diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2024-07-05 06:49:17 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2024-07-05 06:49:17 -0400 |
| commit | 46d0bcbf2fe16877db341577f809b3d635231d80 (patch) | |
| tree | fb287519512c878e0dbd391ac881ce233dd92114 | |
| parent | Linux patch 6.6.36 (diff) | |
| download | linux-patches-46d0bcbf2fe16877db341577f809b3d635231d80.tar.gz linux-patches-46d0bcbf2fe16877db341577f809b3d635231d80.tar.bz2 linux-patches-46d0bcbf2fe16877db341577f809b3d635231d80.zip | |
Linux patch 6.6.376.6-44
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1036_linux-6.6.37.patch | 6575 |
2 files changed, 6579 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 2ed0d8f6..7c6b39c1 100644 --- a/0000_README +++ b/0000_README @@ -187,6 +187,10 @@ Patch: 1035_linux-6.6.36.patch From: https://www.kernel.org Desc: Linux 6.6.36 +Patch: 1036_linux-6.6.37.patch +From: https://www.kernel.org +Desc: Linux 6.6.37 + Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch Desc: Enable link security restrictions by default. diff --git a/1036_linux-6.6.37.patch b/1036_linux-6.6.37.patch new file mode 100644 index 00000000..e16068af --- /dev/null +++ b/1036_linux-6.6.37.patch @@ -0,0 +1,6575 @@ +diff --git a/Documentation/kbuild/modules.rst b/Documentation/kbuild/modules.rst +index a1f3eb7a43e23..131863142cbb3 100644 +--- a/Documentation/kbuild/modules.rst ++++ b/Documentation/kbuild/modules.rst +@@ -128,7 +128,7 @@ executed to make module versioning work. + + modules_install + Install the external module(s). The default location is +- /lib/modules/<kernel_release>/extra/, but a prefix may ++ /lib/modules/<kernel_release>/updates/, but a prefix may + be added with INSTALL_MOD_PATH (discussed in section 5). + + clean +@@ -417,7 +417,7 @@ directory: + + And external modules are installed in: + +- /lib/modules/$(KERNELRELEASE)/extra/ ++ /lib/modules/$(KERNELRELEASE)/updates/ + + 5.1 INSTALL_MOD_PATH + -------------------- +@@ -438,10 +438,10 @@ And external modules are installed in: + ------------------- + + External modules are by default installed to a directory under +- /lib/modules/$(KERNELRELEASE)/extra/, but you may wish to ++ /lib/modules/$(KERNELRELEASE)/updates/, but you may wish to + locate modules for a specific functionality in a separate + directory. For this purpose, use INSTALL_MOD_DIR to specify an +- alternative name to "extra.":: ++ alternative name to "updates.":: + + $ make INSTALL_MOD_DIR=gandalf -C $KDIR \ + M=$PWD modules_install +diff --git a/Makefile b/Makefile +index b7d5f2f0def0d..8a73b886156a0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 36 ++SUBLEVEL = 37 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +diff --git a/arch/arm/boot/dts/rockchip/rk3066a.dtsi b/arch/arm/boot/dts/rockchip/rk3066a.dtsi +index de9915d946f74..b98d5e357baf3 100644 +--- a/arch/arm/boot/dts/rockchip/rk3066a.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3066a.dtsi +@@ -123,6 +123,7 @@ hdmi: hdmi@10116000 { + pinctrl-0 = <&hdmii2c_xfer>, <&hdmi_hpd>; + power-domains = <&power RK3066_PD_VIO>; + rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + + ports { +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index 6a1c9fca5260b..ac8e4d9bf9544 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -1982,28 +1982,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + /* If building the body of the JITed code fails somehow, + * we fall back to the interpretation. + */ +- if (build_body(&ctx) < 0) { +- image_ptr = NULL; +- bpf_jit_binary_free(header); +- prog = orig_prog; +- goto out_imms; +- } ++ if (build_body(&ctx) < 0) ++ goto out_free; + build_epilogue(&ctx); + + /* 3.) Extra pass to validate JITed Code */ +- if (validate_code(&ctx)) { +- image_ptr = NULL; +- bpf_jit_binary_free(header); +- prog = orig_prog; +- goto out_imms; +- } ++ if (validate_code(&ctx)) ++ goto out_free; + flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx)); + + if (bpf_jit_enable > 1) + /* there are 2 passes here */ + bpf_jit_dump(prog->len, image_size, 2, ctx.target); + +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) ++ goto out_free; + prog->bpf_func = (void *)ctx.target; + prog->jited = 1; + prog->jited_len = image_size; +@@ -2020,5 +2013,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_jit_prog_release_other(prog, prog == orig_prog ? + tmp : orig_prog); + return prog; ++ ++out_free: ++ image_ptr = NULL; ++ bpf_jit_binary_free(header); ++ prog = orig_prog; ++ goto out_imms; + } + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index e9810d2f04071..4f6541262ab84 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -5,6 +5,8 @@ + */ + + /dts-v1/; ++ ++#include <dt-bindings/leds/common.h> + #include "rk3308.dtsi" + + / { +@@ -24,17 +26,21 @@ chosen { + leds { + compatible = "gpio-leds"; + pinctrl-names = "default"; +- pinctrl-0 = <&green_led_gio>, <&heartbeat_led_gpio>; ++ pinctrl-0 = <&green_led>, <&heartbeat_led>; + + green-led { ++ color = <LED_COLOR_ID_GREEN>; + default-state = "on"; ++ function = LED_FUNCTION_POWER; + gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>; + label = "rockpis:green:power"; + linux,default-trigger = "default-on"; + }; + + blue-led { ++ color = <LED_COLOR_ID_BLUE>; + default-state = "on"; ++ function = LED_FUNCTION_HEARTBEAT; + gpios = <&gpio0 RK_PA5 GPIO_ACTIVE_HIGH>; + label = "rockpis:blue:user"; + linux,default-trigger = "heartbeat"; +@@ -126,10 +132,12 @@ &cpu0 { + }; + + &emmc { +- bus-width = <4>; + cap-mmc-highspeed; +- mmc-hs200-1_8v; ++ cap-sd-highspeed; ++ no-sdio; + non-removable; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; + vmmc-supply = <&vcc_io>; + status = "okay"; + }; +@@ -152,11 +160,11 @@ &pinctrl { + pinctrl-0 = <&rtc_32k>; + + leds { +- green_led_gio: green-led-gpio { ++ green_led: green-led { + rockchip,pins = <0 RK_PA6 RK_FUNC_GPIO &pcfg_pull_none>; + }; + +- heartbeat_led_gpio: heartbeat-led-gpio { ++ heartbeat_led: heartbeat-led { + rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts +index 018a3a5075c72..d9905a08c6ce8 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts +@@ -186,8 +186,8 @@ &i2c1 { + rk805: pmic@18 { + compatible = "rockchip,rk805"; + reg = <0x18>; +- interrupt-parent = <&gpio2>; +- interrupts = <6 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-parent = <&gpio0>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + #clock-cells = <1>; + clock-output-names = "xin32k", "rk805-clkout2"; + gpio-controller; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +index a4c5aaf1f4579..cac58ad951b2e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +@@ -790,6 +790,7 @@ spdif: spdif@ff880000 { + dma-names = "tx"; + pinctrl-names = "default"; + pinctrl-0 = <&spdif_tx>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +@@ -801,6 +802,7 @@ i2s_2ch: i2s-2ch@ff890000 { + clocks = <&cru SCLK_I2S_2CH>, <&cru HCLK_I2S_2CH>; + dmas = <&dmac_bus 6>, <&dmac_bus 7>; + dma-names = "tx", "rx"; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +@@ -814,6 +816,7 @@ i2s_8ch: i2s-8ch@ff898000 { + dma-names = "tx", "rx"; + pinctrl-names = "default"; + pinctrl-0 = <&i2s_8ch_bus>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +index 789fd0dcc88ba..3cd63d1e8f15b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +@@ -450,7 +450,7 @@ da7219_aad { + dlg,btn-cfg = <50>; + dlg,mic-det-thr = <500>; + dlg,jack-ins-deb = <20>; +- dlg,jack-det-rate = "32ms_64ms"; ++ dlg,jack-det-rate = "32_64"; + dlg,jack-rem-deb = <1>; + + dlg,a-d-btn-thr = <0xa>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts +index 8347adcbd0030..68763714f7f7b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts +@@ -390,6 +390,7 @@ pmic@0 { + pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>, + <&rk806_dvs2_null>, <&rk806_dvs3_null>; + spi-max-frequency = <1000000>; ++ system-power-controller; + + vcc1-supply = <&vcc5v0_sys>; + vcc2-supply = <&vcc5v0_sys>; +diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h +index 78b68311ec819..545a4a7b5371c 100644 +--- a/arch/arm64/include/asm/unistd32.h ++++ b/arch/arm64/include/asm/unistd32.h +@@ -840,7 +840,7 @@ __SYSCALL(__NR_pselect6_time64, compat_sys_pselect6_time64) + #define __NR_ppoll_time64 414 + __SYSCALL(__NR_ppoll_time64, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SYSCALL(__NR_io_pgetevents_time64, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SYSCALL(__NR_recvmmsg_time64, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c +index 9a70d9746b661..f090e39f69bc4 100644 +--- a/arch/arm64/kernel/syscall.c ++++ b/arch/arm64/kernel/syscall.c +@@ -56,17 +56,15 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, + syscall_set_return_value(current, regs, 0, ret); + + /* +- * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), +- * but not enough for arm64 stack utilization comfort. To keep +- * reasonable stack head room, reduce the maximum offset to 9 bits. ++ * This value will get limited by KSTACK_OFFSET_MAX(), which is 10 ++ * bits. The actual entropy will be further reduced by the compiler ++ * when applying stack alignment constraints: the AAPCS mandates a ++ * 16-byte aligned SP at function boundaries, which will remove the ++ * 4 low bits from any entropy chosen here. + * +- * The actual entropy will be further reduced by the compiler when +- * applying stack alignment constraints: the AAPCS mandates a +- * 16-byte (i.e. 4-bit) aligned SP at function boundaries. +- * +- * The resulting 5 bits of entropy is seen in SP[8:4]. ++ * The resulting 6 bits of entropy is seen in SP[9:4]. + */ +- choose_random_kstack_offset(get_random_u16() & 0x1FF); ++ choose_random_kstack_offset(get_random_u16()); + } + + static inline bool has_syscall_work(unsigned long flags) +diff --git a/arch/csky/include/uapi/asm/unistd.h b/arch/csky/include/uapi/asm/unistd.h +index 7ff6a2466af10..e0594b6370a65 100644 +--- a/arch/csky/include/uapi/asm/unistd.h ++++ b/arch/csky/include/uapi/asm/unistd.h +@@ -6,6 +6,7 @@ + #define __ARCH_WANT_SYS_CLONE3 + #define __ARCH_WANT_SET_GET_RLIMIT + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYNC_FILE_RANGE2 + #include <asm-generic/unistd.h> + + #define __NR_set_thread_area (__NR_arch_specific_syscall + 0) +diff --git a/arch/hexagon/include/asm/syscalls.h b/arch/hexagon/include/asm/syscalls.h +new file mode 100644 +index 0000000000000..40f2d08bec92c +--- /dev/null ++++ b/arch/hexagon/include/asm/syscalls.h +@@ -0,0 +1,6 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++ ++#include <asm-generic/syscalls.h> ++ ++asmlinkage long sys_hexagon_fadvise64_64(int fd, int advice, ++ u32 a2, u32 a3, u32 a4, u32 a5); +diff --git a/arch/hexagon/include/uapi/asm/unistd.h b/arch/hexagon/include/uapi/asm/unistd.h +index 432c4db1b6239..21ae22306b5dc 100644 +--- a/arch/hexagon/include/uapi/asm/unistd.h ++++ b/arch/hexagon/include/uapi/asm/unistd.h +@@ -36,5 +36,6 @@ + #define __ARCH_WANT_SYS_VFORK + #define __ARCH_WANT_SYS_FORK + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYNC_FILE_RANGE2 + + #include <asm-generic/unistd.h> +diff --git a/arch/hexagon/kernel/syscalltab.c b/arch/hexagon/kernel/syscalltab.c +index 0fadd582cfc77..5d98bdc494ec2 100644 +--- a/arch/hexagon/kernel/syscalltab.c ++++ b/arch/hexagon/kernel/syscalltab.c +@@ -14,6 +14,13 @@ + #undef __SYSCALL + #define __SYSCALL(nr, call) [nr] = (call), + ++SYSCALL_DEFINE6(hexagon_fadvise64_64, int, fd, int, advice, ++ SC_ARG64(offset), SC_ARG64(len)) ++{ ++ return ksys_fadvise64_64(fd, SC_VAL64(loff_t, offset), SC_VAL64(loff_t, len), advice); ++} ++#define sys_fadvise64_64 sys_hexagon_fadvise64_64 ++ + void *sys_call_table[__NR_syscalls] = { + #include <asm/unistd.h> + }; +diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c +index 9eb7753d117df..13cd480385ca8 100644 +--- a/arch/loongarch/net/bpf_jit.c ++++ b/arch/loongarch/net/bpf_jit.c +@@ -1206,16 +1206,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + flush_icache_range((unsigned long)header, (unsigned long)(ctx.image + ctx.idx)); + + if (!prog->is_func || extra_pass) { ++ int err; ++ + if (extra_pass && ctx.idx != jit_data->ctx.idx) { + pr_err_once("multi-func JIT bug %d != %d\n", + ctx.idx, jit_data->ctx.idx); +- bpf_jit_binary_free(header); +- prog->bpf_func = NULL; +- prog->jited = 0; +- prog->jited_len = 0; +- goto out_offset; ++ goto out_free; ++ } ++ err = bpf_jit_binary_lock_ro(header); ++ if (err) { ++ pr_err_once("bpf_jit_binary_lock_ro() returned %d\n", ++ err); ++ goto out_free; + } +- bpf_jit_binary_lock_ro(header); + } else { + jit_data->ctx = ctx; + jit_data->image = image_ptr; +@@ -1246,6 +1249,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + out_offset = -1; + + return prog; ++ ++out_free: ++ bpf_jit_binary_free(header); ++ prog->bpf_func = NULL; ++ prog->jited = 0; ++ prog->jited_len = 0; ++ goto out_offset; + } + + /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */ +diff --git a/arch/mips/kernel/syscalls/syscall_n32.tbl b/arch/mips/kernel/syscalls/syscall_n32.tbl +index 152034b8e0a0f..4a296124604a1 100644 +--- a/arch/mips/kernel/syscalls/syscall_n32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_n32.tbl +@@ -354,7 +354,7 @@ + 412 n32 utimensat_time64 sys_utimensat + 413 n32 pselect6_time64 compat_sys_pselect6_time64 + 414 n32 ppoll_time64 compat_sys_ppoll_time64 +-416 n32 io_pgetevents_time64 sys_io_pgetevents ++416 n32 io_pgetevents_time64 compat_sys_io_pgetevents_time64 + 417 n32 recvmmsg_time64 compat_sys_recvmmsg_time64 + 418 n32 mq_timedsend_time64 sys_mq_timedsend + 419 n32 mq_timedreceive_time64 sys_mq_timedreceive +diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl +index 1a646813afdca..37bbc8d9a94cc 100644 +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -403,7 +403,7 @@ + 412 o32 utimensat_time64 sys_utimensat sys_utimensat + 413 o32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 o32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 o32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 o32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 o32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 o32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 o32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c +index a40d926b65139..e355dfca44008 100644 +--- a/arch/mips/net/bpf_jit_comp.c ++++ b/arch/mips/net/bpf_jit_comp.c +@@ -1012,7 +1012,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_prog_fill_jited_linfo(prog, &ctx.descriptors[1]); + + /* Set as read-only exec and flush instruction cache */ +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) ++ goto out_err; + flush_icache_range((unsigned long)header, + (unsigned long)&ctx.target[ctx.jit_index]); + +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index 4adeb73d5885c..722e83edad282 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -14,6 +14,7 @@ config PARISC + select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_PTE_SPECIAL + select ARCH_NO_SG_CHAIN ++ select ARCH_SPLIT_ARG64 if !64BIT + select ARCH_SUPPORTS_HUGETLBFS if PA20 + select ARCH_SUPPORTS_MEMORY_FAILURE + select ARCH_STACKWALK +diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c +index 2a12a547b447b..826c8e51b5853 100644 +--- a/arch/parisc/kernel/sys_parisc32.c ++++ b/arch/parisc/kernel/sys_parisc32.c +@@ -23,12 +23,3 @@ asmlinkage long sys32_unimplemented(int r26, int r25, int r24, int r23, + current->comm, current->pid, r20); + return -ENOSYS; + } +- +-asmlinkage long sys32_fanotify_mark(compat_int_t fanotify_fd, compat_uint_t flags, +- compat_uint_t mask0, compat_uint_t mask1, compat_int_t dfd, +- const char __user * pathname) +-{ +- return sys_fanotify_mark(fanotify_fd, flags, +- ((__u64)mask1 << 32) | mask0, +- dfd, pathname); +-} +diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl +index e97c175b56f96..73f560e309573 100644 +--- a/arch/parisc/kernel/syscalls/syscall.tbl ++++ b/arch/parisc/kernel/syscalls/syscall.tbl +@@ -108,7 +108,7 @@ + 95 common fchown sys_fchown + 96 common getpriority sys_getpriority + 97 common setpriority sys_setpriority +-98 common recv sys_recv ++98 common recv sys_recv compat_sys_recv + 99 common statfs sys_statfs compat_sys_statfs + 100 common fstatfs sys_fstatfs compat_sys_fstatfs + 101 common stat64 sys_stat64 +@@ -135,7 +135,7 @@ + 120 common clone sys_clone_wrapper + 121 common setdomainname sys_setdomainname + 122 common sendfile sys_sendfile compat_sys_sendfile +-123 common recvfrom sys_recvfrom ++123 common recvfrom sys_recvfrom compat_sys_recvfrom + 124 32 adjtimex sys_adjtimex_time32 + 124 64 adjtimex sys_adjtimex + 125 common mprotect sys_mprotect +@@ -364,7 +364,7 @@ + 320 common accept4 sys_accept4 + 321 common prlimit64 sys_prlimit64 + 322 common fanotify_init sys_fanotify_init +-323 common fanotify_mark sys_fanotify_mark sys32_fanotify_mark ++323 common fanotify_mark sys_fanotify_mark compat_sys_fanotify_mark + 324 32 clock_adjtime sys_clock_adjtime32 + 324 64 clock_adjtime sys_clock_adjtime + 325 common name_to_handle_at sys_name_to_handle_at +diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c +index d6ee2fd455503..979f45d4d1fbe 100644 +--- a/arch/parisc/net/bpf_jit_core.c ++++ b/arch/parisc/net/bpf_jit_core.c +@@ -167,7 +167,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns); + + if (!prog->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(jit_data->header); ++ if (bpf_jit_binary_lock_ro(jit_data->header)) { ++ bpf_jit_binary_free(jit_data->header); ++ prog->bpf_func = NULL; ++ prog->jited = 0; ++ prog->jited_len = 0; ++ goto out_offset; ++ } + prologue_len = ctx->epilogue_offset - ctx->body_len; + for (i = 0; i < prog->len; i++) + ctx->offset[i] += prologue_len; +diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl +index 20e50586e8a26..40f6751271d3d 100644 +--- a/arch/powerpc/kernel/syscalls/syscall.tbl ++++ b/arch/powerpc/kernel/syscalls/syscall.tbl +@@ -230,8 +230,10 @@ + 178 nospu rt_sigsuspend sys_rt_sigsuspend compat_sys_rt_sigsuspend + 179 32 pread64 sys_ppc_pread64 compat_sys_ppc_pread64 + 179 64 pread64 sys_pread64 ++179 spu pread64 sys_pread64 + 180 32 pwrite64 sys_ppc_pwrite64 compat_sys_ppc_pwrite64 + 180 64 pwrite64 sys_pwrite64 ++180 spu pwrite64 sys_pwrite64 + 181 common chown sys_chown + 182 common getcwd sys_getcwd + 183 common capget sys_capget +@@ -246,6 +248,7 @@ + 190 common ugetrlimit sys_getrlimit compat_sys_getrlimit + 191 32 readahead sys_ppc_readahead compat_sys_ppc_readahead + 191 64 readahead sys_readahead ++191 spu readahead sys_readahead + 192 32 mmap2 sys_mmap2 compat_sys_mmap2 + 193 32 truncate64 sys_ppc_truncate64 compat_sys_ppc_truncate64 + 194 32 ftruncate64 sys_ppc_ftruncate64 compat_sys_ppc_ftruncate64 +@@ -293,6 +296,7 @@ + 232 nospu set_tid_address sys_set_tid_address + 233 32 fadvise64 sys_ppc32_fadvise64 compat_sys_ppc32_fadvise64 + 233 64 fadvise64 sys_fadvise64 ++233 spu fadvise64 sys_fadvise64 + 234 nospu exit_group sys_exit_group + 235 nospu lookup_dcookie sys_lookup_dcookie compat_sys_lookup_dcookie + 236 common epoll_create sys_epoll_create +@@ -502,7 +506,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h +index 72b7bb34fadea..cdea5dccaefe7 100644 +--- a/arch/powerpc/net/bpf_jit.h ++++ b/arch/powerpc/net/bpf_jit.h +@@ -36,9 +36,6 @@ + EMIT(PPC_RAW_BRANCH(offset)); \ + } while (0) + +-/* bl (unconditional 'branch' with link) */ +-#define PPC_BL(dest) EMIT(PPC_RAW_BL((dest) - (unsigned long)(image + ctx->idx))) +- + /* "cond" here covers BO:BI fields. */ + #define PPC_BCC_SHORT(cond, dest) \ + do { \ +@@ -147,12 +144,6 @@ struct codegen_context { + #define BPF_FIXUP_LEN 2 /* Two instructions => 8 bytes */ + #endif + +-static inline void bpf_flush_icache(void *start, void *end) +-{ +- smp_wmb(); /* smp write barrier */ +- flush_icache_range((unsigned long)start, (unsigned long)end); +-} +- + static inline bool bpf_is_seen_register(struct codegen_context *ctx, int i) + { + return ctx->seen & (1 << (31 - i)); +@@ -169,16 +160,17 @@ static inline void bpf_clear_seen_register(struct codegen_context *ctx, int i) + } + + void bpf_jit_init_reg_mapping(struct codegen_context *ctx); +-int bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 func); +-int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *ctx, ++int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *ctx, u64 func); ++int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct codegen_context *ctx, + u32 *addrs, int pass, bool extra_pass); + void bpf_jit_build_prologue(u32 *image, struct codegen_context *ctx); + void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx); + void bpf_jit_realloc_regs(struct codegen_context *ctx); + int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr); + +-int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, int pass, struct codegen_context *ctx, +- int insn_idx, int jmp_off, int dst_reg); ++int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass, ++ struct codegen_context *ctx, int insn_idx, ++ int jmp_off, int dst_reg); + + #endif + +diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c +index 37043dfc1addd..cee6a57b9d088 100644 +--- a/arch/powerpc/net/bpf_jit_comp.c ++++ b/arch/powerpc/net/bpf_jit_comp.c +@@ -39,10 +39,13 @@ int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, + return 0; + } + +-struct powerpc64_jit_data { +- struct bpf_binary_header *header; ++struct powerpc_jit_data { ++ /* address of rw header */ ++ struct bpf_binary_header *hdr; ++ /* address of ro final header */ ++ struct bpf_binary_header *fhdr; + u32 *addrs; +- u8 *image; ++ u8 *fimage; + u32 proglen; + struct codegen_context ctx; + }; +@@ -59,15 +62,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + u8 *image = NULL; + u32 *code_base; + u32 *addrs; +- struct powerpc64_jit_data *jit_data; ++ struct powerpc_jit_data *jit_data; + struct codegen_context cgctx; + int pass; + int flen; +- struct bpf_binary_header *bpf_hdr; ++ struct bpf_binary_header *fhdr = NULL; ++ struct bpf_binary_header *hdr = NULL; + struct bpf_prog *org_fp = fp; + struct bpf_prog *tmp_fp; + bool bpf_blinded = false; + bool extra_pass = false; ++ u8 *fimage = NULL; ++ u32 *fcode_base; + u32 extable_len; + u32 fixup_len; + +@@ -97,9 +103,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + addrs = jit_data->addrs; + if (addrs) { + cgctx = jit_data->ctx; +- image = jit_data->image; +- bpf_hdr = jit_data->header; ++ /* ++ * JIT compiled to a writable location (image/code_base) first. ++ * It is then moved to the readonly final location (fimage/fcode_base) ++ * using instruction patching. ++ */ ++ fimage = jit_data->fimage; ++ fhdr = jit_data->fhdr; + proglen = jit_data->proglen; ++ hdr = jit_data->hdr; ++ image = (void *)hdr + ((void *)fimage - (void *)fhdr); + extra_pass = true; + /* During extra pass, ensure index is reset before repopulating extable entries */ + cgctx.exentry_idx = 0; +@@ -119,7 +132,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + cgctx.stack_size = round_up(fp->aux->stack_depth, 16); + + /* Scouting faux-generate pass 0 */ +- if (bpf_jit_build_body(fp, 0, &cgctx, addrs, 0, false)) { ++ if (bpf_jit_build_body(fp, NULL, NULL, &cgctx, addrs, 0, false)) { + /* We hit something illegal or unsupported. */ + fp = org_fp; + goto out_addrs; +@@ -134,7 +147,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + */ + if (cgctx.seen & SEEN_TAILCALL || !is_offset_in_branch_range((long)cgctx.idx * 4)) { + cgctx.idx = 0; +- if (bpf_jit_build_body(fp, 0, &cgctx, addrs, 0, false)) { ++ if (bpf_jit_build_body(fp, NULL, NULL, &cgctx, addrs, 0, false)) { + fp = org_fp; + goto out_addrs; + } +@@ -156,17 +169,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + proglen = cgctx.idx * 4; + alloclen = proglen + FUNCTION_DESCR_SIZE + fixup_len + extable_len; + +- bpf_hdr = bpf_jit_binary_alloc(alloclen, &image, 4, bpf_jit_fill_ill_insns); +- if (!bpf_hdr) { ++ fhdr = bpf_jit_binary_pack_alloc(alloclen, &fimage, 4, &hdr, &image, ++ bpf_jit_fill_ill_insns); ++ if (!fhdr) { + fp = org_fp; + goto out_addrs; + } + + if (extable_len) +- fp->aux->extable = (void *)image + FUNCTION_DESCR_SIZE + proglen + fixup_len; ++ fp->aux->extable = (void *)fimage + FUNCTION_DESCR_SIZE + proglen + fixup_len; + + skip_init_ctx: + code_base = (u32 *)(image + FUNCTION_DESCR_SIZE); ++ fcode_base = (u32 *)(fimage + FUNCTION_DESCR_SIZE); + + /* Code generation passes 1-2 */ + for (pass = 1; pass < 3; pass++) { +@@ -174,8 +189,10 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + cgctx.idx = 0; + cgctx.alt_exit_addr = 0; + bpf_jit_build_prologue(code_base, &cgctx); +- if (bpf_jit_build_body(fp, code_base, &cgctx, addrs, pass, extra_pass)) { +- bpf_jit_binary_free(bpf_hdr); ++ if (bpf_jit_build_body(fp, code_base, fcode_base, &cgctx, addrs, pass, ++ extra_pass)) { ++ bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size)); ++ bpf_jit_binary_pack_free(fhdr, hdr); + fp = org_fp; + goto out_addrs; + } +@@ -195,17 +212,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + + #ifdef CONFIG_PPC64_ELF_ABI_V1 + /* Function descriptor nastiness: Address + TOC */ +- ((u64 *)image)[0] = (u64)code_base; ++ ((u64 *)image)[0] = (u64)fcode_base; + ((u64 *)image)[1] = local_paca->kernel_toc; + #endif + +- fp->bpf_func = (void *)image; ++ fp->bpf_func = (void *)fimage; + fp->jited = 1; + fp->jited_len = proglen + FUNCTION_DESCR_SIZE; + +- bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + bpf_hdr->size); + if (!fp->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(bpf_hdr); ++ if (bpf_jit_binary_pack_finalize(fp, fhdr, hdr)) { ++ fp = org_fp; ++ goto out_addrs; ++ } + bpf_prog_fill_jited_linfo(fp, addrs); + out_addrs: + kfree(addrs); +@@ -215,8 +234,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + jit_data->addrs = addrs; + jit_data->ctx = cgctx; + jit_data->proglen = proglen; +- jit_data->image = image; +- jit_data->header = bpf_hdr; ++ jit_data->fimage = fimage; ++ jit_data->fhdr = fhdr; ++ jit_data->hdr = hdr; + } + + out: +@@ -230,12 +250,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + * The caller should check for (BPF_MODE(code) == BPF_PROBE_MEM) before calling + * this function, as this only applies to BPF_PROBE_MEM, for now. + */ +-int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, int pass, struct codegen_context *ctx, +- int insn_idx, int jmp_off, int dst_reg) ++int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass, ++ struct codegen_context *ctx, int insn_idx, int jmp_off, ++ int dst_reg) + { + off_t offset; + unsigned long pc; +- struct exception_table_entry *ex; ++ struct exception_table_entry *ex, *ex_entry; + u32 *fixup; + + /* Populate extable entries only in the last pass */ +@@ -246,9 +267,16 @@ int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, int pass, struct code + WARN_ON_ONCE(ctx->exentry_idx >= fp->aux->num_exentries)) + return -EINVAL; + ++ /* ++ * Program is first written to image before copying to the ++ * final location (fimage). Accordingly, update in the image first. ++ * As all offsets used are relative, copying as is to the ++ * final location should be alright. ++ */ + pc = (unsigned long)&image[insn_idx]; ++ ex = (void *)fp->aux->extable - (void *)fimage + (void *)image; + +- fixup = (void *)fp->aux->extable - ++ fixup = (void *)ex - + (fp->aux->num_exentries * BPF_FIXUP_LEN * 4) + + (ctx->exentry_idx * BPF_FIXUP_LEN * 4); + +@@ -259,18 +287,42 @@ int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, int pass, struct code + fixup[BPF_FIXUP_LEN - 1] = + PPC_RAW_BRANCH((long)(pc + jmp_off) - (long)&fixup[BPF_FIXUP_LEN - 1]); + +- ex = &fp->aux->extable[ctx->exentry_idx]; ++ ex_entry = &ex[ctx->exentry_idx]; + +- offset = pc - (long)&ex->insn; ++ offset = pc - (long)&ex_entry->insn; + if (WARN_ON_ONCE(offset >= 0 || offset < INT_MIN)) + return -ERANGE; +- ex->insn = offset; ++ ex_entry->insn = offset; + +- offset = (long)fixup - (long)&ex->fixup; ++ offset = (long)fixup - (long)&ex_entry->fixup; + if (WARN_ON_ONCE(offset >= 0 || offset < INT_MIN)) + return -ERANGE; +- ex->fixup = offset; ++ ex_entry->fixup = offset; + + ctx->exentry_idx++; + return 0; + } ++ ++void bpf_jit_free(struct bpf_prog *fp) ++{ ++ if (fp->jited) { ++ struct powerpc_jit_data *jit_data = fp->aux->jit_data; ++ struct bpf_binary_header *hdr; ++ ++ /* ++ * If we fail the final pass of JIT (from jit_subprogs), ++ * the program may not be finalized yet. Call finalize here ++ * before freeing it. ++ */ ++ if (jit_data) { ++ bpf_jit_binary_pack_finalize(fp, jit_data->fhdr, jit_data->hdr); ++ kvfree(jit_data->addrs); ++ kfree(jit_data); ++ } ++ hdr = bpf_jit_binary_pack_hdr(fp); ++ bpf_jit_binary_pack_free(hdr, NULL); ++ WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp)); ++ } ++ ++ bpf_prog_unlock_free(fp); ++} +diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c +index 06f886850a932..dd61aa4325d93 100644 +--- a/arch/powerpc/net/bpf_jit_comp32.c ++++ b/arch/powerpc/net/bpf_jit_comp32.c +@@ -200,12 +200,13 @@ void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx) + EMIT(PPC_RAW_BLR()); + } + +-int bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 func) ++/* Relative offset needs to be calculated based on final image location */ ++int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *ctx, u64 func) + { +- s32 rel = (s32)func - (s32)(image + ctx->idx); ++ s32 rel = (s32)func - (s32)(fimage + ctx->idx); + + if (image && rel < 0x2000000 && rel >= -0x2000000) { +- PPC_BL(func); ++ EMIT(PPC_RAW_BL(rel)); + } else { + /* Load function address into r0 */ + EMIT(PPC_RAW_LIS(_R0, IMM_H(func))); +@@ -278,7 +279,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 o + } + + /* Assemble the body code between the prologue & epilogue */ +-int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *ctx, ++int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct codegen_context *ctx, + u32 *addrs, int pass, bool extra_pass) + { + const struct bpf_insn *insn = fp->insnsi; +@@ -1009,7 +1010,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context * + jmp_off += 4; + } + +- ret = bpf_add_extable_entry(fp, image, pass, ctx, insn_idx, ++ ret = bpf_add_extable_entry(fp, image, fimage, pass, ctx, insn_idx, + jmp_off, dst_reg); + if (ret) + return ret; +@@ -1065,7 +1066,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context * + EMIT(PPC_RAW_STW(bpf_to_ppc(BPF_REG_5), _R1, 12)); + } + +- ret = bpf_jit_emit_func_call_rel(image, ctx, func_addr); ++ ret = bpf_jit_emit_func_call_rel(image, fimage, ctx, func_addr); + if (ret) + return ret; + +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index 2239ce5e8501c..884eef1b3973b 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -240,7 +240,7 @@ static int bpf_jit_emit_func_call_hlp(u32 *image, struct codegen_context *ctx, u + return 0; + } + +-int bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 func) ++int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *ctx, u64 func) + { + unsigned int i, ctx_idx = ctx->idx; + +@@ -361,7 +361,7 @@ asm ( + ); + + /* Assemble the body code between the prologue & epilogue */ +-int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *ctx, ++int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct codegen_context *ctx, + u32 *addrs, int pass, bool extra_pass) + { + enum stf_barrier_type stf_barrier = stf_barrier_type_get(); +@@ -952,8 +952,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context * + addrs[++i] = ctx->idx * 4; + + if (BPF_MODE(code) == BPF_PROBE_MEM) { +- ret = bpf_add_extable_entry(fp, image, pass, ctx, ctx->idx - 1, +- 4, dst_reg); ++ ret = bpf_add_extable_entry(fp, image, fimage, pass, ctx, ++ ctx->idx - 1, 4, dst_reg); + if (ret) + return ret; + } +@@ -1007,7 +1007,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context * + if (func_addr_fixed) + ret = bpf_jit_emit_func_call_hlp(image, ctx, func_addr); + else +- ret = bpf_jit_emit_func_call_rel(image, ctx, func_addr); ++ ret = bpf_jit_emit_func_call_rel(image, fimage, ctx, func_addr); + + if (ret) + return ret; +diff --git a/arch/riscv/include/asm/insn.h b/arch/riscv/include/asm/insn.h +index 06e439eeef9ad..09fde95a5e8f7 100644 +--- a/arch/riscv/include/asm/insn.h ++++ b/arch/riscv/include/asm/insn.h +@@ -145,7 +145,7 @@ + + /* parts of opcode for RVF, RVD and RVQ */ + #define RVFDQ_FL_FS_WIDTH_OFF 12 +-#define RVFDQ_FL_FS_WIDTH_MASK GENMASK(3, 0) ++#define RVFDQ_FL_FS_WIDTH_MASK GENMASK(2, 0) + #define RVFDQ_FL_FS_WIDTH_W 2 + #define RVFDQ_FL_FS_WIDTH_D 3 + #define RVFDQ_LS_FS_WIDTH_Q 4 +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 528ec7cc9a622..0d3f00eb0baee 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -156,7 +156,7 @@ unsigned long __get_wchan(struct task_struct *task) + return pc; + } + +-noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, ++noinline noinstr void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, + struct task_struct *task, struct pt_regs *regs) + { + walk_stackframe(task, regs, consume_entry, cookie); +diff --git a/arch/s390/include/asm/entry-common.h b/arch/s390/include/asm/entry-common.h +index fdd319a622b06..622cd08e5f50f 100644 +--- a/arch/s390/include/asm/entry-common.h ++++ b/arch/s390/include/asm/entry-common.h +@@ -55,7 +55,7 @@ static __always_inline void arch_exit_to_user_mode(void) + static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, + unsigned long ti_work) + { +- choose_random_kstack_offset(get_tod_clock_fast() & 0xff); ++ choose_random_kstack_offset(get_tod_clock_fast()); + } + + #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare +diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl +index 0122cc156952c..51cc3616d5f98 100644 +--- a/arch/s390/kernel/syscalls/syscall.tbl ++++ b/arch/s390/kernel/syscalls/syscall.tbl +@@ -418,7 +418,7 @@ + 412 32 utimensat_time64 - sys_utimensat + 413 32 pselect6_time64 - compat_sys_pselect6_time64 + 414 32 ppoll_time64 - compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 - sys_io_pgetevents ++416 32 io_pgetevents_time64 - compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 - compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 - sys_mq_timedsend + 419 32 mq_timedreceive_time64 - sys_mq_timedreceive +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 62ee557d4b499..05746e22fe79c 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1973,7 +1973,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + print_fn_code(jit.prg_buf, jit.size_prg); + } + if (!fp->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) { ++ bpf_jit_binary_free(header); ++ fp = orig_fp; ++ goto free_addrs; ++ } + } else { + jit_data->header = header; + jit_data->ctx = jit; +diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c +index ff8f24854c646..0ef83b6ac0db7 100644 +--- a/arch/s390/pci/pci_irq.c ++++ b/arch/s390/pci/pci_irq.c +@@ -410,7 +410,7 @@ static void __init cpu_enable_directed_irq(void *unused) + union zpci_sic_iib iib = {{0}}; + union zpci_sic_iib ziib = {{0}}; + +- iib.cdiib.dibv_addr = (u64) zpci_ibv[smp_processor_id()]->vector; ++ iib.cdiib.dibv_addr = virt_to_phys(zpci_ibv[smp_processor_id()]->vector); + + zpci_set_irq_ctrl(SIC_IRQ_MODE_SET_CPU, 0, &iib); + zpci_set_irq_ctrl(SIC_IRQ_MODE_D_SINGLE, PCI_ISC, &ziib); +diff --git a/arch/sh/kernel/sys_sh32.c b/arch/sh/kernel/sys_sh32.c +index 9dca568509a5e..d6f4afcb0e870 100644 +--- a/arch/sh/kernel/sys_sh32.c ++++ b/arch/sh/kernel/sys_sh32.c +@@ -59,3 +59,14 @@ asmlinkage int sys_fadvise64_64_wrapper(int fd, u32 offset0, u32 offset1, + (u64)len0 << 32 | len1, advice); + #endif + } ++ ++/* ++ * swap the arguments the way that libc wants them instead of ++ * moving flags ahead of the 64-bit nbytes argument ++ */ ++SYSCALL_DEFINE6(sh_sync_file_range6, int, fd, SC_ARG64(offset), ++ SC_ARG64(nbytes), unsigned int, flags) ++{ ++ return ksys_sync_file_range(fd, SC_VAL64(loff_t, offset), ++ SC_VAL64(loff_t, nbytes), flags); ++} +diff --git a/arch/sh/kernel/syscalls/syscall.tbl b/arch/sh/kernel/syscalls/syscall.tbl +index e90d585c4d3e7..7e1ceb2ba5721 100644 +--- a/arch/sh/kernel/syscalls/syscall.tbl ++++ b/arch/sh/kernel/syscalls/syscall.tbl +@@ -321,7 +321,7 @@ + 311 common set_robust_list sys_set_robust_list + 312 common get_robust_list sys_get_robust_list + 313 common splice sys_splice +-314 common sync_file_range sys_sync_file_range ++314 common sync_file_range sys_sh_sync_file_range6 + 315 common tee sys_tee + 316 common vmsplice sys_vmsplice + 317 common move_pages sys_move_pages +@@ -395,6 +395,7 @@ + 385 common pkey_alloc sys_pkey_alloc + 386 common pkey_free sys_pkey_free + 387 common rseq sys_rseq ++388 common sync_file_range2 sys_sync_file_range2 + # room for arch specific syscalls + 393 common semget sys_semget + 394 common semctl sys_semctl +diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S +index a45f0f31fe51a..a3d308f2043e5 100644 +--- a/arch/sparc/kernel/sys32.S ++++ b/arch/sparc/kernel/sys32.S +@@ -18,224 +18,3 @@ sys32_mmap2: + sethi %hi(sys_mmap), %g1 + jmpl %g1 + %lo(sys_mmap), %g0 + sllx %o5, 12, %o5 +- +- .align 32 +- .globl sys32_socketcall +-sys32_socketcall: /* %o0=call, %o1=args */ +- cmp %o0, 1 +- bl,pn %xcc, do_einval +- cmp %o0, 18 +- bg,pn %xcc, do_einval +- sub %o0, 1, %o0 +- sllx %o0, 5, %o0 +- sethi %hi(__socketcall_table_begin), %g2 +- or %g2, %lo(__socketcall_table_begin), %g2 +- jmpl %g2 + %o0, %g0 +- nop +-do_einval: +- retl +- mov -EINVAL, %o0 +- +- .align 32 +-__socketcall_table_begin: +- +- /* Each entry is exactly 32 bytes. */ +-do_sys_socket: /* sys_socket(int, int, int) */ +-1: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_socket), %g1 +-2: ldswa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_socket), %g0 +-3: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_bind: /* sys_bind(int fd, struct sockaddr *, int) */ +-4: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_bind), %g1 +-5: ldswa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_bind), %g0 +-6: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_connect: /* sys_connect(int, struct sockaddr *, int) */ +-7: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_connect), %g1 +-8: ldswa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_connect), %g0 +-9: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_listen: /* sys_listen(int, int) */ +-10: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_listen), %g1 +- jmpl %g1 + %lo(sys_listen), %g0 +-11: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +- nop +-do_sys_accept: /* sys_accept(int, struct sockaddr *, int *) */ +-12: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_accept), %g1 +-13: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_accept), %g0 +-14: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_getsockname: /* sys_getsockname(int, struct sockaddr *, int *) */ +-15: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_getsockname), %g1 +-16: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_getsockname), %g0 +-17: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_getpeername: /* sys_getpeername(int, struct sockaddr *, int *) */ +-18: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_getpeername), %g1 +-19: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(sys_getpeername), %g0 +-20: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_socketpair: /* sys_socketpair(int, int, int, int *) */ +-21: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_socketpair), %g1 +-22: ldswa [%o1 + 0x8] %asi, %o2 +-23: lduwa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_socketpair), %g0 +-24: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +-do_sys_send: /* sys_send(int, void *, size_t, unsigned int) */ +-25: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_send), %g1 +-26: lduwa [%o1 + 0x8] %asi, %o2 +-27: lduwa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_send), %g0 +-28: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +-do_sys_recv: /* sys_recv(int, void *, size_t, unsigned int) */ +-29: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_recv), %g1 +-30: lduwa [%o1 + 0x8] %asi, %o2 +-31: lduwa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_recv), %g0 +-32: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +-do_sys_sendto: /* sys_sendto(int, u32, compat_size_t, unsigned int, u32, int) */ +-33: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_sendto), %g1 +-34: lduwa [%o1 + 0x8] %asi, %o2 +-35: lduwa [%o1 + 0xc] %asi, %o3 +-36: lduwa [%o1 + 0x10] %asi, %o4 +-37: ldswa [%o1 + 0x14] %asi, %o5 +- jmpl %g1 + %lo(sys_sendto), %g0 +-38: lduwa [%o1 + 0x4] %asi, %o1 +-do_sys_recvfrom: /* sys_recvfrom(int, u32, compat_size_t, unsigned int, u32, u32) */ +-39: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_recvfrom), %g1 +-40: lduwa [%o1 + 0x8] %asi, %o2 +-41: lduwa [%o1 + 0xc] %asi, %o3 +-42: lduwa [%o1 + 0x10] %asi, %o4 +-43: lduwa [%o1 + 0x14] %asi, %o5 +- jmpl %g1 + %lo(sys_recvfrom), %g0 +-44: lduwa [%o1 + 0x4] %asi, %o1 +-do_sys_shutdown: /* sys_shutdown(int, int) */ +-45: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_shutdown), %g1 +- jmpl %g1 + %lo(sys_shutdown), %g0 +-46: ldswa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +- nop +-do_sys_setsockopt: /* sys_setsockopt(int, int, int, char *, int) */ +-47: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_setsockopt), %g1 +-48: ldswa [%o1 + 0x8] %asi, %o2 +-49: lduwa [%o1 + 0xc] %asi, %o3 +-50: ldswa [%o1 + 0x10] %asi, %o4 +- jmpl %g1 + %lo(sys_setsockopt), %g0 +-51: ldswa [%o1 + 0x4] %asi, %o1 +- nop +-do_sys_getsockopt: /* sys_getsockopt(int, int, int, u32, u32) */ +-52: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_getsockopt), %g1 +-53: ldswa [%o1 + 0x8] %asi, %o2 +-54: lduwa [%o1 + 0xc] %asi, %o3 +-55: lduwa [%o1 + 0x10] %asi, %o4 +- jmpl %g1 + %lo(sys_getsockopt), %g0 +-56: ldswa [%o1 + 0x4] %asi, %o1 +- nop +-do_sys_sendmsg: /* compat_sys_sendmsg(int, struct compat_msghdr *, unsigned int) */ +-57: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(compat_sys_sendmsg), %g1 +-58: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(compat_sys_sendmsg), %g0 +-59: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int) */ +-60: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(compat_sys_recvmsg), %g1 +-61: lduwa [%o1 + 0x8] %asi, %o2 +- jmpl %g1 + %lo(compat_sys_recvmsg), %g0 +-62: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- nop +-do_sys_accept4: /* sys_accept4(int, struct sockaddr *, int *, int) */ +-63: ldswa [%o1 + 0x0] %asi, %o0 +- sethi %hi(sys_accept4), %g1 +-64: lduwa [%o1 + 0x8] %asi, %o2 +-65: ldswa [%o1 + 0xc] %asi, %o3 +- jmpl %g1 + %lo(sys_accept4), %g0 +-66: lduwa [%o1 + 0x4] %asi, %o1 +- nop +- nop +- +- .section __ex_table,"a" +- .align 4 +- .word 1b, __retl_efault, 2b, __retl_efault +- .word 3b, __retl_efault, 4b, __retl_efault +- .word 5b, __retl_efault, 6b, __retl_efault +- .word 7b, __retl_efault, 8b, __retl_efault +- .word 9b, __retl_efault, 10b, __retl_efault +- .word 11b, __retl_efault, 12b, __retl_efault +- .word 13b, __retl_efault, 14b, __retl_efault +- .word 15b, __retl_efault, 16b, __retl_efault +- .word 17b, __retl_efault, 18b, __retl_efault +- .word 19b, __retl_efault, 20b, __retl_efault +- .word 21b, __retl_efault, 22b, __retl_efault +- .word 23b, __retl_efault, 24b, __retl_efault +- .word 25b, __retl_efault, 26b, __retl_efault +- .word 27b, __retl_efault, 28b, __retl_efault +- .word 29b, __retl_efault, 30b, __retl_efault +- .word 31b, __retl_efault, 32b, __retl_efault +- .word 33b, __retl_efault, 34b, __retl_efault +- .word 35b, __retl_efault, 36b, __retl_efault +- .word 37b, __retl_efault, 38b, __retl_efault +- .word 39b, __retl_efault, 40b, __retl_efault +- .word 41b, __retl_efault, 42b, __retl_efault +- .word 43b, __retl_efault, 44b, __retl_efault +- .word 45b, __retl_efault, 46b, __retl_efault +- .word 47b, __retl_efault, 48b, __retl_efault +- .word 49b, __retl_efault, 50b, __retl_efault +- .word 51b, __retl_efault, 52b, __retl_efault +- .word 53b, __retl_efault, 54b, __retl_efault +- .word 55b, __retl_efault, 56b, __retl_efault +- .word 57b, __retl_efault, 58b, __retl_efault +- .word 59b, __retl_efault, 60b, __retl_efault +- .word 61b, __retl_efault, 62b, __retl_efault +- .word 63b, __retl_efault, 64b, __retl_efault +- .word 65b, __retl_efault, 66b, __retl_efault +- .previous +diff --git a/arch/sparc/kernel/syscalls/syscall.tbl b/arch/sparc/kernel/syscalls/syscall.tbl +index 4ed06c71c43fb..d0f535230ad8b 100644 +--- a/arch/sparc/kernel/syscalls/syscall.tbl ++++ b/arch/sparc/kernel/syscalls/syscall.tbl +@@ -117,7 +117,7 @@ + 90 common dup2 sys_dup2 + 91 32 setfsuid32 sys_setfsuid + 92 common fcntl sys_fcntl compat_sys_fcntl +-93 common select sys_select ++93 common select sys_select compat_sys_select + 94 32 setfsgid32 sys_setfsgid + 95 common fsync sys_fsync + 96 common setpriority sys_setpriority +@@ -155,7 +155,7 @@ + 123 32 fchown sys_fchown16 + 123 64 fchown sys_fchown + 124 common fchmod sys_fchmod +-125 common recvfrom sys_recvfrom ++125 common recvfrom sys_recvfrom compat_sys_recvfrom + 126 32 setreuid sys_setreuid16 + 126 64 setreuid sys_setreuid + 127 32 setregid sys_setregid16 +@@ -247,7 +247,7 @@ + 204 32 readdir sys_old_readdir compat_sys_old_readdir + 204 64 readdir sys_nis_syscall + 205 common readahead sys_readahead compat_sys_readahead +-206 common socketcall sys_socketcall sys32_socketcall ++206 common socketcall sys_socketcall compat_sys_socketcall + 207 common syslog sys_syslog + 208 common lookup_dcookie sys_lookup_dcookie compat_sys_lookup_dcookie + 209 common fadvise64 sys_fadvise64 compat_sys_fadvise64 +@@ -461,7 +461,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c +index fa0759bfe498e..73bf0aea8baf1 100644 +--- a/arch/sparc/net/bpf_jit_comp_64.c ++++ b/arch/sparc/net/bpf_jit_comp_64.c +@@ -1602,7 +1602,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + bpf_flush_icache(header, (u8 *)header + header->size); + + if (!prog->is_func || extra_pass) { +- bpf_jit_binary_lock_ro(header); ++ if (bpf_jit_binary_lock_ro(header)) { ++ bpf_jit_binary_free(header); ++ prog = orig_prog; ++ goto out_off; ++ } + } else { + jit_data->ctx = ctx; + jit_data->image = image_ptr; +diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl +index 2d0b1bd866ead..38db5ef2329f3 100644 +--- a/arch/x86/entry/syscalls/syscall_32.tbl ++++ b/arch/x86/entry/syscalls/syscall_32.tbl +@@ -420,7 +420,7 @@ + 412 i386 utimensat_time64 sys_utimensat + 413 i386 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 i386 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 i386 io_pgetevents_time64 sys_io_pgetevents ++416 i386 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 i386 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 i386 mq_timedsend_time64 sys_mq_timedsend + 419 i386 mq_timedreceive_time64 sys_mq_timedreceive +diff --git a/arch/x86/include/asm/entry-common.h b/arch/x86/include/asm/entry-common.h +index 7e523bb3d2d31..fb2809b20b0ac 100644 +--- a/arch/x86/include/asm/entry-common.h ++++ b/arch/x86/include/asm/entry-common.h +@@ -73,19 +73,16 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, + #endif + + /* +- * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), +- * but not enough for x86 stack utilization comfort. To keep +- * reasonable stack head room, reduce the maximum offset to 8 bits. +- * +- * The actual entropy will be further reduced by the compiler when +- * applying stack alignment constraints (see cc_stack_align4/8 in ++ * This value will get limited by KSTACK_OFFSET_MAX(), which is 10 ++ * bits. The actual entropy will be further reduced by the compiler ++ * when applying stack alignment constraints (see cc_stack_align4/8 in + * arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32) + * low bits from any entropy chosen here. + * +- * Therefore, final stack offset entropy will be 5 (x86_64) or +- * 6 (ia32) bits. ++ * Therefore, final stack offset entropy will be 7 (x86_64) or ++ * 8 (ia32) bits. + */ +- choose_random_kstack_offset(rdtsc() & 0xFF); ++ choose_random_kstack_offset(rdtsc()); + } + #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare + +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index a21a4d0ecc345..4b414b0ab0692 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -145,8 +145,8 @@ void restore_fpregs_from_fpstate(struct fpstate *fpstate, u64 mask) + asm volatile( + "fnclex\n\t" + "emms\n\t" +- "fildl %P[addr]" /* set F?P to defined value */ +- : : [addr] "m" (fpstate)); ++ "fildl %[addr]" /* set F?P to defined value */ ++ : : [addr] "m" (*fpstate)); + } + + if (use_xsave()) { +diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c +index e42faa792c079..52e1f3f0b361c 100644 +--- a/arch/x86/kernel/time.c ++++ b/arch/x86/kernel/time.c +@@ -27,25 +27,7 @@ + + unsigned long profile_pc(struct pt_regs *regs) + { +- unsigned long pc = instruction_pointer(regs); +- +- if (!user_mode(regs) && in_lock_functions(pc)) { +-#ifdef CONFIG_FRAME_POINTER +- return *(unsigned long *)(regs->bp + sizeof(long)); +-#else +- unsigned long *sp = (unsigned long *)regs->sp; +- /* +- * Return address is either directly at stack pointer +- * or above a saved flags. Eflags has bits 22-31 zero, +- * kernel addresses don't. +- */ +- if (sp[0] >> 22) +- return sp[0]; +- if (sp[1] >> 22) +- return sp[1]; +-#endif +- } +- return pc; ++ return instruction_pointer(regs); + } + EXPORT_SYMBOL(profile_pc); + +diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c +index 429a89c5468b5..f2fc8c38629b5 100644 +--- a/arch/x86/net/bpf_jit_comp32.c ++++ b/arch/x86/net/bpf_jit_comp32.c +@@ -2600,8 +2600,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + if (bpf_jit_enable > 1) + bpf_jit_dump(prog->len, proglen, pass + 1, image); + +- if (image) { +- bpf_jit_binary_lock_ro(header); ++ if (image && !bpf_jit_binary_lock_ro(header)) { + prog->bpf_func = (void *)image; + prog->jited = 1; + prog->jited_len = proglen; +diff --git a/crypto/ecdh.c b/crypto/ecdh.c +index 80afee3234fbe..3049f147e0117 100644 +--- a/crypto/ecdh.c ++++ b/crypto/ecdh.c +@@ -33,6 +33,8 @@ static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, + params.key_size > sizeof(u64) * ctx->ndigits) + return -EINVAL; + ++ memset(ctx->private_key, 0, sizeof(ctx->private_key)); ++ + if (!params.key || !params.key_size) + return ecc_gen_privkey(ctx->curve_id, ctx->ndigits, + ctx->private_key); +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 535de3ed60f23..0a6aea36cd975 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1890,8 +1890,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + n_ports = max(ahci_nr_ports(hpriv->cap), fls(hpriv->port_map)); + + host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports); +- if (!host) +- return -ENOMEM; ++ if (!host) { ++ rc = -ENOMEM; ++ goto err_rm_sysfs_file; ++ } + host->private_data = hpriv; + + if (ahci_init_msi(pdev, n_ports, hpriv) < 0) { +@@ -1944,11 +1946,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + /* initialize adapter */ + rc = ahci_configure_dma_masks(pdev, hpriv); + if (rc) +- return rc; ++ goto err_rm_sysfs_file; + + rc = ahci_pci_reset_controller(host); + if (rc) +- return rc; ++ goto err_rm_sysfs_file; + + ahci_pci_init_controller(host); + ahci_pci_print_info(host); +@@ -1957,10 +1959,15 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + rc = ahci_host_activate(host, &ahci_sht); + if (rc) +- return rc; ++ goto err_rm_sysfs_file; + + pm_runtime_put_noidle(&pdev->dev); + return 0; ++ ++err_rm_sysfs_file: ++ sysfs_remove_file_from_group(&pdev->dev.kobj, ++ &dev_attr_remapped_nvme.attr, NULL); ++ return rc; + } + + static void ahci_shutdown_one(struct pci_dev *pdev) +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index a492f23faa877..373d23af1d9ac 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5499,6 +5499,18 @@ struct ata_port *ata_port_alloc(struct ata_host *host) + return ap; + } + ++void ata_port_free(struct ata_port *ap) ++{ ++ if (!ap) ++ return; ++ ++ kfree(ap->pmp_link); ++ kfree(ap->slave_link); ++ kfree(ap->ncq_sense_buf); ++ kfree(ap); ++} ++EXPORT_SYMBOL_GPL(ata_port_free); ++ + static void ata_devres_release(struct device *gendev, void *res) + { + struct ata_host *host = dev_get_drvdata(gendev); +@@ -5525,12 +5537,7 @@ static void ata_host_release(struct kref *kref) + int i; + + for (i = 0; i < host->n_ports; i++) { +- struct ata_port *ap = host->ports[i]; +- +- kfree(ap->pmp_link); +- kfree(ap->slave_link); +- kfree(ap->ncq_sense_buf); +- kfree(ap); ++ ata_port_free(host->ports[i]); + host->ports[i] = NULL; + } + kfree(host); +@@ -5580,8 +5587,10 @@ struct ata_host *ata_host_alloc(struct device *dev, int max_ports) + if (!host) + return NULL; + +- if (!devres_open_group(dev, NULL, GFP_KERNEL)) +- goto err_free; ++ if (!devres_open_group(dev, NULL, GFP_KERNEL)) { ++ kfree(host); ++ return NULL; ++ } + + dr = devres_alloc(ata_devres_release, 0, GFP_KERNEL); + if (!dr) +@@ -5613,8 +5622,6 @@ struct ata_host *ata_host_alloc(struct device *dev, int max_ports) + + err_out: + devres_release_group(dev, NULL); +- err_free: +- kfree(host); + return NULL; + } + EXPORT_SYMBOL_GPL(ata_host_alloc); +@@ -5913,7 +5920,7 @@ int ata_host_register(struct ata_host *host, const struct scsi_host_template *sh + * allocation time. + */ + for (i = host->n_ports; host->ports[i]; i++) +- kfree(host->ports[i]); ++ ata_port_free(host->ports[i]); + + /* give ports names and add SCSI hosts */ + for (i = 0; i < host->n_ports; i++) { +diff --git a/drivers/counter/ti-eqep.c b/drivers/counter/ti-eqep.c +index b0f24cf3e891d..4d3de4a35801f 100644 +--- a/drivers/counter/ti-eqep.c ++++ b/drivers/counter/ti-eqep.c +@@ -6,6 +6,7 @@ + */ + + #include <linux/bitops.h> ++#include <linux/clk.h> + #include <linux/counter.h> + #include <linux/kernel.h> + #include <linux/mod_devicetable.h> +@@ -376,6 +377,7 @@ static int ti_eqep_probe(struct platform_device *pdev) + struct counter_device *counter; + struct ti_eqep_cnt *priv; + void __iomem *base; ++ struct clk *clk; + int err; + + counter = devm_counter_alloc(dev, sizeof(*priv)); +@@ -415,6 +417,10 @@ static int ti_eqep_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + pm_runtime_get_sync(dev); + ++ clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(clk)) ++ return dev_err_probe(dev, PTR_ERR(clk), "failed to enable clock\n"); ++ + err = counter_add(counter); + if (err < 0) { + pm_runtime_put_sync(dev); +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index a5f4c255edadf..3efc2aef31ce4 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -675,7 +675,7 @@ static int amd_pstate_set_boost(struct cpufreq_policy *policy, int state) + if (state) + policy->cpuinfo.max_freq = cpudata->max_freq; + else +- policy->cpuinfo.max_freq = cpudata->nominal_freq * 1000; ++ policy->cpuinfo.max_freq = cpudata->nominal_freq; + + policy->max = policy->cpuinfo.max_freq; + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 586a58d761bb6..0ee3a04bb1022 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -356,15 +356,14 @@ static void intel_pstate_set_itmt_prio(int cpu) + int ret; + + ret = cppc_get_perf_caps(cpu, &cppc_perf); +- if (ret) +- return; +- + /* +- * On some systems with overclocking enabled, CPPC.highest_perf is hardcoded to 0xff. +- * In this case we can't use CPPC.highest_perf to enable ITMT. +- * In this case we can look at MSR_HWP_CAPABILITIES bits [8:0] to decide. ++ * If CPPC is not available, fall back to MSR_HWP_CAPABILITIES bits [8:0]. ++ * ++ * Also, on some systems with overclocking enabled, CPPC.highest_perf is ++ * hardcoded to 0xff, so CPPC.highest_perf cannot be used to enable ITMT. ++ * Fall back to MSR_HWP_CAPABILITIES then too. + */ +- if (cppc_perf.highest_perf == CPPC_MAX_PERF) ++ if (ret || cppc_perf.highest_perf == CPPC_MAX_PERF) + cppc_perf.highest_perf = HWP_HIGHEST_PERF(READ_ONCE(all_cpu_data[cpu]->hwp_cap_cached)); + + /* +diff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h +index 8e5f3d84311e5..6444cc827c9ce 100644 +--- a/drivers/cxl/core/core.h ++++ b/drivers/cxl/core/core.h +@@ -27,7 +27,14 @@ void cxl_decoder_kill_region(struct cxl_endpoint_decoder *cxled); + int cxl_region_init(void); + void cxl_region_exit(void); + int cxl_get_poison_by_endpoint(struct cxl_port *port); ++struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa); ++ + #else ++static inline ++struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa) ++{ ++ return NULL; ++} + static inline int cxl_get_poison_by_endpoint(struct cxl_port *port) + { + return 0; +diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c +index 90664659d5fab..3600b7cbfb589 100644 +--- a/drivers/cxl/core/hdm.c ++++ b/drivers/cxl/core/hdm.c +@@ -52,6 +52,14 @@ int devm_cxl_add_passthrough_decoder(struct cxl_port *port) + struct cxl_dport *dport = NULL; + int single_port_map[1]; + unsigned long index; ++ struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev); ++ ++ /* ++ * Capability checks are moot for passthrough decoders, support ++ * any and all possibilities. ++ */ ++ cxlhdm->interleave_mask = ~0U; ++ cxlhdm->iw_cap_mask = ~0UL; + + cxlsd = cxl_switch_decoder_alloc(port, 1); + if (IS_ERR(cxlsd)) +@@ -79,6 +87,11 @@ static void parse_hdm_decoder_caps(struct cxl_hdm *cxlhdm) + cxlhdm->interleave_mask |= GENMASK(11, 8); + if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_14_12, hdm_cap)) + cxlhdm->interleave_mask |= GENMASK(14, 12); ++ cxlhdm->iw_cap_mask = BIT(1) | BIT(2) | BIT(4) | BIT(8); ++ if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_3_6_12_WAY, hdm_cap)) ++ cxlhdm->iw_cap_mask |= BIT(3) | BIT(6) | BIT(12); ++ if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_16_WAY, hdm_cap)) ++ cxlhdm->iw_cap_mask |= BIT(16); + } + + static int map_hdm_decoder_regs(struct cxl_port *port, void __iomem *crb, +diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c +index 2f43d368ba073..eb895c70043fd 100644 +--- a/drivers/cxl/core/memdev.c ++++ b/drivers/cxl/core/memdev.c +@@ -251,50 +251,6 @@ int cxl_trigger_poison_list(struct cxl_memdev *cxlmd) + } + EXPORT_SYMBOL_NS_GPL(cxl_trigger_poison_list, CXL); + +-struct cxl_dpa_to_region_context { +- struct cxl_region *cxlr; +- u64 dpa; +-}; +- +-static int __cxl_dpa_to_region(struct device *dev, void *arg) +-{ +- struct cxl_dpa_to_region_context *ctx = arg; +- struct cxl_endpoint_decoder *cxled; +- u64 dpa = ctx->dpa; +- +- if (!is_endpoint_decoder(dev)) +- return 0; +- +- cxled = to_cxl_endpoint_decoder(dev); +- if (!cxled->dpa_res || !resource_size(cxled->dpa_res)) +- return 0; +- +- if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start) +- return 0; +- +- dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa, +- dev_name(&cxled->cxld.region->dev)); +- +- ctx->cxlr = cxled->cxld.region; +- +- return 1; +-} +- +-static struct cxl_region *cxl_dpa_to_region(struct cxl_memdev *cxlmd, u64 dpa) +-{ +- struct cxl_dpa_to_region_context ctx; +- struct cxl_port *port; +- +- ctx = (struct cxl_dpa_to_region_context) { +- .dpa = dpa, +- }; +- port = cxlmd->endpoint; +- if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port)) +- device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region); +- +- return ctx.cxlr; +-} +- + static int cxl_validate_poison_dpa(struct cxl_memdev *cxlmd, u64 dpa) + { + struct cxl_dev_state *cxlds = cxlmd->cxlds; +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index 7a646fed17211..bc5a43897d578 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -997,6 +997,26 @@ static int cxl_port_attach_region(struct cxl_port *port, + } + cxld = cxl_rr->decoder; + ++ /* ++ * the number of targets should not exceed the target_count ++ * of the decoder ++ */ ++ if (is_switch_decoder(&cxld->dev)) { ++ struct cxl_switch_decoder *cxlsd; ++ ++ cxlsd = to_cxl_switch_decoder(&cxld->dev); ++ if (cxl_rr->nr_targets > cxlsd->nr_targets) { ++ dev_dbg(&cxlr->dev, ++ "%s:%s %s add: %s:%s @ %d overflows targets: %d\n", ++ dev_name(port->uport_dev), dev_name(&port->dev), ++ dev_name(&cxld->dev), dev_name(&cxlmd->dev), ++ dev_name(&cxled->cxld.dev), pos, ++ cxlsd->nr_targets); ++ rc = -ENXIO; ++ goto out_erase; ++ } ++ } ++ + rc = cxl_rr_ep_add(cxl_rr, cxled); + if (rc) { + dev_dbg(&cxlr->dev, +@@ -1106,6 +1126,50 @@ static int check_last_peer(struct cxl_endpoint_decoder *cxled, + return 0; + } + ++static int check_interleave_cap(struct cxl_decoder *cxld, int iw, int ig) ++{ ++ struct cxl_port *port = to_cxl_port(cxld->dev.parent); ++ struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev); ++ unsigned int interleave_mask; ++ u8 eiw; ++ u16 eig; ++ int high_pos, low_pos; ++ ++ if (!test_bit(iw, &cxlhdm->iw_cap_mask)) ++ return -ENXIO; ++ /* ++ * Per CXL specification r3.1(8.2.4.20.13 Decoder Protection), ++ * if eiw < 8: ++ * DPAOFFSET[51: eig + 8] = HPAOFFSET[51: eig + 8 + eiw] ++ * DPAOFFSET[eig + 7: 0] = HPAOFFSET[eig + 7: 0] ++ * ++ * when the eiw is 0, all the bits of HPAOFFSET[51: 0] are used, the ++ * interleave bits are none. ++ * ++ * if eiw >= 8: ++ * DPAOFFSET[51: eig + 8] = HPAOFFSET[51: eig + eiw] / 3 ++ * DPAOFFSET[eig + 7: 0] = HPAOFFSET[eig + 7: 0] ++ * ++ * when the eiw is 8, all the bits of HPAOFFSET[51: 0] are used, the ++ * interleave bits are none. ++ */ ++ ways_to_eiw(iw, &eiw); ++ if (eiw == 0 || eiw == 8) ++ return 0; ++ ++ granularity_to_eig(ig, &eig); ++ if (eiw > 8) ++ high_pos = eiw + eig - 1; ++ else ++ high_pos = eiw + eig + 7; ++ low_pos = eig + 8; ++ interleave_mask = GENMASK(high_pos, low_pos); ++ if (interleave_mask & ~cxlhdm->interleave_mask) ++ return -ENXIO; ++ ++ return 0; ++} ++ + static int cxl_port_setup_targets(struct cxl_port *port, + struct cxl_region *cxlr, + struct cxl_endpoint_decoder *cxled) +@@ -1256,6 +1320,15 @@ static int cxl_port_setup_targets(struct cxl_port *port, + return -ENXIO; + } + } else { ++ rc = check_interleave_cap(cxld, iw, ig); ++ if (rc) { ++ dev_dbg(&cxlr->dev, ++ "%s:%s iw: %d ig: %d is not supported\n", ++ dev_name(port->uport_dev), ++ dev_name(&port->dev), iw, ig); ++ return rc; ++ } ++ + cxld->interleave_ways = iw; + cxld->interleave_granularity = ig; + cxld->hpa_range = (struct range) { +@@ -1692,6 +1765,15 @@ static int cxl_region_attach(struct cxl_region *cxlr, + struct cxl_dport *dport; + int rc = -ENXIO; + ++ rc = check_interleave_cap(&cxled->cxld, p->interleave_ways, ++ p->interleave_granularity); ++ if (rc) { ++ dev_dbg(&cxlr->dev, "%s iw: %d ig: %d is not supported\n", ++ dev_name(&cxled->cxld.dev), p->interleave_ways, ++ p->interleave_granularity); ++ return rc; ++ } ++ + if (cxled->mode != cxlr->mode) { + dev_dbg(&cxlr->dev, "%s region mode: %d mismatch: %d\n", + dev_name(&cxled->cxld.dev), cxlr->mode, cxled->mode); +@@ -2509,6 +2591,61 @@ int cxl_get_poison_by_endpoint(struct cxl_port *port) + return rc; + } + ++struct cxl_dpa_to_region_context { ++ struct cxl_region *cxlr; ++ u64 dpa; ++}; ++ ++static int __cxl_dpa_to_region(struct device *dev, void *arg) ++{ ++ struct cxl_dpa_to_region_context *ctx = arg; ++ struct cxl_endpoint_decoder *cxled; ++ struct cxl_region *cxlr; ++ u64 dpa = ctx->dpa; ++ ++ if (!is_endpoint_decoder(dev)) ++ return 0; ++ ++ cxled = to_cxl_endpoint_decoder(dev); ++ if (!cxled || !cxled->dpa_res || !resource_size(cxled->dpa_res)) ++ return 0; ++ ++ if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start) ++ return 0; ++ ++ /* ++ * Stop the region search (return 1) when an endpoint mapping is ++ * found. The region may not be fully constructed so offering ++ * the cxlr in the context structure is not guaranteed. ++ */ ++ cxlr = cxled->cxld.region; ++ if (cxlr) ++ dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa, ++ dev_name(&cxlr->dev)); ++ else ++ dev_dbg(dev, "dpa:0x%llx mapped in endpoint:%s\n", dpa, ++ dev_name(dev)); ++ ++ ctx->cxlr = cxlr; ++ ++ return 1; ++} ++ ++struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa) ++{ ++ struct cxl_dpa_to_region_context ctx; ++ struct cxl_port *port; ++ ++ ctx = (struct cxl_dpa_to_region_context) { ++ .dpa = dpa, ++ }; ++ port = cxlmd->endpoint; ++ if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port)) ++ device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region); ++ ++ return ctx.cxlr; ++} ++ + static struct lock_class_key cxl_pmem_region_key; + + static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr) +diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h +index de2c250c894b1..bb3ad219b6b31 100644 +--- a/drivers/cxl/cxl.h ++++ b/drivers/cxl/cxl.h +@@ -43,6 +43,8 @@ + #define CXL_HDM_DECODER_TARGET_COUNT_MASK GENMASK(7, 4) + #define CXL_HDM_DECODER_INTERLEAVE_11_8 BIT(8) + #define CXL_HDM_DECODER_INTERLEAVE_14_12 BIT(9) ++#define CXL_HDM_DECODER_INTERLEAVE_3_6_12_WAY BIT(11) ++#define CXL_HDM_DECODER_INTERLEAVE_16_WAY BIT(12) + #define CXL_HDM_DECODER_CTRL_OFFSET 0x4 + #define CXL_HDM_DECODER_ENABLE BIT(1) + #define CXL_HDM_DECODER0_BASE_LOW_OFFSET(i) (0x20 * (i) + 0x10) +diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h +index 6933bc20e76b6..59c7f88b915a4 100644 +--- a/drivers/cxl/cxlmem.h ++++ b/drivers/cxl/cxlmem.h +@@ -888,11 +888,21 @@ static inline void cxl_mem_active_dec(void) + + int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd); + ++/** ++ * struct cxl_hdm - HDM Decoder registers and cached / decoded capabilities ++ * @regs: mapped registers, see devm_cxl_setup_hdm() ++ * @decoder_count: number of decoders for this port ++ * @target_count: for switch decoders, max downstream port targets ++ * @interleave_mask: interleave granularity capability, see check_interleave_cap() ++ * @iw_cap_mask: bitmask of supported interleave ways, see check_interleave_cap() ++ * @port: mapped cxl_port, see devm_cxl_setup_hdm() ++ */ + struct cxl_hdm { + struct cxl_component_regs regs; + unsigned int decoder_count; + unsigned int target_count; + unsigned int interleave_mask; ++ unsigned long iw_cap_mask; + struct cxl_port *port; + }; + +diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c +index 8db5717bdabe5..aa3ce8aa99dc8 100644 +--- a/drivers/gpio/gpio-davinci.c ++++ b/drivers/gpio/gpio-davinci.c +@@ -225,6 +225,11 @@ static int davinci_gpio_probe(struct platform_device *pdev) + else + nirq = DIV_ROUND_UP(ngpio, 16); + ++ if (nirq > MAX_INT_PER_BANK) { ++ dev_err(dev, "Too many IRQs!\n"); ++ return -EINVAL; ++ } ++ + chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL); + if (!chips) + return -ENOMEM; +diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c +index b4b71e68b90de..d526a4c91e82e 100644 +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -132,6 +132,10 @@ struct linehandle_state { + GPIOHANDLE_REQUEST_OPEN_DRAIN | \ + GPIOHANDLE_REQUEST_OPEN_SOURCE) + ++#define GPIOHANDLE_REQUEST_DIRECTION_FLAGS \ ++ (GPIOHANDLE_REQUEST_INPUT | \ ++ GPIOHANDLE_REQUEST_OUTPUT) ++ + static int linehandle_validate_flags(u32 flags) + { + /* Return an error if an unknown flag is set */ +@@ -212,21 +216,21 @@ static long linehandle_set_config(struct linehandle_state *lh, + if (ret) + return ret; + ++ /* Lines must be reconfigured explicitly as input or output. */ ++ if (!(lflags & GPIOHANDLE_REQUEST_DIRECTION_FLAGS)) ++ return -EINVAL; ++ + for (i = 0; i < lh->num_descs; i++) { + desc = lh->descs[i]; +- linehandle_flags_to_desc_flags(gcnf.flags, &desc->flags); ++ linehandle_flags_to_desc_flags(lflags, &desc->flags); + +- /* +- * Lines have to be requested explicitly for input +- * or output, else the line will be treated "as is". +- */ + if (lflags & GPIOHANDLE_REQUEST_OUTPUT) { + int val = !!gcnf.default_values[i]; + + ret = gpiod_direction_output(desc, val); + if (ret) + return ret; +- } else if (lflags & GPIOHANDLE_REQUEST_INPUT) { ++ } else { + ret = gpiod_direction_input(desc); + if (ret) + return ret; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +index 23651a9738cc8..6521d06c7e4e7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +@@ -399,7 +399,7 @@ amdgpu_atomfirmware_get_vram_info(struct amdgpu_device *adev, + mem_channel_number = vram_info->v30.channel_num; + mem_channel_width = vram_info->v30.channel_width; + if (vram_width) +- *vram_width = mem_channel_number * (1 << mem_channel_width); ++ *vram_width = mem_channel_number * 16; + break; + default: + return -EINVAL; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 062d78818da16..e1227b7c71b16 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4685,11 +4685,14 @@ int amdgpu_device_mode1_reset(struct amdgpu_device *adev) + + dev_info(adev->dev, "GPU mode1 reset\n"); + ++ /* Cache the state before bus master disable. The saved config space ++ * values are used in other cases like restore after mode-2 reset. ++ */ ++ amdgpu_device_cache_pci_state(adev->pdev); ++ + /* disable BM */ + pci_clear_master(adev->pdev); + +- amdgpu_device_cache_pci_state(adev->pdev); +- + if (amdgpu_dpm_is_mode1_reset_supported(adev)) { + dev_info(adev->dev, "GPU smu mode1 reset\n"); + ret = amdgpu_dpm_mode1_reset(adev); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +index db6fc0cb18eb8..f417c3393a090 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +@@ -2,6 +2,7 @@ + + #include <drm/drm_atomic_helper.h> + #include <drm/drm_simple_kms_helper.h> ++#include <drm/drm_gem_framebuffer_helper.h> + #include <drm/drm_vblank.h> + + #include "amdgpu.h" +@@ -313,7 +314,13 @@ static int amdgpu_vkms_prepare_fb(struct drm_plane *plane, + return 0; + } + afb = to_amdgpu_framebuffer(new_state->fb); +- obj = new_state->fb->obj[0]; ++ ++ obj = drm_gem_fb_get_obj(new_state->fb, 0); ++ if (!obj) { ++ DRM_ERROR("Failed to get obj from framebuffer\n"); ++ return -EINVAL; ++ } ++ + rbo = gem_to_amdgpu_bo(obj); + adev = amdgpu_ttm_adev(rbo->tbo.bdev); + +@@ -367,12 +374,19 @@ static void amdgpu_vkms_cleanup_fb(struct drm_plane *plane, + struct drm_plane_state *old_state) + { + struct amdgpu_bo *rbo; ++ struct drm_gem_object *obj; + int r; + + if (!old_state->fb) + return; + +- rbo = gem_to_amdgpu_bo(old_state->fb->obj[0]); ++ obj = drm_gem_fb_get_obj(old_state->fb, 0); ++ if (!obj) { ++ DRM_ERROR("Failed to get obj from framebuffer\n"); ++ return; ++ } ++ ++ rbo = gem_to_amdgpu_bo(obj); + r = amdgpu_bo_reserve(rbo, false); + if (unlikely(r)) { + DRM_ERROR("failed to reserve rbo before unpin\n"); +diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +index db87aa7b5c90f..9a0beaf601f87 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c ++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +@@ -1584,9 +1584,17 @@ static bool retrieve_link_cap(struct dc_link *link) + return false; + } + +- if (dp_is_lttpr_present(link)) ++ if (dp_is_lttpr_present(link)) { + configure_lttpr_mode_transparent(link); + ++ // Echo TOTAL_LTTPR_CNT back downstream ++ core_link_write_dpcd( ++ link, ++ DP_TOTAL_LTTPR_CNT, ++ &link->dpcd_caps.lttpr_caps.phy_repeater_cnt, ++ sizeof(link->dpcd_caps.lttpr_caps.phy_repeater_cnt)); ++ } ++ + /* Read DP tunneling information. */ + status = dpcd_get_tunneling_device_data(link); + +diff --git a/drivers/gpu/drm/amd/display/include/dpcd_defs.h b/drivers/gpu/drm/amd/display/include/dpcd_defs.h +index 914f28e9f2242..aee5170f5fb23 100644 +--- a/drivers/gpu/drm/amd/display/include/dpcd_defs.h ++++ b/drivers/gpu/drm/amd/display/include/dpcd_defs.h +@@ -177,4 +177,9 @@ enum dpcd_psr_sink_states { + #define DP_SINK_PR_PIXEL_DEVIATION_PER_LINE 0x379 + #define DP_SINK_PR_MAX_NUMBER_OF_DEVIATION_LINE 0x37A + ++/* Remove once drm_dp_helper.h is updated upstream */ ++#ifndef DP_TOTAL_LTTPR_CNT ++#define DP_TOTAL_LTTPR_CNT 0xF000A /* 2.1 */ ++#endif ++ + #endif /* __DAL_DPCD_DEFS_H__ */ +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index d612133e2cf7e..117237d3528bd 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -524,6 +524,9 @@ struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper) + if (!info) + return ERR_PTR(-ENOMEM); + ++ if (!drm_leak_fbdev_smem) ++ info->flags |= FBINFO_HIDE_SMEM_START; ++ + ret = fb_alloc_cmap(&info->cmap, 256, 0); + if (ret) + goto err_release; +@@ -1860,9 +1863,6 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper) + info = fb_helper->info; + info->var.pixclock = 0; + +- if (!drm_leak_fbdev_smem) +- info->flags |= FBINFO_HIDE_SMEM_START; +- + /* Need to drop locks to avoid recursive deadlock in + * register_framebuffer. This is ok because the only thing left to do is + * register the fbdev emulation instance in kernel_fb_helper_list. */ +diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c +index 6c9427bb4053b..13cd754af311d 100644 +--- a/drivers/gpu/drm/drm_fbdev_dma.c ++++ b/drivers/gpu/drm/drm_fbdev_dma.c +@@ -130,7 +130,10 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper, + info->flags |= FBINFO_READS_FAST; /* signal caching */ + info->screen_size = sizes->surface_height * fb->pitches[0]; + info->screen_buffer = map.vaddr; +- info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer)); ++ if (!(info->flags & FBINFO_HIDE_SMEM_START)) { ++ if (!drm_WARN_ON(dev, is_vmalloc_addr(info->screen_buffer))) ++ info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer)); ++ } + info->fix.smem_len = info->screen_size; + + return 0; +diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c +index a7799086017ab..639fa6bef69b3 100644 +--- a/drivers/gpu/drm/drm_file.c ++++ b/drivers/gpu/drm/drm_file.c +@@ -529,14 +529,12 @@ void drm_file_update_pid(struct drm_file *filp) + + dev = filp->minor->dev; + mutex_lock(&dev->filelist_mutex); ++ get_pid(pid); + old = rcu_replace_pointer(filp->pid, pid, 1); + mutex_unlock(&dev->filelist_mutex); + +- if (pid != old) { +- get_pid(pid); +- synchronize_rcu(); +- put_pid(old); +- } ++ synchronize_rcu(); ++ put_pid(old); + } + + /** +diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +index 40371b8a9bbbd..93bc1cc1ee7e6 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c ++++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +@@ -298,6 +298,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma) + return; + + GEM_BUG_ON(fence->vma != vma); ++ i915_active_wait(&fence->active); + GEM_BUG_ON(!i915_active_is_idle(&fence->active)); + GEM_BUG_ON(atomic_read(&fence->pin_count)); + +diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +index 670c9739e5e18..2033214c4b784 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +@@ -209,6 +209,8 @@ static int nv17_tv_get_ld_modes(struct drm_encoder *encoder, + struct drm_display_mode *mode; + + mode = drm_mode_duplicate(encoder->dev, tv_mode); ++ if (!mode) ++ continue; + + mode->clock = tv_norm->tv_enc_mode.vrefresh * + mode->htotal / 1000 * +@@ -258,6 +260,8 @@ static int nv17_tv_get_hd_modes(struct drm_encoder *encoder, + if (modes[i].hdisplay == output_mode->hdisplay && + modes[i].vdisplay == output_mode->vdisplay) { + mode = drm_mode_duplicate(encoder->dev, output_mode); ++ if (!mode) ++ continue; + mode->type |= DRM_MODE_TYPE_PREFERRED; + + } else { +@@ -265,6 +269,8 @@ static int nv17_tv_get_hd_modes(struct drm_encoder *encoder, + modes[i].vdisplay, 60, false, + (output_mode->flags & + DRM_MODE_FLAG_INTERLACE), false); ++ if (!mode) ++ continue; + } + + /* CVT modes are sometimes unsuitable... */ +diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +index 7838947a1bf3c..bb201f848ae97 100644 +--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c ++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +@@ -883,10 +883,10 @@ static int ili9881c_prepare(struct drm_panel *panel) + msleep(5); + + /* And reset it */ +- gpiod_set_value(ctx->reset, 1); ++ gpiod_set_value_cansleep(ctx->reset, 1); + msleep(20); + +- gpiod_set_value(ctx->reset, 0); ++ gpiod_set_value_cansleep(ctx->reset, 0); + msleep(20); + + for (i = 0; i < ctx->desc->init_length; i++) { +@@ -941,7 +941,7 @@ static int ili9881c_unprepare(struct drm_panel *panel) + + mipi_dsi_dcs_enter_sleep_mode(ctx->dsi); + regulator_disable(ctx->power); +- gpiod_set_value(ctx->reset, 1); ++ gpiod_set_value_cansleep(ctx->reset, 1); + + return 0; + } +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index e8d12ec8dbec1..11ade6bac592f 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2523,6 +2523,7 @@ static const struct display_timing koe_tx26d202vm0bwa_timing = { + .vfront_porch = { 3, 5, 10 }, + .vback_porch = { 2, 5, 10 }, + .vsync_len = { 5, 5, 5 }, ++ .flags = DISPLAY_FLAGS_DE_HIGH, + }; + + static const struct panel_desc koe_tx26d202vm0bwa = { +diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h +index 3d3d2109dfebc..426a49851e349 100644 +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -132,7 +132,6 @@ extern int radeon_cik_support; + /* RADEON_IB_POOL_SIZE must be a power of 2 */ + #define RADEON_IB_POOL_SIZE 16 + #define RADEON_DEBUGFS_MAX_COMPONENTS 32 +-#define RADEONFB_CONN_LIMIT 4 + #define RADEON_BIOS_NUM_SCRATCH 8 + + /* internal ring indices */ +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index efd18c8d84c83..5f1d24d3120c4 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -683,7 +683,7 @@ static void radeon_crtc_init(struct drm_device *dev, int index) + struct radeon_device *rdev = dev->dev_private; + struct radeon_crtc *radeon_crtc; + +- radeon_crtc = kzalloc(sizeof(struct radeon_crtc) + (RADEONFB_CONN_LIMIT * sizeof(struct drm_connector *)), GFP_KERNEL); ++ radeon_crtc = kzalloc(sizeof(*radeon_crtc), GFP_KERNEL); + if (radeon_crtc == NULL) + return; + +@@ -709,12 +709,6 @@ static void radeon_crtc_init(struct drm_device *dev, int index) + dev->mode_config.cursor_width = radeon_crtc->max_cursor_width; + dev->mode_config.cursor_height = radeon_crtc->max_cursor_height; + +-#if 0 +- radeon_crtc->mode_set.crtc = &radeon_crtc->base; +- radeon_crtc->mode_set.connectors = (struct drm_connector **)(radeon_crtc + 1); +- radeon_crtc->mode_set.num_connectors = 0; +-#endif +- + if (rdev->is_atom_bios && (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom)) + radeon_atombios_init_crtc(dev, radeon_crtc); + else +diff --git a/drivers/i2c/i2c-slave-testunit.c b/drivers/i2c/i2c-slave-testunit.c +index a49642bbae4b7..ca43e98cae1b2 100644 +--- a/drivers/i2c/i2c-slave-testunit.c ++++ b/drivers/i2c/i2c-slave-testunit.c +@@ -118,9 +118,12 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client, + queue_delayed_work(system_long_wq, &tu->worker, + msecs_to_jiffies(10 * tu->regs[TU_REG_DELAY])); + } +- fallthrough; ++ break; + + case I2C_SLAVE_WRITE_REQUESTED: ++ if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags)) ++ return -EBUSY; ++ + memset(tu->regs, 0, TU_NUM_REGS); + tu->reg_idx = 0; + break; +diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig +index 5c5876b4d3b62..0398974c9d2b0 100644 +--- a/drivers/iio/accel/Kconfig ++++ b/drivers/iio/accel/Kconfig +@@ -325,6 +325,8 @@ config DMARD10 + config FXLS8962AF + tristate + depends on I2C || !I2C # cannot be built-in for modular I2C ++ select IIO_BUFFER ++ select IIO_KFIFO_BUF + + config FXLS8962AF_I2C + tristate "NXP FXLS8962AF/FXLS8964AF Accelerometer I2C Driver" +diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c +index 468c2656d2be7..98648c679a55c 100644 +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -157,6 +157,8 @@ static int ad7266_read_raw(struct iio_dev *indio_dev, + ret = ad7266_read_single(st, val, chan->address); + iio_device_release_direct_mode(indio_dev); + ++ if (ret < 0) ++ return ret; + *val = (*val >> 2) & 0xfff; + if (chan->scan_type.sign == 's') + *val = sign_extend32(*val, +diff --git a/drivers/iio/adc/xilinx-ams.c b/drivers/iio/adc/xilinx-ams.c +index f0b71a1220e02..f52abf759260f 100644 +--- a/drivers/iio/adc/xilinx-ams.c ++++ b/drivers/iio/adc/xilinx-ams.c +@@ -414,8 +414,12 @@ static void ams_enable_channel_sequence(struct iio_dev *indio_dev) + + /* Run calibration of PS & PL as part of the sequence */ + scan_mask = BIT(0) | BIT(AMS_PS_SEQ_MAX); +- for (i = 0; i < indio_dev->num_channels; i++) +- scan_mask |= BIT_ULL(indio_dev->channels[i].scan_index); ++ for (i = 0; i < indio_dev->num_channels; i++) { ++ const struct iio_chan_spec *chan = &indio_dev->channels[i]; ++ ++ if (chan->scan_index < AMS_CTRL_SEQ_BASE) ++ scan_mask |= BIT_ULL(chan->scan_index); ++ } + + if (ams->ps_base) { + /* put sysmon in a soft reset to change the sequence */ +diff --git a/drivers/iio/chemical/bme680.h b/drivers/iio/chemical/bme680.h +index 4edc5d21cb9fa..f959252a4fe66 100644 +--- a/drivers/iio/chemical/bme680.h ++++ b/drivers/iio/chemical/bme680.h +@@ -54,7 +54,9 @@ + #define BME680_NB_CONV_MASK GENMASK(3, 0) + + #define BME680_REG_MEAS_STAT_0 0x1D ++#define BME680_NEW_DATA_BIT BIT(7) + #define BME680_GAS_MEAS_BIT BIT(6) ++#define BME680_MEAS_BIT BIT(5) + + /* Calibration Parameters */ + #define BME680_T2_LSB_REG 0x8A +diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c +index ef5e0e46fd344..500f56834b01f 100644 +--- a/drivers/iio/chemical/bme680_core.c ++++ b/drivers/iio/chemical/bme680_core.c +@@ -10,6 +10,7 @@ + */ + #include <linux/acpi.h> + #include <linux/bitfield.h> ++#include <linux/delay.h> + #include <linux/device.h> + #include <linux/module.h> + #include <linux/log2.h> +@@ -38,7 +39,7 @@ struct bme680_calib { + s8 par_h3; + s8 par_h4; + s8 par_h5; +- s8 par_h6; ++ u8 par_h6; + s8 par_h7; + s8 par_gh1; + s16 par_gh2; +@@ -342,10 +343,10 @@ static s16 bme680_compensate_temp(struct bme680_data *data, + if (!calib->par_t2) + bme680_read_calib(data, calib); + +- var1 = (adc_temp >> 3) - (calib->par_t1 << 1); ++ var1 = (adc_temp >> 3) - ((s32)calib->par_t1 << 1); + var2 = (var1 * calib->par_t2) >> 11; + var3 = ((var1 >> 1) * (var1 >> 1)) >> 12; +- var3 = (var3 * (calib->par_t3 << 4)) >> 14; ++ var3 = (var3 * ((s32)calib->par_t3 << 4)) >> 14; + data->t_fine = var2 + var3; + calc_temp = (data->t_fine * 5 + 128) >> 8; + +@@ -368,9 +369,9 @@ static u32 bme680_compensate_press(struct bme680_data *data, + var1 = (data->t_fine >> 1) - 64000; + var2 = ((((var1 >> 2) * (var1 >> 2)) >> 11) * calib->par_p6) >> 2; + var2 = var2 + (var1 * calib->par_p5 << 1); +- var2 = (var2 >> 2) + (calib->par_p4 << 16); ++ var2 = (var2 >> 2) + ((s32)calib->par_p4 << 16); + var1 = (((((var1 >> 2) * (var1 >> 2)) >> 13) * +- (calib->par_p3 << 5)) >> 3) + ++ ((s32)calib->par_p3 << 5)) >> 3) + + ((calib->par_p2 * var1) >> 1); + var1 = var1 >> 18; + var1 = ((32768 + var1) * calib->par_p1) >> 15; +@@ -388,7 +389,7 @@ static u32 bme680_compensate_press(struct bme680_data *data, + var3 = ((press_comp >> 8) * (press_comp >> 8) * + (press_comp >> 8) * calib->par_p10) >> 17; + +- press_comp += (var1 + var2 + var3 + (calib->par_p7 << 7)) >> 4; ++ press_comp += (var1 + var2 + var3 + ((s32)calib->par_p7 << 7)) >> 4; + + return press_comp; + } +@@ -414,7 +415,7 @@ static u32 bme680_compensate_humid(struct bme680_data *data, + (((temp_scaled * ((temp_scaled * calib->par_h5) / 100)) + >> 6) / 100) + (1 << 14))) >> 10; + var3 = var1 * var2; +- var4 = calib->par_h6 << 7; ++ var4 = (s32)calib->par_h6 << 7; + var4 = (var4 + ((temp_scaled * calib->par_h7) / 100)) >> 4; + var5 = ((var3 >> 14) * (var3 >> 14)) >> 10; + var6 = (var4 * var5) >> 1; +@@ -532,6 +533,43 @@ static u8 bme680_oversampling_to_reg(u8 val) + return ilog2(val) + 1; + } + ++/* ++ * Taken from Bosch BME680 API: ++ * https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L490 ++ */ ++static int bme680_wait_for_eoc(struct bme680_data *data) ++{ ++ struct device *dev = regmap_get_device(data->regmap); ++ unsigned int check; ++ int ret; ++ /* ++ * (Sum of oversampling ratios * time per oversampling) + ++ * TPH measurement + gas measurement + wait transition from forced mode ++ * + heater duration ++ */ ++ int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press + ++ data->oversampling_humid) * 1936) + (477 * 4) + ++ (477 * 5) + 1000 + (data->heater_dur * 1000); ++ ++ usleep_range(wait_eoc_us, wait_eoc_us + 100); ++ ++ ret = regmap_read(data->regmap, BME680_REG_MEAS_STAT_0, &check); ++ if (ret) { ++ dev_err(dev, "failed to read measurement status register.\n"); ++ return ret; ++ } ++ if (check & BME680_MEAS_BIT) { ++ dev_err(dev, "Device measurement cycle incomplete.\n"); ++ return -EBUSY; ++ } ++ if (!(check & BME680_NEW_DATA_BIT)) { ++ dev_err(dev, "No new data available from the device.\n"); ++ return -ENODATA; ++ } ++ ++ return 0; ++} ++ + static int bme680_chip_config(struct bme680_data *data) + { + struct device *dev = regmap_get_device(data->regmap); +@@ -622,6 +660,10 @@ static int bme680_read_temp(struct bme680_data *data, int *val) + if (ret < 0) + return ret; + ++ ret = bme680_wait_for_eoc(data); ++ if (ret) ++ return ret; ++ + ret = regmap_bulk_read(data->regmap, BME680_REG_TEMP_MSB, + &tmp, 3); + if (ret < 0) { +@@ -678,7 +720,7 @@ static int bme680_read_press(struct bme680_data *data, + } + + *val = bme680_compensate_press(data, adc_press); +- *val2 = 100; ++ *val2 = 1000; + return IIO_VAL_FRACTIONAL; + } + +@@ -738,6 +780,10 @@ static int bme680_read_gas(struct bme680_data *data, + if (ret < 0) + return ret; + ++ ret = bme680_wait_for_eoc(data); ++ if (ret) ++ return ret; ++ + ret = regmap_read(data->regmap, BME680_REG_MEAS_STAT_0, &check); + if (check & BME680_GAS_MEAS_BIT) { + dev_err(dev, "gas measurement incomplete\n"); +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index a2ef1373a274e..a65630d5742f0 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -920,7 +920,7 @@ static int bmp380_cmd(struct bmp280_data *data, u8 cmd) + } + + /* +- * Returns temperature in Celsius dregrees, resolution is 0.01º C. Output value of ++ * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value of + * "5123" equals 51.2º C. t_fine carries fine temperature as global value. + * + * Taken from datasheet, Section Appendix 9, "Compensation formula" and repo +@@ -1385,12 +1385,12 @@ static int bmp580_read_temp(struct bmp280_data *data, int *val, int *val2) + + /* + * Temperature is returned in Celsius degrees in fractional +- * form down 2^16. We reescale by x1000 to return milli Celsius +- * to respect IIO ABI. ++ * form down 2^16. We rescale by x1000 to return millidegrees ++ * Celsius to respect IIO ABI. + */ +- *val = raw_temp * 1000; +- *val2 = 16; +- return IIO_VAL_FRACTIONAL_LOG2; ++ raw_temp = sign_extend32(raw_temp, 23); ++ *val = ((s64)raw_temp * 1000) / (1 << 16); ++ return IIO_VAL_INT; + } + + static int bmp580_read_press(struct bmp280_data *data, int *val, int *val2) +@@ -1412,7 +1412,7 @@ static int bmp580_read_press(struct bmp280_data *data, int *val, int *val2) + } + /* + * Pressure is returned in Pascals in fractional form down 2^16. +- * We reescale /1000 to convert to kilopascal to respect IIO ABI. ++ * We rescale /1000 to convert to kilopascal to respect IIO ABI. + */ + *val = raw_press; + *val2 = 64000; /* 2^6 * 1000 */ +diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h +index 5c0563ce75725..9d9f4ce2baa6e 100644 +--- a/drivers/iio/pressure/bmp280.h ++++ b/drivers/iio/pressure/bmp280.h +@@ -410,7 +410,7 @@ struct bmp280_data { + __le16 bmp280_cal_buf[BMP280_CONTIGUOUS_CALIB_REGS / 2]; + __be16 bmp180_cal_buf[BMP180_REG_CALIB_COUNT / 2]; + u8 bmp380_cal_buf[BMP380_CALIB_REG_COUNT]; +- /* Miscellaneous, endianess-aware data buffers */ ++ /* Miscellaneous, endianness-aware data buffers */ + __le16 le16; + __be16 be16; + } __aligned(IIO_DMA_MINALIGN); +diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c +index 01a499a8b88db..438ed35881752 100644 +--- a/drivers/infiniband/core/restrack.c ++++ b/drivers/infiniband/core/restrack.c +@@ -37,22 +37,6 @@ int rdma_restrack_init(struct ib_device *dev) + return 0; + } + +-static const char *type2str(enum rdma_restrack_type type) +-{ +- static const char * const names[RDMA_RESTRACK_MAX] = { +- [RDMA_RESTRACK_PD] = "PD", +- [RDMA_RESTRACK_CQ] = "CQ", +- [RDMA_RESTRACK_QP] = "QP", +- [RDMA_RESTRACK_CM_ID] = "CM_ID", +- [RDMA_RESTRACK_MR] = "MR", +- [RDMA_RESTRACK_CTX] = "CTX", +- [RDMA_RESTRACK_COUNTER] = "COUNTER", +- [RDMA_RESTRACK_SRQ] = "SRQ", +- }; +- +- return names[type]; +-}; +- + /** + * rdma_restrack_clean() - clean resource tracking + * @dev: IB device +@@ -60,47 +44,14 @@ static const char *type2str(enum rdma_restrack_type type) + void rdma_restrack_clean(struct ib_device *dev) + { + struct rdma_restrack_root *rt = dev->res; +- struct rdma_restrack_entry *e; +- char buf[TASK_COMM_LEN]; +- bool found = false; +- const char *owner; + int i; + + for (i = 0 ; i < RDMA_RESTRACK_MAX; i++) { + struct xarray *xa = &dev->res[i].xa; + +- if (!xa_empty(xa)) { +- unsigned long index; +- +- if (!found) { +- pr_err("restrack: %s", CUT_HERE); +- dev_err(&dev->dev, "BUG: RESTRACK detected leak of resources\n"); +- } +- xa_for_each(xa, index, e) { +- if (rdma_is_kernel_res(e)) { +- owner = e->kern_name; +- } else { +- /* +- * There is no need to call get_task_struct here, +- * because we can be here only if there are more +- * get_task_struct() call than put_task_struct(). +- */ +- get_task_comm(buf, e->task); +- owner = buf; +- } +- +- pr_err("restrack: %s %s object allocated by %s is not freed\n", +- rdma_is_kernel_res(e) ? "Kernel" : +- "User", +- type2str(e->type), owner); +- } +- found = true; +- } ++ WARN_ON(!xa_empty(xa)); + xa_destroy(xa); + } +- if (found) +- pr_err("restrack: %s", CUT_HERE); +- + kfree(rt); + } + +diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c +index ad6828e4f2e2d..ae7ba0c419f5a 100644 +--- a/drivers/input/touchscreen/ili210x.c ++++ b/drivers/input/touchscreen/ili210x.c +@@ -261,8 +261,8 @@ static int ili251x_read_touch_data(struct i2c_client *client, u8 *data) + if (!error && data[0] == 2) { + error = i2c_master_recv(client, data + ILI251X_DATA_SIZE1, + ILI251X_DATA_SIZE2); +- if (error >= 0 && error != ILI251X_DATA_SIZE2) +- error = -EIO; ++ if (error >= 0) ++ error = error == ILI251X_DATA_SIZE2 ? 0 : -EIO; + } + + return error; +diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig +index f7149d0f3d45c..e7b736800dd02 100644 +--- a/drivers/irqchip/Kconfig ++++ b/drivers/irqchip/Kconfig +@@ -557,7 +557,7 @@ config IRQ_LOONGARCH_CPU + bool + select GENERIC_IRQ_CHIP + select IRQ_DOMAIN +- select GENERIC_IRQ_EFFECTIVE_AFF_MASK ++ select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP + select LOONGSON_HTVEC + select LOONGSON_LIOINTC + select LOONGSON_EIOINTC +diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c +index b3736bdd4b9f2..08e95fad5b12e 100644 +--- a/drivers/irqchip/irq-loongson-eiointc.c ++++ b/drivers/irqchip/irq-loongson-eiointc.c +@@ -15,6 +15,7 @@ + #include <linux/irqchip/chained_irq.h> + #include <linux/kernel.h> + #include <linux/syscore_ops.h> ++#include <asm/numa.h> + + #define EIOINTC_REG_NODEMAP 0x14a0 + #define EIOINTC_REG_IPMAP 0x14c0 +@@ -349,7 +350,7 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header, + int node; + + if (cpu_has_flatmode) +- node = cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE); ++ node = early_cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE); + else + node = eiointc_priv[nr_pics - 1]->node; + +@@ -441,7 +442,7 @@ int __init eiointc_acpi_init(struct irq_domain *parent, + goto out_free_handle; + + if (cpu_has_flatmode) +- node = cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE); ++ node = early_cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE); + else + node = acpi_eiointc->node; + acpi_set_vec_parent(node, priv->eiointc_domain, pch_group); +diff --git a/drivers/irqchip/irq-loongson-liointc.c b/drivers/irqchip/irq-loongson-liointc.c +index e4b33aed1c97b..7c4fe7ab4b830 100644 +--- a/drivers/irqchip/irq-loongson-liointc.c ++++ b/drivers/irqchip/irq-loongson-liointc.c +@@ -28,7 +28,7 @@ + + #define LIOINTC_INTC_CHIP_START 0x20 + +-#define LIOINTC_REG_INTC_STATUS (LIOINTC_INTC_CHIP_START + 0x20) ++#define LIOINTC_REG_INTC_STATUS(core) (LIOINTC_INTC_CHIP_START + 0x20 + (core) * 8) + #define LIOINTC_REG_INTC_EN_STATUS (LIOINTC_INTC_CHIP_START + 0x04) + #define LIOINTC_REG_INTC_ENABLE (LIOINTC_INTC_CHIP_START + 0x08) + #define LIOINTC_REG_INTC_DISABLE (LIOINTC_INTC_CHIP_START + 0x0c) +@@ -217,7 +217,7 @@ static int liointc_init(phys_addr_t addr, unsigned long size, int revision, + goto out_free_priv; + + for (i = 0; i < LIOINTC_NUM_CORES; i++) +- priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS; ++ priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS(i); + + for (i = 0; i < LIOINTC_NUM_PARENT; i++) + priv->handler[i].parent_int_map = parent_int_map[i]; +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 733d0bc4b4cc3..b43695bc51e75 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -956,7 +956,7 @@ int dvb_usercopy(struct file *file, + int (*func)(struct file *file, + unsigned int cmd, void *arg)) + { +- char sbuf[128]; ++ char sbuf[128] = {}; + void *mbuf = NULL; + void *parg = NULL; + int err = -EINVAL; +diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c +index c23251bb95f38..25664cd5e90f4 100644 +--- a/drivers/mmc/host/sdhci-brcmstb.c ++++ b/drivers/mmc/host/sdhci-brcmstb.c +@@ -23,6 +23,7 @@ + #define BRCMSTB_MATCH_FLAGS_NO_64BIT BIT(0) + #define BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT BIT(1) + #define BRCMSTB_MATCH_FLAGS_HAS_CLOCK_GATE BIT(2) ++#define BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY BIT(4) + + #define BRCMSTB_PRIV_FLAGS_HAS_CQE BIT(0) + #define BRCMSTB_PRIV_FLAGS_GATE_CLOCK BIT(1) +@@ -325,6 +326,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev) + if (match_priv->flags & BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT) + host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + ++ if (!(match_priv->flags & BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY)) ++ host->mmc_host_ops.card_busy = NULL; ++ + /* Change the base clock frequency if the DT property exists */ + if (device_property_read_u32(&pdev->dev, "clock-frequency", + &priv->base_freq_hz) != 0) +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 7c14feb5db770..7039af2680ffd 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -1325,7 +1325,7 @@ static int jmicron_pmos(struct sdhci_pci_chip *chip, int on) + + ret = pci_read_config_byte(chip->pdev, 0xAE, &scratch); + if (ret) +- return ret; ++ goto fail; + + /* + * Turn PMOS on [bit 0], set over current detection to 2.4 V +@@ -1336,7 +1336,10 @@ static int jmicron_pmos(struct sdhci_pci_chip *chip, int on) + else + scratch &= ~0x47; + +- return pci_write_config_byte(chip->pdev, 0xAE, scratch); ++ ret = pci_write_config_byte(chip->pdev, 0xAE, scratch); ++ ++fail: ++ return pcibios_err_to_errno(ret); + } + + static int jmicron_probe(struct sdhci_pci_chip *chip) +@@ -2201,7 +2204,7 @@ static int sdhci_pci_probe(struct pci_dev *pdev, + + ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &slots); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + + slots = PCI_SLOT_INFO_SLOTS(slots) + 1; + dev_dbg(&pdev->dev, "found %d slot(s)\n", slots); +@@ -2210,7 +2213,7 @@ static int sdhci_pci_probe(struct pci_dev *pdev, + + ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &first_bar); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + + first_bar &= PCI_SLOT_INFO_FIRST_BAR_MASK; + +diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c +index d4a02184784a3..058bef1c7e419 100644 +--- a/drivers/mmc/host/sdhci-pci-o2micro.c ++++ b/drivers/mmc/host/sdhci-pci-o2micro.c +@@ -823,7 +823,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + +@@ -834,7 +834,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_CLKREQ, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x20; + pci_write_config_byte(chip->pdev, O2_SD_CLKREQ, scratch); + +@@ -843,7 +843,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + */ + ret = pci_read_config_byte(chip->pdev, O2_SD_CAPS, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x01; + pci_write_config_byte(chip->pdev, O2_SD_CAPS, scratch); + pci_write_config_byte(chip->pdev, O2_SD_CAPS, 0x73); +@@ -856,7 +856,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_INF_MOD, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x08; + pci_write_config_byte(chip->pdev, O2_SD_INF_MOD, scratch); + +@@ -864,7 +864,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -875,7 +875,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); +@@ -886,7 +886,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + O2_SD_FUNC_REG0, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 = ((scratch_32 & 0xFF000000) >> 24); + + /* Check Whether subId is 0x11 or 0x12 */ +@@ -898,7 +898,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + O2_SD_FUNC_REG4, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + /* Enable Base Clk setting change */ + scratch_32 |= O2_SD_FREG4_ENABLE_CLK_SET; +@@ -921,7 +921,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_CLK_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + scratch_32 &= ~(0xFF00); + scratch_32 |= 0x07E0C800; +@@ -931,14 +931,14 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_CLKREQ, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 |= 0x3; + pci_write_config_dword(chip->pdev, O2_SD_CLKREQ, scratch_32); + + ret = pci_read_config_dword(chip->pdev, + O2_SD_PLL_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + scratch_32 &= ~(0x1F3F070E); + scratch_32 |= 0x18270106; +@@ -949,7 +949,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_CAP_REG2, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 &= ~(0xE0); + pci_write_config_dword(chip->pdev, + O2_SD_CAP_REG2, scratch_32); +@@ -961,7 +961,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -971,7 +971,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); +@@ -979,7 +979,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_dword(chip->pdev, + O2_SD_PLL_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + if ((scratch_32 & 0xff000000) == 0x01000000) { + scratch_32 &= 0x0000FFFF; +@@ -998,7 +998,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + O2_SD_FUNC_REG4, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 |= (1 << 22); + pci_write_config_dword(chip->pdev, + O2_SD_FUNC_REG4, scratch_32); +@@ -1017,7 +1017,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -1028,7 +1028,7 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + /* UnLock WP */ + ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + +@@ -1057,13 +1057,16 @@ static int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) + /* Lock WP */ + ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; + } + + return 0; ++ ++read_fail: ++ return pcibios_err_to_errno(ret); + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 8ad5f49a4ce9e..9796a3cb3ca62 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2515,26 +2515,29 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio); + + static int sdhci_check_ro(struct sdhci_host *host) + { +- unsigned long flags; ++ bool allow_invert = false; + int is_readonly; + +- spin_lock_irqsave(&host->lock, flags); +- +- if (host->flags & SDHCI_DEVICE_DEAD) ++ if (host->flags & SDHCI_DEVICE_DEAD) { + is_readonly = 0; +- else if (host->ops->get_ro) ++ } else if (host->ops->get_ro) { + is_readonly = host->ops->get_ro(host); +- else if (mmc_can_gpio_ro(host->mmc)) ++ } else if (mmc_can_gpio_ro(host->mmc)) { + is_readonly = mmc_gpio_get_ro(host->mmc); +- else ++ /* Do not invert twice */ ++ allow_invert = !(host->mmc->caps2 & MMC_CAP2_RO_ACTIVE_HIGH); ++ } else { + is_readonly = !(sdhci_readl(host, SDHCI_PRESENT_STATE) + & SDHCI_WRITE_PROTECT); ++ allow_invert = true; ++ } + +- spin_unlock_irqrestore(&host->lock, flags); ++ if (is_readonly >= 0 && ++ allow_invert && ++ (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT)) ++ is_readonly = !is_readonly; + +- /* This quirk needs to be replaced by a callback-function later */ +- return host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT ? +- !is_readonly : is_readonly; ++ return is_readonly; + } + + #define SAMPLE_COUNT 5 +diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c +index a16b42a885816..3b55b676ca6b9 100644 +--- a/drivers/mtd/parsers/redboot.c ++++ b/drivers/mtd/parsers/redboot.c +@@ -102,7 +102,7 @@ static int parse_redboot_partitions(struct mtd_info *master, + offset -= master->erasesize; + } + } else { +- offset = directory * master->erasesize; ++ offset = (unsigned long) directory * master->erasesize; + while (mtd_block_isbad(master, offset)) { + offset += master->erasesize; + if (offset == master->size) +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +index eebf967f4711a..1665f78abb5c9 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +@@ -1618,11 +1618,20 @@ static int mcp251xfd_open(struct net_device *ndev) + clear_bit(MCP251XFD_FLAGS_DOWN, priv->flags); + can_rx_offload_enable(&priv->offload); + ++ priv->wq = alloc_ordered_workqueue("%s-mcp251xfd_wq", ++ WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ dev_name(&spi->dev)); ++ if (!priv->wq) { ++ err = -ENOMEM; ++ goto out_can_rx_offload_disable; ++ } ++ INIT_WORK(&priv->tx_work, mcp251xfd_tx_obj_write_sync); ++ + err = request_threaded_irq(spi->irq, NULL, mcp251xfd_irq, + IRQF_SHARED | IRQF_ONESHOT, + dev_name(&spi->dev), priv); + if (err) +- goto out_can_rx_offload_disable; ++ goto out_destroy_workqueue; + + err = mcp251xfd_chip_interrupts_enable(priv); + if (err) +@@ -1634,6 +1643,8 @@ static int mcp251xfd_open(struct net_device *ndev) + + out_free_irq: + free_irq(spi->irq, priv); ++ out_destroy_workqueue: ++ destroy_workqueue(priv->wq); + out_can_rx_offload_disable: + can_rx_offload_disable(&priv->offload); + set_bit(MCP251XFD_FLAGS_DOWN, priv->flags); +@@ -1661,6 +1672,7 @@ static int mcp251xfd_stop(struct net_device *ndev) + hrtimer_cancel(&priv->tx_irq_timer); + mcp251xfd_chip_interrupts_disable(priv); + free_irq(ndev->irq, priv); ++ destroy_workqueue(priv->wq); + can_rx_offload_disable(&priv->offload); + mcp251xfd_timestamp_stop(priv); + mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED); +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c +index 160528d3cc26b..b1de8052a45cc 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c +@@ -131,6 +131,39 @@ mcp251xfd_tx_obj_from_skb(const struct mcp251xfd_priv *priv, + tx_obj->xfer[0].len = len; + } + ++static void mcp251xfd_tx_failure_drop(const struct mcp251xfd_priv *priv, ++ struct mcp251xfd_tx_ring *tx_ring, ++ int err) ++{ ++ struct net_device *ndev = priv->ndev; ++ struct net_device_stats *stats = &ndev->stats; ++ unsigned int frame_len = 0; ++ u8 tx_head; ++ ++ tx_ring->head--; ++ stats->tx_dropped++; ++ tx_head = mcp251xfd_get_tx_head(tx_ring); ++ can_free_echo_skb(ndev, tx_head, &frame_len); ++ netdev_completed_queue(ndev, 1, frame_len); ++ netif_wake_queue(ndev); ++ ++ if (net_ratelimit()) ++ netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err); ++} ++ ++void mcp251xfd_tx_obj_write_sync(struct work_struct *work) ++{ ++ struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv, ++ tx_work); ++ struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj; ++ struct mcp251xfd_tx_ring *tx_ring = priv->tx; ++ int err; ++ ++ err = spi_sync(priv->spi, &tx_obj->msg); ++ if (err) ++ mcp251xfd_tx_failure_drop(priv, tx_ring, err); ++} ++ + static int mcp251xfd_tx_obj_write(const struct mcp251xfd_priv *priv, + struct mcp251xfd_tx_obj *tx_obj) + { +@@ -162,6 +195,11 @@ static bool mcp251xfd_tx_busy(const struct mcp251xfd_priv *priv, + return false; + } + ++static bool mcp251xfd_work_busy(struct work_struct *work) ++{ ++ return work_busy(work); ++} ++ + netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + struct net_device *ndev) + { +@@ -175,7 +213,8 @@ netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + if (can_dev_dropped_skb(ndev, skb)) + return NETDEV_TX_OK; + +- if (mcp251xfd_tx_busy(priv, tx_ring)) ++ if (mcp251xfd_tx_busy(priv, tx_ring) || ++ mcp251xfd_work_busy(&priv->tx_work)) + return NETDEV_TX_BUSY; + + tx_obj = mcp251xfd_get_tx_obj_next(tx_ring); +@@ -193,13 +232,13 @@ netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + netdev_sent_queue(priv->ndev, frame_len); + + err = mcp251xfd_tx_obj_write(priv, tx_obj); +- if (err) +- goto out_err; +- +- return NETDEV_TX_OK; +- +- out_err: +- netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err); ++ if (err == -EBUSY) { ++ netif_stop_queue(ndev); ++ priv->tx_work_obj = tx_obj; ++ queue_work(priv->wq, &priv->tx_work); ++ } else if (err) { ++ mcp251xfd_tx_failure_drop(priv, tx_ring, err); ++ } + + return NETDEV_TX_OK; + } +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +index 24510b3b80203..b35bfebd23f29 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +@@ -633,6 +633,10 @@ struct mcp251xfd_priv { + struct mcp251xfd_rx_ring *rx[MCP251XFD_FIFO_RX_NUM]; + struct mcp251xfd_tx_ring tx[MCP251XFD_FIFO_TX_NUM]; + ++ struct workqueue_struct *wq; ++ struct work_struct tx_work; ++ struct mcp251xfd_tx_obj *tx_work_obj; ++ + DECLARE_BITMAP(flags, __MCP251XFD_FLAGS_SIZE__); + + u8 rx_ring_num; +@@ -952,6 +956,7 @@ void mcp251xfd_skb_set_timestamp(const struct mcp251xfd_priv *priv, + void mcp251xfd_timestamp_init(struct mcp251xfd_priv *priv); + void mcp251xfd_timestamp_stop(struct mcp251xfd_priv *priv); + ++void mcp251xfd_tx_obj_write_sync(struct work_struct *work); + netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb, + struct net_device *ndev); + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 83b7f2d5c1ea6..a7e8fcdf25768 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -174,10 +174,8 @@ int ksz9477_reset_switch(struct ksz_device *dev) + SPI_AUTO_EDGE_DETECTION, 0); + + /* default configuration */ +- ksz_read8(dev, REG_SW_LUE_CTRL_1, &data8); +- data8 = SW_AGING_ENABLE | SW_LINK_AUTO_AGING | +- SW_SRC_ADDR_FILTER | SW_FLUSH_STP_TABLE | SW_FLUSH_MSTP_TABLE; +- ksz_write8(dev, REG_SW_LUE_CTRL_1, data8); ++ ksz_write8(dev, REG_SW_LUE_CTRL_1, ++ SW_AGING_ENABLE | SW_LINK_AUTO_AGING | SW_SRC_ADDR_FILTER); + + /* disable interrupts */ + ksz_write32(dev, REG_SW_INT_MASK__4, SWITCH_INT_MASK); +@@ -1114,6 +1112,10 @@ int ksz9477_setup(struct dsa_switch *ds) + /* Enable REG_SW_MTU__2 reg by setting SW_JUMBO_PACKET */ + ksz_cfg(dev, REG_SW_MAC_CTRL_1, SW_JUMBO_PACKET, true); + ++ /* Use collision based back pressure mode. */ ++ ksz_cfg(dev, REG_SW_MAC_CTRL_1, SW_BACK_PRESSURE, ++ SW_BACK_PRESSURE_COLLISION); ++ + /* Now we can configure default MTU value */ + ret = regmap_update_bits(ksz_regmap_16(dev), REG_SW_MTU__2, REG_SW_MTU_MASK, + VLAN_ETH_FRAME_LEN + ETH_FCS_LEN); +diff --git a/drivers/net/dsa/microchip/ksz9477_reg.h b/drivers/net/dsa/microchip/ksz9477_reg.h +index cba3dba58bc37..a2ef4b18349c4 100644 +--- a/drivers/net/dsa/microchip/ksz9477_reg.h ++++ b/drivers/net/dsa/microchip/ksz9477_reg.h +@@ -267,6 +267,7 @@ + #define REG_SW_MAC_CTRL_1 0x0331 + + #define SW_BACK_PRESSURE BIT(5) ++#define SW_BACK_PRESSURE_COLLISION 0 + #define FAIR_FLOW_CTRL BIT(4) + #define NO_EXC_COLLISION_DROP BIT(3) + #define SW_JUMBO_PACKET BIT(2) +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 3c2a2b5290e5b..1c3f186499989 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -1973,7 +1973,7 @@ static void ksz_irq_bus_sync_unlock(struct irq_data *d) + struct ksz_device *dev = kirq->dev; + int ret; + +- ret = ksz_write32(dev, kirq->reg_mask, kirq->masked); ++ ret = ksz_write8(dev, kirq->reg_mask, kirq->masked); + if (ret) + dev_err(dev->dev, "failed to change IRQ mask\n"); + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 888509cf1f210..40e8818295951 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -2896,11 +2896,14 @@ static int dpaa2_eth_xdp_xmit(struct net_device *net_dev, int n, + static int update_xps(struct dpaa2_eth_priv *priv) + { + struct net_device *net_dev = priv->net_dev; +- struct cpumask xps_mask; +- struct dpaa2_eth_fq *fq; + int i, num_queues, netdev_queues; ++ struct dpaa2_eth_fq *fq; ++ cpumask_var_t xps_mask; + int err = 0; + ++ if (!alloc_cpumask_var(&xps_mask, GFP_KERNEL)) ++ return -ENOMEM; ++ + num_queues = dpaa2_eth_queue_count(priv); + netdev_queues = (net_dev->num_tc ? : 1) * num_queues; + +@@ -2910,16 +2913,17 @@ static int update_xps(struct dpaa2_eth_priv *priv) + for (i = 0; i < netdev_queues; i++) { + fq = &priv->fq[i % num_queues]; + +- cpumask_clear(&xps_mask); +- cpumask_set_cpu(fq->target_cpu, &xps_mask); ++ cpumask_clear(xps_mask); ++ cpumask_set_cpu(fq->target_cpu, xps_mask); + +- err = netif_set_xps_queue(net_dev, &xps_mask, i); ++ err = netif_set_xps_queue(net_dev, xps_mask, i); + if (err) { + netdev_warn_once(net_dev, "Error setting XPS queue\n"); + break; + } + } + ++ free_cpumask_var(xps_mask); + return err; + } + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index cdf5251e56795..ca21e55335b23 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4057,6 +4057,12 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter, bool do_h_free) + adapter->num_active_tx_scrqs = 0; + } + ++ /* Clean any remaining outstanding SKBs ++ * we freed the irq so we won't be hearing ++ * from them ++ */ ++ clean_tx_pools(adapter); ++ + if (adapter->rx_scrq) { + for (i = 0; i < adapter->num_active_rx_scrqs; i++) { + if (!adapter->rx_scrq[i]) +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 26ef8aec4cfdf..600a2f5370875 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3958,7 +3958,7 @@ bool ice_is_wol_supported(struct ice_hw *hw) + int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) + { + struct ice_pf *pf = vsi->back; +- int err = 0, timeout = 50; ++ int i, err = 0, timeout = 50; + + if (!new_rx && !new_tx) + return -EINVAL; +@@ -3984,6 +3984,14 @@ int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) + + ice_vsi_close(vsi); + ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT); ++ ++ ice_for_each_traffic_class(i) { ++ if (vsi->tc_cfg.ena_tc & BIT(i)) ++ netdev_set_tc_queue(vsi->netdev, ++ vsi->tc_cfg.tc_info[i].netdev_tc, ++ vsi->tc_cfg.tc_info[i].qcount_tx, ++ vsi->tc_cfg.tc_info[i].qoffset); ++ } + ice_pf_dcb_recfg(pf, locked); + ice_vsi_open(vsi); + done: +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +index c9f1c79f3f9d0..ba090262e27ef 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +@@ -1607,8 +1607,8 @@ static void mlxsw_sp_sb_sr_occ_query_cb(struct mlxsw_core *mlxsw_core, + int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, + unsigned int sb_index) + { ++ u16 local_port, local_port_1, first_local_port, last_local_port; + struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core); +- u16 local_port, local_port_1, last_local_port; + struct mlxsw_sp_sb_sr_occ_query_cb_ctx cb_ctx; + u8 masked_count, current_page = 0; + unsigned long cb_priv = 0; +@@ -1628,6 +1628,7 @@ int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, + masked_count = 0; + mlxsw_reg_sbsr_pack(sbsr_pl, false); + mlxsw_reg_sbsr_port_page_set(sbsr_pl, current_page); ++ first_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE; + last_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE + + MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE - 1; + +@@ -1645,9 +1646,12 @@ int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, + if (local_port != MLXSW_PORT_CPU_PORT) { + /* Ingress quotas are not supported for the CPU port */ + mlxsw_reg_sbsr_ingress_port_mask_set(sbsr_pl, +- local_port, 1); ++ local_port - first_local_port, ++ 1); + } +- mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, local_port, 1); ++ mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, ++ local_port - first_local_port, ++ 1); + for (i = 0; i < mlxsw_sp->sb_vals->pool_count; i++) { + err = mlxsw_sp_sb_pm_occ_query(mlxsw_sp, local_port, i, + &bulk_list); +@@ -1684,7 +1688,7 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, + unsigned int sb_index) + { + struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core); +- u16 local_port, last_local_port; ++ u16 local_port, first_local_port, last_local_port; + LIST_HEAD(bulk_list); + unsigned int masked_count; + u8 current_page = 0; +@@ -1702,6 +1706,7 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, + masked_count = 0; + mlxsw_reg_sbsr_pack(sbsr_pl, true); + mlxsw_reg_sbsr_port_page_set(sbsr_pl, current_page); ++ first_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE; + last_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE + + MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE - 1; + +@@ -1719,9 +1724,12 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, + if (local_port != MLXSW_PORT_CPU_PORT) { + /* Ingress quotas are not supported for the CPU port */ + mlxsw_reg_sbsr_ingress_port_mask_set(sbsr_pl, +- local_port, 1); ++ local_port - first_local_port, ++ 1); + } +- mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, local_port, 1); ++ mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, ++ local_port - first_local_port, ++ 1); + for (i = 0; i < mlxsw_sp->sb_vals->pool_count; i++) { + err = mlxsw_sp_sb_pm_occ_clear(mlxsw_sp, local_port, i, + &bulk_list); +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index e443d69e39511..a09001d22b49c 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -2752,6 +2752,8 @@ static int add_adev(struct gdma_dev *gd) + if (ret) + goto init_fail; + ++ /* madev is owned by the auxiliary device */ ++ madev = NULL; + ret = auxiliary_device_add(adev); + if (ret) + goto add_fail; +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 366ae22534373..029c82f88ee38 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -5030,6 +5030,7 @@ static struct mdio_device_id __maybe_unused micrel_tbl[] = { + { PHY_ID_KSZ8081, MICREL_PHY_ID_MASK }, + { PHY_ID_KSZ8873MLL, MICREL_PHY_ID_MASK }, + { PHY_ID_KSZ886X, MICREL_PHY_ID_MASK }, ++ { PHY_ID_KSZ9477, MICREL_PHY_ID_MASK }, + { PHY_ID_LAN8814, MICREL_PHY_ID_MASK }, + { PHY_ID_LAN8804, MICREL_PHY_ID_MASK }, + { PHY_ID_LAN8841, MICREL_PHY_ID_MASK }, +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 53f6efc22f5c9..73de34179f352 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -326,7 +326,8 @@ static void ax88179_status(struct usbnet *dev, struct urb *urb) + + if (netif_carrier_ok(dev->net) != link) { + usbnet_link_change(dev, link, 1); +- netdev_info(dev->net, "ax88179 - Link status is: %d\n", link); ++ if (!link) ++ netdev_info(dev->net, "ax88179 - Link status is: 0\n"); + } + } + +@@ -1540,6 +1541,7 @@ static int ax88179_link_reset(struct usbnet *dev) + GMII_PHY_PHYSR, 2, &tmp16); + + if (!(tmp16 & GMII_PHY_PHYSR_LINK)) { ++ netdev_info(dev->net, "ax88179 - Link status is: 0\n"); + return 0; + } else if (GMII_PHY_PHYSR_GIGA == (tmp16 & GMII_PHY_PHYSR_SMASK)) { + mode |= AX_MEDIUM_GIGAMODE | AX_MEDIUM_EN_125MHZ; +@@ -1577,6 +1579,8 @@ static int ax88179_link_reset(struct usbnet *dev) + + netif_carrier_on(dev->net); + ++ netdev_info(dev->net, "ax88179 - Link status is: 1\n"); ++ + return 0; + } + +diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c +index ef1d8857a51ba..2d117cb74832b 100644 +--- a/drivers/pci/msi/msi.c ++++ b/drivers/pci/msi/msi.c +@@ -348,7 +348,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, + struct irq_affinity *affd) + { + struct irq_affinity_desc *masks = NULL; +- struct msi_desc *entry; ++ struct msi_desc *entry, desc; + int ret; + + /* Reject multi-MSI early on irq domain enabled architectures */ +@@ -373,6 +373,12 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, + /* All MSIs are unmasked by default; mask them all */ + entry = msi_first_desc(&dev->dev, MSI_DESC_ALL); + pci_msi_mask(entry, msi_multi_mask(entry)); ++ /* ++ * Copy the MSI descriptor for the error path because ++ * pci_msi_setup_msi_irqs() will free it for the hierarchical ++ * interrupt domain case. ++ */ ++ memcpy(&desc, entry, sizeof(desc)); + + /* Configure MSI capability structure */ + ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI); +@@ -392,7 +398,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, + goto unlock; + + err: +- pci_msi_unmask(entry, msi_multi_mask(entry)); ++ pci_msi_unmask(&desc, msi_multi_mask(&desc)); + pci_free_msi_irqs(dev); + fail: + dev->msi_enabled = 0; +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 9e7b3e6c79cb1..e19ee66e027bb 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1098,8 +1098,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, + * an -EPROBE_DEFER later, as that is the worst case. + */ + if (ret == -EPROBE_DEFER) { +- pinctrl_free(p, false); + mutex_unlock(&pinctrl_maps_mutex); ++ pinctrl_free(p, false); + return ERR_PTR(ret); + } + } +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 45e416f68e74f..caf8d0a98c327 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -634,23 +634,68 @@ static struct rockchip_mux_recalced_data rk3308_mux_recalced_data[] = { + + static struct rockchip_mux_recalced_data rk3328_mux_recalced_data[] = { + { +- .num = 2, +- .pin = 12, +- .reg = 0x24, +- .bit = 8, +- .mask = 0x3 +- }, { ++ /* gpio2_b7_sel */ + .num = 2, + .pin = 15, + .reg = 0x28, + .bit = 0, + .mask = 0x7 + }, { ++ /* gpio2_c7_sel */ + .num = 2, + .pin = 23, + .reg = 0x30, + .bit = 14, + .mask = 0x3 ++ }, { ++ /* gpio3_b1_sel */ ++ .num = 3, ++ .pin = 9, ++ .reg = 0x44, ++ .bit = 2, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b2_sel */ ++ .num = 3, ++ .pin = 10, ++ .reg = 0x44, ++ .bit = 4, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b3_sel */ ++ .num = 3, ++ .pin = 11, ++ .reg = 0x44, ++ .bit = 6, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b4_sel */ ++ .num = 3, ++ .pin = 12, ++ .reg = 0x44, ++ .bit = 8, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b5_sel */ ++ .num = 3, ++ .pin = 13, ++ .reg = 0x44, ++ .bit = 10, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b6_sel */ ++ .num = 3, ++ .pin = 14, ++ .reg = 0x44, ++ .bit = 12, ++ .mask = 0x3 ++ }, { ++ /* gpio3_b7_sel */ ++ .num = 3, ++ .pin = 15, ++ .reg = 0x44, ++ .bit = 14, ++ .mask = 0x3 + }, + }; + +@@ -2433,6 +2478,7 @@ static int rockchip_get_pull(struct rockchip_pin_bank *bank, int pin_num) + case RK3188: + case RK3288: + case RK3308: ++ case RK3328: + case RK3368: + case RK3399: + case RK3568: +@@ -2491,6 +2537,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank, + case RK3188: + case RK3288: + case RK3308: ++ case RK3328: + case RK3368: + case RK3399: + case RK3568: +@@ -2704,8 +2751,10 @@ static int rockchip_pmx_set(struct pinctrl_dev *pctldev, unsigned selector, + + if (ret) { + /* revert the already done pin settings */ +- for (cnt--; cnt >= 0; cnt--) ++ for (cnt--; cnt >= 0; cnt--) { ++ bank = pin_to_bank(info, pins[cnt]); + rockchip_set_mux(bank, pins[cnt] - bank->pin_base, 0); ++ } + + return ret; + } +@@ -2753,6 +2802,7 @@ static bool rockchip_pinconf_pull_valid(struct rockchip_pin_ctrl *ctrl, + case RK3188: + case RK3288: + case RK3308: ++ case RK3328: + case RK3368: + case RK3399: + case RK3568: +@@ -3765,7 +3815,7 @@ static struct rockchip_pin_bank rk3328_pin_banks[] = { + PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(1, 32, "gpio1", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(2, 32, "gpio2", 0, +- IOMUX_WIDTH_3BIT, ++ 0, + IOMUX_WIDTH_3BIT, + 0), + PIN_BANK_IOMUX_FLAGS(3, 32, "gpio3", +@@ -3779,7 +3829,7 @@ static struct rockchip_pin_ctrl rk3328_pin_ctrl = { + .pin_banks = rk3328_pin_banks, + .nr_banks = ARRAY_SIZE(rk3328_pin_banks), + .label = "RK3328-GPIO", +- .type = RK3288, ++ .type = RK3328, + .grf_mux_offset = 0x0, + .iomux_recalced = rk3328_mux_recalced_data, + .niomux_recalced = ARRAY_SIZE(rk3328_mux_recalced_data), +diff --git a/drivers/pinctrl/pinctrl-rockchip.h b/drivers/pinctrl/pinctrl-rockchip.h +index 4759f336941ef..849266f8b1913 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.h ++++ b/drivers/pinctrl/pinctrl-rockchip.h +@@ -193,6 +193,7 @@ enum rockchip_pinctrl_type { + RK3188, + RK3288, + RK3308, ++ RK3328, + RK3368, + RK3399, + RK3568, +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index deded9c6fd7db..5817c52cee6ba 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -1207,7 +1207,6 @@ static const struct of_device_id pmic_gpio_of_match[] = { + { .compatible = "qcom,pm7325-gpio", .data = (void *) 10 }, + { .compatible = "qcom,pm7550ba-gpio", .data = (void *) 8}, + { .compatible = "qcom,pm8005-gpio", .data = (void *) 4 }, +- { .compatible = "qcom,pm8008-gpio", .data = (void *) 2 }, + { .compatible = "qcom,pm8019-gpio", .data = (void *) 6 }, + /* pm8150 has 10 GPIOs with holes on 2, 5, 7 and 8 */ + { .compatible = "qcom,pm8150-gpio", .data = (void *) 10 }, +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index dd2ee5d9ca066..9bdab6c24fbaf 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -344,6 +344,9 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch, + + prd = div; + ++ if (!prd) ++ return -EINVAL; ++ + if (prescaler > MAX_TIM_PSC) + return -EINVAL; + +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index 12e2653846e3f..70891a1e98a01 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -610,15 +610,15 @@ int sas_ata_init(struct domain_device *found_dev) + + rc = ata_sas_tport_add(ata_host->dev, ap); + if (rc) +- goto destroy_port; ++ goto free_port; + + found_dev->sata_dev.ata_host = ata_host; + found_dev->sata_dev.ap = ap; + + return 0; + +-destroy_port: +- kfree(ap); ++free_port: ++ ata_port_free(ap); + free_host: + ata_host_put(ata_host); + return rc; +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index ff7b63b10aeb3..8afd8ce259e27 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -301,7 +301,7 @@ void sas_free_device(struct kref *kref) + + if (dev_is_sata(dev) && dev->sata_dev.ap) { + ata_sas_tport_delete(dev->sata_dev.ap); +- kfree(dev->sata_dev.ap); ++ ata_port_free(dev->sata_dev.ap); + ata_host_put(dev->sata_dev.ata_host); + dev->sata_dev.ata_host = NULL; + dev->sata_dev.ap = NULL; +diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c +index 3aff106fc11a0..9a22932984232 100644 +--- a/drivers/soc/ti/wkup_m3_ipc.c ++++ b/drivers/soc/ti/wkup_m3_ipc.c +@@ -16,7 +16,6 @@ + #include <linux/irq.h> + #include <linux/module.h> + #include <linux/of.h> +-#include <linux/omap-mailbox.h> + #include <linux/platform_device.h> + #include <linux/remoteproc.h> + #include <linux/suspend.h> +@@ -314,7 +313,6 @@ static irqreturn_t wkup_m3_txev_handler(int irq, void *ipc_data) + static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc) + { + struct device *dev = m3_ipc->dev; +- mbox_msg_t dummy_msg = 0; + int ret; + + if (!m3_ipc->mbox) { +@@ -330,7 +328,7 @@ static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc) + * the RX callback to avoid multiple interrupts being received + * by the CM3. + */ +- ret = mbox_send_message(m3_ipc->mbox, &dummy_msg); ++ ret = mbox_send_message(m3_ipc->mbox, NULL); + if (ret < 0) { + dev_err(dev, "%s: mbox_send_message() failed: %d\n", + __func__, ret); +@@ -352,7 +350,6 @@ static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc) + static int wkup_m3_ping_noirq(struct wkup_m3_ipc *m3_ipc) + { + struct device *dev = m3_ipc->dev; +- mbox_msg_t dummy_msg = 0; + int ret; + + if (!m3_ipc->mbox) { +@@ -361,7 +358,7 @@ static int wkup_m3_ping_noirq(struct wkup_m3_ipc *m3_ipc) + return -EIO; + } + +- ret = mbox_send_message(m3_ipc->mbox, &dummy_msg); ++ ret = mbox_send_message(m3_ipc->mbox, NULL); + if (ret < 0) { + dev_err(dev, "%s: mbox_send_message() failed: %d\n", + __func__, ret); +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 346167afe9e11..8f472a2080ffa 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -165,6 +165,10 @@ static u32 uart_read(struct omap8250_priv *priv, u32 reg) + return readl(priv->membase + (reg << OMAP_UART_REGSHIFT)); + } + ++/* Timeout low and High */ ++#define UART_OMAP_TO_L 0x26 ++#define UART_OMAP_TO_H 0x27 ++ + /* + * Called on runtime PM resume path from omap8250_restore_regs(), and + * omap8250_set_mctrl(). +@@ -646,13 +650,25 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + + /* + * On K3 SoCs, it is observed that RX TIMEOUT is signalled after +- * FIFO has been drained, in which case a dummy read of RX FIFO +- * is required to clear RX TIMEOUT condition. ++ * FIFO has been drained or erroneously. ++ * So apply solution of Errata i2310 as mentioned in ++ * https://www.ti.com/lit/pdf/sprz536 + */ + if (priv->habit & UART_RX_TIMEOUT_QUIRK && + (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT && + serial_port_in(port, UART_OMAP_RX_LVL) == 0) { +- serial_port_in(port, UART_RX); ++ unsigned char efr2, timeout_h, timeout_l; ++ ++ efr2 = serial_in(up, UART_OMAP_EFR2); ++ timeout_h = serial_in(up, UART_OMAP_TO_H); ++ timeout_l = serial_in(up, UART_OMAP_TO_L); ++ serial_out(up, UART_OMAP_TO_H, 0xFF); ++ serial_out(up, UART_OMAP_TO_L, 0xFF); ++ serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE); ++ serial_in(up, UART_IIR); ++ serial_out(up, UART_OMAP_EFR2, efr2); ++ serial_out(up, UART_OMAP_TO_H, timeout_h); ++ serial_out(up, UART_OMAP_TO_L, timeout_l); + } + + /* Stop processing interrupts on input overrun */ +diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c +index 0dd8cceb837cc..44c27e5cefbc9 100644 +--- a/drivers/tty/serial/bcm63xx_uart.c ++++ b/drivers/tty/serial/bcm63xx_uart.c +@@ -309,8 +309,8 @@ static void bcm_uart_do_tx(struct uart_port *port) + + val = bcm_uart_readl(port, UART_MCTL_REG); + val = (val & UART_MCTL_TXFIFOFILL_MASK) >> UART_MCTL_TXFIFOFILL_SHIFT; +- +- pending = uart_port_tx_limited(port, ch, port->fifosize - val, ++ pending = uart_port_tx_limited_flags(port, ch, UART_TX_NOSTOP, ++ port->fifosize - val, + true, + bcm_uart_writel(port, ch, UART_FIFO_REG), + ({})); +@@ -321,6 +321,9 @@ static void bcm_uart_do_tx(struct uart_port *port) + val = bcm_uart_readl(port, UART_IR_REG); + val &= ~UART_TX_INT_MASK; + bcm_uart_writel(port, val, UART_IR_REG); ++ ++ if (uart_tx_stopped(port)) ++ bcm_uart_stop_tx(port); + } + + /* +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index a1476e47c6aab..285e0e1144c4c 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -119,6 +119,7 @@ + #define UCR4_OREN (1<<1) /* Receiver overrun interrupt enable */ + #define UCR4_DREN (1<<0) /* Recv data ready interrupt enable */ + #define UFCR_RXTL_SHF 0 /* Receiver trigger level shift */ ++#define UFCR_RXTL_MASK 0x3F /* Receiver trigger 6 bits wide */ + #define UFCR_DCEDTE (1<<6) /* DCE/DTE mode select */ + #define UFCR_RFDIV (7<<7) /* Reference freq divider mask */ + #define UFCR_RFDIV_REG(x) (((x) < 7 ? 6 - (x) : 6) << 7) +@@ -1940,7 +1941,7 @@ static int imx_uart_rs485_config(struct uart_port *port, struct ktermios *termio + struct serial_rs485 *rs485conf) + { + struct imx_port *sport = (struct imx_port *)port; +- u32 ucr2; ++ u32 ucr2, ufcr; + + if (rs485conf->flags & SER_RS485_ENABLED) { + /* Enable receiver if low-active RTS signal is requested */ +@@ -1959,8 +1960,13 @@ static int imx_uart_rs485_config(struct uart_port *port, struct ktermios *termio + + /* Make sure Rx is enabled in case Tx is active with Rx disabled */ + if (!(rs485conf->flags & SER_RS485_ENABLED) || +- rs485conf->flags & SER_RS485_RX_DURING_TX) ++ rs485conf->flags & SER_RS485_RX_DURING_TX) { ++ /* If the receiver trigger is 0, set it to a default value */ ++ ufcr = imx_uart_readl(sport, UFCR); ++ if ((ufcr & UFCR_RXTL_MASK) == 0) ++ imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT); + imx_uart_start_rx(port); ++ } + + return 0; + } +diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c +index 1666ce012e5e8..aea29b4e65675 100644 +--- a/drivers/tty/serial/mcf.c ++++ b/drivers/tty/serial/mcf.c +@@ -462,7 +462,7 @@ static const struct uart_ops mcf_uart_ops = { + .verify_port = mcf_verify_port, + }; + +-static struct mcf_uart mcf_ports[4]; ++static struct mcf_uart mcf_ports[10]; + + #define MCF_MAXPORTS ARRAY_SIZE(mcf_ports) + +diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c +index 4ce7cba2b48aa..8f3b9a0a38e1d 100644 +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -1131,6 +1131,7 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, + struct cxacru_data *instance; + struct usb_device *usb_dev = interface_to_usbdev(intf); + struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD]; ++ struct usb_endpoint_descriptor *in, *out; + int ret; + + /* instance init */ +@@ -1177,6 +1178,19 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, + goto fail; + } + ++ if (usb_endpoint_xfer_int(&cmd_ep->desc)) ++ ret = usb_find_common_endpoints(intf->cur_altsetting, ++ NULL, NULL, &in, &out); ++ else ++ ret = usb_find_common_endpoints(intf->cur_altsetting, ++ &in, &out, NULL, NULL); ++ ++ if (ret) { ++ usb_err(usbatm_instance, "cxacru_bind: interface has incorrect endpoints\n"); ++ ret = -ENODEV; ++ goto fail; ++ } ++ + if ((cmd_ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) + == USB_ENDPOINT_XFER_INT) { + usb_fill_int_urb(instance->rcv_urb, +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 1f66578c671e7..674467b7638ea 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -865,12 +865,16 @@ static bool dwc3_core_is_valid(struct dwc3 *dwc) + + static void dwc3_core_setup_global_control(struct dwc3 *dwc) + { ++ unsigned int power_opt; ++ unsigned int hw_mode; + u32 reg; + + reg = dwc3_readl(dwc->regs, DWC3_GCTL); + reg &= ~DWC3_GCTL_SCALEDOWN_MASK; ++ hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0); ++ power_opt = DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1); + +- switch (DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1)) { ++ switch (power_opt) { + case DWC3_GHWPARAMS1_EN_PWROPT_CLK: + /** + * WORKAROUND: DWC3 revisions between 2.10a and 2.50a have an +@@ -903,6 +907,20 @@ static void dwc3_core_setup_global_control(struct dwc3 *dwc) + break; + } + ++ /* ++ * This is a workaround for STAR#4846132, which only affects ++ * DWC_usb31 version2.00a operating in host mode. ++ * ++ * There is a problem in DWC_usb31 version 2.00a operating ++ * in host mode that would cause a CSR read timeout When CSR ++ * read coincides with RAM Clock Gating Entry. By disable ++ * Clock Gating, sacrificing power consumption for normal ++ * operation. ++ */ ++ if (power_opt != DWC3_GHWPARAMS1_EN_PWROPT_NO && ++ hw_mode != DWC3_GHWPARAMS0_MODE_GADGET && DWC3_VER_IS(DWC31, 200A)) ++ reg |= DWC3_GCTL_DSBLCLKGTNG; ++ + /* check if current dwc3 is on simulation board */ + if (dwc->hwparams.hwparams6 & DWC3_GHWPARAMS6_EN_FPGA) { + dev_info(dwc->dev, "Running with FPGA optimizations\n"); +@@ -2044,7 +2062,6 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc) + + static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + u32 reg; + + switch (dwc->current_dr_role) { +@@ -2082,9 +2099,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + break; + + if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_suspend(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + synchronize_irq(dwc->irq_gadget); + } + +@@ -2101,7 +2116,6 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + + static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + int ret; + u32 reg; + +@@ -2150,9 +2164,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) + if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) { + dwc3_otg_host_init(dwc); + } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_resume(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + } + + break; +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 69b734a7bae1c..07b062c2f6479 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -1247,6 +1247,7 @@ struct dwc3 { + #define DWC31_REVISION_170A 0x3137302a + #define DWC31_REVISION_180A 0x3138302a + #define DWC31_REVISION_190A 0x3139302a ++#define DWC31_REVISION_200A 0x3230302a + + #define DWC32_REVISION_ANY 0x0 + #define DWC32_REVISION_100A 0x3130302a +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index ba7d180cc9e6d..44e20c6c36d32 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -213,6 +213,7 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, + struct usb_endpoint_descriptor *ss) + { + switch (gadget->speed) { ++ case USB_SPEED_SUPER_PLUS: + case USB_SPEED_SUPER: + return ss; + case USB_SPEED_HIGH: +@@ -449,11 +450,8 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + mutex_lock(&dev->lock_printer_io); + spin_lock_irqsave(&dev->lock, flags); + +- if (dev->interface < 0) { +- spin_unlock_irqrestore(&dev->lock, flags); +- mutex_unlock(&dev->lock_printer_io); +- return -ENODEV; +- } ++ if (dev->interface < 0) ++ goto out_disabled; + + /* We will use this flag later to check if a printer reset happened + * after we turn interrupts back on. +@@ -461,6 +459,9 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + dev->reset_printer = 0; + + setup_rx_reqs(dev); ++ /* this dropped the lock - need to retest */ ++ if (dev->interface < 0) ++ goto out_disabled; + + bytes_copied = 0; + current_rx_req = dev->current_rx_req; +@@ -494,6 +495,8 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + wait_event_interruptible(dev->rx_wait, + (likely(!list_empty(&dev->rx_buffers)))); + spin_lock_irqsave(&dev->lock, flags); ++ if (dev->interface < 0) ++ goto out_disabled; + } + + /* We have data to return then copy it to the caller's buffer.*/ +@@ -537,6 +540,9 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + return -EAGAIN; + } + ++ if (dev->interface < 0) ++ goto out_disabled; ++ + /* If we not returning all the data left in this RX request + * buffer then adjust the amount of data left in the buffer. + * Othewise if we are done with this RX request buffer then +@@ -566,6 +572,11 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) + return bytes_copied; + else + return -EAGAIN; ++ ++out_disabled: ++ spin_unlock_irqrestore(&dev->lock, flags); ++ mutex_unlock(&dev->lock_printer_io); ++ return -ENODEV; + } + + static ssize_t +@@ -586,11 +597,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + mutex_lock(&dev->lock_printer_io); + spin_lock_irqsave(&dev->lock, flags); + +- if (dev->interface < 0) { +- spin_unlock_irqrestore(&dev->lock, flags); +- mutex_unlock(&dev->lock_printer_io); +- return -ENODEV; +- } ++ if (dev->interface < 0) ++ goto out_disabled; + + /* Check if a printer reset happens while we have interrupts on */ + dev->reset_printer = 0; +@@ -613,6 +621,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + wait_event_interruptible(dev->tx_wait, + (likely(!list_empty(&dev->tx_reqs)))); + spin_lock_irqsave(&dev->lock, flags); ++ if (dev->interface < 0) ++ goto out_disabled; + } + + while (likely(!list_empty(&dev->tx_reqs)) && len) { +@@ -662,6 +672,9 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + return -EAGAIN; + } + ++ if (dev->interface < 0) ++ goto out_disabled; ++ + list_add(&req->list, &dev->tx_reqs_active); + + /* here, we unlock, and only unlock, to avoid deadlock. */ +@@ -674,6 +687,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + mutex_unlock(&dev->lock_printer_io); + return -EAGAIN; + } ++ if (dev->interface < 0) ++ goto out_disabled; + } + + spin_unlock_irqrestore(&dev->lock, flags); +@@ -685,6 +700,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + return bytes_copied; + else + return -EAGAIN; ++ ++out_disabled: ++ spin_unlock_irqrestore(&dev->lock, flags); ++ mutex_unlock(&dev->lock_printer_io); ++ return -ENODEV; + } + + static int +diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c +index 2ef89a442f50f..fc2ead0fe6217 100644 +--- a/drivers/usb/gadget/udc/aspeed_udc.c ++++ b/drivers/usb/gadget/udc/aspeed_udc.c +@@ -66,8 +66,8 @@ + #define USB_UPSTREAM_EN BIT(0) + + /* Main config reg */ +-#define UDC_CFG_SET_ADDR(x) ((x) & 0x3f) +-#define UDC_CFG_ADDR_MASK (0x3f) ++#define UDC_CFG_SET_ADDR(x) ((x) & UDC_CFG_ADDR_MASK) ++#define UDC_CFG_ADDR_MASK GENMASK(6, 0) + + /* Interrupt ctrl & status reg */ + #define UDC_IRQ_EP_POOL_NAK BIT(17) +diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c +index 912e32b78ac6e..a8d7224838cf6 100644 +--- a/drivers/usb/musb/da8xx.c ++++ b/drivers/usb/musb/da8xx.c +@@ -555,7 +555,7 @@ static int da8xx_probe(struct platform_device *pdev) + ret = of_platform_populate(pdev->dev.of_node, NULL, + da8xx_auxdata_lookup, &pdev->dev); + if (ret) +- return ret; ++ goto err_unregister_phy; + + pinfo = da8xx_dev_info; + pinfo.parent = &pdev->dev; +@@ -570,9 +570,13 @@ static int da8xx_probe(struct platform_device *pdev) + ret = PTR_ERR_OR_ZERO(glue->musb); + if (ret) { + dev_err(&pdev->dev, "failed to register musb device: %d\n", ret); +- usb_phy_generic_unregister(glue->usb_phy); ++ goto err_unregister_phy; + } + ++ return 0; ++ ++err_unregister_phy: ++ usb_phy_generic_unregister(glue->usb_phy); + return ret; + } + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 7f575b9b3debe..f6fb5575d4f0a 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -49,22 +49,16 @@ static int ucsi_read_message_in(struct ucsi *ucsi, void *buf, + return ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, buf, buf_size); + } + +-static int ucsi_acknowledge_command(struct ucsi *ucsi) ++static int ucsi_acknowledge(struct ucsi *ucsi, bool conn_ack) + { + u64 ctrl; + + ctrl = UCSI_ACK_CC_CI; + ctrl |= UCSI_ACK_COMMAND_COMPLETE; +- +- return ucsi->ops->sync_write(ucsi, UCSI_CONTROL, &ctrl, sizeof(ctrl)); +-} +- +-static int ucsi_acknowledge_connector_change(struct ucsi *ucsi) +-{ +- u64 ctrl; +- +- ctrl = UCSI_ACK_CC_CI; +- ctrl |= UCSI_ACK_CONNECTOR_CHANGE; ++ if (conn_ack) { ++ clear_bit(EVENT_PENDING, &ucsi->flags); ++ ctrl |= UCSI_ACK_CONNECTOR_CHANGE; ++ } + + return ucsi->ops->sync_write(ucsi, UCSI_CONTROL, &ctrl, sizeof(ctrl)); + } +@@ -77,7 +71,7 @@ static int ucsi_read_error(struct ucsi *ucsi) + int ret; + + /* Acknowledge the command that failed */ +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, false); + if (ret) + return ret; + +@@ -89,7 +83,7 @@ static int ucsi_read_error(struct ucsi *ucsi) + if (ret) + return ret; + +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, false); + if (ret) + return ret; + +@@ -152,28 +146,33 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd) + return -EIO; + + if (cci & UCSI_CCI_NOT_SUPPORTED) { +- if (ucsi_acknowledge_command(ucsi) < 0) ++ if (ucsi_acknowledge(ucsi, false) < 0) + dev_err(ucsi->dev, + "ACK of unsupported command failed\n"); + return -EOPNOTSUPP; + } + + if (cci & UCSI_CCI_ERROR) { +- if (cmd == UCSI_GET_ERROR_STATUS) ++ if (cmd == UCSI_GET_ERROR_STATUS) { ++ ret = ucsi_acknowledge(ucsi, false); ++ if (ret) ++ return ret; ++ + return -EIO; ++ } + return ucsi_read_error(ucsi); + } + + if (cmd == UCSI_CANCEL && cci & UCSI_CCI_CANCEL_COMPLETE) { +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, false); + return ret ? ret : -EBUSY; + } + + return UCSI_CCI_LENGTH(cci); + } + +-int ucsi_send_command(struct ucsi *ucsi, u64 command, +- void *data, size_t size) ++static int ucsi_send_command_common(struct ucsi *ucsi, u64 command, ++ void *data, size_t size, bool conn_ack) + { + u8 length; + int ret; +@@ -192,7 +191,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, + goto out; + } + +- ret = ucsi_acknowledge_command(ucsi); ++ ret = ucsi_acknowledge(ucsi, conn_ack); + if (ret) + goto out; + +@@ -201,6 +200,12 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, + mutex_unlock(&ucsi->ppm_lock); + return ret; + } ++ ++int ucsi_send_command(struct ucsi *ucsi, u64 command, ++ void *data, size_t size) ++{ ++ return ucsi_send_command_common(ucsi, command, data, size, false); ++} + EXPORT_SYMBOL_GPL(ucsi_send_command); + + /* -------------------------------------------------------------------------- */ +@@ -886,7 +891,9 @@ static void ucsi_handle_connector_change(struct work_struct *work) + mutex_lock(&con->lock); + + command = UCSI_GET_CONNECTOR_STATUS | UCSI_CONNECTOR_NUMBER(con->num); +- ret = ucsi_send_command(ucsi, command, &con->status, sizeof(con->status)); ++ ++ ret = ucsi_send_command_common(ucsi, command, &con->status, ++ sizeof(con->status), true); + if (ret < 0) { + dev_err(ucsi->dev, "%s: GET_CONNECTOR_STATUS failed (%d)\n", + __func__, ret); +@@ -938,14 +945,6 @@ static void ucsi_handle_connector_change(struct work_struct *work) + if (con->status.change & UCSI_CONSTAT_CAM_CHANGE) + ucsi_partner_task(con, ucsi_check_altmodes, 1, 0); + +- mutex_lock(&ucsi->ppm_lock); +- clear_bit(EVENT_PENDING, &con->ucsi->flags); +- ret = ucsi_acknowledge_connector_change(ucsi); +- mutex_unlock(&ucsi->ppm_lock); +- +- if (ret) +- dev_err(ucsi->dev, "%s: ACK failed (%d)", __func__, ret); +- + out_unlock: + mutex_unlock(&con->lock); + } +diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c +index ee239a6b8f61a..7625e28e12a80 100644 +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -348,6 +348,7 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, + ret = fwnode_property_read_u32(fwnode, "reg", &port); + if (ret < 0) { + dev_err(dev, "missing reg property of %pOFn\n", fwnode); ++ fwnode_handle_put(fwnode); + return ret; + } + +@@ -362,9 +363,11 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, + if (!desc) + continue; + +- if (IS_ERR(desc)) ++ if (IS_ERR(desc)) { ++ fwnode_handle_put(fwnode); + return dev_err_probe(dev, PTR_ERR(desc), + "unable to acquire orientation gpio\n"); ++ } + ucsi->port_orientation[port] = desc; + + ucsi->port_switch[port] = fwnode_typec_switch_get(fwnode); +diff --git a/drivers/usb/typec/ucsi/ucsi_stm32g0.c b/drivers/usb/typec/ucsi/ucsi_stm32g0.c +index 93d7806681cf0..1d7ee833eb4fd 100644 +--- a/drivers/usb/typec/ucsi/ucsi_stm32g0.c ++++ b/drivers/usb/typec/ucsi/ucsi_stm32g0.c +@@ -64,6 +64,7 @@ struct ucsi_stm32g0 { + struct completion complete; + struct device *dev; + unsigned long flags; ++#define ACK_PENDING 2 + const char *fw_name; + struct ucsi *ucsi; + bool suspended; +@@ -395,9 +396,13 @@ static int ucsi_stm32g0_sync_write(struct ucsi *ucsi, unsigned int offset, const + size_t len) + { + struct ucsi_stm32g0 *g0 = ucsi_get_drvdata(ucsi); ++ bool ack = UCSI_COMMAND(*(u64 *)val) == UCSI_ACK_CC_CI; + int ret; + +- set_bit(COMMAND_PENDING, &g0->flags); ++ if (ack) ++ set_bit(ACK_PENDING, &g0->flags); ++ else ++ set_bit(COMMAND_PENDING, &g0->flags); + + ret = ucsi_stm32g0_async_write(ucsi, offset, val, len); + if (ret) +@@ -405,9 +410,14 @@ static int ucsi_stm32g0_sync_write(struct ucsi *ucsi, unsigned int offset, const + + if (!wait_for_completion_timeout(&g0->complete, msecs_to_jiffies(5000))) + ret = -ETIMEDOUT; ++ else ++ return 0; + + out_clear_bit: +- clear_bit(COMMAND_PENDING, &g0->flags); ++ if (ack) ++ clear_bit(ACK_PENDING, &g0->flags); ++ else ++ clear_bit(COMMAND_PENDING, &g0->flags); + + return ret; + } +@@ -428,8 +438,9 @@ static irqreturn_t ucsi_stm32g0_irq_handler(int irq, void *data) + if (UCSI_CCI_CONNECTOR(cci)) + ucsi_connector_change(g0->ucsi, UCSI_CCI_CONNECTOR(cci)); + +- if (test_bit(COMMAND_PENDING, &g0->flags) && +- cci & (UCSI_CCI_ACK_COMPLETE | UCSI_CCI_COMMAND_COMPLETE)) ++ if (cci & UCSI_CCI_ACK_COMPLETE && test_and_clear_bit(ACK_PENDING, &g0->flags)) ++ complete(&g0->complete); ++ if (cci & UCSI_CCI_COMMAND_COMPLETE && test_and_clear_bit(COMMAND_PENDING, &g0->flags)) + complete(&g0->complete); + + return IRQ_HANDLED; +diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c +index df7869537ef14..d7bda179ef79f 100644 +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -8,6 +8,7 @@ + * + */ + ++#include "linux/virtio_net.h" + #include <linux/init.h> + #include <linux/module.h> + #include <linux/cdev.h> +@@ -28,6 +29,7 @@ + #include <uapi/linux/virtio_config.h> + #include <uapi/linux/virtio_ids.h> + #include <uapi/linux/virtio_blk.h> ++#include <uapi/linux/virtio_ring.h> + #include <linux/mod_devicetable.h> + + #include "iova_domain.h" +@@ -1662,13 +1664,17 @@ static bool device_is_allowed(u32 device_id) + return false; + } + +-static bool features_is_valid(u64 features) ++static bool features_is_valid(struct vduse_dev_config *config) + { +- if (!(features & (1ULL << VIRTIO_F_ACCESS_PLATFORM))) ++ if (!(config->features & BIT_ULL(VIRTIO_F_ACCESS_PLATFORM))) + return false; + + /* Now we only support read-only configuration space */ +- if (features & (1ULL << VIRTIO_BLK_F_CONFIG_WCE)) ++ if ((config->device_id == VIRTIO_ID_BLOCK) && ++ (config->features & BIT_ULL(VIRTIO_BLK_F_CONFIG_WCE))) ++ return false; ++ else if ((config->device_id == VIRTIO_ID_NET) && ++ (config->features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ))) + return false; + + return true; +@@ -1695,7 +1701,7 @@ static bool vduse_validate_config(struct vduse_dev_config *config) + if (!device_is_allowed(config->device_id)) + return false; + +- if (!features_is_valid(config->features)) ++ if (!features_is_valid(config)) + return false; + + return true; +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 8dd8ef760321e..dcfc0425115e9 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2695,7 +2695,7 @@ static int __btrfs_add_free_space_zoned(struct btrfs_block_group *block_group, + u64 offset = bytenr - block_group->start; + u64 to_free, to_unusable; + int bg_reclaim_threshold = 0; +- bool initial = (size == block_group->length); ++ bool initial = ((size == block_group->length) && (block_group->alloc_offset == 0)); + u64 reclaimable_unusable; + + WARN_ON(!initial && offset + size > block_group->zone_capacity); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 833391ae0bac2..e0037665aa927 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -140,6 +140,25 @@ static void wait_log_commit(struct btrfs_root *root, int transid); + * and once to do all the other items. + */ + ++static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) ++{ ++ unsigned int nofs_flag; ++ struct inode *inode; ++ ++ /* ++ * We're holding a transaction handle whether we are logging or ++ * replaying a log tree, so we must make sure NOFS semantics apply ++ * because btrfs_alloc_inode() may be triggered and it uses GFP_KERNEL ++ * to allocate an inode, which can recurse back into the filesystem and ++ * attempt a transaction commit, resulting in a deadlock. ++ */ ++ nofs_flag = memalloc_nofs_save(); ++ inode = btrfs_iget(root->fs_info->sb, objectid, root); ++ memalloc_nofs_restore(nofs_flag); ++ ++ return inode; ++} ++ + /* + * start a sub transaction and setup the log tree + * this increments the log tree writer count to make the people +@@ -603,7 +622,7 @@ static noinline struct inode *read_one_inode(struct btrfs_root *root, + { + struct inode *inode; + +- inode = btrfs_iget(root->fs_info->sb, objectid, root); ++ inode = btrfs_iget_logging(objectid, root); + if (IS_ERR(inode)) + inode = NULL; + return inode; +@@ -5377,7 +5396,6 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, + struct btrfs_log_ctx *ctx) + { + struct btrfs_root *root = start_inode->root; +- struct btrfs_fs_info *fs_info = root->fs_info; + struct btrfs_path *path; + LIST_HEAD(dir_list); + struct btrfs_dir_list *dir_elem; +@@ -5438,7 +5456,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, + continue; + + btrfs_release_path(path); +- di_inode = btrfs_iget(fs_info->sb, di_key.objectid, root); ++ di_inode = btrfs_iget_logging(di_key.objectid, root); + if (IS_ERR(di_inode)) { + ret = PTR_ERR(di_inode); + goto out; +@@ -5498,7 +5516,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, + btrfs_add_delayed_iput(curr_inode); + curr_inode = NULL; + +- vfs_inode = btrfs_iget(fs_info->sb, ino, root); ++ vfs_inode = btrfs_iget_logging(ino, root); + if (IS_ERR(vfs_inode)) { + ret = PTR_ERR(vfs_inode); + break; +@@ -5593,7 +5611,7 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans, + if (ctx->num_conflict_inodes >= MAX_CONFLICT_INODES) + return BTRFS_LOG_FORCE_COMMIT; + +- inode = btrfs_iget(root->fs_info->sb, ino, root); ++ inode = btrfs_iget_logging(ino, root); + /* + * If the other inode that had a conflicting dir entry was deleted in + * the current transaction then we either: +@@ -5694,7 +5712,6 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, + struct btrfs_root *root, + struct btrfs_log_ctx *ctx) + { +- struct btrfs_fs_info *fs_info = root->fs_info; + int ret = 0; + + /* +@@ -5725,7 +5742,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, + list_del(&curr->list); + kfree(curr); + +- inode = btrfs_iget(fs_info->sb, ino, root); ++ inode = btrfs_iget_logging(ino, root); + /* + * If the other inode that had a conflicting dir entry was + * deleted in the current transaction, we need to log its parent +@@ -5736,7 +5753,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, + if (ret != -ENOENT) + break; + +- inode = btrfs_iget(fs_info->sb, parent, root); ++ inode = btrfs_iget_logging(parent, root); + if (IS_ERR(inode)) { + ret = PTR_ERR(inode); + break; +@@ -6258,7 +6275,6 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, + struct btrfs_log_ctx *ctx) + { + const bool orig_log_new_dentries = ctx->log_new_dentries; +- struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_delayed_item *item; + int ret = 0; + +@@ -6284,7 +6300,7 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, + if (key.type == BTRFS_ROOT_ITEM_KEY) + continue; + +- di_inode = btrfs_iget(fs_info->sb, key.objectid, inode->root); ++ di_inode = btrfs_iget_logging(key.objectid, inode->root); + if (IS_ERR(di_inode)) { + ret = PTR_ERR(di_inode); + break; +@@ -6668,7 +6684,6 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, + struct btrfs_inode *inode, + struct btrfs_log_ctx *ctx) + { +- struct btrfs_fs_info *fs_info = trans->fs_info; + int ret; + struct btrfs_path *path; + struct btrfs_key key; +@@ -6733,8 +6748,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, + cur_offset = item_size; + } + +- dir_inode = btrfs_iget(fs_info->sb, inode_key.objectid, +- root); ++ dir_inode = btrfs_iget_logging(inode_key.objectid, root); + /* + * If the parent inode was deleted, return an error to + * fallback to a transaction commit. This is to prevent +@@ -6796,7 +6810,6 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, + btrfs_item_key_to_cpu(path->nodes[0], &found_key, path->slots[0]); + + while (true) { +- struct btrfs_fs_info *fs_info = root->fs_info; + struct extent_buffer *leaf; + int slot; + struct btrfs_key search_key; +@@ -6811,7 +6824,7 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, + search_key.objectid = found_key.offset; + search_key.type = BTRFS_INODE_ITEM_KEY; + search_key.offset = 0; +- inode = btrfs_iget(fs_info->sb, ino, root); ++ inode = btrfs_iget_logging(ino, root); + if (IS_ERR(inode)) + return PTR_ERR(inode); + +diff --git a/fs/erofs/data.c b/fs/erofs/data.c +index a75c89a9a3d0b..19ab9bb3a9a0e 100644 +--- a/fs/erofs/data.c ++++ b/fs/erofs/data.c +@@ -222,7 +222,7 @@ int erofs_map_dev(struct super_block *sb, struct erofs_map_dev *map) + up_read(&devs->rwsem); + return 0; + } +- map->m_bdev = dif->bdev_handle->bdev; ++ map->m_bdev = dif->bdev_handle ? dif->bdev_handle->bdev : NULL; + map->m_daxdev = dif->dax_dev; + map->m_dax_part_off = dif->dax_part_off; + map->m_fscache = dif->fscache; +@@ -240,7 +240,8 @@ int erofs_map_dev(struct super_block *sb, struct erofs_map_dev *map) + if (map->m_pa >= startoff && + map->m_pa < startoff + length) { + map->m_pa -= startoff; +- map->m_bdev = dif->bdev_handle->bdev; ++ map->m_bdev = dif->bdev_handle ? ++ dif->bdev_handle->bdev : NULL; + map->m_daxdev = dif->dax_dev; + map->m_dax_part_off = dif->dax_part_off; + map->m_fscache = dif->fscache; +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 88bc9b1b22650..767549066066c 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -1102,7 +1102,8 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + lops_before_commit(sdp, tr); + if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; +- gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE); ++ if (sdp->sd_jdesc) ++ gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE); + if (gfs2_withdrawing_or_withdrawn(sdp)) + goto out_withdraw; + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 2e1d1eca4d14a..8b34c6cf9293f 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -67,9 +67,13 @@ void gfs2_jindex_free(struct gfs2_sbd *sdp) + sdp->sd_journals = 0; + spin_unlock(&sdp->sd_jindex_spin); + ++ down_write(&sdp->sd_log_flush_lock); + sdp->sd_jdesc = NULL; ++ up_write(&sdp->sd_log_flush_lock); ++ + while (!list_empty(&list)) { + jd = list_first_entry(&list, struct gfs2_jdesc, jd_list); ++ BUG_ON(jd->jd_log_bio); + gfs2_free_journal_extents(jd); + list_del(&jd->jd_list); + iput(jd->jd_inode); +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index b6f801e73bfdc..258521d5125ed 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -141,8 +141,6 @@ int nfs_swap_rw(struct kiocb *iocb, struct iov_iter *iter) + { + ssize_t ret; + +- VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); +- + if (iov_iter_rw(iter) == READ) + ret = nfs_file_direct_read(iocb, iter, true); + else +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 6ab03494fc6e7..29361634ce57e 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2370,6 +2370,11 @@ static int ocfs2_dio_end_io_write(struct inode *inode, + } + + list_for_each_entry(ue, &dwc->dw_zero_list, ue_node) { ++ ret = ocfs2_assure_trans_credits(handle, credits); ++ if (ret < 0) { ++ mlog_errno(ret); ++ break; ++ } + ret = ocfs2_mark_extent_written(inode, &et, handle, + ue->ue_cpos, 1, + ue->ue_phys, +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c +index 34ac783ec7b72..400aec9126c65 100644 +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -445,6 +445,23 @@ int ocfs2_extend_trans(handle_t *handle, int nblocks) + return status; + } + ++/* ++ * Make sure handle has at least 'nblocks' credits available. If it does not ++ * have that many credits available, we will try to extend the handle to have ++ * enough credits. If that fails, we will restart transaction to have enough ++ * credits. Similar notes regarding data consistency and locking implications ++ * as for ocfs2_extend_trans() apply here. ++ */ ++int ocfs2_assure_trans_credits(handle_t *handle, int nblocks) ++{ ++ int old_nblks = jbd2_handle_buffer_credits(handle); ++ ++ trace_ocfs2_assure_trans_credits(old_nblks); ++ if (old_nblks >= nblocks) ++ return 0; ++ return ocfs2_extend_trans(handle, nblocks - old_nblks); ++} ++ + /* + * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA. + * If that fails, restart the transaction & regain write access for the +diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h +index 41c9fe7e62f9b..e3c3a35dc5e0e 100644 +--- a/fs/ocfs2/journal.h ++++ b/fs/ocfs2/journal.h +@@ -243,6 +243,8 @@ handle_t *ocfs2_start_trans(struct ocfs2_super *osb, + int ocfs2_commit_trans(struct ocfs2_super *osb, + handle_t *handle); + int ocfs2_extend_trans(handle_t *handle, int nblocks); ++int ocfs2_assure_trans_credits(handle_t *handle, ++ int nblocks); + int ocfs2_allocate_extend_trans(handle_t *handle, + int thresh); + +diff --git a/fs/ocfs2/ocfs2_trace.h b/fs/ocfs2/ocfs2_trace.h +index ac4fd1d5b128b..6c3f4d7df7d6e 100644 +--- a/fs/ocfs2/ocfs2_trace.h ++++ b/fs/ocfs2/ocfs2_trace.h +@@ -2579,6 +2579,8 @@ DEFINE_OCFS2_ULL_UINT_EVENT(ocfs2_commit_cache_end); + + DEFINE_OCFS2_INT_INT_EVENT(ocfs2_extend_trans); + ++DEFINE_OCFS2_INT_EVENT(ocfs2_assure_trans_credits); ++ + DEFINE_OCFS2_INT_EVENT(ocfs2_extend_trans_restart); + + DEFINE_OCFS2_INT_INT_EVENT(ocfs2_allocate_extend_trans); +diff --git a/fs/open.c b/fs/open.c +index 54723fceb7767..59db720693f9a 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -200,13 +200,13 @@ long do_sys_ftruncate(unsigned int fd, loff_t length, int small) + return error; + } + +-SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length) ++SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } + + #ifdef CONFIG_COMPAT +-COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length) ++COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } +diff --git a/include/linux/compat.h b/include/linux/compat.h +index 1cfa4f0f490aa..5981d3eadaee1 100644 +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -609,7 +609,7 @@ asmlinkage long compat_sys_fstatfs(unsigned int fd, + asmlinkage long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, + struct compat_statfs64 __user *buf); + asmlinkage long compat_sys_truncate(const char __user *, compat_off_t); +-asmlinkage long compat_sys_ftruncate(unsigned int, compat_ulong_t); ++asmlinkage long compat_sys_ftruncate(unsigned int, compat_off_t); + /* No generic prototype for truncate64, ftruncate64, fallocate */ + asmlinkage long compat_sys_openat(int dfd, const char __user *filename, + int flags, umode_t mode); +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 5090e940ba3e4..a74d97114a542 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -842,20 +842,22 @@ bpf_ctx_narrow_access_offset(u32 off, u32 size, u32 size_default) + + #define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0])) + +-static inline void bpf_prog_lock_ro(struct bpf_prog *fp) ++static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp) + { + #ifndef CONFIG_BPF_JIT_ALWAYS_ON + if (!fp->jited) { + set_vm_flush_reset_perms(fp); +- set_memory_ro((unsigned long)fp, fp->pages); ++ return set_memory_ro((unsigned long)fp, fp->pages); + } + #endif ++ return 0; + } + +-static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) ++static inline int __must_check ++bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) + { + set_vm_flush_reset_perms(hdr); +- set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT); ++ return set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT); + } + + int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap); +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index aaaa5b90bfe25..5f1e5a16d7b2c 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -951,17 +951,24 @@ struct ieee80211_wide_bw_chansw_ie { + * @dtim_count: DTIM Count + * @dtim_period: DTIM Period + * @bitmap_ctrl: Bitmap Control ++ * @required_octet: "Syntatic sugar" to force the struct size to the ++ * minimum valid size when carried in a non-S1G PPDU + * @virtual_map: Partial Virtual Bitmap + * + * This structure represents the payload of the "TIM element" as +- * described in IEEE Std 802.11-2020 section 9.4.2.5. ++ * described in IEEE Std 802.11-2020 section 9.4.2.5. Note that this ++ * definition is only applicable when the element is carried in a ++ * non-S1G PPDU. When the TIM is carried in an S1G PPDU, the Bitmap ++ * Control and Partial Virtual Bitmap may not be present. + */ + struct ieee80211_tim_ie { + u8 dtim_count; + u8 dtim_period; + u8 bitmap_ctrl; +- /* variable size: 1 - 251 bytes */ +- u8 virtual_map[1]; ++ union { ++ u8 required_octet; ++ DECLARE_FLEX_ARRAY(u8, virtual_map); ++ }; + } __packed; + + /** +@@ -4945,7 +4952,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) + bool check_common_len = false; + u16 control; + +- if (len < fixed) ++ if (!data || len < fixed) + return false; + + control = le16_to_cpu(mle->control); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index e20bbcf594bf3..91c4e11cb6abb 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -1242,6 +1242,7 @@ extern int ata_slave_link_init(struct ata_port *ap); + extern struct ata_port *ata_sas_port_alloc(struct ata_host *, + struct ata_port_info *, struct Scsi_Host *); + extern void ata_port_probe(struct ata_port *ap); ++extern void ata_port_free(struct ata_port *ap); + extern int ata_sas_tport_add(struct device *parent, struct ata_port *ap); + extern void ata_sas_tport_delete(struct ata_port *ap); + extern int ata_sas_slave_configure(struct scsi_device *, struct ata_port *); +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index 1acbc6ce1fe43..e46fbca003099 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -664,13 +664,12 @@ enum zone_watermarks { + }; + + /* +- * One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. One additional list +- * for THP which will usually be GFP_MOVABLE. Even if it is another type, +- * it should not contribute to serious fragmentation causing THP allocation +- * failures. ++ * One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. Two additional lists ++ * are added for THP. One PCP list is used by GPF_MOVABLE, and the other PCP list ++ * is used by GFP_UNMOVABLE and GFP_RECLAIMABLE. + */ + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +-#define NR_PCP_THP 1 ++#define NR_PCP_THP 2 + #else + #define NR_PCP_THP 0 + #endif +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index 26dd3f859d9d7..b61038de139e5 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -90,8 +90,8 @@ enum { + NVMF_RDMA_QPTYPE_DATAGRAM = 2, /* Reliable Datagram */ + }; + +-/* RDMA QP Service Type codes for Discovery Log Page entry TSAS +- * RDMA_QPTYPE field ++/* RDMA Provider Type codes for Discovery Log Page entry TSAS ++ * RDMA_PRTYPE field + */ + enum { + NVMF_RDMA_PRTYPE_NOT_SPECIFIED = 1, /* No Provider Specified */ +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 5da5eb719f614..052df85dfd597 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -787,8 +787,7 @@ enum UART_TX_FLAGS { + if (pending < WAKEUP_CHARS) { \ + uart_write_wakeup(__port); \ + \ +- if (!((flags) & UART_TX_NOSTOP) && pending == 0 && \ +- __port->ops->tx_empty(__port)) \ ++ if (!((flags) & UART_TX_NOSTOP) && pending == 0) \ + __port->ops->stop_tx(__port); \ + } \ + \ +@@ -827,6 +826,24 @@ enum UART_TX_FLAGS { + __count--); \ + }) + ++/** ++ * uart_port_tx_limited_flags -- transmit helper for uart_port with count limiting with flags ++ * @port: uart port ++ * @ch: variable to store a character to be written to the HW ++ * @flags: %UART_TX_NOSTOP or similar ++ * @count: a limit of characters to send ++ * @tx_ready: can HW accept more data function ++ * @put_char: function to write a character ++ * @tx_done: function to call after the loop is done ++ * ++ * See uart_port_tx_limited() for more details. ++ */ ++#define uart_port_tx_limited_flags(port, ch, flags, count, tx_ready, put_char, tx_done) ({ \ ++ unsigned int __count = (count); \ ++ __uart_port_tx(port, ch, flags, tx_ready, put_char, tx_done, __count, \ ++ __count--); \ ++}) ++ + /** + * uart_port_tx -- transmit helper for uart_port + * @port: uart port +diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h +index bbbd6fac3aff7..36c592e43d652 100644 +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -410,7 +410,7 @@ asmlinkage long sys_fstatfs(unsigned int fd, struct statfs __user *buf); + asmlinkage long sys_fstatfs64(unsigned int fd, size_t sz, + struct statfs64 __user *buf); + asmlinkage long sys_truncate(const char __user *path, long length); +-asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length); ++asmlinkage long sys_ftruncate(unsigned int fd, off_t length); + #if BITS_PER_LONG == 32 + asmlinkage long sys_truncate64(const char __user *path, loff_t length); + asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length); +@@ -840,9 +840,15 @@ asmlinkage long sys_prlimit64(pid_t pid, unsigned int resource, + const struct rlimit64 __user *new_rlim, + struct rlimit64 __user *old_rlim); + asmlinkage long sys_fanotify_init(unsigned int flags, unsigned int event_f_flags); ++#if defined(CONFIG_ARCH_SPLIT_ARG64) ++asmlinkage long sys_fanotify_mark(int fanotify_fd, unsigned int flags, ++ unsigned int mask_1, unsigned int mask_2, ++ int dfd, const char __user * pathname); ++#else + asmlinkage long sys_fanotify_mark(int fanotify_fd, unsigned int flags, + u64 mask, int fd, + const char __user *pathname); ++#endif + asmlinkage long sys_name_to_handle_at(int dfd, const char __user *name, + struct file_handle __user *handle, + int __user *mnt_id, int flag); +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 24b1e5070f4d4..52c6dd6d80ac0 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -84,7 +84,7 @@ enum { + WORK_BUSY_RUNNING = 1 << 1, + + /* maximum string length for set_worker_desc() */ +- WORKER_DESC_LEN = 24, ++ WORKER_DESC_LEN = 32, + }; + + /* Convenience constants - of type 'unsigned long', not 'enum'! */ +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 6ecac01115d9c..fee1e56505510 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -264,7 +264,7 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk, + struct sock *inet_csk_reqsk_queue_add(struct sock *sk, + struct request_sock *req, + struct sock *child); +-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, ++bool inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, + unsigned long timeout); + struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child, + struct request_sock *req, +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 5bb8a83e26046..8af2543520b99 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -587,6 +587,11 @@ static inline void *nft_set_priv(const struct nft_set *set) + return (void *)set->data; + } + ++static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) ++{ ++ return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; ++} ++ + static inline bool nft_set_gc_is_pending(const struct nft_set *s) + { + return refcount_read(&s->refs) != 1; +diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h +index 1f4258308b967..061fd49603035 100644 +--- a/include/trace/events/qdisc.h ++++ b/include/trace/events/qdisc.h +@@ -81,14 +81,14 @@ TRACE_EVENT(qdisc_reset, + TP_ARGS(q), + + TP_STRUCT__entry( +- __string( dev, qdisc_dev(q)->name ) ++ __string( dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)" ) + __string( kind, q->ops->id ) + __field( u32, parent ) + __field( u32, handle ) + ), + + TP_fast_assign( +- __assign_str(dev, qdisc_dev(q)->name); ++ __assign_str(dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)"); + __assign_str(kind, q->ops->id); + __entry->parent = q->parent; + __entry->handle = q->handle; +diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h +index abe087c53b4b0..05c412c582399 100644 +--- a/include/uapi/asm-generic/unistd.h ++++ b/include/uapi/asm-generic/unistd.h +@@ -737,7 +737,7 @@ __SC_COMP(__NR_pselect6_time64, sys_pselect6, compat_sys_pselect6_time64) + #define __NR_ppoll_time64 414 + __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 05445a4d55181..77a9b12e00af7 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2174,6 +2174,7 @@ static unsigned int PROG_NAME(stack_size)(const void *ctx, const struct bpf_insn + u64 stack[stack_size / sizeof(u64)]; \ + u64 regs[MAX_BPF_EXT_REG] = {}; \ + \ ++ kmsan_unpoison_memory(stack, sizeof(stack)); \ + FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \ + ARG1 = (u64) (unsigned long) ctx; \ + return ___bpf_prog_run(regs, insn); \ +@@ -2187,6 +2188,7 @@ static u64 PROG_NAME_ARGS(stack_size)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5, \ + u64 stack[stack_size / sizeof(u64)]; \ + u64 regs[MAX_BPF_EXT_REG]; \ + \ ++ kmsan_unpoison_memory(stack, sizeof(stack)); \ + FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \ + BPF_R1 = r1; \ + BPF_R2 = r2; \ +@@ -2373,7 +2375,9 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) + } + + finalize: +- bpf_prog_lock_ro(fp); ++ *err = bpf_prog_lock_ro(fp); ++ if (*err) ++ return fp; + + /* The tail call compatibility check can only be done at + * this late stage as we need to determine, if we deal +diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c +index f045fde632e5f..238d9b206bbde 100644 +--- a/kernel/bpf/ringbuf.c ++++ b/kernel/bpf/ringbuf.c +@@ -51,7 +51,8 @@ struct bpf_ringbuf { + * This prevents a user-space application from modifying the + * position and ruining in-kernel tracking. The permissions of the + * pages depend on who is producing samples: user-space or the +- * kernel. ++ * kernel. Note that the pending counter is placed in the same ++ * page as the producer, so that it shares the same cache line. + * + * Kernel-producer + * --------------- +@@ -70,6 +71,7 @@ struct bpf_ringbuf { + */ + unsigned long consumer_pos __aligned(PAGE_SIZE); + unsigned long producer_pos __aligned(PAGE_SIZE); ++ unsigned long pending_pos; + char data[] __aligned(PAGE_SIZE); + }; + +@@ -179,6 +181,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) + rb->mask = data_sz - 1; + rb->consumer_pos = 0; + rb->producer_pos = 0; ++ rb->pending_pos = 0; + + return rb; + } +@@ -404,9 +407,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) + + static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + { +- unsigned long cons_pos, prod_pos, new_prod_pos, flags; +- u32 len, pg_off; ++ unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; + struct bpf_ringbuf_hdr *hdr; ++ u32 len, pg_off, tmp_size, hdr_len; + + if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) + return NULL; +@@ -424,13 +427,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + spin_lock_irqsave(&rb->spinlock, flags); + } + ++ pend_pos = rb->pending_pos; + prod_pos = rb->producer_pos; + new_prod_pos = prod_pos + len; + +- /* check for out of ringbuf space by ensuring producer position +- * doesn't advance more than (ringbuf_size - 1) ahead ++ while (pend_pos < prod_pos) { ++ hdr = (void *)rb->data + (pend_pos & rb->mask); ++ hdr_len = READ_ONCE(hdr->len); ++ if (hdr_len & BPF_RINGBUF_BUSY_BIT) ++ break; ++ tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; ++ tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); ++ pend_pos += tmp_size; ++ } ++ rb->pending_pos = pend_pos; ++ ++ /* check for out of ringbuf space: ++ * - by ensuring producer position doesn't advance more than ++ * (ringbuf_size - 1) ahead ++ * - by ensuring oldest not yet committed record until newest ++ * record does not span more than (ringbuf_size - 1) + */ +- if (new_prod_pos - cons_pos > rb->mask) { ++ if (new_prod_pos - cons_pos > rb->mask || ++ new_prod_pos - pend_pos > rb->mask) { + spin_unlock_irqrestore(&rb->spinlock, flags); + return NULL; + } +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index ec0464c075bb4..aa546355918cb 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6159,6 +6159,7 @@ static void set_sext32_default_val(struct bpf_reg_state *reg, int size) + } + reg->u32_min_value = 0; + reg->u32_max_value = U32_MAX; ++ reg->var_off = tnum_subreg(tnum_unknown); + } + + static void coerce_subreg_to_size_sx(struct bpf_reg_state *reg, int size) +@@ -6203,6 +6204,7 @@ static void coerce_subreg_to_size_sx(struct bpf_reg_state *reg, int size) + reg->s32_max_value = s32_max; + reg->u32_min_value = (u32)s32_min; + reg->u32_max_value = (u32)s32_max; ++ reg->var_off = tnum_subreg(tnum_range(s32_min, s32_max)); + return; + } + +@@ -18623,10 +18625,14 @@ static int jit_subprogs(struct bpf_verifier_env *env) + * bpf_prog_load will add the kallsyms for the main program. + */ + for (i = 1; i < env->subprog_cnt; i++) { +- bpf_prog_lock_ro(func[i]); +- bpf_prog_kallsyms_add(func[i]); ++ err = bpf_prog_lock_ro(func[i]); ++ if (err) ++ goto out_free; + } + ++ for (i = 1; i < env->subprog_cnt; i++) ++ bpf_prog_kallsyms_add(func[i]); ++ + /* Last step: make now unused interpreter insns from main + * prog consistent for later dump requests, so they can + * later look the same as if they were interpreted only. +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 4f453226fcf48..7ef4bc17453c1 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -2495,7 +2495,7 @@ EXPORT_SYMBOL_GPL(__cpuhp_state_add_instance); + * The caller needs to hold cpus read locked while calling this function. + * Return: + * On success: +- * Positive state number if @state is CPUHP_AP_ONLINE_DYN; ++ * Positive state number if @state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN; + * 0 for all other states + * On failure: proper (negative) error code + */ +@@ -2518,7 +2518,7 @@ int __cpuhp_setup_state_cpuslocked(enum cpuhp_state state, + ret = cpuhp_store_callbacks(state, name, startup, teardown, + multi_instance); + +- dynstate = state == CPUHP_AP_ONLINE_DYN; ++ dynstate = state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN; + if (ret > 0 && dynstate) { + state = ret; + ret = 0; +@@ -2549,8 +2549,8 @@ int __cpuhp_setup_state_cpuslocked(enum cpuhp_state state, + out: + mutex_unlock(&cpuhp_state_mutex); + /* +- * If the requested state is CPUHP_AP_ONLINE_DYN, return the +- * dynamically allocated state in case of success. ++ * If the requested state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN, ++ * return the dynamically allocated state in case of success. + */ + if (!ret && dynstate) + return state; +diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c +index 11c55593a2e91..e8e1177873770 100644 +--- a/kernel/sys_ni.c ++++ b/kernel/sys_ni.c +@@ -46,8 +46,8 @@ COND_SYSCALL(io_getevents_time32); + COND_SYSCALL(io_getevents); + COND_SYSCALL(io_pgetevents_time32); + COND_SYSCALL(io_pgetevents); +-COND_SYSCALL_COMPAT(io_pgetevents_time32); + COND_SYSCALL_COMPAT(io_pgetevents); ++COND_SYSCALL_COMPAT(io_pgetevents_time64); + COND_SYSCALL(io_uring_setup); + COND_SYSCALL(io_uring_enter); + COND_SYSCALL(io_uring_register); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 6b4c30fcae1c9..e99d3223f0fc2 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -519,10 +519,15 @@ static void bad_page(struct page *page, const char *reason) + + static inline unsigned int order_to_pindex(int migratetype, int order) + { ++ bool __maybe_unused movable; ++ + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + if (order > PAGE_ALLOC_COSTLY_ORDER) { + VM_BUG_ON(order != pageblock_order); +- return NR_LOWORDER_PCP_LISTS; ++ ++ movable = migratetype == MIGRATE_MOVABLE; ++ ++ return NR_LOWORDER_PCP_LISTS + movable; + } + #else + VM_BUG_ON(order > PAGE_ALLOC_COSTLY_ORDER); +@@ -536,7 +541,7 @@ static inline int pindex_to_order(unsigned int pindex) + int order = pindex / MIGRATE_PCPTYPES; + + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +- if (pindex == NR_LOWORDER_PCP_LISTS) ++ if (pindex >= NR_LOWORDER_PCP_LISTS) + order = pageblock_order; + #else + VM_BUG_ON(order > PAGE_ALLOC_COSTLY_ORDER); +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 01818b1c37e8e..7d146f198bc32 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1939,6 +1939,7 @@ struct vmap_block { + struct list_head free_list; + struct rcu_head rcu_head; + struct list_head purge; ++ unsigned int cpu; + }; + + /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ +@@ -2066,8 +2067,15 @@ static void *new_vmap_block(unsigned int order, gfp_t gfp_mask) + free_vmap_area(va); + return ERR_PTR(err); + } +- +- vbq = raw_cpu_ptr(&vmap_block_queue); ++ /* ++ * list_add_tail_rcu could happened in another core ++ * rather than vb->cpu due to task migration, which ++ * is safe as list_add_tail_rcu will ensure the list's ++ * integrity together with list_for_each_rcu from read ++ * side. ++ */ ++ vb->cpu = raw_smp_processor_id(); ++ vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); + spin_lock(&vbq->lock); + list_add_tail_rcu(&vb->free_list, &vbq->free); + spin_unlock(&vbq->lock); +@@ -2093,9 +2101,10 @@ static void free_vmap_block(struct vmap_block *vb) + } + + static bool purge_fragmented_block(struct vmap_block *vb, +- struct vmap_block_queue *vbq, struct list_head *purge_list, +- bool force_purge) ++ struct list_head *purge_list, bool force_purge) + { ++ struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); ++ + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || + vb->dirty == VMAP_BBMAP_BITS) + return false; +@@ -2143,7 +2152,7 @@ static void purge_fragmented_blocks(int cpu) + continue; + + spin_lock(&vb->lock); +- purge_fragmented_block(vb, vbq, &purge, true); ++ purge_fragmented_block(vb, &purge, true); + spin_unlock(&vb->lock); + } + rcu_read_unlock(); +@@ -2280,7 +2289,7 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush) + * not purgeable, check whether there is dirty + * space to be flushed. + */ +- if (!purge_fragmented_block(vb, vbq, &purge_list, false) && ++ if (!purge_fragmented_block(vb, &purge_list, false) && + vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { + unsigned long va_start = vb->va->va_start; + unsigned long s, e; +diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c +index dafef3a78ad5d..7388d2ad7b5d8 100644 +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -12,6 +12,7 @@ + #include <linux/errno.h> + #include <linux/etherdevice.h> + #include <linux/gfp.h> ++#include <linux/if_vlan.h> + #include <linux/jiffies.h> + #include <linux/kref.h> + #include <linux/list.h> +@@ -131,6 +132,29 @@ batadv_orig_node_vlan_get(struct batadv_orig_node *orig_node, + return vlan; + } + ++/** ++ * batadv_vlan_id_valid() - check if vlan id is in valid batman-adv encoding ++ * @vid: the VLAN identifier ++ * ++ * Return: true when either no vlan is set or if VLAN is in correct range, ++ * false otherwise ++ */ ++static bool batadv_vlan_id_valid(unsigned short vid) ++{ ++ unsigned short non_vlan = vid & ~(BATADV_VLAN_HAS_TAG | VLAN_VID_MASK); ++ ++ if (vid == 0) ++ return true; ++ ++ if (!(vid & BATADV_VLAN_HAS_TAG)) ++ return false; ++ ++ if (non_vlan) ++ return false; ++ ++ return true; ++} ++ + /** + * batadv_orig_node_vlan_new() - search and possibly create an orig_node_vlan + * object +@@ -149,6 +173,9 @@ batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node, + { + struct batadv_orig_node_vlan *vlan; + ++ if (!batadv_vlan_id_valid(vid)) ++ return NULL; ++ + spin_lock_bh(&orig_node->vlan_list_lock); + + /* first look if an object for this vid already exists */ +diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c +index a6fb89fa62785..7e8a20f2fc42b 100644 +--- a/net/can/j1939/main.c ++++ b/net/can/j1939/main.c +@@ -30,10 +30,6 @@ MODULE_ALIAS("can-proto-" __stringify(CAN_J1939)); + /* CAN_HDR: #bytes before can_frame data part */ + #define J1939_CAN_HDR (offsetof(struct can_frame, data)) + +-/* CAN_FTR: #bytes beyond data part */ +-#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \ +- sizeof(((struct can_frame *)0)->data)) +- + /* lowest layer */ + static void j1939_can_recv(struct sk_buff *iskb, void *data) + { +@@ -342,7 +338,7 @@ int j1939_send_one(struct j1939_priv *priv, struct sk_buff *skb) + memset(cf, 0, J1939_CAN_HDR); + + /* make it a full can frame again */ +- skb_put(skb, J1939_CAN_FTR + (8 - dlc)); ++ skb_put_zero(skb, 8 - dlc); + + canid = CAN_EFF_FLAG | + (skcb->priority << 26) | +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index fe3df23a25957..4be73de5033cb 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1593,8 +1593,8 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, + struct j1939_sk_buff_cb skcb = *j1939_skb_to_cb(skb); + struct j1939_session *session; + const u8 *dat; ++ int len, ret; + pgn_t pgn; +- int len; + + netdev_dbg(priv->ndev, "%s\n", __func__); + +@@ -1653,7 +1653,22 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, + session->tskey = priv->rx_tskey++; + j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_RTS); + +- WARN_ON_ONCE(j1939_session_activate(session)); ++ ret = j1939_session_activate(session); ++ if (ret) { ++ /* Entering this scope indicates an issue with the J1939 bus. ++ * Possible scenarios include: ++ * - A time lapse occurred, and a new session was initiated ++ * due to another packet being sent correctly. This could ++ * have been caused by too long interrupt, debugger, or being ++ * out-scheduled by another task. ++ * - The bus is receiving numerous erroneous packets, either ++ * from a malfunctioning device or during a test scenario. ++ */ ++ netdev_alert(priv->ndev, "%s: 0x%p: concurrent session with same addr (%02x %02x) is already active.\n", ++ __func__, session, skcb.addr.sa, skcb.addr.da); ++ j1939_session_put(session); ++ return NULL; ++ } + + return session; + } +@@ -1681,6 +1696,8 @@ static int j1939_xtp_rx_rts_session_active(struct j1939_session *session, + + j1939_session_timers_cancel(session); + j1939_session_cancel(session, J1939_XTP_ABORT_BUSY); ++ if (session->transmission) ++ j1939_session_deactivate_activate_next(session); + + return -EBUSY; + } +diff --git a/net/core/xdp.c b/net/core/xdp.c +index a70670fe9a2dc..5fe4c099f30a3 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -294,10 +294,8 @@ static struct xdp_mem_allocator *__xdp_reg_mem_model(struct xdp_mem_info *mem, + mutex_lock(&mem_id_lock); + ret = __mem_id_init_hash_table(); + mutex_unlock(&mem_id_lock); +- if (ret < 0) { +- WARN_ON(1); ++ if (ret < 0) + return ERR_PTR(ret); +- } + } + + xdp_alloc = kzalloc(sizeof(*xdp_alloc), gfp); +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index 524b7e581a036..65a6733fc897f 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -655,8 +655,11 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) + if (dccp_v4_send_response(sk, req)) + goto drop_and_free; + +- inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); +- reqsk_put(req); ++ if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT))) ++ reqsk_free(req); ++ else ++ reqsk_put(req); ++ + return 0; + + drop_and_free: +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 6f5a556f4f6d7..683e4291b348a 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -398,8 +398,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (dccp_v6_send_response(sk, req)) + goto drop_and_free; + +- inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); +- reqsk_put(req); ++ if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT))) ++ reqsk_free(req); ++ else ++ reqsk_put(req); ++ + return 0; + + drop_and_free: +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index a018981b45142..8720f3840b698 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -1116,25 +1116,34 @@ static void reqsk_timer_handler(struct timer_list *t) + inet_csk_reqsk_queue_drop_and_put(oreq->rsk_listener, oreq); + } + +-static void reqsk_queue_hash_req(struct request_sock *req, ++static bool reqsk_queue_hash_req(struct request_sock *req, + unsigned long timeout) + { ++ bool found_dup_sk = false; ++ ++ if (!inet_ehash_insert(req_to_sk(req), NULL, &found_dup_sk)) ++ return false; ++ ++ /* The timer needs to be setup after a successful insertion. */ + timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED); + mod_timer(&req->rsk_timer, jiffies + timeout); + +- inet_ehash_insert(req_to_sk(req), NULL, NULL); + /* before letting lookups find us, make sure all req fields + * are committed to memory and refcnt initialized. + */ + smp_wmb(); + refcount_set(&req->rsk_refcnt, 2 + 1); ++ return true; + } + +-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, ++bool inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req, + unsigned long timeout) + { +- reqsk_queue_hash_req(req, timeout); ++ if (!reqsk_queue_hash_req(req, timeout)) ++ return false; ++ + inet_csk_reqsk_queue_added(sk); ++ return true; + } + EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add); + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index abd6e95d2dca8..6743b6bfbc9c5 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2759,13 +2759,37 @@ static void tcp_mtup_probe_success(struct sock *sk) + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMTUPSUCCESS); + } + ++/* Sometimes we deduce that packets have been dropped due to reasons other than ++ * congestion, like path MTU reductions or failed client TFO attempts. In these ++ * cases we call this function to retransmit as many packets as cwnd allows, ++ * without reducing cwnd. Given that retransmits will set retrans_stamp to a ++ * non-zero value (and may do so in a later calling context due to TSQ), we ++ * also enter CA_Loss so that we track when all retransmitted packets are ACKed ++ * and clear retrans_stamp when that happens (to ensure later recurring RTOs ++ * are using the correct retrans_stamp and don't declare ETIMEDOUT ++ * prematurely). ++ */ ++static void tcp_non_congestion_loss_retransmit(struct sock *sk) ++{ ++ const struct inet_connection_sock *icsk = inet_csk(sk); ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (icsk->icsk_ca_state != TCP_CA_Loss) { ++ tp->high_seq = tp->snd_nxt; ++ tp->snd_ssthresh = tcp_current_ssthresh(sk); ++ tp->prior_ssthresh = 0; ++ tp->undo_marker = 0; ++ tcp_set_ca_state(sk, TCP_CA_Loss); ++ } ++ tcp_xmit_retransmit_queue(sk); ++} ++ + /* Do a simple retransmit without using the backoff mechanisms in + * tcp_timer. This is used for path mtu discovery. + * The socket is already locked here. + */ + void tcp_simple_retransmit(struct sock *sk) + { +- const struct inet_connection_sock *icsk = inet_csk(sk); + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *skb; + int mss; +@@ -2805,14 +2829,7 @@ void tcp_simple_retransmit(struct sock *sk) + * in network, but units changed and effective + * cwnd/ssthresh really reduced now. + */ +- if (icsk->icsk_ca_state != TCP_CA_Loss) { +- tp->high_seq = tp->snd_nxt; +- tp->snd_ssthresh = tcp_current_ssthresh(sk); +- tp->prior_ssthresh = 0; +- tp->undo_marker = 0; +- tcp_set_ca_state(sk, TCP_CA_Loss); +- } +- tcp_xmit_retransmit_queue(sk); ++ tcp_non_congestion_loss_retransmit(sk); + } + EXPORT_SYMBOL(tcp_simple_retransmit); + +@@ -6175,8 +6192,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack, + tp->fastopen_client_fail = TFO_DATA_NOT_ACKED; + skb_rbtree_walk_from(data) + tcp_mark_skb_lost(sk, data); +- tcp_xmit_retransmit_queue(sk); +- tp->retrans_stamp = 0; ++ tcp_non_congestion_loss_retransmit(sk); + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPFASTOPENACTIVEFAIL); + return true; +@@ -7091,7 +7107,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + tcp_rsk(req)->tfo_listener = false; + if (!want_cookie) { + req->timeout = tcp_timeout_init((struct sock *)req); +- inet_csk_reqsk_queue_hash_add(sk, req, req->timeout); ++ if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, ++ req->timeout))) { ++ reqsk_free(req); ++ return 0; ++ } ++ + } + af_ops->send_synack(sk, dst, &fl, req, &foc, + !want_cookie ? TCP_SYNACK_NORMAL : +diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c +index f66b5f74cd83a..db41eb2d977f2 100644 +--- a/net/iucv/iucv.c ++++ b/net/iucv/iucv.c +@@ -519,7 +519,7 @@ static void iucv_setmask_mp(void) + */ + static void iucv_setmask_up(void) + { +- cpumask_t cpumask; ++ static cpumask_t cpumask; + int cpu; + + /* Disable all cpu but the first in cpu_irq_cpumask. */ +@@ -627,23 +627,33 @@ static int iucv_cpu_online(unsigned int cpu) + + static int iucv_cpu_down_prep(unsigned int cpu) + { +- cpumask_t cpumask; ++ cpumask_var_t cpumask; ++ int ret = 0; + + if (!iucv_path_table) + return 0; + +- cpumask_copy(&cpumask, &iucv_buffer_cpumask); +- cpumask_clear_cpu(cpu, &cpumask); +- if (cpumask_empty(&cpumask)) ++ if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) ++ return -ENOMEM; ++ ++ cpumask_copy(cpumask, &iucv_buffer_cpumask); ++ cpumask_clear_cpu(cpu, cpumask); ++ if (cpumask_empty(cpumask)) { + /* Can't offline last IUCV enabled cpu. */ +- return -EINVAL; ++ ret = -EINVAL; ++ goto __free_cpumask; ++ } + + iucv_retrieve_cpu(NULL); + if (!cpumask_empty(&iucv_irq_cpumask)) +- return 0; ++ goto __free_cpumask; ++ + smp_call_function_single(cpumask_first(&iucv_buffer_cpumask), + iucv_allow_cpu, NULL, 1); +- return 0; ++ ++__free_cpumask: ++ free_cpumask_var(cpumask); ++ return ret; + } + + /** +diff --git a/net/netfilter/nf_hooks_lwtunnel.c b/net/netfilter/nf_hooks_lwtunnel.c +index 7cdb59bb4459f..d8ebebc9775d7 100644 +--- a/net/netfilter/nf_hooks_lwtunnel.c ++++ b/net/netfilter/nf_hooks_lwtunnel.c +@@ -117,4 +117,7 @@ void netfilter_lwtunnel_fini(void) + { + unregister_pernet_subsys(&nf_lwtunnel_net_ops); + } ++#else ++int __init netfilter_lwtunnel_init(void) { return 0; } ++void netfilter_lwtunnel_fini(void) {} + #endif /* CONFIG_SYSCTL */ +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 387eee416b0bf..7547f7b869395 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5648,8 +5648,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, + + if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && + nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), +- set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, +- set->dlen) < 0) ++ nft_set_datatype(set), set->dlen) < 0) + goto nla_put_failure; + + if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && +@@ -10881,6 +10880,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, + + return 0; + default: ++ if (type != NFT_DATA_VALUE) ++ return -EINVAL; ++ + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) + return -EINVAL; + if (len == 0) +@@ -10889,8 +10891,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, + sizeof_field(struct nft_regs, data)) + return -ERANGE; + +- if (data != NULL && type != NFT_DATA_VALUE) +- return -EINVAL; + return 0; + } + } +diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c +index 870e5b113d13e..7ba4b1454db46 100644 +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -132,7 +132,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx, + return -EINVAL; + + err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG], +- &priv->dreg, NULL, set->dtype, ++ &priv->dreg, NULL, ++ nft_set_datatype(set), + set->dlen); + if (err < 0) + return err; +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 2928c142a2ddb..3b980bf2770bb 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -168,8 +168,13 @@ static u32 ovs_ct_get_mark(const struct nf_conn *ct) + static void ovs_ct_get_labels(const struct nf_conn *ct, + struct ovs_key_ct_labels *labels) + { +- struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL; ++ struct nf_conn_labels *cl = NULL; + ++ if (ct) { ++ if (ct->master && !nf_ct_is_confirmed(ct)) ++ ct = ct->master; ++ cl = nf_ct_labels_find(ct); ++ } + if (cl) + memcpy(labels, cl->bits, OVS_CT_LABELS_LEN); + else +diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst +index 4405d5b67578d..fa3ad33a19df8 100644 +--- a/scripts/Makefile.dtbinst ++++ b/scripts/Makefile.dtbinst +@@ -24,7 +24,7 @@ __dtbs_install: $(dtbs) $(subdirs) + @: + + quiet_cmd_dtb_install = INSTALL $@ +- cmd_dtb_install = install -D $< $@ ++ cmd_dtb_install = install -D -m 0644 $< $@ + + $(dst)/%.dtb: $(obj)/%.dtb + $(call cmd,dtb_install) +diff --git a/scripts/Makefile.package b/scripts/Makefile.package +index 2bcab02da9653..a16d60a4b3fd7 100644 +--- a/scripts/Makefile.package ++++ b/scripts/Makefile.package +@@ -126,7 +126,7 @@ debian-orig: private version = $(shell dpkg-parsechangelog -S Version | sed 's/- + debian-orig: private orig-name = $(source)_$(version).orig.tar$(debian-orig-suffix) + debian-orig: mkdebian-opts = --need-source + debian-orig: linux.tar$(debian-orig-suffix) debian +- $(Q)if [ "$(df --output=target .. 2>/dev/null)" = "$(df --output=target $< 2>/dev/null)" ]; then \ ++ $(Q)if [ "$$(df --output=target .. 2>/dev/null)" = "$$(df --output=target $< 2>/dev/null)" ]; then \ + ln -f $< ../$(orig-name); \ + else \ + cp $< ../$(orig-name); \ +diff --git a/sound/core/seq/seq_ump_convert.c b/sound/core/seq/seq_ump_convert.c +index d81f776a4c3dd..e90b27a135e6f 100644 +--- a/sound/core/seq/seq_ump_convert.c ++++ b/sound/core/seq/seq_ump_convert.c +@@ -791,7 +791,8 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event, + + /* set up the MIDI2 RPN/NRPN packet data from the parsed info */ + static void fill_rpn(struct snd_seq_ump_midi2_bank *cc, +- union snd_ump_midi2_msg *data) ++ union snd_ump_midi2_msg *data, ++ unsigned char channel) + { + if (cc->rpn_set) { + data->rpn.status = UMP_MSG_STATUS_RPN; +@@ -808,6 +809,7 @@ static void fill_rpn(struct snd_seq_ump_midi2_bank *cc, + } + data->rpn.data = upscale_14_to_32bit((cc->cc_data_msb << 7) | + cc->cc_data_lsb); ++ data->rpn.channel = channel; + cc->cc_data_msb = cc->cc_data_lsb = 0; + } + +@@ -855,7 +857,7 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, + cc->cc_data_lsb = val; + if (!(cc->rpn_set || cc->nrpn_set)) + return 0; // skip +- fill_rpn(cc, data); ++ fill_rpn(cc, data, channel); + return 1; + } + +@@ -957,7 +959,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, + cc->cc_data_lsb = lsb; + if (!(cc->rpn_set || cc->nrpn_set)) + return 0; // skip +- fill_rpn(cc, data); ++ fill_rpn(cc, data, channel); + return 1; + } + +@@ -1018,7 +1020,7 @@ static int system_2p_ev_to_ump_midi2(const struct snd_seq_event *event, + union snd_ump_midi2_msg *data, + unsigned char status) + { +- return system_1p_ev_to_ump_midi1(event, dest_port, ++ return system_2p_ev_to_ump_midi1(event, dest_port, + (union snd_ump_midi1_msg *)data, + status); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index af70e764ea4bc..c9f07e6fde963 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9963,6 +9963,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8c7c, "HP ProBook 445 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c7d, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c7e, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8c7f, "HP EliteBook 645 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8c80, "HP EliteBook 645 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8c81, "HP EliteBook 665 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c89, "HP ProBook 460 G11", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c8a, "HP EliteBook 630", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED), +diff --git a/sound/soc/amd/acp/acp-i2s.c b/sound/soc/amd/acp/acp-i2s.c +index df350014966a0..cf2fdde5aaa18 100644 +--- a/sound/soc/amd/acp/acp-i2s.c ++++ b/sound/soc/amd/acp/acp-i2s.c +@@ -543,20 +543,12 @@ static int acp_i2s_probe(struct snd_soc_dai *dai) + { + struct device *dev = dai->component->dev; + struct acp_dev_data *adata = dev_get_drvdata(dev); +- struct acp_resource *rsrc = adata->rsrc; +- unsigned int val; + + if (!adata->acp_base) { + dev_err(dev, "I2S base is NULL\n"); + return -EINVAL; + } + +- val = readl(adata->acp_base + rsrc->i2s_pin_cfg_offset); +- if (val != rsrc->i2s_mode) { +- dev_err(dev, "I2S Mode not supported val %x\n", val); +- return -EINVAL; +- } +- + return 0; + } + +diff --git a/sound/soc/amd/acp/acp-pci.c b/sound/soc/amd/acp/acp-pci.c +index 223238f662f83..7de6446e6f7c1 100644 +--- a/sound/soc/amd/acp/acp-pci.c ++++ b/sound/soc/amd/acp/acp-pci.c +@@ -185,10 +185,12 @@ static int __maybe_unused snd_acp_resume(struct device *dev) + ret = acp_init(chip); + if (ret) + dev_err(dev, "ACP init failed\n"); +- child = chip->chip_pdev->dev; +- adata = dev_get_drvdata(&child); +- if (adata) +- acp_enable_interrupts(adata); ++ if (chip->chip_pdev) { ++ child = chip->chip_pdev->dev; ++ adata = dev_get_drvdata(&child); ++ if (adata) ++ acp_enable_interrupts(adata); ++ } + return ret; + } + +diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c +index 4c1985711218d..ba314b2799190 100644 +--- a/sound/soc/atmel/atmel-classd.c ++++ b/sound/soc/atmel/atmel-classd.c +@@ -118,7 +118,7 @@ static const struct snd_pcm_hardware atmel_classd_hw = { + static int atmel_classd_cpu_dai_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_classd *dd = snd_soc_card_get_drvdata(rtd->card); + int err; + +@@ -141,7 +141,7 @@ atmel_classd_platform_configure_dma(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct dma_slave_config *slave_config) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_classd *dd = snd_soc_card_get_drvdata(rtd->card); + + if (params_physical_width(params) != 16) { +@@ -338,7 +338,7 @@ atmel_classd_cpu_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_classd *dd = snd_soc_card_get_drvdata(rtd->card); + struct snd_soc_component *component = cpu_dai->component; + int fs; +@@ -381,7 +381,7 @@ static void + atmel_classd_cpu_dai_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_classd *dd = snd_soc_card_get_drvdata(rtd->card); + + clk_disable_unprepare(dd->gclk); +@@ -473,19 +473,22 @@ static int atmel_classd_asoc_card_init(struct device *dev, + if (!dai_link) + return -ENOMEM; + +- comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL); ++ comp = devm_kzalloc(dev, 2 * sizeof(*comp), GFP_KERNEL); + if (!comp) + return -ENOMEM; + +- dai_link->cpus = comp; +- dai_link->codecs = &asoc_dummy_dlc; ++ dai_link->cpus = &comp[0]; ++ dai_link->codecs = &snd_soc_dummy_dlc; ++ dai_link->platforms = &comp[1]; + + dai_link->num_cpus = 1; + dai_link->num_codecs = 1; ++ dai_link->num_platforms = 1; + + dai_link->name = "CLASSD"; + dai_link->stream_name = "CLASSD PCM"; + dai_link->cpus->dai_name = dev_name(dev); ++ dai_link->platforms->name = dev_name(dev); + + card->dai_link = dai_link; + card->num_links = 1; +diff --git a/sound/soc/atmel/atmel-pcm-dma.c b/sound/soc/atmel/atmel-pcm-dma.c +index 96a8c7dba98ff..7306e04da513b 100644 +--- a/sound/soc/atmel/atmel-pcm-dma.c ++++ b/sound/soc/atmel/atmel-pcm-dma.c +@@ -52,10 +52,10 @@ static const struct snd_pcm_hardware atmel_pcm_dma_hardware = { + static void atmel_pcm_dma_irq(u32 ssc_sr, + struct snd_pcm_substream *substream) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pcm_dma_params *prtd; + +- prtd = snd_soc_dai_get_dma_data(asoc_rtd_to_cpu(rtd, 0), substream); ++ prtd = snd_soc_dai_get_dma_data(snd_soc_rtd_to_cpu(rtd, 0), substream); + + if (ssc_sr & prtd->mask->ssc_error) { + if (snd_pcm_running(substream)) +@@ -77,12 +77,12 @@ static void atmel_pcm_dma_irq(u32 ssc_sr, + static int atmel_pcm_configure_dma(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, struct dma_slave_config *slave_config) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pcm_dma_params *prtd; + struct ssc_device *ssc; + int ret; + +- prtd = snd_soc_dai_get_dma_data(asoc_rtd_to_cpu(rtd, 0), substream); ++ prtd = snd_soc_dai_get_dma_data(snd_soc_rtd_to_cpu(rtd, 0), substream); + ssc = prtd->ssc; + + ret = snd_hwparams_to_dma_slave_config(substream, params, slave_config); +diff --git a/sound/soc/atmel/atmel-pcm-pdc.c b/sound/soc/atmel/atmel-pcm-pdc.c +index 3e7ea2021b46b..7db8df85c54f3 100644 +--- a/sound/soc/atmel/atmel-pcm-pdc.c ++++ b/sound/soc/atmel/atmel-pcm-pdc.c +@@ -140,12 +140,12 @@ static int atmel_pcm_hw_params(struct snd_soc_component *component, + { + struct snd_pcm_runtime *runtime = substream->runtime; + struct atmel_runtime_data *prtd = runtime->private_data; +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + + /* this may get called several times by oss emulation + * with different params */ + +- prtd->params = snd_soc_dai_get_dma_data(asoc_rtd_to_cpu(rtd, 0), substream); ++ prtd->params = snd_soc_dai_get_dma_data(snd_soc_rtd_to_cpu(rtd, 0), substream); + prtd->params->dma_intr_handler = atmel_pcm_dma_irq; + + prtd->dma_buffer = runtime->dma_addr; +diff --git a/sound/soc/atmel/atmel-pdmic.c b/sound/soc/atmel/atmel-pdmic.c +index 0db7815d230c3..fa29dd8ef2089 100644 +--- a/sound/soc/atmel/atmel-pdmic.c ++++ b/sound/soc/atmel/atmel-pdmic.c +@@ -104,7 +104,7 @@ static struct atmel_pdmic_pdata *atmel_pdmic_dt_init(struct device *dev) + static int atmel_pdmic_cpu_dai_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pdmic *dd = snd_soc_card_get_drvdata(rtd->card); + int ret; + +@@ -132,7 +132,7 @@ static int atmel_pdmic_cpu_dai_startup(struct snd_pcm_substream *substream, + static void atmel_pdmic_cpu_dai_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pdmic *dd = snd_soc_card_get_drvdata(rtd->card); + + /* Disable the overrun error interrupt */ +@@ -145,7 +145,7 @@ static void atmel_pdmic_cpu_dai_shutdown(struct snd_pcm_substream *substream, + static int atmel_pdmic_cpu_dai_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pdmic *dd = snd_soc_card_get_drvdata(rtd->card); + struct snd_soc_component *component = cpu_dai->component; + u32 val; +@@ -191,7 +191,7 @@ atmel_pdmic_platform_configure_dma(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct dma_slave_config *slave_config) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pdmic *dd = snd_soc_card_get_drvdata(rtd->card); + int ret; + +@@ -356,7 +356,7 @@ atmel_pdmic_cpu_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *cpu_dai) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); + struct atmel_pdmic *dd = snd_soc_card_get_drvdata(rtd->card); + struct snd_soc_component *component = cpu_dai->component; + unsigned int rate_min = substream->runtime->hw.rate_min; +@@ -501,7 +501,7 @@ static int atmel_pdmic_asoc_card_init(struct device *dev, + return -ENOMEM; + + dai_link->cpus = comp; +- dai_link->codecs = &asoc_dummy_dlc; ++ dai_link->codecs = &snd_soc_dummy_dlc; + + dai_link->num_cpus = 1; + dai_link->num_codecs = 1; +diff --git a/sound/soc/atmel/atmel_wm8904.c b/sound/soc/atmel/atmel_wm8904.c +index 00e98136bec25..01e944fa11483 100644 +--- a/sound/soc/atmel/atmel_wm8904.c ++++ b/sound/soc/atmel/atmel_wm8904.c +@@ -26,8 +26,8 @@ static const struct snd_soc_dapm_widget atmel_asoc_wm8904_dapm_widgets[] = { + static int atmel_asoc_wm8904_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params) + { +- struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); +- struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0); ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); ++ struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0); + int ret; + + ret = snd_soc_dai_set_pll(codec_dai, WM8904_FLL_MCLK, WM8904_FLL_MCLK, +diff --git a/sound/soc/atmel/mikroe-proto.c b/sound/soc/atmel/mikroe-proto.c +index 30c87c2c1b0bd..18a8760443ae6 100644 +--- a/sound/soc/atmel/mikroe-proto.c ++++ b/sound/soc/atmel/mikroe-proto.c +@@ -21,7 +21,7 @@ + static int snd_proto_init(struct snd_soc_pcm_runtime *rtd) + { + struct snd_soc_card *card = rtd->card; +- struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0); ++ struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0); + + /* Set proto sysclk */ + int ret = snd_soc_dai_set_sysclk(codec_dai, WM8731_SYSCLK_XTAL, +diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c +index 0405e9e49140e..d3ec9826d505f 100644 +--- a/sound/soc/atmel/sam9g20_wm8731.c ++++ b/sound/soc/atmel/sam9g20_wm8731.c +@@ -66,7 +66,7 @@ static const struct snd_soc_dapm_route intercon[] = { + */ + static int at91sam9g20ek_wm8731_init(struct snd_soc_pcm_runtime *rtd) + { +- struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0); ++ struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0); + struct device *dev = rtd->dev; + int ret; + +diff --git a/sound/soc/atmel/sam9x5_wm8731.c b/sound/soc/atmel/sam9x5_wm8731.c +index cd1d59a90e021..d1c1f370a9cd5 100644 +--- a/sound/soc/atmel/sam9x5_wm8731.c ++++ b/sound/soc/atmel/sam9x5_wm8731.c +@@ -40,7 +40,7 @@ struct sam9x5_drvdata { + */ + static int sam9x5_wm8731_init(struct snd_soc_pcm_runtime *rtd) + { +- struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0); ++ struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0); + struct device *dev = rtd->dev; + int ret; + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 5f181b89838ac..f76252b3f5913 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -559,6 +559,8 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + if (!priv) + return -ENOMEM; + ++ priv->pdev = pdev; ++ + cpu_np = of_parse_phandle(np, "audio-cpu", 0); + /* Give a chance to old DT binding */ + if (!cpu_np) +@@ -781,7 +783,6 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + } + + /* Initialize sound card */ +- priv->pdev = pdev; + priv->card.dev = &pdev->dev; + priv->card.owner = THIS_MODULE; + ret = snd_soc_of_parse_card_name(&priv->card, "model"); +diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +index 701fbcc0f2c9c..b48375aa30271 100644 +--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c ++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +@@ -31,7 +31,7 @@ struct mt8183_da7219_max98357_priv { + + static struct snd_soc_jack_pin mt8183_da7219_max98357_jack_pins[] = { + { +- .pin = "Headphone", ++ .pin = "Headphones", + .mask = SND_JACK_HEADPHONE, + }, + { +@@ -626,7 +626,7 @@ static struct snd_soc_codec_conf mt6358_codec_conf[] = { + }; + + static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = { +- SOC_DAPM_PIN_SWITCH("Headphone"), ++ SOC_DAPM_PIN_SWITCH("Headphones"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Speakers"), + SOC_DAPM_PIN_SWITCH("Line Out"), +@@ -634,7 +634,7 @@ static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = { + + static const + struct snd_soc_dapm_widget mt8183_da7219_max98357_dapm_widgets[] = { +- SND_SOC_DAPM_HP("Headphone", NULL), ++ SND_SOC_DAPM_HP("Headphones", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_SPK("Speakers", NULL), + SND_SOC_DAPM_SPK("Line Out", NULL), +@@ -680,7 +680,7 @@ static struct snd_soc_codec_conf mt8183_da7219_rt1015_codec_conf[] = { + }; + + static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { +- SOC_DAPM_PIN_SWITCH("Headphone"), ++ SOC_DAPM_PIN_SWITCH("Headphones"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Left Spk"), + SOC_DAPM_PIN_SWITCH("Right Spk"), +@@ -689,7 +689,7 @@ static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { + + static const + struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = { +- SND_SOC_DAPM_HP("Headphone", NULL), ++ SND_SOC_DAPM_HP("Headphones", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_SPK("Left Spk", NULL), + SND_SOC_DAPM_SPK("Right Spk", NULL), +diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +index 7ad604b80e25e..6511f0a08de16 100644 +--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c ++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +@@ -140,14 +140,17 @@ static void q6apm_lpass_dai_shutdown(struct snd_pcm_substream *substream, struct + struct q6apm_lpass_dai_data *dai_data = dev_get_drvdata(dai->dev); + int rc; + +- if (!dai_data->is_port_started[dai->id]) +- return; +- rc = q6apm_graph_stop(dai_data->graph[dai->id]); +- if (rc < 0) +- dev_err(dai->dev, "fail to close APM port (%d)\n", rc); ++ if (dai_data->is_port_started[dai->id]) { ++ rc = q6apm_graph_stop(dai_data->graph[dai->id]); ++ dai_data->is_port_started[dai->id] = false; ++ if (rc < 0) ++ dev_err(dai->dev, "fail to close APM port (%d)\n", rc); ++ } + +- q6apm_graph_close(dai_data->graph[dai->id]); +- dai_data->is_port_started[dai->id] = false; ++ if (dai_data->graph[dai->id]) { ++ q6apm_graph_close(dai_data->graph[dai->id]); ++ dai_data->graph[dai->id] = NULL; ++ } + } + + static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) +@@ -162,8 +165,10 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s + q6apm_graph_stop(dai_data->graph[dai->id]); + dai_data->is_port_started[dai->id] = false; + +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + q6apm_graph_close(dai_data->graph[dai->id]); ++ dai_data->graph[dai->id] = NULL; ++ } + } + + /** +@@ -182,26 +187,29 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s + + cfg->direction = substream->stream; + rc = q6apm_graph_media_format_pcm(dai_data->graph[dai->id], cfg); +- + if (rc) { + dev_err(dai->dev, "Failed to set media format %d\n", rc); +- return rc; ++ goto err; + } + + rc = q6apm_graph_prepare(dai_data->graph[dai->id]); + if (rc) { + dev_err(dai->dev, "Failed to prepare Graph %d\n", rc); +- return rc; ++ goto err; + } + + rc = q6apm_graph_start(dai_data->graph[dai->id]); + if (rc < 0) { + dev_err(dai->dev, "fail to start APM port %x\n", dai->id); +- return rc; ++ goto err; + } + dai_data->is_port_started[dai->id] = true; + + return 0; ++err: ++ q6apm_graph_close(dai_data->graph[dai->id]); ++ dai_data->graph[dai->id] = NULL; ++ return rc; + } + + static int q6apm_lpass_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) +diff --git a/sound/soc/rockchip/rockchip_i2s_tdm.c b/sound/soc/rockchip/rockchip_i2s_tdm.c +index 15f8919fd224a..e6a6eabc47e5b 100644 +--- a/sound/soc/rockchip/rockchip_i2s_tdm.c ++++ b/sound/soc/rockchip/rockchip_i2s_tdm.c +@@ -657,8 +657,17 @@ static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream, + int err; + + if (i2s_tdm->is_master_mode) { +- struct clk *mclk = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ? +- i2s_tdm->mclk_tx : i2s_tdm->mclk_rx; ++ struct clk *mclk; ++ ++ if (i2s_tdm->clk_trcm == TRCM_TX) { ++ mclk = i2s_tdm->mclk_tx; ++ } else if (i2s_tdm->clk_trcm == TRCM_RX) { ++ mclk = i2s_tdm->mclk_rx; ++ } else if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { ++ mclk = i2s_tdm->mclk_tx; ++ } else { ++ mclk = i2s_tdm->mclk_rx; ++ } + + err = clk_set_rate(mclk, DEFAULT_MCLK_FS * params_rate(params)); + if (err) +diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c +index 16f00097cb95a..eed47e4830248 100644 +--- a/sound/synth/emux/soundfont.c ++++ b/sound/synth/emux/soundfont.c +@@ -701,7 +701,6 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) + struct snd_soundfont *sf; + struct soundfont_sample_info sample_info; + struct snd_sf_sample *sp; +- long off; + + /* patch must be opened */ + sf = sflist->currsf; +@@ -711,12 +710,16 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) + if (is_special_type(sf->type)) + return -EINVAL; + ++ if (count < (long)sizeof(sample_info)) { ++ return -EINVAL; ++ } + if (copy_from_user(&sample_info, data, sizeof(sample_info))) + return -EFAULT; ++ data += sizeof(sample_info); ++ count -= sizeof(sample_info); + +- off = sizeof(sample_info); +- +- if (sample_info.size != (count-off)/2) ++ // SoundFont uses S16LE samples. ++ if (sample_info.size * 2 != count) + return -EINVAL; + + /* Check for dup */ +@@ -744,7 +747,7 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) + int rc; + rc = sflist->callback.sample_new + (sflist->callback.private_data, sp, sflist->memhdr, +- data + off, count - off); ++ data, count); + if (rc < 0) { + sf_sample_delete(sflist, sf, sp); + return rc; +@@ -957,10 +960,12 @@ load_guspatch(struct snd_sf_list *sflist, const char __user *data, + } + if (copy_from_user(&patch, data, sizeof(patch))) + return -EFAULT; +- + count -= sizeof(patch); + data += sizeof(patch); + ++ if ((patch.len << (patch.mode & WAVE_16_BITS ? 1 : 0)) != count) ++ return -EINVAL; ++ + sf = newsf(sflist, SNDRV_SFNT_PAT_TYPE_GUS|SNDRV_SFNT_PAT_SHARED, NULL); + if (sf == NULL) + return -ENOMEM; +diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c +index f4e517a0c7740..8251718eaf3a8 100644 +--- a/tools/testing/cxl/test/cxl.c ++++ b/tools/testing/cxl/test/cxl.c +@@ -624,11 +624,15 @@ static struct cxl_hdm *mock_cxl_setup_hdm(struct cxl_port *port, + struct cxl_endpoint_dvsec_info *info) + { + struct cxl_hdm *cxlhdm = devm_kzalloc(&port->dev, sizeof(*cxlhdm), GFP_KERNEL); ++ struct device *dev = &port->dev; + + if (!cxlhdm) + return ERR_PTR(-ENOMEM); + + cxlhdm->port = port; ++ cxlhdm->interleave_mask = ~0U; ++ cxlhdm->iw_cap_mask = ~0UL; ++ dev_set_drvdata(dev, cxlhdm); + return cxlhdm; + } + +diff --git a/tools/testing/selftests/net/mptcp/userspace_pm.sh b/tools/testing/selftests/net/mptcp/userspace_pm.sh +index 4c62114de0637..4e58291550498 100755 +--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh ++++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh +@@ -184,10 +184,12 @@ make_connection() + local is_v6=$1 + local app_port=$app4_port + local connect_addr="10.0.1.1" ++ local client_addr="10.0.1.2" + local listen_addr="0.0.0.0" + if [ "$is_v6" = "v6" ] + then + connect_addr="dead:beef:1::1" ++ client_addr="dead:beef:1::2" + listen_addr="::" + app_port=$app6_port + else +@@ -249,6 +251,7 @@ make_connection() + [ "$server_serverside" = 1 ] + then + test_pass ++ print_title "Connection info: ${client_addr}:${client_port} -> ${connect_addr}:${app_port}" + else + test_fail "Expected tokens (c:${client_token} - s:${server_token}) and server (c:${client_serverside} - s:${server_serverside})" + mptcp_lib_result_print_all_tap +@@ -369,7 +372,7 @@ test_announce() + ip netns exec "$ns2"\ + ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id $client_addr_id dev\ + ns2eth1 +- print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, reuse port" ++ print_test "ADD_ADDR id:client 10.0.2.2 (ns2) => ns1, reuse port" + sleep 0.5 + verify_announce_event $server_evts $ANNOUNCED $server4_token "10.0.2.2" $client_addr_id \ + "$client4_port" +@@ -378,7 +381,7 @@ test_announce() + :>"$server_evts" + ip netns exec "$ns2" ./pm_nl_ctl ann\ + dead:beef:2::2 token "$client6_token" id $client_addr_id dev ns2eth1 +- print_test "ADD_ADDR6 id:${client_addr_id} dead:beef:2::2 (ns2) => ns1, reuse port" ++ print_test "ADD_ADDR6 id:client dead:beef:2::2 (ns2) => ns1, reuse port" + sleep 0.5 + verify_announce_event "$server_evts" "$ANNOUNCED" "$server6_token" "dead:beef:2::2"\ + "$client_addr_id" "$client6_port" "v6" +@@ -388,7 +391,7 @@ test_announce() + client_addr_id=$((client_addr_id+1)) + ip netns exec "$ns2" ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id\ + $client_addr_id dev ns2eth1 port $new4_port +- print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, new port" ++ print_test "ADD_ADDR id:client+1 10.0.2.2 (ns2) => ns1, new port" + sleep 0.5 + verify_announce_event "$server_evts" "$ANNOUNCED" "$server4_token" "10.0.2.2"\ + "$client_addr_id" "$new4_port" +@@ -399,7 +402,7 @@ test_announce() + # ADD_ADDR from the server to client machine reusing the subflow port + ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\ + $server_addr_id dev ns1eth2 +- print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port" ++ print_test "ADD_ADDR id:server 10.0.2.1 (ns1) => ns2, reuse port" + sleep 0.5 + verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\ + "$server_addr_id" "$app4_port" +@@ -408,7 +411,7 @@ test_announce() + :>"$client_evts" + ip netns exec "$ns1" ./pm_nl_ctl ann dead:beef:2::1 token "$server6_token" id\ + $server_addr_id dev ns1eth2 +- print_test "ADD_ADDR6 id:${server_addr_id} dead:beef:2::1 (ns1) => ns2, reuse port" ++ print_test "ADD_ADDR6 id:server dead:beef:2::1 (ns1) => ns2, reuse port" + sleep 0.5 + verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "dead:beef:2::1"\ + "$server_addr_id" "$app6_port" "v6" +@@ -418,7 +421,7 @@ test_announce() + server_addr_id=$((server_addr_id+1)) + ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\ + $server_addr_id dev ns1eth2 port $new4_port +- print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, new port" ++ print_test "ADD_ADDR id:server+1 10.0.2.1 (ns1) => ns2, new port" + sleep 0.5 + verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\ + "$server_addr_id" "$new4_port" +@@ -452,7 +455,7 @@ test_remove() + local invalid_token=$(( client4_token - 1 )) + ip netns exec "$ns2" ./pm_nl_ctl rem token $invalid_token id\ + $client_addr_id > /dev/null 2>&1 +- print_test "RM_ADDR id:${client_addr_id} ns2 => ns1, invalid token" ++ print_test "RM_ADDR id:client ns2 => ns1, invalid token" + local type + type=$(mptcp_lib_evts_get_info type "$server_evts") + if [ "$type" = "" ] +@@ -466,7 +469,7 @@ test_remove() + local invalid_id=$(( client_addr_id + 1 )) + ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ + $invalid_id > /dev/null 2>&1 +- print_test "RM_ADDR id:${invalid_id} ns2 => ns1, invalid id" ++ print_test "RM_ADDR id:client+1 ns2 => ns1, invalid id" + type=$(mptcp_lib_evts_get_info type "$server_evts") + if [ "$type" = "" ] + then +@@ -479,7 +482,7 @@ test_remove() + :>"$server_evts" + ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ + $client_addr_id +- print_test "RM_ADDR id:${client_addr_id} ns2 => ns1" ++ print_test "RM_ADDR id:client ns2 => ns1" + sleep 0.5 + verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id" + +@@ -488,7 +491,7 @@ test_remove() + client_addr_id=$(( client_addr_id - 1 )) + ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ + $client_addr_id +- print_test "RM_ADDR id:${client_addr_id} ns2 => ns1" ++ print_test "RM_ADDR id:client-1 ns2 => ns1" + sleep 0.5 + verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id" + +@@ -496,7 +499,7 @@ test_remove() + :>"$server_evts" + ip netns exec "$ns2" ./pm_nl_ctl rem token "$client6_token" id\ + $client_addr_id +- print_test "RM_ADDR6 id:${client_addr_id} ns2 => ns1" ++ print_test "RM_ADDR6 id:client-1 ns2 => ns1" + sleep 0.5 + verify_remove_event "$server_evts" "$REMOVED" "$server6_token" "$client_addr_id" + +@@ -506,7 +509,7 @@ test_remove() + # RM_ADDR from the server to client machine + ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\ + $server_addr_id +- print_test "RM_ADDR id:${server_addr_id} ns1 => ns2" ++ print_test "RM_ADDR id:server ns1 => ns2" + sleep 0.5 + verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id" + +@@ -515,7 +518,7 @@ test_remove() + server_addr_id=$(( server_addr_id - 1 )) + ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\ + $server_addr_id +- print_test "RM_ADDR id:${server_addr_id} ns1 => ns2" ++ print_test "RM_ADDR id:server-1 ns1 => ns2" + sleep 0.5 + verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id" + +@@ -523,7 +526,7 @@ test_remove() + :>"$client_evts" + ip netns exec "$ns1" ./pm_nl_ctl rem token "$server6_token" id\ + $server_addr_id +- print_test "RM_ADDR6 id:${server_addr_id} ns1 => ns2" ++ print_test "RM_ADDR6 id:server-1 ns1 => ns2" + sleep 0.5 + verify_remove_event "$client_evts" "$REMOVED" "$client6_token" "$server_addr_id" + } +@@ -551,8 +554,14 @@ verify_subflow_events() + local locid + local remid + local info ++ local e_dport_txt + +- info="${e_saddr} (${e_from}) => ${e_daddr}:${e_dport} (${e_to})" ++ # only display the fixed ports ++ if [ "${e_dport}" -ge "${app4_port}" ] && [ "${e_dport}" -le "${app6_port}" ]; then ++ e_dport_txt=":${e_dport}" ++ fi ++ ++ info="${e_saddr} (${e_from}) => ${e_daddr}${e_dport_txt} (${e_to})" + + if [ "$e_type" = "$SUB_ESTABLISHED" ] + then +@@ -838,7 +847,7 @@ test_subflows_v4_v6_mix() + :>"$client_evts" + ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\ + $server_addr_id dev ns1eth2 +- print_test "ADD_ADDR4 id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port" ++ print_test "ADD_ADDR4 id:server 10.0.2.1 (ns1) => ns2, reuse port" + sleep 0.5 + verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\ + "$server_addr_id" "$app6_port" +@@ -917,12 +926,6 @@ verify_listener_events() + local saddr + local sport + +- if [ $e_type = $LISTENER_CREATED ]; then +- print_test "CREATE_LISTENER $e_saddr:$e_sport" +- elif [ $e_type = $LISTENER_CLOSED ]; then +- print_test "CLOSE_LISTENER $e_saddr:$e_sport" +- fi +- + type=$(mptcp_lib_evts_get_info type $evt $e_type) + family=$(mptcp_lib_evts_get_info family $evt $e_type) + sport=$(mptcp_lib_evts_get_info sport $evt $e_type) +@@ -954,6 +957,7 @@ test_listener() + local listener_pid=$! + + sleep 0.5 ++ print_test "CREATE_LISTENER 10.0.2.2 (client port)" + verify_listener_events $client_evts $LISTENER_CREATED $AF_INET 10.0.2.2 $client4_port + + # ADD_ADDR from client to server machine reusing the subflow port +@@ -970,12 +974,14 @@ test_listener() + mptcp_lib_kill_wait $listener_pid + + sleep 0.5 ++ print_test "CLOSE_LISTENER 10.0.2.2 (client port)" + verify_listener_events $client_evts $LISTENER_CLOSED $AF_INET 10.0.2.2 $client4_port + } + + print_title "Make connections" + make_connection + make_connection "v6" ++print_title "Will be using address IDs ${client_addr_id} (client) and ${server_addr_id} (server)" + + test_announce + test_remove |