int wkup_m3_ping_noirq(struct wkup_m3_ipc *m3_ipc) + { + struct device *dev = m3_ipc->dev; +- mbox_msg_t dummy_msg = 0; + int ret; + + if (!m3_ipc->mbox) { +@@ -361,7 +358,7 @@ static int wkup_m3_ping_noirq(struct wkup_m3_ipc *m3_ipc) + return -EIO; + } + +- ret = mbox_send_message(m3_ipc->mbox, &dummy_msg); ++ ret = mbox_send_message(m3_ipc->mbox, NULL); + if (ret < 0) { + dev_err(dev, "%s: mbox_send_message() failed: %d\n", + __func__, ret); +diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c +index 458bb1280ebf9..5b97e420a95f8 100644 +--- a/drivers/tty/mxser.c ++++ b/drivers/tty/mxser.c +@@ -288,7 +288,7 @@ struct mxser_board { + enum mxser_must_hwid must_hwid; + speed_t max_baud; + +- struct mxser_port ports[] __counted_by(nports); ++ struct mxser_port ports[] /* __counted_by(nports) */; + }; + + static DECLARE_BITMAP(mxser_boards, MXSER_BOARDS); +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 66901d93089a3..ddf23ccbc9253 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -116,6 +116,10 @@ + /* RX FIFO occupancy indicator */ + #define UART_OMAP_RX_LVL 0x19 + ++/* Timeout low and High */ ++#define UART_OMAP_TO_L 0x26 ++#define UART_OMAP_TO_H 0x27 ++ + /* + * Copy of the genpd flags for the console. + * Only used if console suspend is disabled +@@ -664,13 +668,25 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + + /* + * On K3 SoCs, it is observed that RX TIMEOUT is signalled after +- * FIFO has been drained, in which case a dummy read of RX FIFO +- * is required to clear RX TIMEOUT condition. ++ * FIFO has been drained or erroneously. ++ * So apply solution of Errata i2310 as mentioned in ++ * https://www.ti.com/lit/pdf/sprz536 + */ + if (priv->habit & UART_RX_TIMEOUT_QUIRK && + (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT && + serial_port_in(port, UART_OMAP_RX_LVL) == 0) { +- serial_port_in(port, UART_RX); ++ unsigned char efr2, timeout_h, timeout_l; ++ ++ efr2 = serial_in(up, UART_OMAP_EFR2); ++ timeout_h = serial_in(up, UART_OMAP_TO_H); ++ timeout_l = serial_in(up, UART_OMAP_TO_L); ++ serial_out(up, UART_OMAP_TO_H, 0xFF); ++ serial_out(up, UART_OMAP_TO_L, 0xFF); ++ serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE); ++ serial_in(up, UART_IIR); ++ serial_out(up, UART_OMAP_EFR2, efr2); ++ serial_out(up, UART_OMAP_TO_H, timeout_h); ++ serial_out(up, UART_OMAP_TO_L, timeout_l); + } + + /* Stop processing interrupts on input overrun */ +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index e2e4f99f9d347..fe0fb2b4e9db7 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1985,6 +1985,17 @@ enum { + MOXA_SUPP_RS485 = BIT(2), + }; + ++static unsigned short moxa_get_nports(unsigned short device) ++{ ++ switch (device) { ++ case PCI_DEVICE_ID_MOXA_CP116E_A_A: ++ case PCI_DEVICE_ID_MOXA_CP116E_A_B: ++ return 8; ++ } ++ ++ return FIELD_GET(0x00F0, device); ++} ++ + static bool pci_moxa_is_mini_pcie(unsigned short device) + { + if (device == PCI_DEVICE_ID_MOXA_CP102N || +@@ -2038,7 +2049,7 @@ static int pci_moxa_init(struct pci_dev *dev) + { + unsigned short device = dev->device; + resource_size_t iobar_addr = pci_resource_start(dev, 2); +- unsigned int num_ports = (device & 0x00F0) >> 4, i; ++ unsigned int i, num_ports = moxa_get_nports(device); + u8 val, init_mode = MOXA_RS232; + + if (!(pci_moxa_supported_rs(dev) & MOXA_SUPP_RS232)) { +diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c +index 34801a6f300b6..b88cc28c94e33 100644 +--- a/drivers/tty/serial/bcm63xx_uart.c ++++ b/drivers/tty/serial/bcm63xx_uart.c +@@ -308,8 +308,8 @@ static void bcm_uart_do_tx(struct uart_port *port) + + val = bcm_uart_readl(port, UART_MCTL_REG); + val = (val & UART_MCTL_TXFIFOFILL_MASK) >> UART_MCTL_TXFIFOFILL_SHIFT; +- +- pending = uart_port_tx_limited(port, ch, port->fifosize - val, ++ pending = uart_port_tx_limited_flags(port, ch, UART_TX_NOSTOP, ++ port->fifosize - val, + true, + bcm_uart_writel(port, ch, UART_FIFO_REG), + ({})); +@@ -320,6 +320,9 @@ static void bcm_uart_do_tx(struct uart_port *port) + val = bcm_uart_readl(port, UART_IR_REG); + val &= ~UART_TX_INT_MASK; + bcm_uart_writel(port, val, UART_IR_REG); ++ ++ if (uart_tx_stopped(port)) ++ bcm_uart_stop_tx(port); + } + + /* +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 09c1678ddfd49..9552228d21614 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -119,6 +119,7 @@ + #define UCR4_OREN (1<<1) /* Receiver overrun interrupt enable */ + #define UCR4_DREN (1<<0) /* Recv data ready interrupt enable */ + #define UFCR_RXTL_SHF 0 /* Receiver trigger level shift */ ++#define UFCR_RXTL_MASK 0x3F /* Receiver trigger 6 bits wide */ + #define UFCR_DCEDTE (1<<6) /* DCE/DTE mode select */ + #define UFCR_RFDIV (7<<7) /* Reference freq divider mask */ + #define UFCR_RFDIV_REG(x) (((x) < 7 ? 6 - (x) : 6) << 7) +@@ -1941,7 +1942,7 @@ static int imx_uart_rs485_config(struct uart_port *port, struct ktermios *termio + struct serial_rs485 *rs485conf) + { + struct imx_port *sport = (struct imx_port *)port; +- u32 ucr2; ++ u32 ucr2, ufcr; + + if (rs485conf->flags & SER_RS485_ENABLED) { + /* Enable receiver if low-active RTS signal is requested */ +@@ -1960,8 +1961,13 @@ static int imx_uart_rs485_config(struct uart_port *port, struct ktermios *termio + + /* Make sure Rx is enabled in case Tx is active with Rx disabled */ + if (!(rs485conf->flags & SER_RS485_ENABLED) || +- rs485conf->flags & SER_RS485_RX_DURING_TX) ++ rs485conf->flags & SER_RS485_RX_DURING_TX) { ++ /* If the receiver trigger is 0, set it to a default value */ ++ ufcr = imx_uart_readl(sport, UFCR); ++ if ((ufcr & UFCR_RXTL_MASK) == 0) ++ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); + imx_uart_start_rx(port); ++ } + + return 0; + } +diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c +index b0604d6da0257..58858dd352c59 100644 +--- a/drivers/tty/serial/mcf.c ++++ b/drivers/tty/serial/mcf.c +@@ -462,7 +462,7 @@ static const struct uart_ops mcf_uart_ops = { + .verify_port = mcf_verify_port, + }; + +-static struct mcf_uart mcf_ports[4]; ++static struct mcf_uart mcf_ports[10]; + + #define MCF_MAXPORTS ARRAY_SIZE(mcf_ports) + +diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c +index 4ce7cba2b48aa..8f3b9a0a38e1d 100644 +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -1131,6 +1131,7 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, + struct cxacru_data *instance; + struct usb_device *usb_dev = interface_to_usbdev(intf); + struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD]; ++ struct usb_endpoint_descriptor *in, *out; + int ret; + + /* instance init */ +@@ -1177,6 +1178,19 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, + goto fail; + } + ++ if (usb_endpoint_xfer_int(&cmd_ep->desc)) ++ ret = usb_find_common_endpoints(intf->cur_altsetting, ++ NULL, NULL, &in, &out); ++ else ++ ret = usb_find_common_endpoints(intf->cur_altsetting, ++ &in, &out, NULL, NULL); ++ ++ if (ret) { ++ usb_err(usbatm_instance, "cxacru_bind: interface has incorrect endpoints\n"); ++ ret = -ENODEV; ++ goto fail; ++ } ++ + if ((cmd_ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) + == USB_ENDPOINT_XFER_INT) { + usb_fill_int_urb(instance->rcv_urb, +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 100041320e8dd..cfe754f480a07 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -879,12 +879,16 @@ static bool dwc3_core_is_valid(struct dwc3 *dwc) + + static void dwc3_core_setup_global_control(struct dwc3 *dwc) + { ++ unsigned int power_opt; ++ unsigned int hw_mode; + u32 reg; + + reg = dwc3_readl(dwc->regs, DWC3_GCTL); + reg &= ~DWC3_GCTL_SCALEDOWN_MASK; ++ hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0); ++ power_opt = DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1); + +- switch (DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1)) { ++ switch (power_opt) { + case DWC3_GHWPARAMS1_EN_PWROPT_CLK: + /** + * WORKAROUND: DWC3 revisions between 2.10a and 2.50a have an +@@ -917,6 +921,20 @@ static void dwc3_core_setup_global_control(struct dwc3 *dwc) + break; + } + ++ /* ++ * This is a workaround for STAR#4846132, which only affects ++ * DWC_usb31 version2.00a operating in host mode. ++ * ++ * There is a problem in DWC_usb31 version 2.00a operating ++ * in host mode that would cause a CSR read timeout When CSR ++ * read coincides with RAM Clock Gating Entry. By disable ++ * Clock Gating, sacrificing power consumption for normal ++ * operation. ++ */ ++ if (power_opt != DWC3_GHWPARAMS1_EN_PWROPT_NO && ++ hw_mode != DWC3_GHWPARAMS0_MODE_GADGET && DWC3_VER_IS(DWC31, 200A)) ++ reg |= DWC3_GCTL_DSBLCLKGTNG; ++ + /* check if current dwc3 is on simulation board */ + if (dwc->hwparams.hwparams6 & DWC3_GHWPARAMS6_EN_FPGA) { + dev_info(dwc->dev, "Running with FPGA optimizations\n"); +@@ -2084,7 +2102,6 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc) + + static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + u32 reg; + + switch (dwc->current_dr_role) { +@@ -2122,9 +2139,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + break; + + if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_suspend(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + synchronize_irq(dwc->irq_gadget); + } + +@@ -2141,7 +2156,6 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + + static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + int ret; + u32 reg; + +@@ -2190,9 +2204,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) + if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) { + dwc3_otg_host_init(dwc); + } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_resume(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + } + + break; +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index ba7d180cc9e6d..44e20c6c36d32 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -213,6 +213,7 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, + struct usb_endpoint_descriptor *ss) + { + switch (gadget->speed) { ++ case USB_SPEED_SUPER_PLUS: + case USB_SPEED_SUPER: + return ss; + case USB_SPEED_HIGH: +@@ -449,11 +450,8 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + mutex_lock(&dev->lock_printer_io); + spin_lock_irqsave(&dev->lock, flags); + +- if (dev->interface < 0) { +- spin_unlock_irqrestore(&dev->lock, flags); +- mutex_unlock(&dev->lock_printer_io); +- return -ENODEV; +- } ++ if (dev->interface < 0) ++ goto out_disabled; + + /* We will use this flag later to check if a printer reset happened + * after we turn interrupts back on. +@@ -461,6 +459,9 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + dev->reset_printer = 0; + + setup_rx_reqs(dev); ++ /* this dropped the lock - need to retest */ ++ if (dev->interface < 0) ++ goto out_disabled; + + bytes_copied = 0; + current_rx_req = dev->current_rx_req; +@@ -494,6 +495,8 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + wait_event_interruptible(dev->rx_wait, + (likely(!list_empty(&dev->rx_buffers)))); + spin_lock_irqsave(&dev->lock, flags); ++ if (dev->interface < 0) ++ goto out_disabled; + } + + /* We have data to return then copy it to the caller's buffer.*/ +@@ -537,6 +540,9 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + return -EAGAIN; + } + ++ if (dev->interface < 0) ++ goto out_disabled; ++ + /* If we not returning all the data left in this RX request + * buffer then adjust the amount of data left in the buffer. + * Othewise if we are done with this RX request buffer then +@@ -566,6 +572,11 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + return bytes_copied; + else + return -EAGAIN; ++ ++out_disabled: ++ spin_unlock_irqrestore(&dev->lock, flags); ++ mutex_unlock(&dev->lock_printer_io); ++ return -ENODEV; + } + + static ssize_t +@@ -586,11 +597,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + mutex_lock(&dev->lock_printer_io); + spin_lock_irqsave(&dev->lock, flags); + +- if (dev->interface < 0) { +- spin_unlock_irqrestore(&dev->lock, flags); +- mutex_unlock(&dev->lock_printer_io); +- return -ENODEV; +- } ++ if (dev->interface < 0) ++ goto out_disabled; + + /* Check if a printer reset happens while we have interrupts on */ + dev->reset_printer = 0; +@@ -613,6 +621,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + wait_event_interruptible(dev->tx_wait, + (likely(!list_empty(&dev->tx_reqs)))); + spin_lock_irqsave(&dev->lock, flags); ++ if (dev->interface < 0) ++ goto out_disabled; + } + + while (likely(!list_empty(&dev->tx_reqs)) && len) { +@@ -662,6 +672,9 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + return -EAGAIN; + } + ++ if (dev->interface < 0) ++ goto out_disabled; ++ + list_add(&req->list, &dev->tx_reqs_active); + + /* here, we unlock, and only unlock, to avoid deadlock. */ +@@ -674,6 +687,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + mutex_unlock(&dev->lock_printer_io); + return -EAGAIN; + } ++ if (dev->interface < 0) ++ goto out_disabled; + } + + spin_unlock_irqrestore(&dev->lock, flags); +@@ -685,6 +700,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + return bytes_copied; + else + return -EAGAIN; ++ ++out_disabled: ++ spin_unlock_irqrestore(&dev->lock, flags); ++ mutex_unlock(&dev->lock_printer_io); ++ return -ENODEV; + } + + static int +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c +index 444212c0b5a98..be3b0bad554e5 100644 +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -1163,8 +1163,6 @@ struct net_device *gether_connect(struct gether *link) + if (netif_running(dev->net)) + eth_start(dev, GFP_ATOMIC); + +- netif_device_attach(dev->net); +- + /* on error, disable any endpoints */ + } else { + (void) usb_ep_disable(link->out_ep); +@@ -1202,7 +1200,7 @@ void gether_disconnect(struct gether *link) + + DBG(dev, "%s\n", __func__); + +- netif_device_detach(dev->net); ++ netif_stop_queue(dev->net); + netif_carrier_off(dev->net); + + /* disable endpoints, forcing (synchronous) completion +diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c +index 3916c8e2ba01f..821a6ab5da56f 100644 +--- a/drivers/usb/gadget/udc/aspeed_udc.c ++++ b/drivers/usb/gadget/udc/aspeed_udc.c +@@ -66,8 +66,8 @@ + #define USB_UPSTREAM_EN BIT(0) + + /* Main config reg */ +-#define UDC_CFG_SET_ADDR(x) ((x) & 0x3f) +-#define UDC_CFG_ADDR_MASK (0x3f) ++#define UDC_CFG_SET_ADDR(x) ((x) & UDC_CFG_ADDR_MASK) ++#define UDC_CFG_ADDR_MASK GENMASK(6, 0) + + /* Interrupt ctrl & status reg */ + #define UDC_IRQ_EP_POOL_NAK BIT(17) +diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c +index 8abf3a567e30a..108d9a593a80d 100644 +--- a/drivers/usb/musb/da8xx.c ++++ b/drivers/usb/musb/da8xx.c +@@ -556,7 +556,7 @@ static int da8xx_probe(struct platform_device *pdev) + ret = of_platform_populate(pdev->dev.of_node, NULL, + da8xx_auxdata_lookup, &pdev->dev); + if (ret) +- return ret; ++ goto err_unregister_phy; + + pinfo = da8xx_dev_info; + pinfo.parent = &pdev->dev; +@@ -571,9 +571,13 @@ static int da8xx_probe(struct platform_device *pdev) + ret = PTR_ERR_OR_ZERO(glue->musb); + if (ret) { + dev_err(&pdev->dev, "failed to register musb device: %d\n", ret); +- usb_phy_generic_unregister(glue->usb_phy); ++ goto err_unregister_phy; + } + ++ return 0; ++ ++err_unregister_phy: ++ usb_phy_generic_unregister(glue->usb_phy); + return ret; + } + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 7801501837b69..911d774c9805a 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -49,22 +49,16 @@ static int ucsi_read_message_in(struct ucsi *ucsi, void *buf, + return ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, buf, buf_size); + } + +-static int ucsi_acknowledge_command(struct ucsi *ucsi) ++static int ucsi_acknowledge(struct ucsi *ucsi, bool conn_ack) + { + u64 ctrl; + + ctrl = UCSI_ACK_CC_CI; + ctrl |= UCSI_ACK_COMMAND_COMPLETE; +- +- return ucsi->ops->sync_write(ucsi, UCSI_CONTROL, &ctrl, sizeof(ctrl)); +-} +- +-static int ucsi_acknowledge_connector_change(struct ucsi *ucsi) +-{ +- u64 ctrl; +- +- ctrl = UCSI_ACK_CC_CI; +- ctrl |= UCSI_ACK_CONNECTOR_CHANGE; ++ if (conn_ack) { ++ clear_bit(EVENT_PENDING, &ucsi->flags); ++ ctrl |= UCSI_ACK_CONNECTOR_CHANGE; ++ } + + return ucsi->ops->sync_write(ucsi, UCSI_CONTROL, &ctrl, sizeof(ctrl)); + } +@@ -77,7 +71,7 @@ static int ucsi_read_error(struct ucsi *ucsi) + int ret; + + /* Acknowledge the command that failed */ +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, false); + if (ret) + return ret; + +@@ -89,7 +83,7 @@ static int ucsi_read_error(struct ucsi *ucsi) + if (ret) + return ret; + +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, false); + if (ret) + return ret; + +@@ -152,28 +146,33 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd) + return -EIO; + + if (cci & UCSI_CCI_NOT_SUPPORTED) { +- if (ucsi_acknowledge_command(ucsi) < 0) ++ if (ucsi_acknowledge(ucsi, false) < 0) + dev_err(ucsi->dev, + "ACK of unsupported command failed\n"); + return -EOPNOTSUPP; + } + + if (cci & UCSI_CCI_ERROR) { +- if (cmd == UCSI_GET_ERROR_STATUS) ++ if (cmd == UCSI_GET_ERROR_STATUS) { ++ ret = ucsi_acknowledge(ucsi, false); ++ if (ret) ++ return ret; ++ + return -EIO; ++ } + return ucsi_read_error(ucsi); + } + + if (cmd == UCSI_CANCEL && cci & UCSI_CCI_CANCEL_COMPLETE) { +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, false); + return ret ? ret : -EBUSY; + } + + return UCSI_CCI_LENGTH(cci); + } + +-int ucsi_send_command(struct ucsi *ucsi, u64 command, +- void *data, size_t size) ++static int ucsi_send_command_common(struct ucsi *ucsi, u64 command, ++ void *data, size_t size, bool conn_ack) + { + u8 length; + int ret; +@@ -192,7 +191,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, + goto out; + } + +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, conn_ack); + if (ret) + goto out; + +@@ -201,6 +200,12 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, + mutex_unlock(&ucsi->ppm_lock); + return ret; + } ++ ++int ucsi_send_command(struct ucsi *ucsi, u64 command, ++ void *data, size_t size) ++{ ++ return ucsi_send_command_common(ucsi, command, data, size, false); ++} + EXPORT_SYMBOL_GPL(ucsi_send_command); + + /* -------------------------------------------------------------------------- */ +@@ -1157,7 +1162,9 @@ static void ucsi_handle_connector_change(struct work_struct *work) + mutex_lock(&con->lock); + + command = UCSI_GET_CONNECTOR_STATUS | UCSI_CONNECTOR_NUMBER(con->num); +- ret = ucsi_send_command(ucsi, command, &con->status, sizeof(con->status)); ++ ++ ret = ucsi_send_command_common(ucsi, command, &con->status, ++ sizeof(con->status), true); + if (ret < 0) { + dev_err(ucsi->dev, "%s: GET_CONNECTOR_STATUS failed (%d)\n", + __func__, ret); +@@ -1214,14 +1221,6 @@ static void ucsi_handle_connector_change(struct work_struct *work) + if (con->status.change & UCSI_CONSTAT_CAM_CHANGE) + ucsi_partner_task(con, ucsi_check_altmodes, 1, 0); + +- mutex_lock(&ucsi->ppm_lock); +- clear_bit(EVENT_PENDING, &con->ucsi->flags); +- ret = ucsi_acknowledge_connector_change(ucsi); +- mutex_unlock(&ucsi->ppm_lock); +- +- if (ret) +- dev_err(ucsi->dev, "%s: ACK failed (%d)", __func__, ret); +- + out_unlock: + mutex_unlock(&con->lock); + } +diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c +index 1d0e2d87e9b31..4763bd6e55a79 100644 +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -365,6 +365,7 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, + ret = fwnode_property_read_u32(fwnode, "reg", &port); + if (ret < 0) { + dev_err(dev, "missing reg property of %pOFn\n", fwnode); ++ fwnode_handle_put(fwnode); + return ret; + } + +@@ -379,9 +380,11 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, + if (!desc) + continue; + +- if (IS_ERR(desc)) ++ if (IS_ERR(desc)) { ++ fwnode_handle_put(fwnode); + return dev_err_probe(dev, PTR_ERR(desc), + "unable to acquire orientation gpio\n"); ++ } + ucsi->port_orientation[port] = desc; + + ucsi->port_switch[port] = fwnode_typec_switch_get(fwnode); +diff --git a/drivers/usb/typec/ucsi/ucsi_stm32g0.c b/drivers/usb/typec/ucsi/ucsi_stm32g0.c +index 93d7806681cf0..1d7ee833eb4fd 100644 +--- a/drivers/usb/typec/ucsi/ucsi_stm32g0.c ++++ b/drivers/usb/typec/ucsi/ucsi_stm32g0.c +@@ -64,6 +64,7 @@ struct ucsi_stm32g0 { + struct completion complete; + struct device *dev; + unsigned long flags; ++#define ACK_PENDING 2 + const char *fw_name; + struct ucsi *ucsi; + bool suspended; +@@ -395,9 +396,13 @@ static int ucsi_stm32g0_sync_write(struct ucsi *ucsi, unsigned int offset, const + size_t len) + { + struct ucsi_stm32g0 *g0 = ucsi_get_drvdata(ucsi); ++ bool ack = UCSI_COMMAND(*(u64 *)val) == UCSI_ACK_CC_CI; + int ret; + +- set_bit(COMMAND_PENDING, &g0->flags); ++ if (ack) ++ set_bit(ACK_PENDING, &g0->flags); ++ else ++ set_bit(COMMAND_PENDING, &g0->flags); + + ret = ucsi_stm32g0_async_write(ucsi, offset, val, len); + if (ret) +@@ -405,9 +410,14 @@ static int ucsi_stm32g0_sync_write(struct ucsi *ucsi, unsigned int offset, const + + if (!wait_for_completion_timeout(&g0->complete, msecs_to_jiffies(5000))) + ret = -ETIMEDOUT; ++ else ++ return 0; + + out_clear_bit: +- clear_bit(COMMAND_PENDING, &g0->flags); ++ if (ack) ++ clear_bit(ACK_PENDING, &g0->flags); ++ else ++ clear_bit(COMMAND_PENDING, &g0->flags); + + return ret; + } +@@ -428,8 +438,9 @@ static irqreturn_t ucsi_stm32g0_irq_handler(int irq, void *data) + if (UCSI_CCI_CONNECTOR(cci)) + ucsi_connector_change(g0->ucsi, UCSI_CCI_CONNECTOR(cci)); + +- if (test_bit(COMMAND_PENDING, &g0->flags) && +- cci & (UCSI_CCI_ACK_COMPLETE | UCSI_CCI_COMMAND_COMPLETE)) ++ if (cci & UCSI_CCI_ACK_COMPLETE && test_and_clear_bit(ACK_PENDING, &g0->flags)) ++ complete(&g0->complete); ++ if (cci & UCSI_CCI_COMMAND_COMPLETE && test_and_clear_bit(COMMAND_PENDING, &g0->flags)) + complete(&g0->complete); + + return IRQ_HANDLED; +diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c +index 73c89701fc9d4..ac8b5b52e3dc4 100644 +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -8,6 +8,7 @@ + * + */ + ++#include "linux/virtio_net.h" + #include <linux/init.h> + #include <linux/module.h> + #include <linux/cdev.h> +@@ -28,6 +29,7 @@ + #include <uapi/linux/virtio_config.h> + #include <uapi/linux/virtio_ids.h> + #include <uapi/linux/virtio_blk.h> ++#include <uapi/linux/virtio_ring.h> + #include <linux/mod_devicetable.h> + + #include "iova_domain.h" +@@ -1705,13 +1707,17 @@ static bool device_is_allowed(u32 device_id) + return false; + } + +-static bool features_is_valid(u64 features) ++static bool features_is_valid(struct vduse_dev_config *config) + { +- if (!(features & (1ULL << VIRTIO_F_ACCESS_PLATFORM))) ++ if (!(config->features & BIT_ULL(VIRTIO_F_ACCESS_PLATFORM))) + return false; + + /* Now we only support read-only configuration space */ +- if (features & (1ULL << VIRTIO_BLK_F_CONFIG_WCE)) ++ if ((config->device_id == VIRTIO_ID_BLOCK) && ++ (config->features & BIT_ULL(VIRTIO_BLK_F_CONFIG_WCE))) ++ return false; ++ else if ((config->device_id == VIRTIO_ID_NET) && ++ (config->features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ))) + return false; + + return true; +@@ -1738,7 +1744,7 @@ static bool vduse_validate_config(struct vduse_dev_config *config) + if (!device_is_allowed(config->device_id)) + return false; + +- if (!features_is_valid(config->features)) ++ if (!features_is_valid(config)) + return false; + + return true; +diff --git a/fs/bcachefs/bcachefs.h b/fs/bcachefs/bcachefs.h +index 91c3c1fef233d..e6bcf74b0d60a 100644 +--- a/fs/bcachefs/bcachefs.h ++++ b/fs/bcachefs/bcachefs.h +@@ -455,6 +455,7 @@ enum bch_time_stats { + }; + + #include "alloc_types.h" ++#include "btree_gc_types.h" + #include "btree_types.h" + #include "btree_node_scan_types.h" + #include "btree_write_buffer_types.h" +@@ -485,49 +486,6 @@ enum bch_time_stats { + + struct btree; + +-enum gc_phase { +- GC_PHASE_NOT_RUNNING, +- GC_PHASE_START, +- GC_PHASE_SB, +- +- GC_PHASE_BTREE_stripes, +- GC_PHASE_BTREE_extents, +- GC_PHASE_BTREE_inodes, +- GC_PHASE_BTREE_dirents, +- GC_PHASE_BTREE_xattrs, +- GC_PHASE_BTREE_alloc, +- GC_PHASE_BTREE_quotas, +- GC_PHASE_BTREE_reflink, +- GC_PHASE_BTREE_subvolumes, +- GC_PHASE_BTREE_snapshots, +- GC_PHASE_BTREE_lru, +- GC_PHASE_BTREE_freespace, +- GC_PHASE_BTREE_need_discard, +- GC_PHASE_BTREE_backpointers, +- GC_PHASE_BTREE_bucket_gens, +- GC_PHASE_BTREE_snapshot_trees, +- GC_PHASE_BTREE_deleted_inodes, +- GC_PHASE_BTREE_logged_ops, +- GC_PHASE_BTREE_rebalance_work, +- GC_PHASE_BTREE_subvolume_children, +- +- GC_PHASE_PENDING_DELETE, +-}; +- +-struct gc_pos { +- enum gc_phase phase; +- struct bpos pos; +- unsigned level; +-}; +- +-struct reflink_gc { +- u64 offset; +- u32 size; +- u32 refcount; +-}; +- +-typedef GENRADIX(struct reflink_gc) reflink_gc_table; +- + struct io_count { + u64 sectors[2][BCH_DATA_NR]; + }; +diff --git a/fs/bcachefs/btree_gc.c b/fs/bcachefs/btree_gc.c +index 791470b0c6545..58f7c99e0ed88 100644 +--- a/fs/bcachefs/btree_gc.c ++++ b/fs/bcachefs/btree_gc.c +@@ -1080,8 +1080,7 @@ static int bch2_gc_btree_init(struct btree_trans *trans, + + static inline int btree_id_gc_phase_cmp(enum btree_id l, enum btree_id r) + { +- return (int) btree_id_to_gc_phase(l) - +- (int) btree_id_to_gc_phase(r); ++ return cmp_int(gc_btree_order(l), gc_btree_order(r)); + } + + static int bch2_gc_btrees(struct bch_fs *c, bool initial, bool metadata_only) +@@ -1126,7 +1125,7 @@ static void mark_metadata_sectors(struct bch_fs *c, struct bch_dev *ca, + min_t(u64, bucket_to_sector(ca, b + 1), end) - start; + + bch2_mark_metadata_bucket(c, ca, b, type, sectors, +- gc_phase(GC_PHASE_SB), flags); ++ gc_phase(GC_PHASE_sb), flags); + b++; + start += sectors; + } while (start < end); +@@ -1155,14 +1154,14 @@ static void bch2_mark_dev_superblock(struct bch_fs *c, struct bch_dev *ca, + b = ca->journal.buckets[i]; + bch2_mark_metadata_bucket(c, ca, b, BCH_DATA_journal, + ca->mi.bucket_size, +- gc_phase(GC_PHASE_SB), flags); ++ gc_phase(GC_PHASE_sb), flags); + } + } + + static void bch2_mark_superblocks(struct bch_fs *c) + { + mutex_lock(&c->sb_lock); +- gc_pos_set(c, gc_phase(GC_PHASE_SB)); ++ gc_pos_set(c, gc_phase(GC_PHASE_sb)); + + for_each_online_member(c, ca) + bch2_mark_dev_superblock(c, ca, BTREE_TRIGGER_GC); +@@ -1773,7 +1772,7 @@ int bch2_gc(struct bch_fs *c, bool initial, bool metadata_only) + if (ret) + goto out; + again: +- gc_pos_set(c, gc_phase(GC_PHASE_START)); ++ gc_pos_set(c, gc_phase(GC_PHASE_start)); + + bch2_mark_superblocks(c); + +@@ -1800,7 +1799,7 @@ int bch2_gc(struct bch_fs *c, bool initial, bool metadata_only) + */ + bch_info(c, "Second GC pass needed, restarting:"); + clear_bit(BCH_FS_need_another_gc, &c->flags); +- __gc_pos_set(c, gc_phase(GC_PHASE_NOT_RUNNING)); ++ __gc_pos_set(c, gc_phase(GC_PHASE_not_running)); + + bch2_gc_stripes_reset(c, metadata_only); + bch2_gc_alloc_reset(c, metadata_only); +@@ -1827,7 +1826,7 @@ int bch2_gc(struct bch_fs *c, bool initial, bool metadata_only) + + percpu_down_write(&c->mark_lock); + /* Indicates that gc is no longer in progress: */ +- __gc_pos_set(c, gc_phase(GC_PHASE_NOT_RUNNING)); ++ __gc_pos_set(c, gc_phase(GC_PHASE_not_running)); + + bch2_gc_free(c); + percpu_up_write(&c->mark_lock); +diff --git a/fs/bcachefs/btree_gc.h b/fs/bcachefs/btree_gc.h +index 607575f83a002..5c97eb6a38790 100644 +--- a/fs/bcachefs/btree_gc.h ++++ b/fs/bcachefs/btree_gc.h +@@ -3,6 +3,7 @@ + #define _BCACHEFS_BTREE_GC_H + + #include "bkey.h" ++#include "btree_gc_types.h" + #include "btree_types.h" + + int bch2_check_topology(struct bch_fs *); +@@ -35,38 +36,17 @@ int bch2_gc_thread_start(struct bch_fs *); + /* Position of (the start of) a gc phase: */ + static inline struct gc_pos gc_phase(enum gc_phase phase) + { +- return (struct gc_pos) { +- .phase = phase, +- .pos = POS_MIN, +- .level = 0, +- }; +-} +- +-static inline int gc_pos_cmp(struct gc_pos l, struct gc_pos r) +-{ +- return cmp_int(l.phase, r.phase) ?: +- bpos_cmp(l.pos, r.pos) ?: +- cmp_int(l.level, r.level); +-} +- +-static inline enum gc_phase btree_id_to_gc_phase(enum btree_id id) +-{ +- switch (id) { +-#define x(name, v, ...) case BTREE_ID_##name: return GC_PHASE_BTREE_##name; +- BCH_BTREE_IDS() +-#undef x +- default: +- BUG(); +- } ++ return (struct gc_pos) { .phase = phase, }; + } + +-static inline struct gc_pos gc_pos_btree(enum btree_id id, ++static inline struct gc_pos gc_pos_btree(enum btree_id btree, + struct bpos pos, unsigned level) + { + return (struct gc_pos) { +- .phase = btree_id_to_gc_phase(id), +- .pos = pos, ++ .phase = GC_PHASE_btree, ++ .btree = btree, + .level = level, ++ .pos = pos, + }; + } + +@@ -91,6 +71,22 @@ static inline struct gc_pos gc_pos_btree_root(enum btree_id id) + return gc_pos_btree(id, SPOS_MAX, BTREE_MAX_DEPTH); + } + ++static inline int gc_btree_order(enum btree_id btree) ++{ ++ if (btree == BTREE_ID_stripes) ++ return -1; ++ return btree; ++} ++ ++static inline int gc_pos_cmp(struct gc_pos l, struct gc_pos r) ++{ ++ return cmp_int(l.phase, r.phase) ?: ++ cmp_int(gc_btree_order(l.btree), ++ gc_btree_order(r.btree)) ?: ++ -cmp_int(l.level, r.level) ?: ++ bpos_cmp(l.pos, r.pos); ++} ++ + static inline bool gc_visited(struct bch_fs *c, struct gc_pos pos) + { + unsigned seq; +diff --git a/fs/bcachefs/btree_gc_types.h b/fs/bcachefs/btree_gc_types.h +new file mode 100644 +index 0000000000000..b82c24bcc0880 +--- /dev/null ++++ b/fs/bcachefs/btree_gc_types.h +@@ -0,0 +1,29 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _BCACHEFS_BTREE_GC_TYPES_H ++#define _BCACHEFS_BTREE_GC_TYPES_H ++ ++#include <linux/generic-radix-tree.h> ++ ++enum gc_phase { ++ GC_PHASE_not_running, ++ GC_PHASE_start, ++ GC_PHASE_sb, ++ GC_PHASE_btree, ++}; ++ ++struct gc_pos { ++ enum gc_phase phase:8; ++ enum btree_id btree:8; ++ u16 level; ++ struct bpos pos; ++}; ++ ++struct reflink_gc { ++ u64 offset; ++ u32 size; ++ u32 refcount; ++}; ++ ++typedef GENRADIX(struct reflink_gc) reflink_gc_table; ++ ++#endif /* _BCACHEFS_BTREE_GC_TYPES_H */ +diff --git a/fs/bcachefs/ec.c b/fs/bcachefs/ec.c +index 556a217108d32..0a49c2e9955ad 100644 +--- a/fs/bcachefs/ec.c ++++ b/fs/bcachefs/ec.c +@@ -880,7 +880,7 @@ static int __ec_stripe_mem_alloc(struct bch_fs *c, size_t idx, gfp_t gfp) + if (!genradix_ptr_alloc(&c->stripes, idx, gfp)) + return -BCH_ERR_ENOMEM_ec_stripe_mem_alloc; + +- if (c->gc_pos.phase != GC_PHASE_NOT_RUNNING && ++ if (c->gc_pos.phase != GC_PHASE_not_running && + !genradix_ptr_alloc(&c->gc_stripes, idx, gfp)) + return -BCH_ERR_ENOMEM_ec_stripe_mem_alloc; + +diff --git a/fs/bcachefs/sb-downgrade.c b/fs/bcachefs/sb-downgrade.c +index a98ef940b7a32..ed6d298bc19c9 100644 +--- a/fs/bcachefs/sb-downgrade.c ++++ b/fs/bcachefs/sb-downgrade.c +@@ -134,7 +134,8 @@ downgrade_entry_next_c(const struct bch_sb_field_downgrade_entry *e) + #define for_each_downgrade_entry(_d, _i) \ + for (const struct bch_sb_field_downgrade_entry *_i = (_d)->entries; \ + (void *) _i < vstruct_end(&(_d)->field) && \ +- (void *) &_i->errors[0] < vstruct_end(&(_d)->field); \ ++ (void *) &_i->errors[0] <= vstruct_end(&(_d)->field) && \ ++ (void *) downgrade_entry_next_c(_i) <= vstruct_end(&(_d)->field); \ + _i = downgrade_entry_next_c(_i)) + + static int bch2_sb_downgrade_validate(struct bch_sb *sb, struct bch_sb_field *f, +@@ -142,7 +143,17 @@ static int bch2_sb_downgrade_validate(struct bch_sb *sb, struct bch_sb_field *f, + { + struct bch_sb_field_downgrade *e = field_to_type(f, downgrade); + +- for_each_downgrade_entry(e, i) { ++ for (const struct bch_sb_field_downgrade_entry *i = e->entries; ++ (void *) i < vstruct_end(&e->field); ++ i = downgrade_entry_next_c(i)) { ++ /* ++ * Careful: sb_field_downgrade_entry is only 2 byte aligned, but ++ * section sizes are 8 byte aligned - an empty entry spanning ++ * the end of the section is allowed (and ignored): ++ */ ++ if ((void *) &i->errors[0] > vstruct_end(&e->field)) ++ break; ++ + if (BCH_VERSION_MAJOR(le16_to_cpu(i->version)) != + BCH_VERSION_MAJOR(le16_to_cpu(sb->version))) { + prt_printf(err, "downgrade entry with mismatched major version (%u != %u)", +@@ -214,7 +225,7 @@ int bch2_sb_downgrade_update(struct bch_fs *c) + + dst = (void *) &darray_top(table); + dst->version = cpu_to_le16(src->version); +- dst->recovery_passes[0] = cpu_to_le64(src->recovery_passes); ++ dst->recovery_passes[0] = cpu_to_le64(bch2_recovery_passes_to_stable(src->recovery_passes)); + dst->recovery_passes[1] = 0; + dst->nr_errors = cpu_to_le16(src->nr_errors); + for (unsigned i = 0; i < src->nr_errors; i++) +diff --git a/fs/bcachefs/super-io.c b/fs/bcachefs/super-io.c +index bfdb15e7d778e..a337246e912aa 100644 +--- a/fs/bcachefs/super-io.c ++++ b/fs/bcachefs/super-io.c +@@ -1123,18 +1123,12 @@ bool bch2_check_version_downgrade(struct bch_fs *c) + * c->sb will be checked before we write the superblock, so update it as + * well: + */ +- if (BCH_SB_VERSION_UPGRADE_COMPLETE(c->disk_sb.sb) > bcachefs_metadata_version_current) { ++ if (BCH_SB_VERSION_UPGRADE_COMPLETE(c->disk_sb.sb) > bcachefs_metadata_version_current) + SET_BCH_SB_VERSION_UPGRADE_COMPLETE(c->disk_sb.sb, bcachefs_metadata_version_current); +- c->sb.version_upgrade_complete = bcachefs_metadata_version_current; +- } +- if (c->sb.version > bcachefs_metadata_version_current) { ++ if (c->sb.version > bcachefs_metadata_version_current) + c->disk_sb.sb->version = cpu_to_le16(bcachefs_metadata_version_current); +- c->sb.version = bcachefs_metadata_version_current; +- } +- if (c->sb.version_min > bcachefs_metadata_version_current) { ++ if (c->sb.version_min > bcachefs_metadata_version_current) + c->disk_sb.sb->version_min = cpu_to_le16(bcachefs_metadata_version_current); +- c->sb.version_min = bcachefs_metadata_version_current; +- } + c->disk_sb.sb->compat[0] &= cpu_to_le64((1ULL << BCH_COMPAT_NR) - 1); + return ret; + } +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index c8a05d5eb9cbc..b642df5e52558 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2697,7 +2697,7 @@ static int __btrfs_add_free_space_zoned(struct btrfs_block_group *block_group, + u64 offset = bytenr - block_group->start; + u64 to_free, to_unusable; + int bg_reclaim_threshold = 0; +- bool initial = (size == block_group->length); ++ bool initial = ((size == block_group->length) && (block_group->alloc_offset == 0)); + u64 reclaimable_unusable; + + WARN_ON(!initial && offset + size > block_group->zone_capacity); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index d4fc5fedd8ee5..9d156aa8f20d1 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -138,6 +138,25 @@ static void wait_log_commit(struct btrfs_root *root, int transid); + * and once to do all the other items. + */ + ++static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) ++{ ++ unsigned int nofs_flag; ++ struct inode *inode; ++ ++ /* ++ * We're holding a transaction handle whether we are logging or ++ * replaying a log tree, so we must make sure NOFS semantics apply ++ * because btrfs_alloc_inode() may be triggered and it uses GFP_KERNEL ++ * to allocate an inode, which can recurse back into the filesystem and ++ * attempt a transaction commit, resulting in a deadlock. ++ */ ++ nofs_flag = memalloc_nofs_save(); ++ inode = btrfs_iget(root->fs_info->sb, objectid, root); ++ memalloc_nofs_restore(nofs_flag); ++ ++ return inode; ++} ++ + /* + * start a sub transaction and setup the log tree + * this increments the log tree writer count to make the people +@@ -600,7 +619,7 @@ static noinline struct inode *read_one_inode(struct btrfs_root *root, + { + struct inode *inode; + +- inode = btrfs_iget(root->fs_info->sb, objectid, root); ++ inode = btrfs_iget_logging(objectid, root); + if (IS_ERR(inode)) + inode = NULL; + return inode; +@@ -5434,7 +5453,6 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, + struct btrfs_log_ctx *ctx) + { + struct btrfs_root *root = start_inode->root; +- struct btrfs_fs_info *fs_info = root->fs_info; + struct btrfs_path *path; + LIST_HEAD(dir_list); + struct btrfs_dir_list *dir_elem; +@@ -5495,7 +5513,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, + continue; + + btrfs_release_path(path); +- di_inode = btrfs_iget(fs_info->sb, di_key.objectid, root); ++ di_inode = btrfs_iget_logging(di_key.objectid, root); + if (IS_ERR(di_inode)) { + ret = PTR_ERR(di_inode); + goto out; +@@ -5555,7 +5573,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, + btrfs_add_delayed_iput(curr_inode); + curr_inode = NULL; + +- vfs_inode = btrfs_iget(fs_info->sb, ino, root); ++ vfs_inode = btrfs_iget_logging(ino, root); + if (IS_ERR(vfs_inode)) { + ret = PTR_ERR(vfs_inode); + break; +@@ -5650,7 +5668,7 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans, + if (ctx->num_conflict_inodes >= MAX_CONFLICT_INODES) + return BTRFS_LOG_FORCE_COMMIT; + +- inode = btrfs_iget(root->fs_info->sb, ino, root); ++ inode = btrfs_iget_logging(ino, root); + /* + * If the other inode that had a conflicting dir entry was deleted in + * the current transaction then we either: +@@ -5751,7 +5769,6 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, + struct btrfs_root *root, + struct btrfs_log_ctx *ctx) + { +- struct btrfs_fs_info *fs_info = root->fs_info; + int ret = 0; + + /* +@@ -5782,7 +5799,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, + list_del(&curr->list); + kfree(curr); + +- inode = btrfs_iget(fs_info->sb, ino, root); ++ inode = btrfs_iget_logging(ino, root); + /* + * If the other inode that had a conflicting dir entry was + * deleted in the current transaction, we need to log its parent +@@ -5793,7 +5810,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, + if (ret != -ENOENT) + break; + +- inode = btrfs_iget(fs_info->sb, parent, root); ++ inode = btrfs_iget_logging(parent, root); + if (IS_ERR(inode)) { + ret = PTR_ERR(inode); + break; +@@ -6315,7 +6332,6 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, + struct btrfs_log_ctx *ctx) + { + const bool orig_log_new_dentries = ctx->log_new_dentries; +- struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_delayed_item *item; + int ret = 0; + +@@ -6341,7 +6357,7 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, + if (key.type == BTRFS_ROOT_ITEM_KEY) + continue; + +- di_inode = btrfs_iget(fs_info->sb, key.objectid, inode->root); ++ di_inode = btrfs_iget_logging(key.objectid, inode->root); + if (IS_ERR(di_inode)) { + ret = PTR_ERR(di_inode); + break; +@@ -6725,7 +6741,6 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, + struct btrfs_inode *inode, + struct btrfs_log_ctx *ctx) + { +- struct btrfs_fs_info *fs_info = trans->fs_info; + int ret; + struct btrfs_path *path; + struct btrfs_key key; +@@ -6790,8 +6805,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, + cur_offset = item_size; + } + +- dir_inode = btrfs_iget(fs_info->sb, inode_key.objectid, +- root); ++ dir_inode = btrfs_iget_logging(inode_key.objectid, root); + /* + * If the parent inode was deleted, return an error to + * fallback to a transaction commit. This is to prevent +@@ -6853,7 +6867,6 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, + btrfs_item_key_to_cpu(path->nodes[0], &found_key, path->slots[0]); + + while (true) { +- struct btrfs_fs_info *fs_info = root->fs_info; + struct extent_buffer *leaf; + int slot; + struct btrfs_key search_key; +@@ -6868,7 +6881,7 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, + search_key.objectid = found_key.offset; + search_key.type = BTRFS_INODE_ITEM_KEY; + search_key.offset = 0; +- inode = btrfs_iget(fs_info->sb, ino, root); ++ inode = btrfs_iget_logging(ino, root); + if (IS_ERR(inode)) + return PTR_ERR(inode); + +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 8cddf955ebc0c..a6dd68b458cec 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -1108,7 +1108,8 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + lops_before_commit(sdp, tr); + if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; +- gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE); ++ if (sdp->sd_jdesc) ++ gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE); + if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 2d780b4701a23..ee61fcb7f200d 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -67,9 +67,13 @@ void gfs2_jindex_free(struct gfs2_sbd *sdp) + sdp->sd_journals = 0; + spin_unlock(&sdp->sd_jindex_spin); + ++ down_write(&sdp->sd_log_flush_lock); + sdp->sd_jdesc = NULL; ++ up_write(&sdp->sd_log_flush_lock); ++ + while (!list_empty(&list)) { + jd = list_first_entry(&list, struct gfs2_jdesc, jd_list); ++ BUG_ON(jd->jd_log_bio); + gfs2_free_journal_extents(jd); + list_del(&jd->jd_list); + iput(jd->jd_inode); +diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c +index 912ad0a1df021..d2ce0849bb53d 100644 +--- a/fs/netfs/buffered_write.c ++++ b/fs/netfs/buffered_write.c +@@ -507,6 +507,7 @@ vm_fault_t netfs_page_mkwrite(struct vm_fault *vmf, struct netfs_group *netfs_gr + { + struct folio *folio = page_folio(vmf->page); + struct file *file = vmf->vma->vm_file; ++ struct address_space *mapping = file->f_mapping; + struct inode *inode = file_inode(file); + vm_fault_t ret = VM_FAULT_RETRY; + int err; +@@ -520,6 +521,11 @@ vm_fault_t netfs_page_mkwrite(struct vm_fault *vmf, struct netfs_group *netfs_gr + + if (folio_lock_killable(folio) < 0) + goto out; ++ if (folio->mapping != mapping) { ++ folio_unlock(folio); ++ ret = VM_FAULT_NOPAGE; ++ goto out; ++ } + + /* Can we see a streaming write here? */ + if (WARN_ON(!folio_test_uptodate(folio))) { +@@ -529,9 +535,9 @@ vm_fault_t netfs_page_mkwrite(struct vm_fault *vmf, struct netfs_group *netfs_gr + + if (netfs_folio_group(folio) != netfs_group) { + folio_unlock(folio); +- err = filemap_fdatawait_range(inode->i_mapping, +- folio_pos(folio), +- folio_pos(folio) + folio_size(folio)); ++ err = filemap_fdatawrite_range(mapping, ++ folio_pos(folio), ++ folio_pos(folio) + folio_size(folio)); + switch (err) { + case 0: + ret = VM_FAULT_RETRY; +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index bb2f583eb28bf..90079ca134dd3 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -141,8 +141,6 @@ int nfs_swap_rw(struct kiocb *iocb, struct iov_iter *iter) + { + ssize_t ret; + +- VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); +- + if (iov_iter_rw(iter) == READ) + ret = nfs_file_direct_read(iocb, iter, true); + else +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 4d23bb1d08c0a..332847daa1b41 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -1679,6 +1679,8 @@ static __net_init int nfsd_net_init(struct net *net) + nn->nfsd_svcstats.program = &nfsd_program; + nn->nfsd_versions = NULL; + nn->nfsd4_minorversions = NULL; ++ nn->nfsd_info.mutex = &nfsd_mutex; ++ nn->nfsd_serv = NULL; + nfsd4_init_leases_net(nn); + get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key)); + seqlock_init(&nn->writeverf_lock); +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index c0d17b92b249f..f23b00cb9f631 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -673,7 +673,6 @@ int nfsd_create_serv(struct net *net) + return error; + } + spin_lock(&nfsd_notifier_lock); +- nn->nfsd_info.mutex = &nfsd_mutex; + nn->nfsd_serv = serv; + spin_unlock(&nfsd_notifier_lock); + +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index b82185075de7d..469143110f310 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2368,6 +2368,11 @@ static int ocfs2_dio_end_io_write(struct inode *inode, + } + + list_for_each_entry(ue, &dwc->dw_zero_list, ue_node) { ++ ret = ocfs2_assure_trans_credits(handle, credits); ++ if (ret < 0) { ++ mlog_errno(ret); ++ break; ++ } + ret = ocfs2_mark_extent_written(inode, &et, handle, + ue->ue_cpos, 1, + ue->ue_phys, +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c +index 86807086b2dfd..530fba34f6d31 100644 +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -445,6 +445,23 @@ int ocfs2_extend_trans(handle_t *handle, int nblocks) + return status; + } + ++/* ++ * Make sure handle has at least 'nblocks' credits available. If it does not ++ * have that many credits available, we will try to extend the handle to have ++ * enough credits. If that fails, we will restart transaction to have enough ++ * credits. Similar notes regarding data consistency and locking implications ++ * as for ocfs2_extend_trans() apply here. ++ */ ++int ocfs2_assure_trans_credits(handle_t *handle, int nblocks) ++{ ++ int old_nblks = jbd2_handle_buffer_credits(handle); ++ ++ trace_ocfs2_assure_trans_credits(old_nblks); ++ if (old_nblks >= nblocks) ++ return 0; ++ return ocfs2_extend_trans(handle, nblocks - old_nblks); ++} ++ + /* + * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA. + * If that fails, restart the transaction & regain write access for the +diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h +index 41c9fe7e62f9b..e3c3a35dc5e0e 100644 +--- a/fs/ocfs2/journal.h ++++ b/fs/ocfs2/journal.h +@@ -243,6 +243,8 @@ handle_t *ocfs2_start_trans(struct ocfs2_super *osb, + int ocfs2_commit_trans(struct ocfs2_super *osb, + handle_t *handle); + int ocfs2_extend_trans(handle_t *handle, int nblocks); ++int ocfs2_assure_trans_credits(handle_t *handle, ++ int nblocks); + int ocfs2_allocate_extend_trans(handle_t *handle, + int thresh); + +diff --git a/fs/ocfs2/ocfs2_trace.h b/fs/ocfs2/ocfs2_trace.h +index 9898c11bdfa1b..d194d202413da 100644 +--- a/fs/ocfs2/ocfs2_trace.h ++++ b/fs/ocfs2/ocfs2_trace.h +@@ -2577,6 +2577,8 @@ DEFINE_OCFS2_ULL_UINT_EVENT(ocfs2_commit_cache_end); + + DEFINE_OCFS2_INT_INT_EVENT(ocfs2_extend_trans); + ++DEFINE_OCFS2_INT_EVENT(ocfs2_assure_trans_credits); ++ + DEFINE_OCFS2_INT_EVENT(ocfs2_extend_trans_restart); + + DEFINE_OCFS2_INT_INT_EVENT(ocfs2_allocate_extend_trans); +diff --git a/fs/open.c b/fs/open.c +index ee8460c83c779..0131ae30351ec 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -202,13 +202,13 @@ long do_sys_ftruncate(unsigned int fd, loff_t length, int small) + return error; + } + +-SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length) ++SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } + + #ifdef CONFIG_COMPAT +-COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length) ++COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } +diff --git a/include/linux/compat.h b/include/linux/compat.h +index 233f61ec8afca..56cebaff0c910 100644 +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -608,7 +608,7 @@ asmlinkage long compat_sys_fstatfs(unsigned int fd, + asmlinkage long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, + struct compat_statfs64 __user *buf); + asmlinkage long compat_sys_truncate(const char __user *, compat_off_t); +-asmlinkage long compat_sys_ftruncate(unsigned int, compat_ulong_t); ++asmlinkage long compat_sys_ftruncate(unsigned int, compat_off_t); + /* No generic prototype for truncate64, ftruncate64, fallocate */ + asmlinkage long compat_sys_openat(int dfd, const char __user *filename, + int flags, umode_t mode); +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 219ee7a768744..cf12bfa2a78cc 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -887,20 +887,22 @@ bpf_ctx_narrow_access_offset(u32 off, u32 size, u32 size_default) + + #define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0])) + +-static inline void bpf_prog_lock_ro(struct bpf_prog *fp) ++static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp) + { + #ifndef CONFIG_BPF_JIT_ALWAYS_ON + if (!fp->jited) { + set_vm_flush_reset_perms(fp); +- set_memory_ro((unsigned long)fp, fp->pages); ++ return set_memory_ro((unsigned long)fp, fp->pages); + } + #endif ++ return 0; + } + +-static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) ++static inline int __must_check ++bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) + { + set_vm_flush_reset_perms(hdr); +- set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT); ++ return set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT); + } + + int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap); +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index ac5be38d8aaf0..4fd9735bb75e5 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -5166,7 +5166,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) + bool check_common_len = false; + u16 control; + +- if (len < fixed) ++ if (!data || len < fixed) + return false; + + control = le16_to_cpu(mle->control); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 324d792e7c786..186a6cbbbfbc6 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -1242,6 +1242,7 @@ extern int ata_slave_link_init(struct ata_port *ap); + extern struct ata_port *ata_sas_port_alloc(struct ata_host *, + struct ata_port_info *, struct Scsi_Host *); + extern void ata_port_probe(struct ata_port *ap); ++extern void ata_port_free(struct ata_port *ap); + extern int ata_sas_tport_add(struct device *parent, struct ata_port *ap); + extern void ata_sas_tport_delete(struct ata_port *ap); + extern int ata_sas_slave_configure(struct scsi_device *, struct ata_port *); +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index c11b7cde81efa..a4f6f1fecc6f3 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -651,13 +651,12 @@ enum zone_watermarks { + }; + + /* +- * One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. One additional list +- * for THP which will usually be GFP_MOVABLE. Even if it is another type, +- * it should not contribute to serious fragmentation causing THP allocation +- * failures. ++ * One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. Two additional lists ++ * are added for THP. One PCP list is used by GPF_MOVABLE, and the other PCP list ++ * is used by GFP_UNMOVABLE and GFP_RECLAIMABLE. + */ + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +-#define NR_PCP_THP 1 ++#define NR_PCP_THP 2 + #else + #define NR_PCP_THP 0 + #endif +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index 4255732022953..c693ac344ec05 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -85,10 +85,11 @@ enum { + enum { + NVMF_RDMA_QPTYPE_CONNECTED = 1, /* Reliable Connected */ + NVMF_RDMA_QPTYPE_DATAGRAM = 2, /* Reliable Datagram */ ++ NVMF_RDMA_QPTYPE_INVALID = 0xff, + }; + +-/* RDMA QP Service Type codes for Discovery Log Page entry TSAS +- * RDMA_QPTYPE field ++/* RDMA Provider Type codes for Discovery Log Page entry TSAS ++ * RDMA_PRTYPE field + */ + enum { + NVMF_RDMA_PRTYPE_NOT_SPECIFIED = 1, /* No Provider Specified */ +@@ -110,6 +111,7 @@ enum { + NVMF_TCP_SECTYPE_NONE = 0, /* No Security */ + NVMF_TCP_SECTYPE_TLS12 = 1, /* TLSv1.2, NVMe-oF 1.1 and NVMe-TCP 3.6.1.1 */ + NVMF_TCP_SECTYPE_TLS13 = 2, /* TLSv1.3, NVMe-oF 1.1 and NVMe-TCP 3.6.1.1 */ ++ NVMF_TCP_SECTYPE_INVALID = 0xff, + }; + + #define NVME_AQ_DEPTH 32 +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 0a0f6e21d40ec..4697b8f450445 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -789,8 +789,7 @@ enum UART_TX_FLAGS { + if (pending < WAKEUP_CHARS) { \ + uart_write_wakeup(__port); \ + \ +- if (!((flags) & UART_TX_NOSTOP) && pending == 0 && \ +- __port->ops->tx_empty(__port)) \ ++ if (!((flags) & UART_TX_NOSTOP) && pending == 0) \ + __port->ops->stop_tx(__port); \ + } \ + \ +@@ -829,6 +828,24 @@ enum UART_TX_FLAGS { + __count--); \ + }) + ++/** ++ * uart_port_tx_limited_flags -- transmit helper for uart_port with count limiting with flags ++ * @port: uart port ++ * @ch: variable to store a character to be written to the HW ++ * @flags: %UART_TX_NOSTOP or similar ++ * @count: a limit of characters to send ++ * @tx_ready: can HW accept more data function ++ * @put_char: function to write a character ++ * @tx_done: function to call after the loop is done ++ * ++ * See uart_port_tx_limited() for more details. ++ */ ++#define uart_port_tx_limited_flags(port, ch, flags, count, tx_ready, put_char, tx_done) ({ \ ++ unsigned int __count = (count); \ ++ __uart_port_tx(port, ch, flags, tx_ready, put_char, tx_done, __count, \ ++ __count--); \ ++}) ++ + /** + * uart_port_tx -- transmit helper for uart_port + * @port: uart port +diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h +index e619ac10cd234..ac3db59a74e23 100644 +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -418,7 +418,7 @@ asmlinkage long sys_listmount(const struct mnt_id_req __user *req, + u64 __user *mnt_ids, size_t nr_mnt_ids, + unsigned int flags); + asmlinkage long sys_truncate(const char __user *path, long length); +-asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length); ++asmlinkage long sys_ftruncate(unsigned int fd, off_t length); + #if BITS_PER_LONG == 32 + asmlinkage long sys_truncate64(const char __user *path, loff_t length); + asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length); +@@ -858,9 +858,15 @@ asmlinkage long sys_prlimit64(pid_t pid, unsigned int resource, + const struct rlimit64 __user *new_rlim, + struct rlimit64 __user *old_rlim); + asmlinkage long sys_fanotify_init(unsigned int flags, unsigned int event_f_flags); ++#if defined(CONFIG_ARCH_SPLIT_ARG64) ++asmlinkage long sys_fanotify_mark(int fanotify_fd, unsigned int flags, ++ unsigned int mask_1, unsigned int mask_2, ++ int dfd, const char __user * pathname); ++#else + asmlinkage long sys_fanotify_mark(int fanotify_fd, unsigned int flags, + u64 mask, int fd, + const char __user *pathname); ++#endif + asmlinkage long sys_name_to_handle_at(int dfd, const char __user *name, + struct file_handle __user *handle, + int __user *mnt_id, int flag); +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 158784dd189ab..72031fa804147 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -92,7 +92,7 @@ enum wq_misc_consts { + WORK_BUSY_RUNNING = 1 << 1, + + /* maximum string length for set_worker_desc() */ +- WORKER_DESC_LEN = 24, ++ WORKER_DESC_LEN = 32, + }; + + /* Convenience constants - of type 'unsigned long', not 'enum'! */ +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index ccf171f7eb60d..146ece8563cae 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -266,7 +266,7 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk, + struct sock *inet_csk_reqsk_queue_add(struct sock *sk, + struct request_sock *req, + struct sock *child); +-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, ++bool inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, + unsigned long timeout); + struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child, + struct request_sock *req, +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 3f1ed467f951f..2164fa350fa69 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -619,6 +619,11 @@ static inline void *nft_set_priv(const struct nft_set *set) + return (void *)set->data; + } + ++static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) ++{ ++ return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; ++} ++ + static inline bool nft_set_gc_is_pending(const struct nft_set *s) + { + return refcount_read(&s->refs) != 1; +diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h +index 1f4258308b967..061fd49603035 100644 +--- a/include/trace/events/qdisc.h ++++ b/include/trace/events/qdisc.h +@@ -81,14 +81,14 @@ TRACE_EVENT(qdisc_reset, + TP_ARGS(q), + + TP_STRUCT__entry( +- __string( dev, qdisc_dev(q)->name ) ++ __string( dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)" ) + __string( kind, q->ops->id ) + __field( u32, parent ) + __field( u32, handle ) + ), + + TP_fast_assign( +- __assign_str(dev, qdisc_dev(q)->name); ++ __assign_str(dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)"); + __assign_str(kind, q->ops->id); + __entry->parent = q->parent; + __entry->handle = q->handle; +diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h +index 75f00965ab158..060f68e4195bd 100644 +--- a/include/uapi/asm-generic/unistd.h ++++ b/include/uapi/asm-generic/unistd.h +@@ -737,7 +737,7 @@ __SC_COMP(__NR_pselect6_time64, sys_pselect6, compat_sys_pselect6_time64) + #define __NR_ppoll_time64 414 + __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index 8a216b1d6dc1c..d3926a27714e2 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -1374,8 +1374,8 @@ static void io_req_normal_work_add(struct io_kiocb *req) + if (ctx->flags & IORING_SETUP_SQPOLL) { + struct io_sq_data *sqd = ctx->sq_data; + +- if (wq_has_sleeper(&sqd->wait)) +- wake_up(&sqd->wait); ++ if (sqd->thread) ++ __set_notify_signal(sqd->thread); + return; + } + +diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c +index 343c3456c8ddf..a59ae9c582253 100644 +--- a/kernel/bpf/arena.c ++++ b/kernel/bpf/arena.c +@@ -212,6 +212,7 @@ static u64 arena_map_mem_usage(const struct bpf_map *map) + struct vma_list { + struct vm_area_struct *vma; + struct list_head head; ++ atomic_t mmap_count; + }; + + static int remember_vma(struct bpf_arena *arena, struct vm_area_struct *vma) +@@ -221,20 +222,30 @@ static int remember_vma(struct bpf_arena *arena, struct vm_area_struct *vma) + vml = kmalloc(sizeof(*vml), GFP_KERNEL); + if (!vml) + return -ENOMEM; ++ atomic_set(&vml->mmap_count, 1); + vma->vm_private_data = vml; + vml->vma = vma; + list_add(&vml->head, &arena->vma_list); + return 0; + } + ++static void arena_vm_open(struct vm_area_struct *vma) ++{ ++ struct vma_list *vml = vma->vm_private_data; ++ ++ atomic_inc(&vml->mmap_count); ++} ++ + static void arena_vm_close(struct vm_area_struct *vma) + { + struct bpf_map *map = vma->vm_file->private_data; + struct bpf_arena *arena = container_of(map, struct bpf_arena, map); +- struct vma_list *vml; ++ struct vma_list *vml = vma->vm_private_data; + ++ if (!atomic_dec_and_test(&vml->mmap_count)) ++ return; + guard(mutex)(&arena->lock); +- vml = vma->vm_private_data; ++ /* update link list under lock */ + list_del(&vml->head); + vma->vm_private_data = NULL; + kfree(vml); +@@ -287,6 +298,7 @@ static vm_fault_t arena_vm_fault(struct vm_fault *vmf) + } + + static const struct vm_operations_struct arena_vm_ops = { ++ .open = arena_vm_open, + .close = arena_vm_close, + .fault = arena_vm_fault, + }; +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 1ea5ce5bb5993..80bcfde927206 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2204,6 +2204,7 @@ static unsigned int PROG_NAME(stack_size)(const void *ctx, const struct bpf_insn + u64 stack[stack_size / sizeof(u64)]; \ + u64 regs[MAX_BPF_EXT_REG] = {}; \ + \ ++ kmsan_unpoison_memory(stack, sizeof(stack)); \ + FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \ + ARG1 = (u64) (unsigned long) ctx; \ + return ___bpf_prog_run(regs, insn); \ +@@ -2217,6 +2218,7 @@ static u64 PROG_NAME_ARGS(stack_size)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5, \ + u64 stack[stack_size / sizeof(u64)]; \ + u64 regs[MAX_BPF_EXT_REG]; \ + \ ++ kmsan_unpoison_memory(stack, sizeof(stack)); \ + FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \ + BPF_R1 = r1; \ + BPF_R2 = r2; \ +@@ -2403,7 +2405,9 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) + } + + finalize: +- bpf_prog_lock_ro(fp); ++ *err = bpf_prog_lock_ro(fp); ++ if (*err) ++ return fp; + + /* The tail call compatibility check can only be done at + * this late stage as we need to determine, if we deal +diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c +index 0ee653a936ea0..e20b90c361316 100644 +--- a/kernel/bpf/ringbuf.c ++++ b/kernel/bpf/ringbuf.c +@@ -51,7 +51,8 @@ struct bpf_ringbuf { + * This prevents a user-space application from modifying the + * position and ruining in-kernel tracking. The permissions of the + * pages depend on who is producing samples: user-space or the +- * kernel. ++ * kernel. Note that the pending counter is placed in the same ++ * page as the producer, so that it shares the same cache line. + * + * Kernel-producer + * --------------- +@@ -70,6 +71,7 @@ struct bpf_ringbuf { + */ + unsigned long consumer_pos __aligned(PAGE_SIZE); + unsigned long producer_pos __aligned(PAGE_SIZE); ++ unsigned long pending_pos; + char data[] __aligned(PAGE_SIZE); + }; + +@@ -179,6 +181,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) + rb->mask = data_sz - 1; + rb->consumer_pos = 0; + rb->producer_pos = 0; ++ rb->pending_pos = 0; + + return rb; + } +@@ -404,9 +407,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) + + static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + { +- unsigned long cons_pos, prod_pos, new_prod_pos, flags; +- u32 len, pg_off; ++ unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; + struct bpf_ringbuf_hdr *hdr; ++ u32 len, pg_off, tmp_size, hdr_len; + + if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) + return NULL; +@@ -424,13 +427,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + spin_lock_irqsave(&rb->spinlock, flags); + } + ++ pend_pos = rb->pending_pos; + prod_pos = rb->producer_pos; + new_prod_pos = prod_pos + len; + +- /* check for out of ringbuf space by ensuring producer position +- * doesn't advance more than (ringbuf_size - 1) ahead ++ while (pend_pos < prod_pos) { ++ hdr = (void *)rb->data + (pend_pos & rb->mask); ++ hdr_len = READ_ONCE(hdr->len); ++ if (hdr_len & BPF_RINGBUF_BUSY_BIT) ++ break; ++ tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; ++ tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); ++ pend_pos += tmp_size; ++ } ++ rb->pending_pos = pend_pos; ++ ++ /* check for out of ringbuf space: ++ * - by ensuring producer position doesn't advance more than ++ * (ringbuf_size - 1) ahead ++ * - by ensuring oldest not yet committed record until newest ++ * record does not span more than (ringbuf_size - 1) + */ +- if (new_prod_pos - cons_pos > rb->mask) { ++ if (new_prod_pos - cons_pos > rb->mask || ++ new_prod_pos - pend_pos > rb->mask) { + spin_unlock_irqrestore(&rb->spinlock, flags); + return NULL; + } +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 0ef18ae40bc5a..d5fca9deac5a1 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6223,6 +6223,7 @@ static void set_sext32_default_val(struct bpf_reg_state *reg, int size) + } + reg->u32_min_value = 0; + reg->u32_max_value = U32_MAX; ++ reg->var_off = tnum_subreg(tnum_unknown); + } + + static void coerce_subreg_to_size_sx(struct bpf_reg_state *reg, int size) +@@ -6267,6 +6268,7 @@ static void coerce_subreg_to_size_sx(struct bpf_reg_state *reg, int size) + reg->s32_max_value = s32_max; + reg->u32_min_value = (u32)s32_min; + reg->u32_max_value = (u32)s32_max; ++ reg->var_off = tnum_subreg(tnum_range(s32_min, s32_max)); + return; + } + +@@ -12544,6 +12546,16 @@ static bool signed_add32_overflows(s32 a, s32 b) + return res < a; + } + ++static bool signed_add16_overflows(s16 a, s16 b) ++{ ++ /* Do the add in u16, where overflow is well-defined */ ++ s16 res = (s16)((u16)a + (u16)b); ++ ++ if (b < 0) ++ return res > a; ++ return res < a; ++} ++ + static bool signed_sub_overflows(s64 a, s64 b) + { + /* Do the sub in u64, where overflow is well-defined */ +@@ -17296,11 +17308,11 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx) + goto skip_inf_loop_check; + } + if (is_may_goto_insn_at(env, insn_idx)) { +- if (states_equal(env, &sl->state, cur, RANGE_WITHIN)) { ++ if (sl->state.may_goto_depth != cur->may_goto_depth && ++ states_equal(env, &sl->state, cur, RANGE_WITHIN)) { + update_loop_entry(cur, &sl->state); + goto hit; + } +- goto skip_inf_loop_check; + } + if (calls_callback(env, insn_idx)) { + if (states_equal(env, &sl->state, cur, RANGE_WITHIN)) +@@ -18562,6 +18574,39 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of + return new_prog; + } + ++/* ++ * For all jmp insns in a given 'prog' that point to 'tgt_idx' insn adjust the ++ * jump offset by 'delta'. ++ */ ++static int adjust_jmp_off(struct bpf_prog *prog, u32 tgt_idx, u32 delta) ++{ ++ struct bpf_insn *insn = prog->insnsi; ++ u32 insn_cnt = prog->len, i; ++ ++ for (i = 0; i < insn_cnt; i++, insn++) { ++ u8 code = insn->code; ++ ++ if ((BPF_CLASS(code) != BPF_JMP && BPF_CLASS(code) != BPF_JMP32) || ++ BPF_OP(code) == BPF_CALL || BPF_OP(code) == BPF_EXIT) ++ continue; ++ ++ if (insn->code == (BPF_JMP32 | BPF_JA)) { ++ if (i + 1 + insn->imm != tgt_idx) ++ continue; ++ if (signed_add32_overflows(insn->imm, delta)) ++ return -ERANGE; ++ insn->imm += delta; ++ } else { ++ if (i + 1 + insn->off != tgt_idx) ++ continue; ++ if (signed_add16_overflows(insn->imm, delta)) ++ return -ERANGE; ++ insn->off += delta; ++ } ++ } ++ return 0; ++} ++ + static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env, + u32 off, u32 cnt) + { +@@ -19309,10 +19354,14 @@ static int jit_subprogs(struct bpf_verifier_env *env) + * bpf_prog_load will add the kallsyms for the main program. + */ + for (i = 1; i < env->subprog_cnt; i++) { +- bpf_prog_lock_ro(func[i]); +- bpf_prog_kallsyms_add(func[i]); ++ err = bpf_prog_lock_ro(func[i]); ++ if (err) ++ goto out_free; + } + ++ for (i = 1; i < env->subprog_cnt; i++) ++ bpf_prog_kallsyms_add(func[i]); ++ + /* Last step: make now unused interpreter insns from main + * prog consistent for later dump requests, so they can + * later look the same as if they were interpreted only. +@@ -19808,7 +19857,10 @@ static int do_misc_fixups(struct bpf_verifier_env *env) + + stack_depth_extra = 8; + insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_AX, BPF_REG_10, stack_off); +- insn_buf[1] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, insn->off + 2); ++ if (insn->off >= 0) ++ insn_buf[1] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, insn->off + 2); ++ else ++ insn_buf[1] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, insn->off - 1); + insn_buf[2] = BPF_ALU64_IMM(BPF_SUB, BPF_REG_AX, 1); + insn_buf[3] = BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_AX, stack_off); + cnt = 4; +@@ -20266,6 +20318,13 @@ static int do_misc_fixups(struct bpf_verifier_env *env) + if (!new_prog) + return -ENOMEM; + env->prog = prog = new_prog; ++ /* ++ * If may_goto is a first insn of a prog there could be a jmp ++ * insn that points to it, hence adjust all such jmps to point ++ * to insn after BPF_ST that inits may_goto count. ++ * Adjustment will succeed because bpf_patch_insn_data() didn't fail. ++ */ ++ WARN_ON(adjust_jmp_off(env->prog, subprog_start, 1)); + } + + /* Since poke tab is now finalized, publish aux to tracker. */ +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 563877d6c28b6..3d2bf1d50a0c4 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -1859,6 +1859,9 @@ static inline bool cpuhp_bringup_cpus_parallel(unsigned int ncpus) { return fals + + void __init bringup_nonboot_cpus(unsigned int max_cpus) + { ++ if (!max_cpus) ++ return; ++ + /* Try parallel bringup optimization if enabled */ + if (cpuhp_bringup_cpus_parallel(max_cpus)) + return; +@@ -2446,7 +2449,7 @@ EXPORT_SYMBOL_GPL(__cpuhp_state_add_instance); + * The caller needs to hold cpus read locked while calling this function. + * Return: + * On success: +- * Positive state number if @state is CPUHP_AP_ONLINE_DYN; ++ * Positive state number if @state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN; + * 0 for all other states + * On failure: proper (negative) error code + */ +@@ -2469,7 +2472,7 @@ int __cpuhp_setup_state_cpuslocked(enum cpuhp_state state, + ret = cpuhp_store_callbacks(state, name, startup, teardown, + multi_instance); + +- dynstate = state == CPUHP_AP_ONLINE_DYN; ++ dynstate = state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN; + if (ret > 0 && dynstate) { + state = ret; + ret = 0; +@@ -2500,8 +2503,8 @@ int __cpuhp_setup_state_cpuslocked(enum cpuhp_state state, + out: + mutex_unlock(&cpuhp_state_mutex); + /* +- * If the requested state is CPUHP_AP_ONLINE_DYN, return the +- * dynamically allocated state in case of success. ++ * If the requested state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN, ++ * return the dynamically allocated state in case of success. + */ + if (!ret && dynstate) + return state; +diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c +index faad00cce269c..858196ff9b894 100644 +--- a/kernel/sys_ni.c ++++ b/kernel/sys_ni.c +@@ -46,8 +46,8 @@ COND_SYSCALL(io_getevents_time32); + COND_SYSCALL(io_getevents); + COND_SYSCALL(io_pgetevents_time32); + COND_SYSCALL(io_pgetevents); +-COND_SYSCALL_COMPAT(io_pgetevents_time32); + COND_SYSCALL_COMPAT(io_pgetevents); ++COND_SYSCALL_COMPAT(io_pgetevents_time64); + COND_SYSCALL(io_uring_setup); + COND_SYSCALL(io_uring_enter); + COND_SYSCALL(io_uring_register); +diff --git a/mm/kasan/common.c b/mm/kasan/common.c +index e7c9a4dc89f82..85e7c6b4575c2 100644 +--- a/mm/kasan/common.c ++++ b/mm/kasan/common.c +@@ -532,7 +532,7 @@ void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip) + return; + + /* Unpoison the object and save alloc info for non-kmalloc() allocations. */ +- unpoison_slab_object(slab->slab_cache, ptr, size, flags); ++ unpoison_slab_object(slab->slab_cache, ptr, flags, false); + + /* Poison the redzone and save alloc info for kmalloc() allocations. */ + if (is_kmalloc_cache(slab->slab_cache)) +diff --git a/mm/memory.c b/mm/memory.c +index d2155ced45f8f..4bd6d68f1b174 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -4583,8 +4583,9 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct page *page) + if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER)) + return ret; + +- if (page != &folio->page || folio_order(folio) != HPAGE_PMD_ORDER) ++ if (folio_order(folio) != HPAGE_PMD_ORDER) + return ret; ++ page = &folio->page; + + /* + * Just backoff if any subpage of a THP is corrupted otherwise +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 14d39f34d3367..00fafda76bde9 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -521,10 +521,15 @@ static void bad_page(struct page *page, const char *reason) + + static inline unsigned int order_to_pindex(int migratetype, int order) + { ++ bool __maybe_unused movable; ++ + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + if (order > PAGE_ALLOC_COSTLY_ORDER) { + VM_BUG_ON(order != pageblock_order); +- return NR_LOWORDER_PCP_LISTS; ++ ++ movable = migratetype == MIGRATE_MOVABLE; ++ ++ return NR_LOWORDER_PCP_LISTS + movable; + } + #else + VM_BUG_ON(order > PAGE_ALLOC_COSTLY_ORDER); +@@ -538,7 +543,7 @@ static inline int pindex_to_order(unsigned int pindex) + int order = pindex / MIGRATE_PCPTYPES; + + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +- if (pindex == NR_LOWORDER_PCP_LISTS) ++ if (pindex >= NR_LOWORDER_PCP_LISTS) + order = pageblock_order; + #else + VM_BUG_ON(order > PAGE_ALLOC_COSTLY_ORDER); +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 109272b8ee2e9..2cd015e976102 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2474,6 +2474,7 @@ struct vmap_block { + struct list_head free_list; + struct rcu_head rcu_head; + struct list_head purge; ++ unsigned int cpu; + }; + + /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ +@@ -2601,8 +2602,15 @@ static void *new_vmap_block(unsigned int order, gfp_t gfp_mask) + free_vmap_area(va); + return ERR_PTR(err); + } +- +- vbq = raw_cpu_ptr(&vmap_block_queue); ++ /* ++ * list_add_tail_rcu could happened in another core ++ * rather than vb->cpu due to task migration, which ++ * is safe as list_add_tail_rcu will ensure the list's ++ * integrity together with list_for_each_rcu from read ++ * side. ++ */ ++ vb->cpu = raw_smp_processor_id(); ++ vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); + spin_lock(&vbq->lock); + list_add_tail_rcu(&vb->free_list, &vbq->free); + spin_unlock(&vbq->lock); +@@ -2630,9 +2638,10 @@ static void free_vmap_block(struct vmap_block *vb) + } + + static bool purge_fragmented_block(struct vmap_block *vb, +- struct vmap_block_queue *vbq, struct list_head *purge_list, +- bool force_purge) ++ struct list_head *purge_list, bool force_purge) + { ++ struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); ++ + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || + vb->dirty == VMAP_BBMAP_BITS) + return false; +@@ -2680,7 +2689,7 @@ static void purge_fragmented_blocks(int cpu) + continue; + + spin_lock(&vb->lock); +- purge_fragmented_block(vb, vbq, &purge, true); ++ purge_fragmented_block(vb, &purge, true); + spin_unlock(&vb->lock); + } + rcu_read_unlock(); +@@ -2817,7 +2826,7 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush) + * not purgeable, check whether there is dirty + * space to be flushed. + */ +- if (!purge_fragmented_block(vb, vbq, &purge_list, false) && ++ if (!purge_fragmented_block(vb, &purge_list, false) && + vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { + unsigned long va_start = vb->va->va_start; + unsigned long s, e; +diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c +index ac74f6ead62d5..8f6dd2c6ee41d 100644 +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -12,6 +12,7 @@ + #include <linux/errno.h> + #include <linux/etherdevice.h> + #include <linux/gfp.h> ++#include <linux/if_vlan.h> + #include <linux/jiffies.h> + #include <linux/kref.h> + #include <linux/list.h> +@@ -131,6 +132,29 @@ batadv_orig_node_vlan_get(struct batadv_orig_node *orig_node, + return vlan; + } + ++/** ++ * batadv_vlan_id_valid() - check if vlan id is in valid batman-adv encoding ++ * @vid: the VLAN identifier ++ * ++ * Return: true when either no vlan is set or if VLAN is in correct range, ++ * false otherwise ++ */ ++static bool batadv_vlan_id_valid(unsigned short vid) ++{ ++ unsigned short non_vlan = vid & ~(BATADV_VLAN_HAS_TAG | VLAN_VID_MASK); ++ ++ if (vid == 0) ++ return true; ++ ++ if (!(vid & BATADV_VLAN_HAS_TAG)) ++ return false; ++ ++ if (non_vlan) ++ return false; ++ ++ return true; ++} ++ + /** + * batadv_orig_node_vlan_new() - search and possibly create an orig_node_vlan + * object +@@ -149,6 +173,9 @@ batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node, + { + struct batadv_orig_node_vlan *vlan; + ++ if (!batadv_vlan_id_valid(vid)) ++ return NULL; ++ + spin_lock_bh(&orig_node->vlan_list_lock); + + /* first look if an object for this vid already exists */ +diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c +index a6fb89fa62785..7e8a20f2fc42b 100644 +--- a/net/can/j1939/main.c ++++ b/net/can/j1939/main.c +@@ -30,10 +30,6 @@ MODULE_ALIAS("can-proto-" __stringify(CAN_J1939)); + /* CAN_HDR: #bytes before can_frame data part */ + #define J1939_CAN_HDR (offsetof(struct can_frame, data)) + +-/* CAN_FTR: #bytes beyond data part */ +-#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \ +- sizeof(((struct can_frame *)0)->data)) +- + /* lowest layer */ + static void j1939_can_recv(struct sk_buff *iskb, void *data) + { +@@ -342,7 +338,7 @@ int j1939_send_one(struct j1939_priv *priv, struct sk_buff *skb) + memset(cf, 0, J1939_CAN_HDR); + + /* make it a full can frame again */ +- skb_put(skb, J1939_CAN_FTR + (8 - dlc)); ++ skb_put_zero(skb, 8 - dlc); + + canid = CAN_EFF_FLAG | + (skcb->priority << 26) | +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index fe3df23a25957..4be73de5033cb 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1593,8 +1593,8 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, + struct j1939_sk_buff_cb skcb = *j1939_skb_to_cb(skb); + struct j1939_session *session; + const u8 *dat; ++ int len, ret; + pgn_t pgn; +- int len; + + netdev_dbg(priv->ndev, "%s\n", __func__); + +@@ -1653,7 +1653,22 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, + session->tskey = priv->rx_tskey++; + j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_RTS); + +- WARN_ON_ONCE(j1939_session_activate(session)); ++ ret = j1939_session_activate(session); ++ if (ret) { ++ /* Entering this scope indicates an issue with the J1939 bus. ++ * Possible scenarios include: ++ * - A time lapse occurred, and a new session was initiated ++ * due to another packet being sent correctly. This could ++ * have been caused by too long interrupt, debugger, or being ++ * out-scheduled by another task. ++ * - The bus is receiving numerous erroneous packets, either ++ * from a malfunctioning device or during a test scenario. ++ */ ++ netdev_alert(priv->ndev, "%s: 0x%p: concurrent session with same addr (%02x %02x) is already active.\n", ++ __func__, session, skcb.addr.sa, skcb.addr.da); ++ j1939_session_put(session); ++ return NULL; ++ } + + return session; + } +@@ -1681,6 +1696,8 @@ static int j1939_xtp_rx_rts_session_active(struct j1939_session *session, + + j1939_session_timers_cancel(session); + j1939_session_cancel(session, J1939_XTP_ABORT_BUSY); ++ if (session->transmission) ++ j1939_session_deactivate_activate_next(session); + + return -EBUSY; + } +diff --git a/net/core/filter.c b/net/core/filter.c +index ce255e0a2fbd9..15d850ea7d4ad 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -87,6 +87,9 @@ + + #include "dev.h" + ++/* Keep the struct bpf_fib_lookup small so that it fits into a cacheline */ ++static_assert(sizeof(struct bpf_fib_lookup) == 64, "struct bpf_fib_lookup size check"); ++ + static const struct bpf_func_proto * + bpf_sk_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog); + +diff --git a/net/core/xdp.c b/net/core/xdp.c +index 41693154e426f..022c12059cf2f 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -295,10 +295,8 @@ static struct xdp_mem_allocator *__xdp_reg_mem_model(struct xdp_mem_info *mem, + mutex_lock(&mem_id_lock); + ret = __mem_id_init_hash_table(); + mutex_unlock(&mem_id_lock); +- if (ret < 0) { +- WARN_ON(1); ++ if (ret < 0) + return ERR_PTR(ret); +- } + } + + xdp_alloc = kzalloc(sizeof(*xdp_alloc), gfp); +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index 44b033fe1ef68..f94d30b171992 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -655,8 +655,11 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) + if (dccp_v4_send_response(sk, req)) + goto drop_and_free; + +- inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); +- reqsk_put(req); ++ if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT))) ++ reqsk_free(req); ++ else ++ reqsk_put(req); ++ + return 0; + + drop_and_free: +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index ded07e09f8135..ddbd490b3531b 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -398,8 +398,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (dccp_v6_send_response(sk, req)) + goto drop_and_free; + +- inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); +- reqsk_put(req); ++ if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT))) ++ reqsk_free(req); ++ else ++ reqsk_put(req); ++ + return 0; + + drop_and_free: +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 3b38610958ee4..39e9070fe3cdf 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -1121,25 +1121,34 @@ static void reqsk_timer_handler(struct timer_list *t) + inet_csk_reqsk_queue_drop_and_put(oreq->rsk_listener, oreq); + } + +-static void reqsk_queue_hash_req(struct request_sock *req, ++static bool reqsk_queue_hash_req(struct request_sock *req, + unsigned long timeout) + { ++ bool found_dup_sk = false; ++ ++ if (!inet_ehash_insert(req_to_sk(req), NULL, &found_dup_sk)) ++ return false; ++ ++ /* The timer needs to be setup after a successful insertion. */ + timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED); + mod_timer(&req->rsk_timer, jiffies + timeout); + +- inet_ehash_insert(req_to_sk(req), NULL, NULL); + /* before letting lookups find us, make sure all req fields + * are committed to memory and refcnt initialized. + */ + smp_wmb(); + refcount_set(&req->rsk_refcnt, 2 + 1); ++ return true; + } + +-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, ++bool inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, + unsigned long timeout) + { +- reqsk_queue_hash_req(req, timeout); ++ if (!reqsk_queue_hash_req(req, timeout)) ++ return false; ++ + inet_csk_reqsk_queue_added(sk); ++ return true; + } + EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add); + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 1054a440332d3..0953c915bb4de 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2779,13 +2779,37 @@ static void tcp_mtup_probe_success(struct sock *sk) + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMTUPSUCCESS); + } + ++/* Sometimes we deduce that packets have been dropped due to reasons other than ++ * congestion, like path MTU reductions or failed client TFO attempts. In these ++ * cases we call this function to retransmit as many packets as cwnd allows, ++ * without reducing cwnd. Given that retransmits will set retrans_stamp to a ++ * non-zero value (and may do so in a later calling context due to TSQ), we ++ * also enter CA_Loss so that we track when all retransmitted packets are ACKed ++ * and clear retrans_stamp when that happens (to ensure later recurring RTOs ++ * are using the correct retrans_stamp and don't declare ETIMEDOUT ++ * prematurely). ++ */ ++static void tcp_non_congestion_loss_retransmit(struct sock *sk) ++{ ++ const struct inet_connection_sock *icsk = inet_csk(sk); ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (icsk->icsk_ca_state != TCP_CA_Loss) { ++ tp->high_seq = tp->snd_nxt; ++ tp->snd_ssthresh = tcp_current_ssthresh(sk); ++ tp->prior_ssthresh = 0; ++ tp->undo_marker = 0; ++ tcp_set_ca_state(sk, TCP_CA_Loss); ++ } ++ tcp_xmit_retransmit_queue(sk); ++} ++ + /* Do a simple retransmit without using the backoff mechanisms in + * tcp_timer. This is used for path mtu discovery. + * The socket is already locked here. + */ + void tcp_simple_retransmit(struct sock *sk) + { +- const struct inet_connection_sock *icsk = inet_csk(sk); + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *skb; + int mss; +@@ -2825,14 +2849,7 @@ void tcp_simple_retransmit(struct sock *sk) + * in network, but units changed and effective + * cwnd/ssthresh really reduced now. + */ +- if (icsk->icsk_ca_state != TCP_CA_Loss) { +- tp->high_seq = tp->snd_nxt; +- tp->snd_ssthresh = tcp_current_ssthresh(sk); +- tp->prior_ssthresh = 0; +- tp->undo_marker = 0; +- tcp_set_ca_state(sk, TCP_CA_Loss); +- } +- tcp_xmit_retransmit_queue(sk); ++ tcp_non_congestion_loss_retransmit(sk); + } + EXPORT_SYMBOL(tcp_simple_retransmit); + +@@ -6288,8 +6305,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack, + tp->fastopen_client_fail = TFO_DATA_NOT_ACKED; + skb_rbtree_walk_from(data) + tcp_mark_skb_lost(sk, data); +- tcp_xmit_retransmit_queue(sk); +- tp->retrans_stamp = 0; ++ tcp_non_congestion_loss_retransmit(sk); + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPFASTOPENACTIVEFAIL); + return true; +@@ -7243,7 +7259,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + tcp_rsk(req)->tfo_listener = false; + if (!want_cookie) { + req->timeout = tcp_timeout_init((struct sock *)req); +- inet_csk_reqsk_queue_hash_add(sk, req, req->timeout); ++ if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, ++ req->timeout))) { ++ reqsk_free(req); ++ return 0; ++ } ++ + } + af_ops->send_synack(sk, dst, &fl, req, &foc, + !want_cookie ? TCP_SYNACK_NORMAL : +diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c +index a4ab615ca3e3e..5e37a8ceebcb8 100644 +--- a/net/iucv/iucv.c ++++ b/net/iucv/iucv.c +@@ -520,7 +520,7 @@ static void iucv_setmask_mp(void) + */ + static void iucv_setmask_up(void) + { +- cpumask_t cpumask; ++ static cpumask_t cpumask; + int cpu; + + /* Disable all cpu but the first in cpu_irq_cpumask. */ +@@ -628,23 +628,33 @@ static int iucv_cpu_online(unsigned int cpu) + + static int iucv_cpu_down_prep(unsigned int cpu) + { +- cpumask_t cpumask; ++ cpumask_var_t cpumask; ++ int ret = 0; + + if (!iucv_path_table) + return 0; + +- cpumask_copy(&cpumask, &iucv_buffer_cpumask); +- cpumask_clear_cpu(cpu, &cpumask); +- if (cpumask_empty(&cpumask)) ++ if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) ++ return -ENOMEM; ++ ++ cpumask_copy(cpumask, &iucv_buffer_cpumask); ++ cpumask_clear_cpu(cpu, cpumask); ++ if (cpumask_empty(cpumask)) { + /* Can't offline last IUCV enabled cpu. */ +- return -EINVAL; ++ ret = -EINVAL; ++ goto __free_cpumask; ++ } + + iucv_retrieve_cpu(NULL); + if (!cpumask_empty(&iucv_irq_cpumask)) +- return 0; ++ goto __free_cpumask; ++ + smp_call_function_single(cpumask_first(&iucv_buffer_cpumask), + iucv_allow_cpu, NULL, 1); +- return 0; ++ ++__free_cpumask: ++ free_cpumask_var(cpumask); ++ return ret; + } + + /** +diff --git a/net/netfilter/nf_hooks_lwtunnel.c b/net/netfilter/nf_hooks_lwtunnel.c +index 7cdb59bb4459f..d8ebebc9775d7 100644 +--- a/net/netfilter/nf_hooks_lwtunnel.c ++++ b/net/netfilter/nf_hooks_lwtunnel.c +@@ -117,4 +117,7 @@ void netfilter_lwtunnel_fini(void) + { + unregister_pernet_subsys(&nf_lwtunnel_net_ops); + } ++#else ++int __init netfilter_lwtunnel_init(void) { return 0; } ++void netfilter_lwtunnel_fini(void) {} + #endif /* CONFIG_SYSCTL */ +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 167074283ea91..faa77b031d1f3 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5740,8 +5740,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, + + if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && + nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), +- set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, +- set->dlen) < 0) ++ nft_set_datatype(set), set->dlen) < 0) + goto nla_put_failure; + + if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && +@@ -11069,6 +11068,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, + + return 0; + default: ++ if (type != NFT_DATA_VALUE) ++ return -EINVAL; ++ + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) + return -EINVAL; + if (len == 0) +@@ -11077,8 +11079,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, + sizeof_field(struct nft_regs, data)) + return -ERANGE; + +- if (data != NULL && type != NFT_DATA_VALUE) +- return -EINVAL; + return 0; + } + } +diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c +index b314ca728a291..f3080fa1b2263 100644 +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -132,7 +132,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx, + return -EINVAL; + + err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG], +- &priv->dreg, NULL, set->dtype, ++ &priv->dreg, NULL, ++ nft_set_datatype(set), + set->dlen); + if (err < 0) + return err; +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 2928c142a2ddb..3b980bf2770bb 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -168,8 +168,13 @@ static u32 ovs_ct_get_mark(const struct nf_conn *ct) + static void ovs_ct_get_labels(const struct nf_conn *ct, + struct ovs_key_ct_labels *labels) + { +- struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; ++ struct nf_conn_labels *cl = NULL; + ++ if (ct) { ++ if (ct->master && !nf_ct_is_confirmed(ct)) ++ ct = ct->master; ++ cl = nf_ct_labels_find(ct); ++ } + if (cl) + memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); + else +diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c +index 2b4b1276d4e86..d9cda1e53a017 100644 +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1557,9 +1557,11 @@ void svc_process(struct svc_rqst *rqstp) + */ + void svc_process_bc(struct rpc_rqst *req, struct svc_rqst *rqstp) + { ++ struct rpc_timeout timeout = { ++ .to_increment = 0, ++ }; + struct rpc_task *task; + int proc_error; +- struct rpc_timeout timeout; + + /* Build the svc_rqst used by the common processing routine */ + rqstp->rq_xid = req->rq_xid; +@@ -1612,6 +1614,7 @@ void svc_process_bc(struct rpc_rqst *req, struct svc_rqst *rqstp) + timeout.to_initval = req->rq_xprt->timeout->to_initval; + timeout.to_retries = req->rq_xprt->timeout->to_retries; + } ++ timeout.to_maxval = timeout.to_initval; + memcpy(&req->rq_snd_buf, &rqstp->rq_res, sizeof(req->rq_snd_buf)); + task = rpc_run_bc_task(req, &timeout); + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 68a58bc07cf23..24286ce0ef3ee 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2660,10 +2660,24 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk, + { + struct unix_sock *u = unix_sk(sk); + +- if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) { +- skb_unlink(skb, &sk->sk_receive_queue); +- consume_skb(skb); +- skb = NULL; ++ if (!unix_skb_len(skb)) { ++ struct sk_buff *unlinked_skb = NULL; ++ ++ spin_lock(&sk->sk_receive_queue.lock); ++ ++ if (copied && (!u->oob_skb || skb == u->oob_skb)) { ++ skb = NULL; ++ } else if (flags & MSG_PEEK) { ++ skb = skb_peek_next(skb, &sk->sk_receive_queue); ++ } else { ++ unlinked_skb = skb; ++ skb = skb_peek_next(skb, &sk->sk_receive_queue); ++ __skb_unlink(unlinked_skb, &sk->sk_receive_queue); ++ } ++ ++ spin_unlock(&sk->sk_receive_queue.lock); ++ ++ consume_skb(unlinked_skb); + } else { + struct sk_buff *unlinked_skb = NULL; + +@@ -3140,12 +3154,23 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + #if IS_ENABLED(CONFIG_AF_UNIX_OOB) + case SIOCATMARK: + { ++ struct unix_sock *u = unix_sk(sk); + struct sk_buff *skb; + int answ = 0; + ++ mutex_lock(&u->iolock); ++ + skb = skb_peek(&sk->sk_receive_queue); +- if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb)) +- answ = 1; ++ if (skb) { ++ struct sk_buff *oob_skb = READ_ONCE(u->oob_skb); ++ ++ if (skb == oob_skb || ++ (!oob_skb && !unix_skb_len(skb))) ++ answ = 1; ++ } ++ ++ mutex_unlock(&u->iolock); ++ + err = put_user(answ, (int __user *)arg); + } + break; +diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst +index 67956f6496a5c..9d920419a62cf 100644 +--- a/scripts/Makefile.dtbinst ++++ b/scripts/Makefile.dtbinst +@@ -17,7 +17,7 @@ include $(srctree)/scripts/Kbuild.include + dst := $(INSTALL_DTBS_PATH) + + quiet_cmd_dtb_install = INSTALL $@ +- cmd_dtb_install = install -D $< $@ ++ cmd_dtb_install = install -D -m 0644 $< $@ + + $(dst)/%: $(obj)/% + $(call cmd,dtb_install) +diff --git a/scripts/Makefile.package b/scripts/Makefile.package +index 38653f3e81088..bf016af8bf8ad 100644 +--- a/scripts/Makefile.package ++++ b/scripts/Makefile.package +@@ -103,7 +103,7 @@ debian-orig: private version = $(shell dpkg-parsechangelog -S Version | sed 's/- + debian-orig: private orig-name = $(source)_$(version).orig.tar$(debian-orig-suffix) + debian-orig: mkdebian-opts = --need-source + debian-orig: linux.tar$(debian-orig-suffix) debian +- $(Q)if [ "$(df --output=target .. 2>/dev/null)" = "$(df --output=target $< 2>/dev/null)" ]; then \ ++ $(Q)if [ "$$(df --output=target .. 2>/dev/null)" = "$$(df --output=target $< 2>/dev/null)" ]; then \ + ln -f $< ../$(orig-name); \ + else \ + cp $< ../$(orig-name); \ +diff --git a/scripts/package/kernel.spec b/scripts/package/kernel.spec +index e095eb1e290ec..fffc8af8deb17 100644 +--- a/scripts/package/kernel.spec ++++ b/scripts/package/kernel.spec +@@ -57,7 +57,8 @@ patch -p1 < %{SOURCE2} + %install + mkdir -p %{buildroot}/lib/modules/%{KERNELRELEASE} + cp $(%{make} %{makeflags} -s image_name) %{buildroot}/lib/modules/%{KERNELRELEASE}/vmlinuz +-%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} modules_install ++# DEPMOD=true makes depmod no-op. We do not package depmod-generated files. ++%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} DEPMOD=true modules_install + %{make} %{makeflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install + cp System.map %{buildroot}/lib/modules/%{KERNELRELEASE} + cp .config %{buildroot}/lib/modules/%{KERNELRELEASE}/config +@@ -70,10 +71,7 @@ ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEA + %endif + + { +- for x in System.map config kernel modules.builtin \ +- modules.builtin.modinfo modules.order vmlinuz; do +- echo "/lib/modules/%{KERNELRELEASE}/${x}" +- done ++ echo "/lib/modules/%{KERNELRELEASE}" + + for x in alias alias.bin builtin.alias.bin builtin.bin dep dep.bin \ + devname softdep symbols symbols.bin; do +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 81dbade5b9b3d..518b3090cdb77 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -192,7 +192,11 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, + iint->evm_status == INTEGRITY_PASS_IMMUTABLE)) + return iint->evm_status; + +- if (is_unsupported_fs(dentry)) ++ /* ++ * On unsupported filesystems without EVM_INIT_X509 enabled, skip ++ * signature verification. ++ */ ++ if (!(evm_initialized & EVM_INIT_X509) && is_unsupported_fs(dentry)) + return INTEGRITY_UNKNOWN; + + /* if status is not PASS, try to check again - against -ENOMEM */ +@@ -260,7 +264,8 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, + evm_status = INTEGRITY_PASS_IMMUTABLE; + } else if (!IS_RDONLY(inode) && + !(inode->i_sb->s_readonly_remount) && +- !IS_IMMUTABLE(inode)) { ++ !IS_IMMUTABLE(inode) && ++ !is_unsupported_fs(dentry)) { + evm_update_evmxattr(dentry, xattr_name, + xattr_value, + xattr_value_len); +@@ -418,9 +423,6 @@ enum integrity_status evm_verifyxattr(struct dentry *dentry, + if (!evm_key_loaded() || !evm_protected_xattr(xattr_name)) + return INTEGRITY_UNKNOWN; + +- if (is_unsupported_fs(dentry)) +- return INTEGRITY_UNKNOWN; +- + return evm_verify_hmac(dentry, xattr_name, xattr_value, + xattr_value_len); + } +diff --git a/sound/core/seq/seq_ump_convert.c b/sound/core/seq/seq_ump_convert.c +index d81f776a4c3dd..e90b27a135e6f 100644 +--- a/sound/core/seq/seq_ump_convert.c ++++ b/sound/core/seq/seq_ump_convert.c +@@ -791,7 +791,8 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event, + + /* set up the MIDI2 RPN/NRPN packet data from the parsed info */ + static void fill_rpn(struct snd_seq_ump_midi2_bank *cc, +- union snd_ump_midi2_msg *data) ++ union snd_ump_midi2_msg *data, ++ unsigned char channel) + { + if (cc->rpn_set) { + data->rpn.status = UMP_MSG_STATUS_RPN; +@@ -808,6 +809,7 @@ static void fill_rpn(struct snd_seq_ump_midi2_bank *cc, + } + data->rpn.data = upscale_14_to_32bit((cc->cc_data_msb << 7) | + cc->cc_data_lsb); ++ data->rpn.channel = channel; + cc->cc_data_msb = cc->cc_data_lsb = 0; + } + +@@ -855,7 +857,7 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, + cc->cc_data_lsb = val; + if (!(cc->rpn_set || cc->nrpn_set)) + return 0; // skip +- fill_rpn(cc, data); ++ fill_rpn(cc, data, channel); + return 1; + } + +@@ -957,7 +959,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, + cc->cc_data_lsb = lsb; + if (!(cc->rpn_set || cc->nrpn_set)) + return 0; // skip +- fill_rpn(cc, data); ++ fill_rpn(cc, data, channel); + return 1; + } + +@@ -1018,7 +1020,7 @@ static int system_2p_ev_to_ump_midi2(const struct snd_seq_event *event, + union snd_ump_midi2_msg *data, + unsigned char status) + { +- return system_1p_ev_to_ump_midi1(event, dest_port, ++ return system_2p_ev_to_ump_midi1(event, dest_port, + (union snd_ump_midi1_msg *)data, + status); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3e6de1d86022f..3a56434c86bd9 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10187,6 +10187,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8c7c, "HP ProBook 445 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c7d, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c7e, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8c7f, "HP EliteBook 645 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8c80, "HP EliteBook 645 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8c81, "HP EliteBook 665 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c89, "HP ProBook 460 G11", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c8a, "HP EliteBook 630", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED), +diff --git a/sound/soc/amd/acp/acp-i2s.c b/sound/soc/amd/acp/acp-i2s.c +index 60cbc881be6e1..ef12f97ddc69e 100644 +--- a/sound/soc/amd/acp/acp-i2s.c ++++ b/sound/soc/amd/acp/acp-i2s.c +@@ -588,20 +588,12 @@ static int acp_i2s_probe(struct snd_soc_dai *dai) + { + struct device *dev = dai->component->dev; + struct acp_dev_data *adata = dev_get_drvdata(dev); +- struct acp_resource *rsrc = adata->rsrc; +- unsigned int val; + + if (!adata->acp_base) { + dev_err(dev, "I2S base is NULL\n"); + return -EINVAL; + } + +- val = readl(adata->acp_base + rsrc->i2s_pin_cfg_offset); +- if (val != rsrc->i2s_mode) { +- dev_err(dev, "I2S Mode not supported val %x\n", val); +- return -EINVAL; +- } +- + return 0; + } + +diff --git a/sound/soc/amd/acp/acp-pci.c b/sound/soc/amd/acp/acp-pci.c +index ad320b29e87dc..777b5a78d8a9e 100644 +--- a/sound/soc/amd/acp/acp-pci.c ++++ b/sound/soc/amd/acp/acp-pci.c +@@ -100,6 +100,7 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id + ret = -EINVAL; + goto release_regions; + } ++ chip->flag = flag; + dmic_dev = platform_device_register_data(dev, "dmic-codec", PLATFORM_DEVID_NONE, NULL, 0); + if (IS_ERR(dmic_dev)) { + dev_err(dev, "failed to create DMIC device\n"); +@@ -139,7 +140,6 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id + } + } + +- chip->flag = flag; + memset(&pdevinfo, 0, sizeof(pdevinfo)); + + pdevinfo.name = chip->name; +@@ -199,10 +199,12 @@ static int __maybe_unused snd_acp_resume(struct device *dev) + ret = acp_init(chip); + if (ret) + dev_err(dev, "ACP init failed\n"); +- child = chip->chip_pdev->dev; +- adata = dev_get_drvdata(&child); +- if (adata) +- acp_enable_interrupts(adata); ++ if (chip->chip_pdev) { ++ child = chip->chip_pdev->dev; ++ adata = dev_get_drvdata(&child); ++ if (adata) ++ acp_enable_interrupts(adata); ++ } + return ret; + } + +diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c +index 6aed1ee443b44..ba314b2799190 100644 +--- a/sound/soc/atmel/atmel-classd.c ++++ b/sound/soc/atmel/atmel-classd.c +@@ -473,19 +473,22 @@ static int atmel_classd_asoc_card_init(struct device *dev, + if (!dai_link) + return -ENOMEM; + +- comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL); ++ comp = devm_kzalloc(dev, 2 * sizeof(*comp), GFP_KERNEL); + if (!comp) + return -ENOMEM; + +- dai_link->cpus = comp; ++ dai_link->cpus = &comp[0]; + dai_link->codecs = &snd_soc_dummy_dlc; ++ dai_link->platforms = &comp[1]; + + dai_link->num_cpus = 1; + dai_link->num_codecs = 1; ++ dai_link->num_platforms = 1; + + dai_link->name = "CLASSD"; + dai_link->stream_name = "CLASSD PCM"; + dai_link->cpus->dai_name = dev_name(dev); ++ dai_link->platforms->name = dev_name(dev); + + card->dai_link = dai_link; + card->num_links = 1; +diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c +index 901b9dbcf5854..d9ab003e166bf 100644 +--- a/sound/soc/codecs/cs42l43-jack.c ++++ b/sound/soc/codecs/cs42l43-jack.c +@@ -121,7 +121,7 @@ int cs42l43_set_jack(struct snd_soc_component *component, + priv->buttons[3] = 735; + } + +- ret = cs42l43_find_index(priv, "cirrus,detect-us", 1000, &priv->detect_us, ++ ret = cs42l43_find_index(priv, "cirrus,detect-us", 50000, &priv->detect_us, + cs42l43_accdet_us, ARRAY_SIZE(cs42l43_accdet_us)); + if (ret < 0) + goto error; +@@ -433,7 +433,7 @@ irqreturn_t cs42l43_button_press(int irq, void *data) + + // Wait for 2 full cycles of comb filter to ensure good reading + queue_delayed_work(system_wq, &priv->button_press_work, +- msecs_to_jiffies(10)); ++ msecs_to_jiffies(20)); + + return IRQ_HANDLED; + } +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index bc07f26ba303f..e5ba256b3de22 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -558,6 +558,8 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + if (!priv) + return -ENOMEM; + ++ priv->pdev = pdev; ++ + cpu_np = of_parse_phandle(np, "audio-cpu", 0); + /* Give a chance to old DT binding */ + if (!cpu_np) +@@ -780,7 +782,6 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + } + + /* Initialize sound card */ +- priv->pdev = pdev; + priv->card.dev = &pdev->dev; + priv->card.owner = THIS_MODULE; + ret = snd_soc_of_parse_card_name(&priv->card, "model"); +diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +index acaf81fd6c9b5..f848e14b091a1 100644 +--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c ++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +@@ -31,7 +31,7 @@ struct mt8183_da7219_max98357_priv { + + static struct snd_soc_jack_pin mt8183_da7219_max98357_jack_pins[] = { + { +- .pin = "Headphone", ++ .pin = "Headphones", + .mask = SND_JACK_HEADPHONE, + }, + { +@@ -626,7 +626,7 @@ static struct snd_soc_codec_conf mt6358_codec_conf[] = { + }; + + static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = { +- SOC_DAPM_PIN_SWITCH("Headphone"), ++ SOC_DAPM_PIN_SWITCH("Headphones"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Speakers"), + SOC_DAPM_PIN_SWITCH("Line Out"), +@@ -634,7 +634,7 @@ static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = { + + static const + struct snd_soc_dapm_widget mt8183_da7219_max98357_dapm_widgets[] = { +- SND_SOC_DAPM_HP("Headphone", NULL), ++ SND_SOC_DAPM_HP("Headphones", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_SPK("Speakers", NULL), + SND_SOC_DAPM_SPK("Line Out", NULL), +@@ -680,7 +680,7 @@ static struct snd_soc_codec_conf mt8183_da7219_rt1015_codec_conf[] = { + }; + + static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { +- SOC_DAPM_PIN_SWITCH("Headphone"), ++ SOC_DAPM_PIN_SWITCH("Headphones"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Left Spk"), + SOC_DAPM_PIN_SWITCH("Right Spk"), +@@ -689,7 +689,7 @@ static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { + + static const + struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = { +- SND_SOC_DAPM_HP("Headphone", NULL), ++ SND_SOC_DAPM_HP("Headphones", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_SPK("Left Spk", NULL), + SND_SOC_DAPM_SPK("Right Spk", NULL), +diff --git a/sound/soc/mediatek/mt8195/mt8195-mt6359.c b/sound/soc/mediatek/mt8195/mt8195-mt6359.c +index 53fd8a897b9d2..c25a526c90d25 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-mt6359.c ++++ b/sound/soc/mediatek/mt8195/mt8195-mt6359.c +@@ -939,6 +939,7 @@ SND_SOC_DAILINK_DEFS(ETDM2_IN_BE, + + SND_SOC_DAILINK_DEFS(ETDM1_OUT_BE, + DAILINK_COMP_ARRAY(COMP_CPU("ETDM1_OUT")), ++ DAILINK_COMP_ARRAY(COMP_EMPTY()), + DAILINK_COMP_ARRAY(COMP_EMPTY())); + + SND_SOC_DAILINK_DEFS(ETDM2_OUT_BE, +diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +index 68a38f63a2dbf..66b911b49e3f4 100644 +--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c ++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +@@ -141,14 +141,17 @@ static void q6apm_lpass_dai_shutdown(struct snd_pcm_substream *substream, struct + struct q6apm_lpass_dai_data *dai_data = dev_get_drvdata(dai->dev); + int rc; + +- if (!dai_data->is_port_started[dai->id]) +- return; +- rc = q6apm_graph_stop(dai_data->graph[dai->id]); +- if (rc < 0) +- dev_err(dai->dev, "fail to close APM port (%d)\n", rc); ++ if (dai_data->is_port_started[dai->id]) { ++ rc = q6apm_graph_stop(dai_data->graph[dai->id]); ++ dai_data->is_port_started[dai->id] = false; ++ if (rc < 0) ++ dev_err(dai->dev, "fail to close APM port (%d)\n", rc); ++ } + +- q6apm_graph_close(dai_data->graph[dai->id]); +- dai_data->is_port_started[dai->id] = false; ++ if (dai_data->graph[dai->id]) { ++ q6apm_graph_close(dai_data->graph[dai->id]); ++ dai_data->graph[dai->id] = NULL; ++ } + } + + static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) +@@ -163,8 +166,10 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s + q6apm_graph_stop(dai_data->graph[dai->id]); + dai_data->is_port_started[dai->id] = false; + +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + q6apm_graph_close(dai_data->graph[dai->id]); ++ dai_data->graph[dai->id] = NULL; ++ } + } + + /** +@@ -183,26 +188,29 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s + + cfg->direction = substream->stream; + rc = q6apm_graph_media_format_pcm(dai_data->graph[dai->id], cfg); +- + if (rc) { + dev_err(dai->dev, "Failed to set media format %d\n", rc); +- return rc; ++ goto err; + } + + rc = q6apm_graph_prepare(dai_data->graph[dai->id]); + if (rc) { + dev_err(dai->dev, "Failed to prepare Graph %d\n", rc); +- return rc; ++ goto err; + } + + rc = q6apm_graph_start(dai_data->graph[dai->id]); + if (rc < 0) { + dev_err(dai->dev, "fail to start APM port %x\n", dai->id); +- return rc; ++ goto err; + } + dai_data->is_port_started[dai->id] = true; + + return 0; ++err: ++ q6apm_graph_close(dai_data->graph[dai->id]); ++ dai_data->graph[dai->id] = NULL; ++ return rc; + } + + static int q6apm_lpass_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) +diff --git a/sound/soc/rockchip/rockchip_i2s_tdm.c b/sound/soc/rockchip/rockchip_i2s_tdm.c +index 9fa020ef7eab9..ee517d7b5b7bb 100644 +--- a/sound/soc/rockchip/rockchip_i2s_tdm.c ++++ b/sound/soc/rockchip/rockchip_i2s_tdm.c +@@ -655,8 +655,17 @@ static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream, + int err; + + if (i2s_tdm->is_master_mode) { +- struct clk *mclk = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ? +- i2s_tdm->mclk_tx : i2s_tdm->mclk_rx; ++ struct clk *mclk; ++ ++ if (i2s_tdm->clk_trcm == TRCM_TX) { ++ mclk = i2s_tdm->mclk_tx; ++ } else if (i2s_tdm->clk_trcm == TRCM_RX) { ++ mclk = i2s_tdm->mclk_rx; ++ } else if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { ++ mclk = i2s_tdm->mclk_tx; ++ } else { ++ mclk = i2s_tdm->mclk_rx; ++ } + + err = clk_set_rate(mclk, DEFAULT_MCLK_FS * params_rate(params)); + if (err) +diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c +index 16f00097cb95a..eed47e4830248 100644 +--- a/sound/synth/emux/soundfont.c ++++ b/sound/synth/emux/soundfont.c +@@ -701,7 +701,6 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) + struct snd_soundfont *sf; + struct soundfont_sample_info sample_info; + struct snd_sf_sample *sp; +- long off; + + /* patch must be opened */ + sf = sflist->currsf; +@@ -711,12 +710,16 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) + if (is_special_type(sf->type)) + return -EINVAL; + ++ if (count < (long)sizeof(sample_info)) { ++ return -EINVAL; ++ } + if (copy_from_user(&sample_info, data, sizeof(sample_info))) + return -EFAULT; ++ data += sizeof(sample_info); ++ count -= sizeof(sample_info); + +- off = sizeof(sample_info); +- +- if (sample_info.size != (count-off)/2) ++ // SoundFont uses S16LE samples. ++ if (sample_info.size * 2 != count) + return -EINVAL; + + /* Check for dup */ +@@ -744,7 +747,7 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) + int rc; + rc = sflist->callback.sample_new + (sflist->callback.private_data, sp, sflist->memhdr, +- data + off, count - off); ++ data, count); + if (rc < 0) { + sf_sample_delete(sflist, sf, sp); + return rc; +@@ -957,10 +960,12 @@ load_guspatch(struct snd_sf_list *sflist, const char __user *data, + } + if (copy_from_user(&patch, data, sizeof(patch))) + return -EFAULT; +- + count -= sizeof(patch); + data += sizeof(patch); + ++ if ((patch.len << (patch.mode & WAVE_16_BITS ? 1 : 0)) != count) ++ return -EINVAL; ++ + sf = newsf(sflist, SNDRV_SFNT_PAT_TYPE_GUS|SNDRV_SFNT_PAT_SHARED, NULL); + if (sf == NULL) + return -ENOMEM; +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 98256468e2480..8071a3ef2a2e8 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -7851,7 +7851,7 @@ void cmdline(int argc, char **argv) + * Parse some options early, because they may make other options invalid, + * like adding the MSR counter with --add and at the same time using --no-msr. + */ +- while ((opt = getopt_long_only(argc, argv, "MP", long_options, &option_index)) != -1) { ++ while ((opt = getopt_long_only(argc, argv, "MPn:", long_options, &option_index)) != -1) { + switch (opt) { + case 'M': + no_msr = 1; +diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c +index 3482248aa3442..90d5afd52dd06 100644 +--- a/tools/testing/cxl/test/cxl.c ++++ b/tools/testing/cxl/test/cxl.c +@@ -630,11 +630,15 @@ static struct cxl_hdm *mock_cxl_setup_hdm(struct cxl_port *port, + struct cxl_endpoint_dvsec_info *info) + { + struct cxl_hdm *cxlhdm = devm_kzalloc(&port->dev, sizeof(*cxlhdm), GFP_KERNEL); ++ struct device *dev = &port->dev; + + if (!cxlhdm) + return ERR_PTR(-ENOMEM); + + cxlhdm->port = port; ++ cxlhdm->interleave_mask = ~0U; ++ cxlhdm->iw_cap_mask = ~0UL; ++ dev_set_drvdata(dev, cxlhdm); + return cxlhdm; + } + |