commit: 0ed25f649e3464d2d4a156d1ec101d471e87f711 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Dec 13 12:36:47 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Dec 13 12:36:47 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0ed25f64
Linux patch 5.3.16 and add missing entries in README Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 12 + 1015_linux-5.3.16.patch | 3370 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3382 insertions(+) diff --git a/0000_README b/0000_README index 5f3156b..0825437 100644 --- a/0000_README +++ b/0000_README @@ -95,6 +95,18 @@ Patch: 1012_linux-5.3.13.patch From: http://www.kernel.org Desc: Linux 5.3.13 +Patch: 1013_linux-5.3.14.patch +From: http://www.kernel.org +Desc: Linux 5.3.14 + +Patch: 1014_linux-5.3.15.patch +From: http://www.kernel.org +Desc: Linux 5.3.15 + +Patch: 1015_linux-5.3.16.patch +From: http://www.kernel.org +Desc: Linux 5.3.16 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1015_linux-5.3.16.patch b/1015_linux-5.3.16.patch new file mode 100644 index 0000000..ad0944a --- /dev/null +++ b/1015_linux-5.3.16.patch @@ -0,0 +1,3370 @@ +diff --git a/Makefile b/Makefile +index 5a88d67e9635..ced7342b61ff 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 3 +-SUBLEVEL = 15 ++SUBLEVEL = 16 + EXTRAVERSION = + NAME = Bobtail Squid + +diff --git a/arch/arm64/boot/dts/exynos/exynos5433.dtsi b/arch/arm64/boot/dts/exynos/exynos5433.dtsi +index a76f620f7f35..a5f8752f607b 100644 +--- a/arch/arm64/boot/dts/exynos/exynos5433.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos5433.dtsi +@@ -18,8 +18,8 @@ + + / { + compatible = "samsung,exynos5433"; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <2>; + + interrupt-parent = <&gic>; + +@@ -311,7 +311,7 @@ + compatible = "simple-bus"; + #address-cells = <1>; + #size-cells = <1>; +- ranges; ++ ranges = <0x0 0x0 0x0 0x18000000>; + + chipid@10000000 { + compatible = "samsung,exynos4210-chipid"; +diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi +index bcb9d8cee267..0821489a874d 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi +@@ -12,8 +12,8 @@ + / { + compatible = "samsung,exynos7"; + interrupt-parent = <&gic>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <2>; + + aliases { + pinctrl0 = &pinctrl_alive; +@@ -98,7 +98,7 @@ + compatible = "simple-bus"; + #address-cells = <1>; + #size-cells = <1>; +- ranges; ++ ranges = <0 0 0 0x18000000>; + + chipid@10000000 { + compatible = "samsung,exynos4210-chipid"; +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +index a7dc319214a4..b0095072bc28 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +@@ -1612,7 +1612,7 @@ + regulator-name = "VDD_HDMI_5V0"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; +- gpio = <&exp1 12 GPIO_ACTIVE_LOW>; ++ gpio = <&exp1 12 GPIO_ACTIVE_HIGH>; + enable-active-high; + vin-supply = <&vdd_5v0_sys>; + }; +diff --git a/arch/mips/sgi-ip27/Kconfig b/arch/mips/sgi-ip27/Kconfig +index ef3847e7aee0..e5b6cadbec85 100644 +--- a/arch/mips/sgi-ip27/Kconfig ++++ b/arch/mips/sgi-ip27/Kconfig +@@ -38,10 +38,3 @@ config REPLICATE_KTEXT + Say Y here to enable replicating the kernel text across multiple + nodes in a NUMA cluster. This trades memory for speed. + +-config REPLICATE_EXHANDLERS +- bool "Exception handler replication support" +- depends on SGI_IP27 +- help +- Say Y here to enable replicating the kernel exception handlers +- across multiple nodes in a NUMA cluster. This trades memory for +- speed. +diff --git a/arch/mips/sgi-ip27/ip27-init.c b/arch/mips/sgi-ip27/ip27-init.c +index 066b33f50bcc..db58ebf02870 100644 +--- a/arch/mips/sgi-ip27/ip27-init.c ++++ b/arch/mips/sgi-ip27/ip27-init.c +@@ -69,23 +69,14 @@ static void per_hub_init(cnodeid_t cnode) + + hub_rtc_init(cnode); + +-#ifdef CONFIG_REPLICATE_EXHANDLERS +- /* +- * If this is not a headless node initialization, +- * copy over the caliased exception handlers. +- */ +- if (get_compact_nodeid() == cnode) { +- extern char except_vec2_generic, except_vec3_generic; +- extern void build_tlb_refill_handler(void); +- +- memcpy((void *)(CKSEG0 + 0x100), &except_vec2_generic, 0x80); +- memcpy((void *)(CKSEG0 + 0x180), &except_vec3_generic, 0x80); +- build_tlb_refill_handler(); +- memcpy((void *)(CKSEG0 + 0x100), (void *) CKSEG0, 0x80); +- memcpy((void *)(CKSEG0 + 0x180), &except_vec3_generic, 0x100); ++ if (nasid) { ++ /* copy exception handlers from first node to current node */ ++ memcpy((void *)NODE_OFFSET_TO_K0(nasid, 0), ++ (void *)CKSEG0, 0x200); + __flush_cache_all(); ++ /* switch to node local exception handlers */ ++ REMOTE_HUB_S(nasid, PI_CALIAS_SIZE, PI_CALIAS_SIZE_8K); + } +-#endif + } + + void per_cpu_init(void) +diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c +index fb077a947575..8624a885d95b 100644 +--- a/arch/mips/sgi-ip27/ip27-memory.c ++++ b/arch/mips/sgi-ip27/ip27-memory.c +@@ -332,11 +332,7 @@ static void __init mlreset(void) + * thinks it is a node 0 address. + */ + REMOTE_HUB_S(nasid, PI_REGION_PRESENT, (region_mask | 1)); +-#ifdef CONFIG_REPLICATE_EXHANDLERS +- REMOTE_HUB_S(nasid, PI_CALIAS_SIZE, PI_CALIAS_SIZE_8K); +-#else + REMOTE_HUB_S(nasid, PI_CALIAS_SIZE, PI_CALIAS_SIZE_0); +-#endif + + #ifdef LATER + /* +diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c +index a3f9c665bb5b..baa740815b3c 100644 +--- a/arch/powerpc/kvm/book3s_xive.c ++++ b/arch/powerpc/kvm/book3s_xive.c +@@ -2005,6 +2005,10 @@ static int kvmppc_xive_create(struct kvm_device *dev, u32 type) + + pr_devel("Creating xive for partition\n"); + ++ /* Already there ? */ ++ if (kvm->arch.xive) ++ return -EEXIST; ++ + xive = kvmppc_xive_get_device(kvm, type); + if (!xive) + return -ENOMEM; +@@ -2014,12 +2018,6 @@ static int kvmppc_xive_create(struct kvm_device *dev, u32 type) + xive->kvm = kvm; + mutex_init(&xive->lock); + +- /* Already there ? */ +- if (kvm->arch.xive) +- ret = -EEXIST; +- else +- kvm->arch.xive = xive; +- + /* We use the default queue size set by the host */ + xive->q_order = xive_native_default_eq_shift(); + if (xive->q_order < PAGE_SHIFT) +@@ -2039,6 +2037,7 @@ static int kvmppc_xive_create(struct kvm_device *dev, u32 type) + if (ret) + return ret; + ++ kvm->arch.xive = xive; + return 0; + } + +diff --git a/arch/powerpc/kvm/book3s_xive_native.c b/arch/powerpc/kvm/book3s_xive_native.c +index 78b906ffa0d2..5a3373e06e60 100644 +--- a/arch/powerpc/kvm/book3s_xive_native.c ++++ b/arch/powerpc/kvm/book3s_xive_native.c +@@ -50,6 +50,24 @@ static void kvmppc_xive_native_cleanup_queue(struct kvm_vcpu *vcpu, int prio) + } + } + ++static int kvmppc_xive_native_configure_queue(u32 vp_id, struct xive_q *q, ++ u8 prio, __be32 *qpage, ++ u32 order, bool can_escalate) ++{ ++ int rc; ++ __be32 *qpage_prev = q->qpage; ++ ++ rc = xive_native_configure_queue(vp_id, q, prio, qpage, order, ++ can_escalate); ++ if (rc) ++ return rc; ++ ++ if (qpage_prev) ++ put_page(virt_to_page(qpage_prev)); ++ ++ return rc; ++} ++ + void kvmppc_xive_native_cleanup_vcpu(struct kvm_vcpu *vcpu) + { + struct kvmppc_xive_vcpu *xc = vcpu->arch.xive_vcpu; +@@ -582,19 +600,14 @@ static int kvmppc_xive_native_set_queue_config(struct kvmppc_xive *xive, + q->guest_qaddr = 0; + q->guest_qshift = 0; + +- rc = xive_native_configure_queue(xc->vp_id, q, priority, +- NULL, 0, true); ++ rc = kvmppc_xive_native_configure_queue(xc->vp_id, q, priority, ++ NULL, 0, true); + if (rc) { + pr_err("Failed to reset queue %d for VCPU %d: %d\n", + priority, xc->server_num, rc); + return rc; + } + +- if (q->qpage) { +- put_page(virt_to_page(q->qpage)); +- q->qpage = NULL; +- } +- + return 0; + } + +@@ -624,12 +637,6 @@ static int kvmppc_xive_native_set_queue_config(struct kvmppc_xive *xive, + + srcu_idx = srcu_read_lock(&kvm->srcu); + gfn = gpa_to_gfn(kvm_eq.qaddr); +- page = gfn_to_page(kvm, gfn); +- if (is_error_page(page)) { +- srcu_read_unlock(&kvm->srcu, srcu_idx); +- pr_err("Couldn't get queue page %llx!\n", kvm_eq.qaddr); +- return -EINVAL; +- } + + page_size = kvm_host_page_size(kvm, gfn); + if (1ull << kvm_eq.qshift > page_size) { +@@ -638,6 +645,13 @@ static int kvmppc_xive_native_set_queue_config(struct kvmppc_xive *xive, + return -EINVAL; + } + ++ page = gfn_to_page(kvm, gfn); ++ if (is_error_page(page)) { ++ srcu_read_unlock(&kvm->srcu, srcu_idx); ++ pr_err("Couldn't get queue page %llx!\n", kvm_eq.qaddr); ++ return -EINVAL; ++ } ++ + qaddr = page_to_virt(page) + (kvm_eq.qaddr & ~PAGE_MASK); + srcu_read_unlock(&kvm->srcu, srcu_idx); + +@@ -653,8 +667,8 @@ static int kvmppc_xive_native_set_queue_config(struct kvmppc_xive *xive, + * OPAL level because the use of END ESBs is not supported by + * Linux. + */ +- rc = xive_native_configure_queue(xc->vp_id, q, priority, +- (__be32 *) qaddr, kvm_eq.qshift, true); ++ rc = kvmppc_xive_native_configure_queue(xc->vp_id, q, priority, ++ (__be32 *) qaddr, kvm_eq.qshift, true); + if (rc) { + pr_err("Failed to configure queue %d for VCPU %d: %d\n", + priority, xc->server_num, rc); +@@ -1081,7 +1095,6 @@ static int kvmppc_xive_native_create(struct kvm_device *dev, u32 type) + dev->private = xive; + xive->dev = dev; + xive->kvm = kvm; +- kvm->arch.xive = xive; + mutex_init(&xive->mapping_lock); + mutex_init(&xive->lock); + +@@ -1102,6 +1115,7 @@ static int kvmppc_xive_native_create(struct kvm_device *dev, u32 type) + if (ret) + return ret; + ++ kvm->arch.xive = xive; + return 0; + } + +diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h +index 688911051b44..f4afa301954a 100644 +--- a/arch/sparc/include/asm/io_64.h ++++ b/arch/sparc/include/asm/io_64.h +@@ -407,6 +407,7 @@ static inline void __iomem *ioremap(unsigned long offset, unsigned long size) + } + + #define ioremap_nocache(X,Y) ioremap((X),(Y)) ++#define ioremap_uc(X,Y) ioremap((X),(Y)) + #define ioremap_wc(X,Y) ioremap((X),(Y)) + #define ioremap_wt(X,Y) ioremap((X),(Y)) + +diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +index a46dee8e78db..2e3b06d6bbc6 100644 +--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c ++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +@@ -461,10 +461,8 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of, + } + + rdtgrp = rdtgroup_kn_lock_live(of->kn); +- rdt_last_cmd_clear(); + if (!rdtgrp) { + ret = -ENOENT; +- rdt_last_cmd_puts("Directory was removed\n"); + goto unlock; + } + +@@ -2648,10 +2646,8 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + int ret; + + prdtgrp = rdtgroup_kn_lock_live(prgrp_kn); +- rdt_last_cmd_clear(); + if (!prdtgrp) { + ret = -ENODEV; +- rdt_last_cmd_puts("Directory was removed\n"); + goto out_unlock; + } + +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index e7d25f436466..9d2e0a1967a1 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -497,7 +497,7 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function, + + r = -E2BIG; + +- if (*nent >= maxnent) ++ if (WARN_ON(*nent >= maxnent)) + goto out; + + do_host_cpuid(entry, function, 0); +@@ -794,6 +794,9 @@ out: + static int do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 func, + int *nent, int maxnent, unsigned int type) + { ++ if (*nent >= maxnent) ++ return -E2BIG; ++ + if (type == KVM_GET_EMULATED_CPUID) + return __do_cpuid_func_emulated(entry, func, nent, maxnent); + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index 61aa9421e27a..69c2a4fed5e1 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -2392,6 +2392,16 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, + entry_failure_code)) + return -EINVAL; + ++ /* ++ * Immediately write vmcs02.GUEST_CR3. It will be propagated to vmcs12 ++ * on nested VM-Exit, which can occur without actually running L2 and ++ * thus without hitting vmx_set_cr3(), e.g. if L1 is entering L2 with ++ * vmcs12.GUEST_ACTIVITYSTATE=HLT, in which case KVM will intercept the ++ * transition to HLT instead of running L2. ++ */ ++ if (enable_ept) ++ vmcs_writel(GUEST_CR3, vmcs12->guest_cr3); ++ + /* Late preparation of GUEST_PDPTRs now that EFER and CRs are set. */ + if (load_guest_pdptrs_vmcs12 && nested_cpu_has_ept(vmcs12) && + is_pae_paging(vcpu)) { +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 2a0e281542cc..9e4b0036141f 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -2878,6 +2878,7 @@ u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa) + void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) + { + struct kvm *kvm = vcpu->kvm; ++ bool update_guest_cr3 = true; + unsigned long guest_cr3; + u64 eptp; + +@@ -2894,15 +2895,18 @@ void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) + spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock); + } + +- if (enable_unrestricted_guest || is_paging(vcpu) || +- is_guest_mode(vcpu)) ++ /* Loading vmcs02.GUEST_CR3 is handled by nested VM-Enter. */ ++ if (is_guest_mode(vcpu)) ++ update_guest_cr3 = false; ++ else if (enable_unrestricted_guest || is_paging(vcpu)) + guest_cr3 = kvm_read_cr3(vcpu); + else + guest_cr3 = to_kvm_vmx(kvm)->ept_identity_map_addr; + ept_load_pdptrs(vcpu); + } + +- vmcs_writel(GUEST_CR3, guest_cr3); ++ if (update_guest_cr3) ++ vmcs_writel(GUEST_CR3, guest_cr3); + } + + int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index f82f766c81c8..2826f60c558d 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -300,13 +300,14 @@ int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) + struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); + int err; + +- if (((value ^ smsr->values[slot].curr) & mask) == 0) ++ value = (value & mask) | (smsr->values[slot].host & ~mask); ++ if (value == smsr->values[slot].curr) + return 0; +- smsr->values[slot].curr = value; + err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); + if (err) + return 1; + ++ smsr->values[slot].curr = value; + if (!smsr->registered) { + smsr->urn.on_user_return = kvm_on_user_return; + user_return_notifier_register(&smsr->urn); +@@ -1291,10 +1292,15 @@ static u64 kvm_get_arch_capabilities(void) + * If TSX is disabled on the system, guests are also mitigated against + * TAA and clear CPU buffer mitigation is not required for guests. + */ +- if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) && +- (data & ARCH_CAP_TSX_CTRL_MSR)) ++ if (!boot_cpu_has(X86_FEATURE_RTM)) ++ data &= ~ARCH_CAP_TAA_NO; ++ else if (!boot_cpu_has_bug(X86_BUG_TAA)) ++ data |= ARCH_CAP_TAA_NO; ++ else if (data & ARCH_CAP_TSX_CTRL_MSR) + data &= ~ARCH_CAP_MDS_NO; + ++ /* KVM does not emulate MSR_IA32_TSX_CTRL. */ ++ data &= ~ARCH_CAP_TSX_CTRL_MSR; + return data; + } + +@@ -4327,6 +4333,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp, + case KVM_SET_NESTED_STATE: { + struct kvm_nested_state __user *user_kvm_nested_state = argp; + struct kvm_nested_state kvm_state; ++ int idx; + + r = -EINVAL; + if (!kvm_x86_ops->set_nested_state) +@@ -4350,7 +4357,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, + && !(kvm_state.flags & KVM_STATE_NESTED_GUEST_MODE)) + break; + ++ idx = srcu_read_lock(&vcpu->kvm->srcu); + r = kvm_x86_ops->set_nested_state(vcpu, user_kvm_nested_state, &kvm_state); ++ srcu_read_unlock(&vcpu->kvm->srcu, idx); + break; + } + case KVM_GET_SUPPORTED_HV_CPUID: { +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 9ceacd1156db..304d31d8cbbc 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -197,7 +197,7 @@ void vmalloc_sync_all(void) + return; + + for (address = VMALLOC_START & PMD_MASK; +- address >= TASK_SIZE_MAX && address < FIXADDR_TOP; ++ address >= TASK_SIZE_MAX && address < VMALLOC_END; + address += PMD_SIZE) { + struct page *page; + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index 527e69b12002..e723559c386a 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -588,6 +588,17 @@ static void pci_fixup_amd_ehci_pme(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7808, pci_fixup_amd_ehci_pme); + ++/* ++ * Device [1022:7914] ++ * When in D0, PME# doesn't get asserted when plugging USB 2.0 device. ++ */ ++static void pci_fixup_amd_fch_xhci_pme(struct pci_dev *dev) ++{ ++ dev_info(&dev->dev, "PME# does not work under D0, disabling it\n"); ++ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7914, pci_fixup_amd_fch_xhci_pme); ++ + /* + * Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff] + * +diff --git a/block/bio.c b/block/bio.c +index 299a0e7651ec..31d56e7e2ce0 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -769,7 +769,7 @@ bool __bio_try_merge_page(struct bio *bio, struct page *page, + if (WARN_ON_ONCE(bio_flagged(bio, BIO_CLONED))) + return false; + +- if (bio->bi_vcnt > 0) { ++ if (bio->bi_vcnt > 0 && !bio_full(bio, len)) { + struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt - 1]; + + if (page_is_mergeable(bv, page, len, off, same_page)) { +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 879cf23f7489..0dceaabc6321 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1043,7 +1043,7 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err) + af_alg_free_resources(areq); + sock_put(sk); + +- iocb->ki_complete(iocb, err ? err : resultlen, 0); ++ iocb->ki_complete(iocb, err ? err : (int)resultlen, 0); + } + EXPORT_SYMBOL_GPL(af_alg_async_cb); + +diff --git a/crypto/crypto_user_base.c b/crypto/crypto_user_base.c +index c65e39005ce2..a4db71846af5 100644 +--- a/crypto/crypto_user_base.c ++++ b/crypto/crypto_user_base.c +@@ -214,8 +214,10 @@ static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, + drop_alg: + crypto_mod_put(alg); + +- if (err) ++ if (err) { ++ kfree_skb(skb); + return err; ++ } + + return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid); + } +diff --git a/crypto/crypto_user_stat.c b/crypto/crypto_user_stat.c +index a03f326a63d3..30f77cf9122d 100644 +--- a/crypto/crypto_user_stat.c ++++ b/crypto/crypto_user_stat.c +@@ -326,8 +326,10 @@ int crypto_reportstat(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, + drop_alg: + crypto_mod_put(alg); + +- if (err) ++ if (err) { ++ kfree_skb(skb); + return err; ++ } + + return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid); + } +diff --git a/crypto/ecc.c b/crypto/ecc.c +index dfe114bc0c4a..8ee787723c5c 100644 +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -1284,10 +1284,11 @@ EXPORT_SYMBOL(ecc_point_mult_shamir); + static inline void ecc_swap_digits(const u64 *in, u64 *out, + unsigned int ndigits) + { ++ const __be64 *src = (__force __be64 *)in; + int i; + + for (i = 0; i < ndigits; i++) +- out[i] = __swab64(in[ndigits - 1 - i]); ++ out[i] = be64_to_cpu(src[ndigits - 1 - i]); + } + + static int __ecc_is_key_valid(const struct ecc_curve *curve, +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 8fe99b20ca02..bb0a732cd98a 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -277,8 +277,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, + return 0; + + free_range: +- for (page_addr = end - PAGE_SIZE; page_addr >= start; +- page_addr -= PAGE_SIZE) { ++ for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) { + bool ret; + size_t index; + +@@ -291,6 +290,8 @@ free_range: + WARN_ON(!ret); + + trace_binder_free_lru_end(alloc, index); ++ if (page_addr == start) ++ break; + continue; + + err_vm_insert_page_failed: +@@ -298,7 +299,8 @@ err_vm_insert_page_failed: + page->page_ptr = NULL; + err_alloc_page_failed: + err_page_ptr_cleared: +- ; ++ if (page_addr == start) ++ break; + } + err_no_vma: + if (mm) { +@@ -681,17 +683,17 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, + struct binder_buffer *buffer; + + mutex_lock(&binder_alloc_mmap_lock); +- if (alloc->buffer) { ++ if (alloc->buffer_size) { + ret = -EBUSY; + failure_string = "already mapped"; + goto err_already_mapped; + } ++ alloc->buffer_size = min_t(unsigned long, vma->vm_end - vma->vm_start, ++ SZ_4M); ++ mutex_unlock(&binder_alloc_mmap_lock); + + alloc->buffer = (void __user *)vma->vm_start; +- mutex_unlock(&binder_alloc_mmap_lock); + +- alloc->buffer_size = min_t(unsigned long, vma->vm_end - vma->vm_start, +- SZ_4M); + alloc->pages = kcalloc(alloc->buffer_size / PAGE_SIZE, + sizeof(alloc->pages[0]), + GFP_KERNEL); +@@ -722,8 +724,9 @@ err_alloc_buf_struct_failed: + kfree(alloc->pages); + alloc->pages = NULL; + err_alloc_pages_failed: +- mutex_lock(&binder_alloc_mmap_lock); + alloc->buffer = NULL; ++ mutex_lock(&binder_alloc_mmap_lock); ++ alloc->buffer_size = 0; + err_already_mapped: + mutex_unlock(&binder_alloc_mmap_lock); + binder_alloc_debug(BINDER_DEBUG_USER_ERROR, +@@ -841,14 +844,20 @@ void binder_alloc_print_pages(struct seq_file *m, + int free = 0; + + mutex_lock(&alloc->mutex); +- for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) { +- page = &alloc->pages[i]; +- if (!page->page_ptr) +- free++; +- else if (list_empty(&page->lru)) +- active++; +- else +- lru++; ++ /* ++ * Make sure the binder_alloc is fully initialized, otherwise we might ++ * read inconsistent state. ++ */ ++ if (binder_alloc_get_vma(alloc) != NULL) { ++ for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) { ++ page = &alloc->pages[i]; ++ if (!page->page_ptr) ++ free++; ++ else if (list_empty(&page->lru)) ++ active++; ++ else ++ lru++; ++ } + } + mutex_unlock(&alloc->mutex); + seq_printf(m, " pages: %d:%d:%d\n", active, lru, free); +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index c8fb886aebd4..64e364c4a0fb 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2089,7 +2089,7 @@ static int rbd_object_map_update_finish(struct rbd_obj_request *obj_req, + struct rbd_device *rbd_dev = obj_req->img_request->rbd_dev; + struct ceph_osd_data *osd_data; + u64 objno; +- u8 state, new_state, current_state; ++ u8 state, new_state, uninitialized_var(current_state); + bool has_current_state; + void *p; + +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index 76b73ddf8fd7..10f6368117d8 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -1000,8 +1000,10 @@ static void rsxx_pci_remove(struct pci_dev *dev) + + cancel_work_sync(&card->event_work); + ++ destroy_workqueue(card->event_wq); + rsxx_destroy_dev(card); + rsxx_dma_destroy(card); ++ destroy_workqueue(card->creg_ctrl.creg_wq); + + spin_lock_irqsave(&card->irq_lock, flags); + rsxx_disable_ier_and_isr(card, CR_INTR_ALL); +diff --git a/drivers/char/lp.c b/drivers/char/lp.c +index 7c9269e3477a..bd95aba1f9fe 100644 +--- a/drivers/char/lp.c ++++ b/drivers/char/lp.c +@@ -713,6 +713,10 @@ static int lp_set_timeout64(unsigned int minor, void __user *arg) + if (copy_from_user(karg, arg, sizeof(karg))) + return -EFAULT; + ++ /* sparc64 suseconds_t is 32-bit only */ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ karg[1] >>= 32; ++ + return lp_set_timeout(minor, karg[0], karg[1]); + } + +diff --git a/drivers/cpufreq/imx-cpufreq-dt.c b/drivers/cpufreq/imx-cpufreq-dt.c +index 35db14cf3102..85a6efd6b68f 100644 +--- a/drivers/cpufreq/imx-cpufreq-dt.c ++++ b/drivers/cpufreq/imx-cpufreq-dt.c +@@ -44,19 +44,19 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev) + mkt_segment = (cell_value & OCOTP_CFG3_MKT_SEGMENT_MASK) >> OCOTP_CFG3_MKT_SEGMENT_SHIFT; + + /* +- * Early samples without fuses written report "0 0" which means +- * consumer segment and minimum speed grading. +- * +- * According to datasheet minimum speed grading is not supported for +- * consumer parts so clamp to 1 to avoid warning for "no OPPs" ++ * Early samples without fuses written report "0 0" which may NOT ++ * match any OPP defined in DT. So clamp to minimum OPP defined in ++ * DT to avoid warning for "no OPPs". + * + * Applies to i.MX8M series SoCs. + */ +- if (mkt_segment == 0 && speed_grade == 0 && ( +- of_machine_is_compatible("fsl,imx8mm") || +- of_machine_is_compatible("fsl,imx8mn") || +- of_machine_is_compatible("fsl,imx8mq"))) +- speed_grade = 1; ++ if (mkt_segment == 0 && speed_grade == 0) { ++ if (of_machine_is_compatible("fsl,imx8mm") || ++ of_machine_is_compatible("fsl,imx8mq")) ++ speed_grade = 1; ++ if (of_machine_is_compatible("fsl,imx8mn")) ++ speed_grade = 0xb; ++ } + + supported_hw[0] = BIT(speed_grade); + supported_hw[1] = BIT(mkt_segment); +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index de5e9352e920..7d6b695c4ab3 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -365,12 +365,8 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev) + dma_alloc_coherent(dev->core_dev->device, + PPC4XX_SD_BUFFER_SIZE * PPC4XX_NUM_SD, + &dev->scatter_buffer_pa, GFP_ATOMIC); +- if (!dev->scatter_buffer_va) { +- dma_free_coherent(dev->core_dev->device, +- sizeof(struct ce_sd) * PPC4XX_NUM_SD, +- dev->sdr, dev->sdr_pa); ++ if (!dev->scatter_buffer_va) + return -ENOMEM; +- } + + for (i = 0; i < PPC4XX_NUM_SD; i++) { + dev->sdr[i].ptr = dev->scatter_buffer_pa + +diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c +index 2b7af44c7b85..eb0dbdc12f47 100644 +--- a/drivers/crypto/atmel-aes.c ++++ b/drivers/crypto/atmel-aes.c +@@ -490,6 +490,29 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd) + static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err); + #endif + ++static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd) ++{ ++ struct ablkcipher_request *req = ablkcipher_request_cast(dd->areq); ++ struct atmel_aes_reqctx *rctx = ablkcipher_request_ctx(req); ++ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); ++ unsigned int ivsize = crypto_ablkcipher_ivsize(ablkcipher); ++ ++ if (req->nbytes < ivsize) ++ return; ++ ++ if (rctx->mode & AES_FLAGS_ENCRYPT) { ++ scatterwalk_map_and_copy(req->info, req->dst, ++ req->nbytes - ivsize, ivsize, 0); ++ } else { ++ if (req->src == req->dst) ++ memcpy(req->info, rctx->lastc, ivsize); ++ else ++ scatterwalk_map_and_copy(req->info, req->src, ++ req->nbytes - ivsize, ++ ivsize, 0); ++ } ++} ++ + static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err) + { + #ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC +@@ -500,26 +523,8 @@ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err) + clk_disable(dd->iclk); + dd->flags &= ~AES_FLAGS_BUSY; + +- if (!dd->ctx->is_aead) { +- struct ablkcipher_request *req = +- ablkcipher_request_cast(dd->areq); +- struct atmel_aes_reqctx *rctx = ablkcipher_request_ctx(req); +- struct crypto_ablkcipher *ablkcipher = +- crypto_ablkcipher_reqtfm(req); +- int ivsize = crypto_ablkcipher_ivsize(ablkcipher); +- +- if (rctx->mode & AES_FLAGS_ENCRYPT) { +- scatterwalk_map_and_copy(req->info, req->dst, +- req->nbytes - ivsize, ivsize, 0); +- } else { +- if (req->src == req->dst) { +- memcpy(req->info, rctx->lastc, ivsize); +- } else { +- scatterwalk_map_and_copy(req->info, req->src, +- req->nbytes - ivsize, ivsize, 0); +- } +- } +- } ++ if (!dd->ctx->is_aead) ++ atmel_aes_set_iv_as_last_ciphertext_block(dd); + + if (dd->is_async) + dd->areq->complete(dd->areq, err); +@@ -1125,10 +1130,12 @@ static int atmel_aes_crypt(struct ablkcipher_request *req, unsigned long mode) + rctx->mode = mode; + + if (!(mode & AES_FLAGS_ENCRYPT) && (req->src == req->dst)) { +- int ivsize = crypto_ablkcipher_ivsize(ablkcipher); ++ unsigned int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + +- scatterwalk_map_and_copy(rctx->lastc, req->src, +- (req->nbytes - ivsize), ivsize, 0); ++ if (req->nbytes >= ivsize) ++ scatterwalk_map_and_copy(rctx->lastc, req->src, ++ req->nbytes - ivsize, ++ ivsize, 0); + } + + return atmel_aes_handle_queue(dd, &req->base); +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 7f22a45bbc11..03817df17728 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -337,6 +337,7 @@ static struct ccp_dma_desc *ccp_alloc_dma_desc(struct ccp_dma_chan *chan, + desc->tx_desc.flags = flags; + desc->tx_desc.tx_submit = ccp_tx_submit; + desc->ccp = chan->ccp; ++ INIT_LIST_HEAD(&desc->entry); + INIT_LIST_HEAD(&desc->pending); + INIT_LIST_HEAD(&desc->active); + desc->status = DMA_IN_PROGRESS; +diff --git a/drivers/crypto/geode-aes.c b/drivers/crypto/geode-aes.c +index d81a1297cb9e..940485112d15 100644 +--- a/drivers/crypto/geode-aes.c ++++ b/drivers/crypto/geode-aes.c +@@ -10,6 +10,7 @@ + #include <linux/spinlock.h> + #include <crypto/algapi.h> + #include <crypto/aes.h> ++#include <crypto/skcipher.h> + + #include <linux/io.h> + #include <linux/delay.h> +@@ -166,13 +167,15 @@ static int geode_setkey_blk(struct crypto_tfm *tfm, const u8 *key, + /* + * The requested key size is not supported by HW, do a fallback + */ +- op->fallback.blk->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK; +- op->fallback.blk->base.crt_flags |= (tfm->crt_flags & CRYPTO_TFM_REQ_MASK); ++ crypto_sync_skcipher_clear_flags(op->fallback.blk, CRYPTO_TFM_REQ_MASK); ++ crypto_sync_skcipher_set_flags(op->fallback.blk, ++ tfm->crt_flags & CRYPTO_TFM_REQ_MASK); + +- ret = crypto_blkcipher_setkey(op->fallback.blk, key, len); ++ ret = crypto_sync_skcipher_setkey(op->fallback.blk, key, len); + if (ret) { + tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK; +- tfm->crt_flags |= (op->fallback.blk->base.crt_flags & CRYPTO_TFM_RES_MASK); ++ tfm->crt_flags |= crypto_sync_skcipher_get_flags(op->fallback.blk) & ++ CRYPTO_TFM_RES_MASK; + } + return ret; + } +@@ -181,33 +184,28 @@ static int fallback_blk_dec(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- unsigned int ret; +- struct crypto_blkcipher *tfm; + struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm); ++ SYNC_SKCIPHER_REQUEST_ON_STACK(req, op->fallback.blk); + +- tfm = desc->tfm; +- desc->tfm = op->fallback.blk; +- +- ret = crypto_blkcipher_decrypt_iv(desc, dst, src, nbytes); ++ skcipher_request_set_sync_tfm(req, op->fallback.blk); ++ skcipher_request_set_callback(req, 0, NULL, NULL); ++ skcipher_request_set_crypt(req, src, dst, nbytes, desc->info); + +- desc->tfm = tfm; +- return ret; ++ return crypto_skcipher_decrypt(req); + } ++ + static int fallback_blk_enc(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- unsigned int ret; +- struct crypto_blkcipher *tfm; + struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm); ++ SYNC_SKCIPHER_REQUEST_ON_STACK(req, op->fallback.blk); + +- tfm = desc->tfm; +- desc->tfm = op->fallback.blk; +- +- ret = crypto_blkcipher_encrypt_iv(desc, dst, src, nbytes); ++ skcipher_request_set_sync_tfm(req, op->fallback.blk); ++ skcipher_request_set_callback(req, 0, NULL, NULL); ++ skcipher_request_set_crypt(req, src, dst, nbytes, desc->info); + +- desc->tfm = tfm; +- return ret; ++ return crypto_skcipher_encrypt(req); + } + + static void +@@ -307,6 +305,9 @@ geode_cbc_decrypt(struct blkcipher_desc *desc, + struct blkcipher_walk walk; + int err, ret; + ++ if (nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + if (unlikely(op->keylen != AES_KEYSIZE_128)) + return fallback_blk_dec(desc, dst, src, nbytes); + +@@ -339,6 +340,9 @@ geode_cbc_encrypt(struct blkcipher_desc *desc, + struct blkcipher_walk walk; + int err, ret; + ++ if (nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + if (unlikely(op->keylen != AES_KEYSIZE_128)) + return fallback_blk_enc(desc, dst, src, nbytes); + +@@ -366,9 +370,8 @@ static int fallback_init_blk(struct crypto_tfm *tfm) + const char *name = crypto_tfm_alg_name(tfm); + struct geode_aes_op *op = crypto_tfm_ctx(tfm); + +- op->fallback.blk = crypto_alloc_blkcipher(name, 0, +- CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK); +- ++ op->fallback.blk = crypto_alloc_sync_skcipher(name, 0, ++ CRYPTO_ALG_NEED_FALLBACK); + if (IS_ERR(op->fallback.blk)) { + printk(KERN_ERR "Error allocating fallback algo %s\n", name); + return PTR_ERR(op->fallback.blk); +@@ -381,7 +384,7 @@ static void fallback_exit_blk(struct crypto_tfm *tfm) + { + struct geode_aes_op *op = crypto_tfm_ctx(tfm); + +- crypto_free_blkcipher(op->fallback.blk); ++ crypto_free_sync_skcipher(op->fallback.blk); + op->fallback.blk = NULL; + } + +@@ -420,6 +423,9 @@ geode_ecb_decrypt(struct blkcipher_desc *desc, + struct blkcipher_walk walk; + int err, ret; + ++ if (nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + if (unlikely(op->keylen != AES_KEYSIZE_128)) + return fallback_blk_dec(desc, dst, src, nbytes); + +@@ -450,6 +456,9 @@ geode_ecb_encrypt(struct blkcipher_desc *desc, + struct blkcipher_walk walk; + int err, ret; + ++ if (nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + if (unlikely(op->keylen != AES_KEYSIZE_128)) + return fallback_blk_enc(desc, dst, src, nbytes); + +diff --git a/drivers/crypto/geode-aes.h b/drivers/crypto/geode-aes.h +index 5c6e131a8f9d..f8a86898ac22 100644 +--- a/drivers/crypto/geode-aes.h ++++ b/drivers/crypto/geode-aes.h +@@ -60,7 +60,7 @@ struct geode_aes_op { + u8 *iv; + + union { +- struct crypto_blkcipher *blk; ++ struct crypto_sync_skcipher *blk; + struct crypto_cipher *cip; + } fallback; + u32 keylen; +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index 2059e43ccc01..1163c382d4a5 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -26,9 +26,18 @@ struct ghes_edac_pvt { + char msg[80]; + }; + +-static atomic_t ghes_init = ATOMIC_INIT(0); ++static refcount_t ghes_refcount = REFCOUNT_INIT(0); ++ ++/* ++ * Access to ghes_pvt must be protected by ghes_lock. The spinlock ++ * also provides the necessary (implicit) memory barrier for the SMP ++ * case to make the pointer visible on another CPU. ++ */ + static struct ghes_edac_pvt *ghes_pvt; + ++/* GHES registration mutex */ ++static DEFINE_MUTEX(ghes_reg_mutex); ++ + /* + * Sync with other, potentially concurrent callers of + * ghes_edac_report_mem_error(). We don't know what the +@@ -79,9 +88,8 @@ static void ghes_edac_count_dimms(const struct dmi_header *dh, void *arg) + (*num_dimm)++; + } + +-static int get_dimm_smbios_index(u16 handle) ++static int get_dimm_smbios_index(struct mem_ctl_info *mci, u16 handle) + { +- struct mem_ctl_info *mci = ghes_pvt->mci; + int i; + + for (i = 0; i < mci->tot_dimms; i++) { +@@ -198,14 +206,11 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + enum hw_event_mc_err_type type; + struct edac_raw_error_desc *e; + struct mem_ctl_info *mci; +- struct ghes_edac_pvt *pvt = ghes_pvt; ++ struct ghes_edac_pvt *pvt; + unsigned long flags; + char *p; + u8 grain_bits; + +- if (!pvt) +- return; +- + /* + * We can do the locking below because GHES defers error processing + * from NMI to IRQ context. Whenever that changes, we'd at least +@@ -216,6 +221,10 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + + spin_lock_irqsave(&ghes_lock, flags); + ++ pvt = ghes_pvt; ++ if (!pvt) ++ goto unlock; ++ + mci = pvt->mci; + e = &mci->error_desc; + +@@ -348,7 +357,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + p += sprintf(p, "DIMM DMI handle: 0x%.4x ", + mem_err->mem_dev_handle); + +- index = get_dimm_smbios_index(mem_err->mem_dev_handle); ++ index = get_dimm_smbios_index(mci, mem_err->mem_dev_handle); + if (index >= 0) { + e->top_layer = index; + e->enable_per_layer_report = true; +@@ -443,6 +452,8 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + grain_bits, e->syndrome, pvt->detail_location); + + edac_raw_mc_handle_error(type, mci, e); ++ ++unlock: + spin_unlock_irqrestore(&ghes_lock, flags); + } + +@@ -457,10 +468,12 @@ static struct acpi_platform_list plat_list[] = { + int ghes_edac_register(struct ghes *ghes, struct device *dev) + { + bool fake = false; +- int rc, num_dimm = 0; ++ int rc = 0, num_dimm = 0; + struct mem_ctl_info *mci; ++ struct ghes_edac_pvt *pvt; + struct edac_mc_layer layers[1]; + struct ghes_edac_dimm_fill dimm_fill; ++ unsigned long flags; + int idx = -1; + + if (IS_ENABLED(CONFIG_X86)) { +@@ -472,11 +485,14 @@ int ghes_edac_register(struct ghes *ghes, struct device *dev) + idx = 0; + } + ++ /* finish another registration/unregistration instance first */ ++ mutex_lock(&ghes_reg_mutex); ++ + /* + * We have only one logical memory controller to which all DIMMs belong. + */ +- if (atomic_inc_return(&ghes_init) > 1) +- return 0; ++ if (refcount_inc_not_zero(&ghes_refcount)) ++ goto unlock; + + /* Get the number of DIMMs */ + dmi_walk(ghes_edac_count_dimms, &num_dimm); +@@ -494,12 +510,13 @@ int ghes_edac_register(struct ghes *ghes, struct device *dev) + mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(struct ghes_edac_pvt)); + if (!mci) { + pr_info("Can't allocate memory for EDAC data\n"); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto unlock; + } + +- ghes_pvt = mci->pvt_info; +- ghes_pvt->ghes = ghes; +- ghes_pvt->mci = mci; ++ pvt = mci->pvt_info; ++ pvt->ghes = ghes; ++ pvt->mci = mci; + + mci->pdev = dev; + mci->mtype_cap = MEM_FLAG_EMPTY; +@@ -541,23 +558,48 @@ int ghes_edac_register(struct ghes *ghes, struct device *dev) + if (rc < 0) { + pr_info("Can't register at EDAC core\n"); + edac_mc_free(mci); +- return -ENODEV; ++ rc = -ENODEV; ++ goto unlock; + } +- return 0; ++ ++ spin_lock_irqsave(&ghes_lock, flags); ++ ghes_pvt = pvt; ++ spin_unlock_irqrestore(&ghes_lock, flags); ++ ++ /* only increment on success */ ++ refcount_inc(&ghes_refcount); ++ ++unlock: ++ mutex_unlock(&ghes_reg_mutex); ++ ++ return rc; + } + + void ghes_edac_unregister(struct ghes *ghes) + { + struct mem_ctl_info *mci; ++ unsigned long flags; + +- if (!ghes_pvt) +- return; ++ mutex_lock(&ghes_reg_mutex); + +- if (atomic_dec_return(&ghes_init)) +- return; ++ if (!refcount_dec_and_test(&ghes_refcount)) ++ goto unlock; + +- mci = ghes_pvt->mci; ++ /* ++ * Wait for the irq handler being finished. ++ */ ++ spin_lock_irqsave(&ghes_lock, flags); ++ mci = ghes_pvt ? ghes_pvt->mci : NULL; + ghes_pvt = NULL; +- edac_mc_del_mc(mci->pdev); +- edac_mc_free(mci); ++ spin_unlock_irqrestore(&ghes_lock, flags); ++ ++ if (!mci) ++ goto unlock; ++ ++ mci = edac_mc_del_mc(mci->pdev); ++ if (mci) ++ edac_mc_free(mci); ++ ++unlock: ++ mutex_unlock(&ghes_reg_mutex); + } +diff --git a/drivers/gpu/drm/drm_damage_helper.c b/drivers/gpu/drm/drm_damage_helper.c +index 8230dac01a89..3a4126dc2520 100644 +--- a/drivers/gpu/drm/drm_damage_helper.c ++++ b/drivers/gpu/drm/drm_damage_helper.c +@@ -212,8 +212,14 @@ retry: + drm_for_each_plane(plane, fb->dev) { + struct drm_plane_state *plane_state; + +- if (plane->state->fb != fb) ++ ret = drm_modeset_lock(&plane->mutex, state->acquire_ctx); ++ if (ret) ++ goto out; ++ ++ if (plane->state->fb != fb) { ++ drm_modeset_unlock(&plane->mutex); + continue; ++ } + + plane_state = drm_atomic_get_plane_state(state, plane); + if (IS_ERR(plane_state)) { +diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c +index 3b378936f575..a9b15001416a 100644 +--- a/drivers/gpu/drm/i810/i810_dma.c ++++ b/drivers/gpu/drm/i810/i810_dma.c +@@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev, + if (nbox > I810_NR_SAREA_CLIPRECTS) + nbox = I810_NR_SAREA_CLIPRECTS; + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + if (sarea_priv->dirty) +@@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in + if (u != I810_BUF_CLIENT) + DRM_DEBUG("MC found buffer that isn't mine!\n"); + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + sarea_priv->dirty = 0x7f; +diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c +index a810568c76df..1bd744231aad 100644 +--- a/drivers/gpu/drm/mcde/mcde_drv.c ++++ b/drivers/gpu/drm/mcde/mcde_drv.c +@@ -487,7 +487,8 @@ static int mcde_probe(struct platform_device *pdev) + } + if (!match) { + dev_err(dev, "no matching components\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto clk_disable; + } + if (IS_ERR(match)) { + dev_err(dev, "could not create component match\n"); +diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c +index a0a8df591e93..dd43681b8662 100644 +--- a/drivers/gpu/drm/msm/msm_debugfs.c ++++ b/drivers/gpu/drm/msm/msm_debugfs.c +@@ -42,12 +42,8 @@ static int msm_gpu_release(struct inode *inode, struct file *file) + struct msm_gpu_show_priv *show_priv = m->private; + struct msm_drm_private *priv = show_priv->dev->dev_private; + struct msm_gpu *gpu = priv->gpu; +- int ret; +- +- ret = mutex_lock_interruptible(&show_priv->dev->struct_mutex); +- if (ret) +- return ret; + ++ mutex_lock(&show_priv->dev->struct_mutex); + gpu->funcs->gpu_state_put(show_priv->state); + mutex_unlock(&show_priv->dev->struct_mutex); + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index df0cc8f46d7b..3491c4c7659e 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -486,7 +486,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon, + + WARN_ON(!tcon->quirks->has_channel_0); + +- tcon->dclk_min_div = 6; ++ tcon->dclk_min_div = 1; + tcon->dclk_max_div = 127; + sun4i_tcon0_mode_set_common(tcon, mode); + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index a0365e23678e..f5fb1e7a9c17 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -655,10 +655,13 @@ static ssize_t cyc_threshold_store(struct device *dev, + + if (kstrtoul(buf, 16, &val)) + return -EINVAL; ++ ++ /* mask off max threshold before checking min value */ ++ val &= ETM_CYC_THRESHOLD_MASK; + if (val < drvdata->ccitmin) + return -EINVAL; + +- config->ccctlr = val & ETM_CYC_THRESHOLD_MASK; ++ config->ccctlr = val; + return size; + } + static DEVICE_ATTR_RW(cyc_threshold); +@@ -689,14 +692,16 @@ static ssize_t bb_ctrl_store(struct device *dev, + return -EINVAL; + if (!drvdata->nr_addr_cmp) + return -EINVAL; ++ + /* +- * Bit[7:0] selects which address range comparator is used for +- * branch broadcast control. ++ * Bit[8] controls include(1) / exclude(0), bits[0-7] select ++ * individual range comparators. If include then at least 1 ++ * range must be selected. + */ +- if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp) ++ if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0)) + return -EINVAL; + +- config->bb_ctrl = val; ++ config->bb_ctrl = val & GENMASK(8, 0); + return size; + } + static DEVICE_ATTR_RW(bb_ctrl); +@@ -1329,8 +1334,8 @@ static ssize_t seq_event_store(struct device *dev, + + spin_lock(&drvdata->spinlock); + idx = config->seq_idx; +- /* RST, bits[7:0] */ +- config->seq_ctrl[idx] = val & 0xFF; ++ /* Seq control has two masks B[15:8] F[7:0] */ ++ config->seq_ctrl[idx] = val & 0xFFFF; + spin_unlock(&drvdata->spinlock); + return size; + } +@@ -1585,7 +1590,7 @@ static ssize_t res_ctrl_store(struct device *dev, + if (idx % 2 != 0) + /* PAIRINV, bit[21] */ + val &= ~BIT(21); +- config->res_ctrl[idx] = val; ++ config->res_ctrl[idx] = val & GENMASK(21, 0); + spin_unlock(&drvdata->spinlock); + return size; + } +diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c +index d1c48dec7118..9b2fce4906c4 100644 +--- a/drivers/i2c/i2c-core-of.c ++++ b/drivers/i2c/i2c-core-of.c +@@ -250,14 +250,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action, + } + + client = of_i2c_register_device(adap, rd->dn); +- put_device(&adap->dev); +- + if (IS_ERR(client)) { + dev_err(&adap->dev, "failed to create client for '%pOF'\n", + rd->dn); ++ put_device(&adap->dev); + of_node_clear_flag(rd->dn, OF_POPULATED); + return notifier_from_errno(PTR_ERR(client)); + } ++ put_device(&adap->dev); + break; + case OF_RECONFIG_CHANGE_REMOVE: + /* already depopulated? */ +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index f1ccb8f35fe5..e41ebc25b1f9 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -59,7 +59,7 @@ enum { + + #define HNS_ROCE_HEM_CHUNK_LEN \ + ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \ +- (sizeof(struct scatterlist))) ++ (sizeof(struct scatterlist) + sizeof(void *))) + + #define check_whether_bt_num_3(type, hop_num) \ + (type < HEM_TYPE_MTT && hop_num == 2) +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index 38bb548eaa6d..9768e377cd22 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -221,7 +221,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq, + srq->max = roundup_pow_of_two(srq_init_attr->attr.max_wr + 1); + srq->max_gs = srq_init_attr->attr.max_sge; + +- srq_desc_size = max(16, 16 * srq->max_gs); ++ srq_desc_size = roundup_pow_of_two(max(16, 16 * srq->max_gs)); + + srq->wqe_shift = ilog2(srq_desc_size); + +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index 905206a0c2d5..d4f5e8cd438d 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -301,6 +301,9 @@ static ssize_t qib_portattr_show(struct kobject *kobj, + struct qib_pportdata *ppd = + container_of(kobj, struct qib_pportdata, pport_kobj); + ++ if (!pattr->show) ++ return -EIO; ++ + return pattr->show(ppd, buf); + } + +@@ -312,6 +315,9 @@ static ssize_t qib_portattr_store(struct kobject *kobj, + struct qib_pportdata *ppd = + container_of(kobj, struct qib_pportdata, pport_kobj); + ++ if (!pattr->store) ++ return -EIO; ++ + return pattr->store(ppd, buf, len); + } + +diff --git a/drivers/input/joystick/psxpad-spi.c b/drivers/input/joystick/psxpad-spi.c +index 7eee1b0e360f..99a6052500ca 100644 +--- a/drivers/input/joystick/psxpad-spi.c ++++ b/drivers/input/joystick/psxpad-spi.c +@@ -292,7 +292,7 @@ static int psxpad_spi_probe(struct spi_device *spi) + if (!pad) + return -ENOMEM; + +- pdev = input_allocate_polled_device(); ++ pdev = devm_input_allocate_polled_device(&spi->dev); + if (!pdev) { + dev_err(&spi->dev, "failed to allocate input device\n"); + return -ENOMEM; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 46bbe99d6511..13a92e8823f1 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -172,6 +172,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN0071", /* T480 */ + "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ + "LEN0073", /* X1 Carbon G5 (Elantech) */ ++ "LEN0091", /* X1 Carbon 6 */ + "LEN0092", /* X1 Carbon 6 */ + "LEN0093", /* T480 */ + "LEN0096", /* X280 */ +diff --git a/drivers/input/rmi4/rmi_f34v7.c b/drivers/input/rmi4/rmi_f34v7.c +index a4cabf52740c..74f7c6f214ff 100644 +--- a/drivers/input/rmi4/rmi_f34v7.c ++++ b/drivers/input/rmi4/rmi_f34v7.c +@@ -1189,6 +1189,9 @@ int rmi_f34v7_do_reflash(struct f34_data *f34, const struct firmware *fw) + { + int ret; + ++ f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev, ++ f34->fn->irq_mask); ++ + rmi_f34v7_read_queries_bl_version(f34); + + f34->v7.image = fw->data; +diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c +index 2407ea43de59..b313c579914f 100644 +--- a/drivers/input/rmi4/rmi_smbus.c ++++ b/drivers/input/rmi4/rmi_smbus.c +@@ -163,7 +163,6 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr, + /* prepare to write next block of bytes */ + cur_len -= SMB_MAX_COUNT; + databuff += SMB_MAX_COUNT; +- rmiaddr += SMB_MAX_COUNT; + } + exit: + mutex_unlock(&rmi_smb->page_mutex); +@@ -215,7 +214,6 @@ static int rmi_smb_read_block(struct rmi_transport_dev *xport, u16 rmiaddr, + /* prepare to read next block of bytes */ + cur_len -= SMB_MAX_COUNT; + databuff += SMB_MAX_COUNT; +- rmiaddr += SMB_MAX_COUNT; + } + + retval = 0; +diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c +index 4b22d49a0f49..6bcffc930384 100644 +--- a/drivers/input/touchscreen/cyttsp4_core.c ++++ b/drivers/input/touchscreen/cyttsp4_core.c +@@ -1990,11 +1990,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + /* get sysinfo */ + md->si = &cd->sysinfo; +- if (!md->si) { +- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n", +- __func__, md->si); +- goto error_get_sysinfo; +- } + + rc = cyttsp4_setup_input_device(cd); + if (rc) +@@ -2004,8 +1999,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + error_init_input: + input_free_device(md->input); +-error_get_sysinfo: +- input_set_drvdata(md->input, NULL); + error_alloc_failed: + dev_err(dev, "%s failed.\n", __func__); + return rc; +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 5178ea8b5f30..b99ace9b9a0e 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -126,6 +126,15 @@ static const unsigned long goodix_irq_flags[] = { + */ + static const struct dmi_system_id rotated_screen[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ .ident = "Teclast X89", ++ .matches = { ++ /* tPAD is too generic, also match on bios date */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BOARD_NAME, "tPAD"), ++ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), ++ }, ++ }, + { + .ident = "WinBook TW100", + .matches = { +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index c3445d2cedb9..94c3f1a6fb5c 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -612,7 +612,7 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + tmp_dev = map_sector(mddev, zone, sector, §or); + break; + default: +- WARN("md/raid0:%s: Invalid layout\n", mdname(mddev)); ++ WARN(1, "md/raid0:%s: Invalid layout\n", mdname(mddev)); + bio_io_error(bio); + return true; + } +diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c +index 13da4c5c7d17..7741151606ef 100644 +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1773,6 +1773,7 @@ static int rc_prepare_rx_device(struct rc_dev *dev) + set_bit(MSC_SCAN, dev->input_dev->mscbit); + + /* Pointer/mouse events */ ++ set_bit(INPUT_PROP_POINTING_STICK, dev->input_dev->propbit); + set_bit(EV_REL, dev->input_dev->evbit); + set_bit(REL_X, dev->input_dev->relbit); + set_bit(REL_Y, dev->input_dev->relbit); +diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c +index 5d338b2ac39e..cf0769ad39cd 100644 +--- a/drivers/net/can/slcan.c ++++ b/drivers/net/can/slcan.c +@@ -613,6 +613,7 @@ err_free_chan: + sl->tty = NULL; + tty->disc_data = NULL; + clear_bit(SLF_INUSE, &sl->flags); ++ slc_free_netdev(sl->dev); + free_netdev(sl->dev); + + err_exit: +diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c +index 04aac3bb54ef..81e942f713e6 100644 +--- a/drivers/net/can/usb/ucan.c ++++ b/drivers/net/can/usb/ucan.c +@@ -792,7 +792,7 @@ resubmit: + up); + + usb_anchor_urb(urb, &up->rx_urbs); +- ret = usb_submit_urb(urb, GFP_KERNEL); ++ ret = usb_submit_urb(urb, GFP_ATOMIC); + + if (ret < 0) { + netdev_err(up->netdev, +diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c +index f1a0c4dceda0..f37c9a08c4cf 100644 +--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c ++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c +@@ -763,6 +763,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + { + struct net_device *dev; + struct ep93xx_priv *ep; ++ struct resource *mem; + + dev = platform_get_drvdata(pdev); + if (dev == NULL) +@@ -778,8 +779,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + iounmap(ep->base_addr); + + if (ep->res != NULL) { +- release_resource(ep->res); +- kfree(ep->res); ++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ release_mem_region(mem->start, resource_size(mem)); + } + + free_netdev(dev); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index bac4ce13f6ae..f5c323e79834 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -124,7 +124,7 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, + if (ret) + return ret; + +- for (i = 0; i < HNAE3_MAX_TC; i++) { ++ for (i = 0; i < hdev->tc_max; i++) { + switch (ets->tc_tsa[i]) { + case IEEE_8021QAZ_TSA_STRICT: + if (hdev->tm_info.tc_info[i].tc_sch_mode != +@@ -302,6 +302,7 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + struct hclge_vport *vport = hclge_get_vport(h); + struct hclge_dev *hdev = vport->back; + u8 i, j, pfc_map, *prio_tc; ++ int ret; + + if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE) || + hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE) +@@ -327,7 +328,21 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + + hclge_tm_pfc_info_update(hdev); + +- return hclge_pause_setup_hw(hdev, false); ++ ret = hclge_pause_setup_hw(hdev, false); ++ if (ret) ++ return ret; ++ ++ ret = hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); ++ if (ret) ++ return ret; ++ ++ ret = hclge_buffer_alloc(hdev); ++ if (ret) { ++ hclge_notify_client(hdev, HNAE3_UP_CLIENT); ++ return ret; ++ } ++ ++ return hclge_notify_client(hdev, HNAE3_UP_CLIENT); + } + + /* DCBX configuration */ +diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h +index ac9195add811..709022939822 100644 +--- a/drivers/net/ethernet/renesas/ravb.h ++++ b/drivers/net/ethernet/renesas/ravb.h +@@ -960,6 +960,8 @@ enum RAVB_QUEUE { + #define NUM_RX_QUEUE 2 + #define NUM_TX_QUEUE 2 + ++#define RX_BUF_SZ (2048 - ETH_FCS_LEN + sizeof(__sum16)) ++ + /* TX descriptors per packet */ + #define NUM_TX_DESC_GEN2 2 + #define NUM_TX_DESC_GEN3 1 +@@ -1023,7 +1025,6 @@ struct ravb_private { + u32 dirty_rx[NUM_RX_QUEUE]; /* Producer ring indices */ + u32 cur_tx[NUM_TX_QUEUE]; + u32 dirty_tx[NUM_TX_QUEUE]; +- u32 rx_buf_sz; /* Based on MTU+slack. */ + struct napi_struct napi[NUM_RX_QUEUE]; + struct work_struct work; + /* MII transceiver section. */ +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 6cacd5e893ac..393644833cd5 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -230,7 +230,7 @@ static void ravb_ring_free(struct net_device *ndev, int q) + le32_to_cpu(desc->dptr))) + dma_unmap_single(ndev->dev.parent, + le32_to_cpu(desc->dptr), +- priv->rx_buf_sz, ++ RX_BUF_SZ, + DMA_FROM_DEVICE); + } + ring_size = sizeof(struct ravb_ex_rx_desc) * +@@ -293,9 +293,9 @@ static void ravb_ring_format(struct net_device *ndev, int q) + for (i = 0; i < priv->num_rx_ring[q]; i++) { + /* RX descriptor */ + rx_desc = &priv->rx_ring[q][i]; +- rx_desc->ds_cc = cpu_to_le16(priv->rx_buf_sz); ++ rx_desc->ds_cc = cpu_to_le16(RX_BUF_SZ); + dma_addr = dma_map_single(ndev->dev.parent, priv->rx_skb[q][i]->data, +- priv->rx_buf_sz, ++ RX_BUF_SZ, + DMA_FROM_DEVICE); + /* We just set the data size to 0 for a failed mapping which + * should prevent DMA from happening... +@@ -342,9 +342,6 @@ static int ravb_ring_init(struct net_device *ndev, int q) + int ring_size; + int i; + +- priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) + +- ETH_HLEN + VLAN_HLEN + sizeof(__sum16); +- + /* Allocate RX and TX skb rings */ + priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q], + sizeof(*priv->rx_skb[q]), GFP_KERNEL); +@@ -354,7 +351,7 @@ static int ravb_ring_init(struct net_device *ndev, int q) + goto error; + + for (i = 0; i < priv->num_rx_ring[q]; i++) { +- skb = netdev_alloc_skb(ndev, priv->rx_buf_sz + RAVB_ALIGN - 1); ++ skb = netdev_alloc_skb(ndev, RX_BUF_SZ + RAVB_ALIGN - 1); + if (!skb) + goto error; + ravb_set_buffer_align(skb); +@@ -590,7 +587,7 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q) + skb = priv->rx_skb[q][entry]; + priv->rx_skb[q][entry] = NULL; + dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr), +- priv->rx_buf_sz, ++ RX_BUF_SZ, + DMA_FROM_DEVICE); + get_ts &= (q == RAVB_NC) ? + RAVB_RXTSTAMP_TYPE_V2_L2_EVENT : +@@ -623,11 +620,11 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q) + for (; priv->cur_rx[q] - priv->dirty_rx[q] > 0; priv->dirty_rx[q]++) { + entry = priv->dirty_rx[q] % priv->num_rx_ring[q]; + desc = &priv->rx_ring[q][entry]; +- desc->ds_cc = cpu_to_le16(priv->rx_buf_sz); ++ desc->ds_cc = cpu_to_le16(RX_BUF_SZ); + + if (!priv->rx_skb[q][entry]) { + skb = netdev_alloc_skb(ndev, +- priv->rx_buf_sz + ++ RX_BUF_SZ + + RAVB_ALIGN - 1); + if (!skb) + break; /* Better luck next round. */ +@@ -1814,10 +1811,15 @@ static int ravb_do_ioctl(struct net_device *ndev, struct ifreq *req, int cmd) + + static int ravb_change_mtu(struct net_device *ndev, int new_mtu) + { +- if (netif_running(ndev)) +- return -EBUSY; ++ struct ravb_private *priv = netdev_priv(ndev); + + ndev->mtu = new_mtu; ++ ++ if (netif_running(ndev)) { ++ synchronize_irq(priv->emac_irq); ++ ravb_emac_init(ndev); ++ } ++ + netdev_update_features(ndev); + + return 0; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +index 9ef6b8fe03c1..0fbf8c1d5c98 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +@@ -252,27 +252,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + struct ieee80211_hdr *hdr = (void *)skb->data; + unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room; + unsigned int mss = skb_shinfo(skb)->gso_size; +- u16 length, iv_len, amsdu_pad; ++ u16 length, amsdu_pad; + u8 *start_hdr; + struct iwl_tso_hdr_page *hdr_page; + struct page **page_ptr; + struct tso_t tso; + +- /* if the packet is protected, then it must be CCMP or GCMP */ +- iv_len = ieee80211_has_protected(hdr->frame_control) ? +- IEEE80211_CCMP_HDR_LEN : 0; +- + trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), + &dev_cmd->hdr, start_len, 0); + + ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb); + snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb); +- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len; ++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len; + amsdu_pad = 0; + + /* total amount of header we may need for this A-MSDU */ + hdr_room = DIV_ROUND_UP(total_len, mss) * +- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len; ++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)); + + /* Our device supports 9 segments at most, it will fit in 1 page */ + hdr_page = get_page_hdr(trans, hdr_room); +@@ -283,14 +279,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + start_hdr = hdr_page->pos; + page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs); + *page_ptr = hdr_page->page; +- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len); +- hdr_page->pos += iv_len; + + /* +- * Pull the ieee80211 header + IV to be able to use TSO core, ++ * Pull the ieee80211 header to be able to use TSO core, + * we will restore it for the tx_status flow. + */ +- skb_pull(skb, hdr_len + iv_len); ++ skb_pull(skb, hdr_len); + + /* + * Remove the length of all the headers that we don't actually +@@ -365,8 +359,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + } + } + +- /* re -add the WiFi header and IV */ +- skb_push(skb, hdr_len + iv_len); ++ /* re -add the WiFi header */ ++ skb_push(skb, hdr_len); + + return 0; + +diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +index 6c7f26ef6476..9cc8a335d519 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +@@ -1756,6 +1756,7 @@ static int rsi_send_beacon(struct rsi_common *common) + skb_pull(skb, (64 - dword_align_bytes)); + if (rsi_prepare_beacon(common, skb)) { + rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n"); ++ dev_kfree_skb(skb); + return -EINVAL; + } + skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb); +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 4aeb3861b409..6c468899f2ff 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -225,8 +225,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + + if (r == -EREMOTEIO) { + phy->hard_fault = r; +- skb = NULL; +- } else if (r < 0) { ++ if (info->mode == NXP_NCI_MODE_FW) ++ nxp_nci_fw_recv_frame(phy->ndev, NULL); ++ } ++ if (r < 0) { + nfc_err(&client->dev, "Read failed with error %d\n", r); + goto exit_irq_handled; + } +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index f00b367523cd..6a4540ba65ba 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1182,10 +1182,8 @@ static int atmel_spi_setup(struct spi_device *spi) + as = spi_master_get_devdata(spi->master); + + /* see notes above re chipselect */ +- if (!atmel_spi_is_v2(as) +- && spi->chip_select == 0 +- && (spi->mode & SPI_CS_HIGH)) { +- dev_dbg(&spi->dev, "setup: can't be active-high\n"); ++ if (!as->use_cs_gpios && (spi->mode & SPI_CS_HIGH)) { ++ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n"); + return -EINVAL; + } + +diff --git a/drivers/spi/spi-fsl-qspi.c b/drivers/spi/spi-fsl-qspi.c +index 448c00e4065b..609e10aa2535 100644 +--- a/drivers/spi/spi-fsl-qspi.c ++++ b/drivers/spi/spi-fsl-qspi.c +@@ -63,6 +63,11 @@ + #define QUADSPI_IPCR 0x08 + #define QUADSPI_IPCR_SEQID(x) ((x) << 24) + ++#define QUADSPI_FLSHCR 0x0c ++#define QUADSPI_FLSHCR_TCSS_MASK GENMASK(3, 0) ++#define QUADSPI_FLSHCR_TCSH_MASK GENMASK(11, 8) ++#define QUADSPI_FLSHCR_TDH_MASK GENMASK(17, 16) ++ + #define QUADSPI_BUF3CR 0x1c + #define QUADSPI_BUF3CR_ALLMST_MASK BIT(31) + #define QUADSPI_BUF3CR_ADATSZ(x) ((x) << 8) +@@ -95,6 +100,9 @@ + #define QUADSPI_FR 0x160 + #define QUADSPI_FR_TFF_MASK BIT(0) + ++#define QUADSPI_RSER 0x164 ++#define QUADSPI_RSER_TFIE BIT(0) ++ + #define QUADSPI_SPTRCLR 0x16c + #define QUADSPI_SPTRCLR_IPPTRC BIT(8) + #define QUADSPI_SPTRCLR_BFPTRC BIT(0) +@@ -112,9 +120,6 @@ + #define QUADSPI_LCKER_LOCK BIT(0) + #define QUADSPI_LCKER_UNLOCK BIT(1) + +-#define QUADSPI_RSER 0x164 +-#define QUADSPI_RSER_TFIE BIT(0) +- + #define QUADSPI_LUT_BASE 0x310 + #define QUADSPI_LUT_OFFSET (SEQID_LUT * 4 * 4) + #define QUADSPI_LUT_REG(idx) \ +@@ -181,6 +186,12 @@ + */ + #define QUADSPI_QUIRK_BASE_INTERNAL BIT(4) + ++/* ++ * Controller uses TDH bits in register QUADSPI_FLSHCR. ++ * They need to be set in accordance with the DDR/SDR mode. ++ */ ++#define QUADSPI_QUIRK_USE_TDH_SETTING BIT(5) ++ + struct fsl_qspi_devtype_data { + unsigned int rxfifo; + unsigned int txfifo; +@@ -209,7 +220,8 @@ static const struct fsl_qspi_devtype_data imx7d_data = { + .rxfifo = SZ_128, + .txfifo = SZ_512, + .ahb_buf_size = SZ_1K, +- .quirks = QUADSPI_QUIRK_TKT253890 | QUADSPI_QUIRK_4X_INT_CLK, ++ .quirks = QUADSPI_QUIRK_TKT253890 | QUADSPI_QUIRK_4X_INT_CLK | ++ QUADSPI_QUIRK_USE_TDH_SETTING, + .little_endian = true, + }; + +@@ -217,7 +229,8 @@ static const struct fsl_qspi_devtype_data imx6ul_data = { + .rxfifo = SZ_128, + .txfifo = SZ_512, + .ahb_buf_size = SZ_1K, +- .quirks = QUADSPI_QUIRK_TKT253890 | QUADSPI_QUIRK_4X_INT_CLK, ++ .quirks = QUADSPI_QUIRK_TKT253890 | QUADSPI_QUIRK_4X_INT_CLK | ++ QUADSPI_QUIRK_USE_TDH_SETTING, + .little_endian = true, + }; + +@@ -275,6 +288,11 @@ static inline int needs_amba_base_offset(struct fsl_qspi *q) + return !(q->devtype_data->quirks & QUADSPI_QUIRK_BASE_INTERNAL); + } + ++static inline int needs_tdh_setting(struct fsl_qspi *q) ++{ ++ return q->devtype_data->quirks & QUADSPI_QUIRK_USE_TDH_SETTING; ++} ++ + /* + * An IC bug makes it necessary to rearrange the 32-bit data. + * Later chips, such as IMX6SLX, have fixed this bug. +@@ -710,6 +728,16 @@ static int fsl_qspi_default_setup(struct fsl_qspi *q) + qspi_writel(q, QUADSPI_MCR_MDIS_MASK | QUADSPI_MCR_RESERVED_MASK, + base + QUADSPI_MCR); + ++ /* ++ * Previous boot stages (BootROM, bootloader) might have used DDR ++ * mode and did not clear the TDH bits. As we currently use SDR mode ++ * only, clear the TDH bits if necessary. ++ */ ++ if (needs_tdh_setting(q)) ++ qspi_writel(q, qspi_readl(q, base + QUADSPI_FLSHCR) & ++ ~QUADSPI_FLSHCR_TDH_MASK, ++ base + QUADSPI_FLSHCR); ++ + reg = qspi_readl(q, base + QUADSPI_SMPR); + qspi_writel(q, reg & ~(QUADSPI_SMPR_FSDLY_MASK + | QUADSPI_SMPR_FSPHS_MASK +diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c +index 655e4afbfb2a..c9a782010006 100644 +--- a/drivers/spi/spi-stm32-qspi.c ++++ b/drivers/spi/spi-stm32-qspi.c +@@ -528,7 +528,6 @@ static void stm32_qspi_release(struct stm32_qspi *qspi) + stm32_qspi_dma_free(qspi); + mutex_destroy(&qspi->lock); + clk_disable_unprepare(qspi->clk); +- spi_master_put(qspi->ctrl); + } + + static int stm32_qspi_probe(struct platform_device *pdev) +@@ -629,6 +628,8 @@ static int stm32_qspi_probe(struct platform_device *pdev) + + err: + stm32_qspi_release(qspi); ++ spi_master_put(qspi->ctrl); ++ + return ret; + } + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 75ac046cae52..f3b54025986f 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1710,15 +1710,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, + spi->mode |= SPI_3WIRE; + if (of_property_read_bool(nc, "spi-lsb-first")) + spi->mode |= SPI_LSB_FIRST; +- +- /* +- * For descriptors associated with the device, polarity inversion is +- * handled in the gpiolib, so all chip selects are "active high" in +- * the logical sense, the gpiolib will invert the line if need be. +- */ +- if (ctlr->use_gpio_descriptors) +- spi->mode |= SPI_CS_HIGH; +- else if (of_property_read_bool(nc, "spi-cs-high")) ++ if (of_property_read_bool(nc, "spi-cs-high")) + spi->mode |= SPI_CS_HIGH; + + /* Device DUAL/QUAD mode */ +@@ -1782,6 +1774,15 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, + } + spi->chip_select = value; + ++ /* ++ * For descriptors associated with the device, polarity inversion is ++ * handled in the gpiolib, so all gpio chip selects are "active high" ++ * in the logical sense, the gpiolib will invert the line if need be. ++ */ ++ if ((ctlr->use_gpio_descriptors) && ctlr->cs_gpiods && ++ ctlr->cs_gpiods[spi->chip_select]) ++ spi->mode |= SPI_CS_HIGH; ++ + /* Device speed */ + rc = of_property_read_u32(nc, "spi-max-frequency", &value); + if (rc) { +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index ebe15f2cf7fc..7f38ba134bb9 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -304,7 +304,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz, + &tz->poll_queue, + msecs_to_jiffies(delay)); + else +- cancel_delayed_work_sync(&tz->poll_queue); ++ cancel_delayed_work(&tz->poll_queue); + } + + static void monitor_thermal_zone(struct thermal_zone_device *tz) +@@ -1404,7 +1404,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) + + mutex_unlock(&thermal_list_lock); + +- thermal_zone_device_set_polling(tz, 0); ++ cancel_delayed_work_sync(&tz->poll_queue); + + thermal_set_governor(tz, NULL); + +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 5921a33b2a07..eba7266cef87 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -813,10 +813,8 @@ __acquires(&uap->port.lock) + if (!uap->using_tx_dma) + return; + +- /* Avoid deadlock with the DMA engine callback */ +- spin_unlock(&uap->port.lock); +- dmaengine_terminate_all(uap->dmatx.chan); +- spin_lock(&uap->port.lock); ++ dmaengine_terminate_async(uap->dmatx.chan); ++ + if (uap->dmatx.queued) { + dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, + DMA_TO_DEVICE); +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 92dad2b4ec36..2cd1a9dd8877 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -436,8 +436,8 @@ static void lpuart_dma_tx(struct lpuart_port *sport) + } + + sport->dma_tx_desc = dmaengine_prep_slave_sg(sport->dma_tx_chan, sgl, +- sport->dma_tx_nents, +- DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT); ++ ret, DMA_MEM_TO_DEV, ++ DMA_PREP_INTERRUPT); + if (!sport->dma_tx_desc) { + dma_unmap_sg(dev, sgl, sport->dma_tx_nents, DMA_TO_DEVICE); + dev_err(dev, "Cannot prepare TX slave DMA!\n"); +diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c +index ffefd218761e..31033d517e82 100644 +--- a/drivers/tty/serial/ifx6x60.c ++++ b/drivers/tty/serial/ifx6x60.c +@@ -1230,6 +1230,9 @@ static int ifx_spi_spi_remove(struct spi_device *spi) + struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi); + /* stop activity */ + tasklet_kill(&ifx_dev->io_work_tasklet); ++ ++ pm_runtime_disable(&spi->dev); ++ + /* free irq */ + free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), ifx_dev); + free_irq(gpio_to_irq(ifx_dev->gpio.srdy), ifx_dev); +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 3657a24913fc..00964b6e4ac1 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -980,6 +980,7 @@ static unsigned int msm_get_mctrl(struct uart_port *port) + static void msm_reset(struct uart_port *port) + { + struct msm_port *msm_port = UART_TO_MSM(port); ++ unsigned int mr; + + /* reset everything */ + msm_write(port, UART_CR_CMD_RESET_RX, UART_CR); +@@ -987,7 +988,10 @@ static void msm_reset(struct uart_port *port) + msm_write(port, UART_CR_CMD_RESET_ERR, UART_CR); + msm_write(port, UART_CR_CMD_RESET_BREAK_INT, UART_CR); + msm_write(port, UART_CR_CMD_RESET_CTS, UART_CR); +- msm_write(port, UART_CR_CMD_SET_RFR, UART_CR); ++ msm_write(port, UART_CR_CMD_RESET_RFR, UART_CR); ++ mr = msm_read(port, UART_MR1); ++ mr &= ~UART_MR1_RX_RDY_CTL; ++ msm_write(port, mr, UART_MR1); + + /* Disable DM modes */ + if (msm_port->is_uartdm) +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 4223cb496764..efaf6f9ca17f 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1106,7 +1106,7 @@ static int uart_break_ctl(struct tty_struct *tty, int break_state) + if (!uport) + goto out; + +- if (uport->type != PORT_UNKNOWN) ++ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl) + uport->ops->break_ctl(uport, break_state); + ret = 0; + out: +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 24a2261f879a..0b97268b0055 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -239,8 +239,8 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded) + * cleared by the sequence [read SR - read DR]. + */ + if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG) +- stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF | +- USART_ICR_PECF | USART_ICR_FECF); ++ writel_relaxed(sr & USART_SR_ERR_MASK, ++ port->membase + ofs->icr); + + c = stm32_get_char(port, &sr, &stm32_port->last_res); + port->icount.rx++; +@@ -434,7 +434,7 @@ static void stm32_transmit_chars(struct uart_port *port) + if (ofs->icr == UNDEF_REG) + stm32_clr_bits(port, ofs->isr, USART_SR_TC); + else +- stm32_set_bits(port, ofs->icr, USART_ICR_TCCF); ++ writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr); + + if (stm32_port->tx_ch) + stm32_transmit_chars_dma(port); +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index 515fc095e3b4..15d33fa0c925 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1491,7 +1491,7 @@ static void kbd_event(struct input_handle *handle, unsigned int event_type, + + if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev)) + kbd_rawcode(value); +- if (event_type == EV_KEY) ++ if (event_type == EV_KEY && event_code <= KEY_MAX) + kbd_keycode(event_code, value, HW_RAW(handle->dev)); + + spin_unlock(&kbd_event_lock); +diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c +index 1f042346e722..778f83ea2249 100644 +--- a/drivers/tty/vt/vc_screen.c ++++ b/drivers/tty/vt/vc_screen.c +@@ -456,6 +456,9 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) + size_t ret; + char *con_buf; + ++ if (use_unicode(inode)) ++ return -EOPNOTSUPP; ++ + con_buf = (char *) __get_free_page(GFP_KERNEL); + if (!con_buf) + return -ENOMEM; +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 65f634ec7fc2..bb1e2e1d0076 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1239,8 +1239,10 @@ int gserial_alloc_line(unsigned char *line_num) + __func__, port_num, PTR_ERR(tty_dev)); + + ret = PTR_ERR(tty_dev); ++ mutex_lock(&ports[port_num].lock); + port = ports[port_num].port; + ports[port_num].port = NULL; ++ mutex_unlock(&ports[port_num].lock); + gserial_free_port(port); + goto err; + } +diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c +index 5b64bc2e8788..c59e981841e1 100644 +--- a/drivers/watchdog/aspeed_wdt.c ++++ b/drivers/watchdog/aspeed_wdt.c +@@ -202,11 +202,6 @@ static int aspeed_wdt_probe(struct platform_device *pdev) + if (IS_ERR(wdt->base)) + return PTR_ERR(wdt->base); + +- /* +- * The ast2400 wdt can run at PCLK, or 1MHz. The ast2500 only +- * runs at 1MHz. We chose to always run at 1MHz, as there's no +- * good reason to have a faster watchdog counter. +- */ + wdt->wdd.info = &aspeed_wdt_info; + wdt->wdd.ops = &aspeed_wdt_ops; + wdt->wdd.max_hw_heartbeat_ms = WDT_MAX_TIMEOUT_MS; +@@ -222,7 +217,16 @@ static int aspeed_wdt_probe(struct platform_device *pdev) + return -EINVAL; + config = ofdid->data; + +- wdt->ctrl = WDT_CTRL_1MHZ_CLK; ++ /* ++ * On clock rates: ++ * - ast2400 wdt can run at PCLK, or 1MHz ++ * - ast2500 only runs at 1MHz, hard coding bit 4 to 1 ++ * - ast2600 always runs at 1MHz ++ * ++ * Set the ast2400 to run at 1MHz as it simplifies the driver. ++ */ ++ if (of_device_is_compatible(np, "aspeed,ast2400-wdt")) ++ wdt->ctrl = WDT_CTRL_1MHZ_CLK; + + /* + * Control reset on a per-device basis to ensure the +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 139b4e3cc946..f4fdf3eaa570 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -803,7 +803,12 @@ success: + continue; + + if (cookie->inodes[i]) { +- afs_vnode_commit_status(&fc, AFS_FS_I(cookie->inodes[i]), ++ struct afs_vnode *iv = AFS_FS_I(cookie->inodes[i]); ++ ++ if (test_bit(AFS_VNODE_UNSET, &iv->flags)) ++ continue; ++ ++ afs_vnode_commit_status(&fc, iv, + scb->cb_break, NULL, scb); + continue; + } +diff --git a/fs/aio.c b/fs/aio.c +index 01e0fb9ae45a..0d9a559d488c 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -2179,7 +2179,7 @@ SYSCALL_DEFINE5(io_getevents_time32, __u32, ctx_id, + #ifdef CONFIG_COMPAT + + struct __compat_aio_sigset { +- compat_sigset_t __user *sigmask; ++ compat_uptr_t sigmask; + compat_size_t sigsetsize; + }; + +@@ -2193,7 +2193,7 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents, + struct old_timespec32 __user *, timeout, + const struct __compat_aio_sigset __user *, usig) + { +- struct __compat_aio_sigset ksig = { NULL, }; ++ struct __compat_aio_sigset ksig = { 0, }; + struct timespec64 t; + bool interrupted; + int ret; +@@ -2204,7 +2204,7 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents, + if (usig && copy_from_user(&ksig, usig, sizeof(ksig))) + return -EFAULT; + +- ret = set_compat_user_sigmask(ksig.sigmask, ksig.sigsetsize); ++ ret = set_compat_user_sigmask(compat_ptr(ksig.sigmask), ksig.sigsetsize); + if (ret) + return ret; + +@@ -2228,7 +2228,7 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents_time64, + struct __kernel_timespec __user *, timeout, + const struct __compat_aio_sigset __user *, usig) + { +- struct __compat_aio_sigset ksig = { NULL, }; ++ struct __compat_aio_sigset ksig = { 0, }; + struct timespec64 t; + bool interrupted; + int ret; +@@ -2239,7 +2239,7 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents_time64, + if (usig && copy_from_user(&ksig, usig, sizeof(ksig))) + return -EFAULT; + +- ret = set_compat_user_sigmask(ksig.sigmask, ksig.sigsetsize); ++ ret = set_compat_user_sigmask(compat_ptr(ksig.sigmask), ksig.sigsetsize); + if (ret) + return ret; + +diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c +index cdff0567aacb..2d01553a6d58 100644 +--- a/fs/autofs/expire.c ++++ b/fs/autofs/expire.c +@@ -498,9 +498,10 @@ static struct dentry *autofs_expire_indirect(struct super_block *sb, + */ + how &= ~AUTOFS_EXP_LEAVES; + found = should_expire(expired, mnt, timeout, how); +- if (!found || found != expired) +- /* Something has changed, continue */ ++ if (found != expired) { // something has changed, continue ++ dput(found); + goto next; ++ } + + if (expired != dentry) + dput(dentry); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index facb52d37d19..c9abc789c6b5 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -313,9 +313,6 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + INIT_LIST_HEAD(&fdlocks->locks); + fdlocks->cfile = cfile; + cfile->llist = fdlocks; +- cifs_down_write(&cinode->lock_sem); +- list_add(&fdlocks->llist, &cinode->llist); +- up_write(&cinode->lock_sem); + + cfile->count = 1; + cfile->pid = current->tgid; +@@ -339,6 +336,10 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + oplock = 0; + } + ++ cifs_down_write(&cinode->lock_sem); ++ list_add(&fdlocks->llist, &cinode->llist); ++ up_write(&cinode->lock_sem); ++ + spin_lock(&tcon->open_file_lock); + if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock) + oplock = fid->pending_open->oplock; +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index e311f58dc1c8..449d1584ff72 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -673,10 +673,10 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + spin_lock(&cifs_tcp_ses_lock); + list_for_each(tmp, &server->smb_ses_list) { + ses = list_entry(tmp, struct cifs_ses, smb_ses_list); ++ + list_for_each(tmp1, &ses->tcon_list) { + tcon = list_entry(tmp1, struct cifs_tcon, tcon_list); + +- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks); + spin_lock(&tcon->open_file_lock); + list_for_each(tmp2, &tcon->openFileList) { + cfile = list_entry(tmp2, struct cifsFileInfo, +@@ -688,6 +688,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + continue; + + cifs_dbg(FYI, "file id match, oplock break\n"); ++ cifs_stats_inc( ++ &tcon->stats.cifs_stats.num_oplock_brks); + cinode = CIFS_I(d_inode(cfile->dentry)); + spin_lock(&cfile->file_info_lock); + if (!CIFS_CACHE_WRITE(cinode) && +@@ -720,9 +722,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + return true; + } + spin_unlock(&tcon->open_file_lock); +- spin_unlock(&cifs_tcp_ses_lock); +- cifs_dbg(FYI, "No matching file for oplock break\n"); +- return true; + } + } + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c +index 0c7ea4596202..e23752d9a79f 100644 +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -128,13 +128,20 @@ static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry, + struct inode *inode) + { + struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); +- struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir); + struct dentry *lower_dir_dentry; ++ struct inode *lower_dir_inode; + int rc; + +- dget(lower_dentry); +- lower_dir_dentry = lock_parent(lower_dentry); +- rc = vfs_unlink(lower_dir_inode, lower_dentry, NULL); ++ lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent); ++ lower_dir_inode = d_inode(lower_dir_dentry); ++ inode_lock_nested(lower_dir_inode, I_MUTEX_PARENT); ++ dget(lower_dentry); // don't even try to make the lower negative ++ if (lower_dentry->d_parent != lower_dir_dentry) ++ rc = -EINVAL; ++ else if (d_unhashed(lower_dentry)) ++ rc = -EINVAL; ++ else ++ rc = vfs_unlink(lower_dir_inode, lower_dentry, NULL); + if (rc) { + printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc); + goto out_unlock; +@@ -142,10 +149,11 @@ static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry, + fsstack_copy_attr_times(dir, lower_dir_inode); + set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink); + inode->i_ctime = dir->i_ctime; +- d_drop(dentry); + out_unlock: +- unlock_dir(lower_dir_dentry); + dput(lower_dentry); ++ inode_unlock(lower_dir_inode); ++ if (!rc) ++ d_drop(dentry); + return rc; + } + +@@ -519,22 +527,30 @@ static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry) + { + struct dentry *lower_dentry; + struct dentry *lower_dir_dentry; ++ struct inode *lower_dir_inode; + int rc; + + lower_dentry = ecryptfs_dentry_to_lower(dentry); +- dget(dentry); +- lower_dir_dentry = lock_parent(lower_dentry); +- dget(lower_dentry); +- rc = vfs_rmdir(d_inode(lower_dir_dentry), lower_dentry); +- dput(lower_dentry); +- if (!rc && d_really_is_positive(dentry)) ++ lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent); ++ lower_dir_inode = d_inode(lower_dir_dentry); ++ ++ inode_lock_nested(lower_dir_inode, I_MUTEX_PARENT); ++ dget(lower_dentry); // don't even try to make the lower negative ++ if (lower_dentry->d_parent != lower_dir_dentry) ++ rc = -EINVAL; ++ else if (d_unhashed(lower_dentry)) ++ rc = -EINVAL; ++ else ++ rc = vfs_rmdir(lower_dir_inode, lower_dentry); ++ if (!rc) { + clear_nlink(d_inode(dentry)); +- fsstack_copy_attr_times(dir, d_inode(lower_dir_dentry)); +- set_nlink(dir, d_inode(lower_dir_dentry)->i_nlink); +- unlock_dir(lower_dir_dentry); ++ fsstack_copy_attr_times(dir, lower_dir_inode); ++ set_nlink(dir, lower_dir_inode->i_nlink); ++ } ++ dput(lower_dentry); ++ inode_unlock(lower_dir_inode); + if (!rc) + d_drop(dentry); +- dput(dentry); + return rc; + } + +@@ -572,20 +588,22 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry, + struct dentry *lower_new_dentry; + struct dentry *lower_old_dir_dentry; + struct dentry *lower_new_dir_dentry; +- struct dentry *trap = NULL; ++ struct dentry *trap; + struct inode *target_inode; + + if (flags) + return -EINVAL; + ++ lower_old_dir_dentry = ecryptfs_dentry_to_lower(old_dentry->d_parent); ++ lower_new_dir_dentry = ecryptfs_dentry_to_lower(new_dentry->d_parent); ++ + lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); + lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); +- dget(lower_old_dentry); +- dget(lower_new_dentry); +- lower_old_dir_dentry = dget_parent(lower_old_dentry); +- lower_new_dir_dentry = dget_parent(lower_new_dentry); ++ + target_inode = d_inode(new_dentry); ++ + trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry); ++ dget(lower_new_dentry); + rc = -EINVAL; + if (lower_old_dentry->d_parent != lower_old_dir_dentry) + goto out_lock; +@@ -613,11 +631,8 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry, + if (new_dir != old_dir) + fsstack_copy_attr_all(old_dir, d_inode(lower_old_dir_dentry)); + out_lock: +- unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry); +- dput(lower_new_dir_dentry); +- dput(lower_old_dir_dentry); + dput(lower_new_dentry); +- dput(lower_old_dentry); ++ unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry); + return rc; + } + +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c +index f0e549783caf..ba6de72a3e34 100644 +--- a/fs/exportfs/expfs.c ++++ b/fs/exportfs/expfs.c +@@ -519,26 +519,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid, + * inode is actually connected to the parent. + */ + err = exportfs_get_name(mnt, target_dir, nbuf, result); +- if (!err) { +- inode_lock(target_dir->d_inode); +- nresult = lookup_one_len(nbuf, target_dir, +- strlen(nbuf)); +- inode_unlock(target_dir->d_inode); +- if (!IS_ERR(nresult)) { +- if (nresult->d_inode) { +- dput(result); +- result = nresult; +- } else +- dput(nresult); +- } ++ if (err) { ++ dput(target_dir); ++ goto err_result; + } + ++ inode_lock(target_dir->d_inode); ++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf)); ++ if (!IS_ERR(nresult)) { ++ if (unlikely(nresult->d_inode != result->d_inode)) { ++ dput(nresult); ++ nresult = ERR_PTR(-ESTALE); ++ } ++ } ++ inode_unlock(target_dir->d_inode); + /* + * At this point we are done with the parent, but it's pinned + * by the child dentry anyway. + */ + dput(target_dir); + ++ if (IS_ERR(nresult)) { ++ err = PTR_ERR(nresult); ++ goto err_result; ++ } ++ dput(result); ++ result = nresult; ++ + /* + * And finally make sure the dentry is actually acceptable + * to NFSD. +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index 0c4b6a41e385..2d417bf778ef 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -214,7 +214,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) + kfree(forget); + if (ret == -ENOMEM) + goto out; +- if (ret || (outarg.attr.mode ^ inode->i_mode) & S_IFMT) ++ if (ret || fuse_invalid_attr(&outarg.attr) || ++ (outarg.attr.mode ^ inode->i_mode) & S_IFMT) + goto invalid; + + forget_all_cached_acls(inode); +@@ -272,6 +273,12 @@ int fuse_valid_type(int m) + S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m); + } + ++bool fuse_invalid_attr(struct fuse_attr *attr) ++{ ++ return !fuse_valid_type(attr->mode) || ++ attr->size > LLONG_MAX; ++} ++ + int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name, + struct fuse_entry_out *outarg, struct inode **inode) + { +@@ -303,7 +310,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name + err = -EIO; + if (!outarg->nodeid) + goto out_put_forget; +- if (!fuse_valid_type(outarg->attr.mode)) ++ if (fuse_invalid_attr(&outarg->attr)) + goto out_put_forget; + + *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, +@@ -427,7 +434,8 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, + goto out_free_ff; + + err = -EIO; +- if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid)) ++ if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) || ++ fuse_invalid_attr(&outentry.attr)) + goto out_free_ff; + + ff->fh = outopen.fh; +@@ -535,7 +543,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args, + goto out_put_forget_req; + + err = -EIO; +- if (invalid_nodeid(outarg.nodeid)) ++ if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr)) + goto out_put_forget_req; + + if ((outarg.attr.mode ^ mode) & S_IFMT) +@@ -814,7 +822,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir, + + spin_lock(&fi->lock); + fi->attr_version = atomic64_inc_return(&fc->attr_version); +- inc_nlink(inode); ++ if (likely(inode->i_nlink < UINT_MAX)) ++ inc_nlink(inode); + spin_unlock(&fi->lock); + fuse_invalidate_attr(inode); + fuse_update_ctime(inode); +@@ -894,7 +903,8 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, + args.out.args[0].value = &outarg; + err = fuse_simple_request(fc, &args); + if (!err) { +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + } else { +@@ -1517,7 +1527,8 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, + goto error; + } + +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + goto error; +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index 89bdc41e0d86..28ba17462325 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -1008,6 +1008,8 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc); + */ + int fuse_valid_type(int m); + ++bool fuse_invalid_attr(struct fuse_attr *attr); ++ + /** + * Is current process allowed to perform filesystem operation? + */ +diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c +index b2da3de6a78e..656afd035e21 100644 +--- a/fs/fuse/readdir.c ++++ b/fs/fuse/readdir.c +@@ -184,7 +184,7 @@ static int fuse_direntplus_link(struct file *file, + + if (invalid_nodeid(o->nodeid)) + return -EIO; +- if (!fuse_valid_type(o->attr.mode)) ++ if (fuse_invalid_attr(&o->attr)) + return -EIO; + + fc = get_fuse_conn(dir); +diff --git a/fs/io_uring.c b/fs/io_uring.c +index f563a581b924..7a83ecab9f4a 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -1535,6 +1535,8 @@ static int io_send_recvmsg(struct io_kiocb *req, const struct io_uring_sqe *sqe, + ret = fn(sock, msg, flags); + if (force_nonblock && ret == -EAGAIN) + return ret; ++ if (ret == -ERESTARTSYS) ++ ret = -EINTR; + } + + io_cqring_add_event(req->ctx, sqe->user_data, ret); +@@ -1785,7 +1787,7 @@ static int io_poll_add(struct io_kiocb *req, const struct io_uring_sqe *sqe) + } + + static int io_req_defer(struct io_ring_ctx *ctx, struct io_kiocb *req, +- const struct io_uring_sqe *sqe) ++ struct sqe_submit *s) + { + struct io_uring_sqe *sqe_copy; + +@@ -1803,7 +1805,8 @@ static int io_req_defer(struct io_ring_ctx *ctx, struct io_kiocb *req, + return 0; + } + +- memcpy(sqe_copy, sqe, sizeof(*sqe_copy)); ++ memcpy(&req->submit, s, sizeof(*s)); ++ memcpy(sqe_copy, s->sqe, sizeof(*sqe_copy)); + req->submit.sqe = sqe_copy; + + INIT_WORK(&req->work, io_sq_wq_submit_work); +@@ -2112,7 +2115,7 @@ static int io_queue_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req, + { + int ret; + +- ret = io_req_defer(ctx, req, s->sqe); ++ ret = io_req_defer(ctx, req, s); + if (ret) { + if (ret != -EIOCBQUEUED) { + io_free_req(req); +diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c +index 10517cea9682..23b8059812c0 100644 +--- a/fs/iomap/direct-io.c ++++ b/fs/iomap/direct-io.c +@@ -501,8 +501,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + } + pos += ret; + +- if (iov_iter_rw(iter) == READ && pos >= dio->i_size) ++ if (iov_iter_rw(iter) == READ && pos >= dio->i_size) { ++ /* ++ * We only report that we've read data up to i_size. ++ * Revert iter to a state corresponding to that as ++ * some callers (such as splice code) rely on it. ++ */ ++ iov_iter_revert(iter, pos - dio->i_size); + break; ++ } + } while ((count = iov_iter_count(iter)) > 0); + blk_finish_plug(&plug); + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index a387534c9577..a5a65de50318 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -621,7 +621,6 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + { + struct kernfs_node *kn; + u32 gen; +- int cursor; + int ret; + + name = kstrdup_const(name, GFP_KERNEL); +@@ -634,11 +633,11 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + + idr_preload(GFP_KERNEL); + spin_lock(&kernfs_idr_lock); +- cursor = idr_get_cursor(&root->ino_idr); + ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC); +- if (ret >= 0 && ret < cursor) ++ if (ret >= 0 && ret < root->last_ino) + root->next_generation++; + gen = root->next_generation; ++ root->last_ino = ret; + spin_unlock(&kernfs_idr_lock); + idr_preload_end(); + if (ret < 0) +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 8beda999e134..c187d892e656 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1083,7 +1083,8 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + goto out; + + status = nfsd4_clone_file_range(src, clone->cl_src_pos, +- dst, clone->cl_dst_pos, clone->cl_count); ++ dst, clone->cl_dst_pos, clone->cl_count, ++ EX_ISSYNC(cstate->current_fh.fh_export)); + + fput(dst); + fput(src); +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 18d94ea984ba..7f938bcb927d 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -94,12 +94,11 @@ static const struct svc_version *nfsd_acl_version[] = { + + #define NFSD_ACL_MINVERS 2 + #define NFSD_ACL_NRVERS ARRAY_SIZE(nfsd_acl_version) +-static const struct svc_version *nfsd_acl_versions[NFSD_ACL_NRVERS]; + + static struct svc_program nfsd_acl_program = { + .pg_prog = NFS_ACL_PROGRAM, + .pg_nvers = NFSD_ACL_NRVERS, +- .pg_vers = nfsd_acl_versions, ++ .pg_vers = nfsd_acl_version, + .pg_name = "nfsacl", + .pg_class = "nfsd", + .pg_stats = &nfsd_acl_svcstats, +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index c85783e536d5..18ffb590f008 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -552,7 +552,7 @@ __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp, + #endif + + __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst, +- u64 dst_pos, u64 count) ++ u64 dst_pos, u64 count, bool sync) + { + loff_t cloned; + +@@ -561,6 +561,12 @@ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst, + return nfserrno(cloned); + if (count && cloned != count) + return nfserrno(-EINVAL); ++ if (sync) { ++ loff_t dst_end = count ? dst_pos + count - 1 : LLONG_MAX; ++ int status = vfs_fsync_range(dst, dst_pos, dst_end, 0); ++ if (status < 0) ++ return nfserrno(status); ++ } + return 0; + } + +diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h +index db351247892d..02b0a140af8c 100644 +--- a/fs/nfsd/vfs.h ++++ b/fs/nfsd/vfs.h +@@ -58,7 +58,7 @@ __be32 nfsd4_set_nfs4_label(struct svc_rqst *, struct svc_fh *, + __be32 nfsd4_vfs_fallocate(struct svc_rqst *, struct svc_fh *, + struct file *, loff_t, loff_t, int); + __be32 nfsd4_clone_file_range(struct file *, u64, struct file *, +- u64, u64); ++ u64, u64, bool); + #endif /* CONFIG_NFSD_V4 */ + __be32 nfsd_create_locked(struct svc_rqst *, struct svc_fh *, + char *name, int len, struct iattr *attrs, +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index df03825ad1a1..b20ef2c0812d 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1584,7 +1584,7 @@ static inline int jbd2_space_needed(journal_t *journal) + static inline unsigned long jbd2_log_space_left(journal_t *journal) + { + /* Allow for rounding errors */ +- unsigned long free = journal->j_free - 32; ++ long free = journal->j_free - 32; + + if (journal->j_committing_transaction) { + unsigned long committing = atomic_read(&journal-> +@@ -1593,7 +1593,7 @@ static inline unsigned long jbd2_log_space_left(journal_t *journal) + /* Transaction + control blocks */ + free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT); + } +- return free; ++ return max_t(long, free, 0); + } + + /* +diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h +index 936b61bd504e..f797ccc650e7 100644 +--- a/include/linux/kernfs.h ++++ b/include/linux/kernfs.h +@@ -187,6 +187,7 @@ struct kernfs_root { + + /* private fields, do not use outside kernfs proper */ + struct idr ino_idr; ++ u32 last_ino; + u32 next_generation; + struct kernfs_syscall_ops *syscall_ops; + +diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h +index 612a17e375d0..3f0330a505b3 100644 +--- a/include/sound/hdaudio.h ++++ b/include/sound/hdaudio.h +@@ -504,6 +504,7 @@ struct hdac_stream { + bool prepared:1; + bool no_period_wakeup:1; + bool locked:1; ++ bool stripe:1; /* apply stripe control */ + + /* timestamp */ + unsigned long start_wallclk; /* start + minimum wallclk */ +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index 1f31c2f1e6fc..4508d5e0cf69 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -351,12 +351,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent) + struct dentry *d = kern_path_locked(watch->path, parent); + if (IS_ERR(d)) + return PTR_ERR(d); +- inode_unlock(d_backing_inode(parent->dentry)); + if (d_is_positive(d)) { + /* update watch filter fields */ + watch->dev = d->d_sb->s_dev; + watch->ino = d_backing_inode(d)->i_ino; + } ++ inode_unlock(d_backing_inode(parent->dentry)); + dput(d); + return 0; + } +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 8be1da1ebd9a..f23862fa1514 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -2119,11 +2119,12 @@ int cgroup_do_get_tree(struct fs_context *fc) + + nsdentry = kernfs_node_dentry(cgrp->kn, sb); + dput(fc->root); +- fc->root = nsdentry; + if (IS_ERR(nsdentry)) { +- ret = PTR_ERR(nsdentry); + deactivate_locked_super(sb); ++ ret = PTR_ERR(nsdentry); ++ nsdentry = NULL; + } ++ fc->root = nsdentry; + } + + if (!ctx->kfc.new_sb_created) +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 53173883513c..25942e43b8d4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -11719,7 +11719,7 @@ inherit_event(struct perf_event *parent_event, + GFP_KERNEL); + if (!child_ctx->task_ctx_data) { + free_event(child_event); +- return NULL; ++ return ERR_PTR(-ENOMEM); + } + } + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index fffe790d98bb..9a839798851c 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5874,10 +5874,11 @@ void init_idle(struct task_struct *idle, int cpu) + struct rq *rq = cpu_rq(cpu); + unsigned long flags; + ++ __sched_fork(0, idle); ++ + raw_spin_lock_irqsave(&idle->pi_lock, flags); + raw_spin_lock(&rq->lock); + +- __sched_fork(0, idle); + idle->state = TASK_RUNNING; + idle->se.exec_start = sched_clock(); + idle->flags |= PF_IDLE; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 649c6b60929e..ba7cc68a3993 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7530,6 +7530,19 @@ static void update_blocked_averages(int cpu) + rq_lock_irqsave(rq, &rf); + update_rq_clock(rq); + ++ /* ++ * update_cfs_rq_load_avg() can call cpufreq_update_util(). Make sure ++ * that RT, DL and IRQ signals have been updated before updating CFS. ++ */ ++ curr_class = rq->curr->sched_class; ++ update_rt_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &rt_sched_class); ++ update_dl_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &dl_sched_class); ++ update_irq_load_avg(rq, 0); ++ ++ /* Don't need periodic decay once load/util_avg are null */ ++ if (others_have_blocked(rq)) ++ done = false; ++ + /* + * Iterates the task_group tree in a bottom up fashion, see + * list_add_leaf_cfs_rq() for details. +@@ -7557,14 +7570,6 @@ static void update_blocked_averages(int cpu) + done = false; + } + +- curr_class = rq->curr->sched_class; +- update_rt_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &rt_sched_class); +- update_dl_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &dl_sched_class); +- update_irq_load_avg(rq, 0); +- /* Don't need periodic decay once load/util_avg are null */ +- if (others_have_blocked(rq)) +- done = false; +- + update_blocked_load_status(rq, !done); + rq_unlock_irqrestore(rq, &rf); + } +@@ -7625,12 +7630,18 @@ static inline void update_blocked_averages(int cpu) + + rq_lock_irqsave(rq, &rf); + update_rq_clock(rq); +- update_cfs_rq_load_avg(cfs_rq_clock_pelt(cfs_rq), cfs_rq); + ++ /* ++ * update_cfs_rq_load_avg() can call cpufreq_update_util(). Make sure ++ * that RT, DL and IRQ signals have been updated before updating CFS. ++ */ + curr_class = rq->curr->sched_class; + update_rt_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &rt_sched_class); + update_dl_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &dl_sched_class); + update_irq_load_avg(rq, 0); ++ ++ update_cfs_rq_load_avg(cfs_rq_clock_pelt(cfs_rq), cfs_rq); ++ + update_blocked_load_status(rq, cfs_rq_has_blocked(cfs_rq) || others_have_blocked(rq)); + rq_unlock_irqrestore(rq, &rf); + } +diff --git a/kernel/time/time.c b/kernel/time/time.c +index 5c54ca632d08..83f403e7a15c 100644 +--- a/kernel/time/time.c ++++ b/kernel/time/time.c +@@ -881,7 +881,8 @@ int get_timespec64(struct timespec64 *ts, + ts->tv_sec = kts.tv_sec; + + /* Zero out the padding for 32 bit systems or in compat mode */ +- if (IS_ENABLED(CONFIG_64BIT_TIME) && in_compat_syscall()) ++ if (IS_ENABLED(CONFIG_64BIT_TIME) && (!IS_ENABLED(CONFIG_64BIT) || ++ in_compat_syscall())) + kts.tv_nsec &= 0xFFFFFFFFUL; + + ts->tv_nsec = kts.tv_nsec; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 53934fe73a9d..d6a27b99efd7 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -260,7 +260,7 @@ static void __rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const c + rpc_reset_waitqueue_priority(queue); + queue->qlen = 0; + queue->timer_list.expires = 0; +- INIT_DEFERRABLE_WORK(&queue->timer_list.dwork, __rpc_queue_timer_fn); ++ INIT_DELAYED_WORK(&queue->timer_list.dwork, __rpc_queue_timer_fn); + INIT_LIST_HEAD(&queue->timer_list.list); + rpc_assign_waitqueue_name(queue, qname); + } +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 6088bc2dc11e..fcd4b1f36e66 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -480,6 +480,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + else + XFRM_INC_STATS(net, + LINUX_MIB_XFRMINSTATEINVALID); ++ ++ if (encap_type == -1) ++ dev_put(skb->dev); + goto drop; + } + +diff --git a/sound/core/oss/linear.c b/sound/core/oss/linear.c +index 2045697f449d..797d838a2f9e 100644 +--- a/sound/core/oss/linear.c ++++ b/sound/core/oss/linear.c +@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin, + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + convert(plugin, src_channels, dst_channels, frames); + return frames; + } +diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c +index 7915564bd394..3788906421a7 100644 +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(struct snd_pcm_plugin *plugin, + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + data = (struct mulaw_priv *)plugin->extra_data; + data->func(plugin, src_channels, dst_channels, frames); + return frames; +diff --git a/sound/core/oss/route.c b/sound/core/oss/route.c +index c8171f5783c8..72dea04197ef 100644 +--- a/sound/core/oss/route.c ++++ b/sound/core/oss/route.c +@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(struct snd_pcm_plugin *plugin, + return -ENXIO; + if (frames == 0) + return 0; ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + + nsrcs = plugin->src_format.channels; + ndsts = plugin->dst_format.channels; +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index d80041ea4e01..2236b5e0c1f2 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1782,11 +1782,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + struct snd_pcm_runtime *runtime; + unsigned long flags; + +- if (PCM_RUNTIME_CHECK(substream)) ++ if (snd_BUG_ON(!substream)) + return; +- runtime = substream->runtime; + + snd_pcm_stream_lock_irqsave(substream, flags); ++ if (PCM_RUNTIME_CHECK(substream)) ++ goto _unlock; ++ runtime = substream->runtime; ++ + if (!snd_pcm_running(substream) || + snd_pcm_update_hw_ptr0(substream, 1) < 0) + goto _end; +@@ -1797,6 +1800,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + #endif + _end: + kill_fasync(&runtime->fasync, SIGIO, POLL_IN); ++ _unlock: + snd_pcm_stream_unlock_irqrestore(substream, flags); + } + EXPORT_SYMBOL(snd_pcm_period_elapsed); +diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c +index 55d53b89ac21..581706acf486 100644 +--- a/sound/hda/hdac_stream.c ++++ b/sound/hda/hdac_stream.c +@@ -96,12 +96,14 @@ void snd_hdac_stream_start(struct hdac_stream *azx_dev, bool fresh_start) + 1 << azx_dev->index, + 1 << azx_dev->index); + /* set stripe control */ +- if (azx_dev->substream) +- stripe_ctl = snd_hdac_get_stream_stripe_ctl(bus, azx_dev->substream); +- else +- stripe_ctl = 0; +- snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK, +- stripe_ctl); ++ if (azx_dev->stripe) { ++ if (azx_dev->substream) ++ stripe_ctl = snd_hdac_get_stream_stripe_ctl(bus, azx_dev->substream); ++ else ++ stripe_ctl = 0; ++ snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK, ++ stripe_ctl); ++ } + /* set DMA start and interrupt mask */ + snd_hdac_stream_updateb(azx_dev, SD_CTL, + 0, SD_CTL_DMA_START | SD_INT_MASK); +@@ -118,7 +120,10 @@ void snd_hdac_stream_clear(struct hdac_stream *azx_dev) + snd_hdac_stream_updateb(azx_dev, SD_CTL, + SD_CTL_DMA_START | SD_INT_MASK, 0); + snd_hdac_stream_writeb(azx_dev, SD_STS, SD_INT_MASK); /* to be sure */ +- snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK, 0); ++ if (azx_dev->stripe) { ++ snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK, 0); ++ azx_dev->stripe = 0; ++ } + azx_dev->running = false; + } + EXPORT_SYMBOL_GPL(snd_hdac_stream_clear); +diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c +index 8272b50b8349..6a8564566375 100644 +--- a/sound/pci/hda/hda_bind.c ++++ b/sound/pci/hda/hda_bind.c +@@ -43,6 +43,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev) + { + struct hda_codec *codec = container_of(dev, struct hda_codec, core); + ++ /* ignore unsol events during shutdown */ ++ if (codec->bus->shutdown) ++ return; ++ + if (codec->patch_ops.unsol_event) + codec->patch_ops.unsol_event(codec, ev); + } +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index e1791d01ccc0..c2740366815d 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1383,8 +1383,11 @@ static int azx_free(struct azx *chip) + static int azx_dev_disconnect(struct snd_device *device) + { + struct azx *chip = device->device_data; ++ struct hdac_bus *bus = azx_bus(chip); + + chip->bus.shutdown = 1; ++ cancel_work_sync(&bus->unsol_work); ++ + return 0; + } + +@@ -2428,6 +2431,9 @@ static const struct pci_device_id azx_ids[] = { + /* CometLake-H */ + { PCI_DEVICE(0x8086, 0x06C8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ /* CometLake-S */ ++ { PCI_DEVICE(0x8086, 0xa3f0), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Icelake */ + { PCI_DEVICE(0x8086, 0x34c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 968d3caab6ac..90aa0f400a57 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -910,6 +910,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index ff99f5feaace..22de30af529e 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -31,6 +31,7 @@ + #include <sound/hda_codec.h> + #include "hda_local.h" + #include "hda_jack.h" ++#include "hda_controller.h" + + static bool static_hdmi_pcm; + module_param(static_hdmi_pcm, bool, 0644); +@@ -45,10 +46,12 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info"); + ((codec)->core.vendor_id == 0x80862800)) + #define is_cannonlake(codec) ((codec)->core.vendor_id == 0x8086280c) + #define is_icelake(codec) ((codec)->core.vendor_id == 0x8086280f) ++#define is_tigerlake(codec) ((codec)->core.vendor_id == 0x80862812) + #define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec) \ + || is_skylake(codec) || is_broxton(codec) \ + || is_kabylake(codec) || is_geminilake(codec) \ +- || is_cannonlake(codec) || is_icelake(codec)) ++ || is_cannonlake(codec) || is_icelake(codec) \ ++ || is_tigerlake(codec)) + #define is_valleyview(codec) ((codec)->core.vendor_id == 0x80862882) + #define is_cherryview(codec) ((codec)->core.vendor_id == 0x80862883) + #define is_valleyview_plus(codec) (is_valleyview(codec) || is_cherryview(codec)) +@@ -1226,6 +1229,10 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo, + per_pin->cvt_nid = per_cvt->cvt_nid; + hinfo->nid = per_cvt->cvt_nid; + ++ /* flip stripe flag for the assigned stream if supported */ ++ if (get_wcaps(codec, per_cvt->cvt_nid) & AC_WCAP_STRIPE) ++ azx_stream(get_azx_dev(substream))->stripe = 1; ++ + snd_hda_set_dev_select(codec, per_pin->pin_nid, per_pin->dev_id); + snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0, + AC_VERB_SET_CONNECT_SEL, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d4daa3c937ba..4b23e374d367 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -367,9 +367,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0215: + case 0x10ec0233: + case 0x10ec0235: +- case 0x10ec0236: + case 0x10ec0255: +- case 0x10ec0256: + case 0x10ec0257: + case 0x10ec0282: + case 0x10ec0283: +@@ -381,6 +379,11 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0300: + alc_update_coef_idx(codec, 0x10, 1<<9, 0); + break; ++ case 0x10ec0236: ++ case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x36, 0x5757); ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ break; + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; +@@ -5878,6 +5881,7 @@ enum { + ALC299_FIXUP_PREDATOR_SPK, + ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC, + ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, ++ ALC294_FIXUP_ASUS_INTSPK_GPIO, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6953,6 +6957,13 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE + }, ++ [ALC294_FIXUP_ASUS_INTSPK_GPIO] = { ++ .type = HDA_FIXUP_FUNC, ++ /* The GPIO must be pulled to initialize the AMP */ ++ .v.func = alc_fixup_gpio4, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7112,7 +7123,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_GPIO), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), +@@ -7219,6 +7230,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), + SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */ ++ SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), + + #if 0 +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index c14a1cdad80c..b0de5684ebd6 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1075,7 +1075,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample, + insn++; + } + } +- if (off != (unsigned)len) ++ if (off != end - start) + printed += fprintf(fp, "\tmismatch of LBR data and executable\n"); + } + +diff --git a/tools/perf/scripts/python/exported-sql-viewer.py b/tools/perf/scripts/python/exported-sql-viewer.py +index 61b3911d91e6..4b28c9d08d5a 100755 +--- a/tools/perf/scripts/python/exported-sql-viewer.py ++++ b/tools/perf/scripts/python/exported-sql-viewer.py +@@ -625,7 +625,7 @@ class CallGraphRootItem(CallGraphLevelItemBase): + self.query_done = True + if_has_calls = "" + if IsSelectable(glb.db, "comms", columns = "has_calls"): +- if_has_calls = " WHERE has_calls = TRUE" ++ if_has_calls = " WHERE has_calls = " + glb.dbref.TRUE + query = QSqlQuery(glb.db) + QueryExec(query, "SELECT id, comm FROM comms" + if_has_calls) + while query.next(): +@@ -905,7 +905,7 @@ class CallTreeRootItem(CallGraphLevelItemBase): + self.query_done = True + if_has_calls = "" + if IsSelectable(glb.db, "comms", columns = "has_calls"): +- if_has_calls = " WHERE has_calls = TRUE" ++ if_has_calls = " WHERE has_calls = " + glb.dbref.TRUE + query = QSqlQuery(glb.db) + QueryExec(query, "SELECT id, comm FROM comms" + if_has_calls) + while query.next(): +@@ -3509,6 +3509,12 @@ class DBRef(): + def __init__(self, is_sqlite3, dbname): + self.is_sqlite3 = is_sqlite3 + self.dbname = dbname ++ self.TRUE = "TRUE" ++ self.FALSE = "FALSE" ++ # SQLite prior to version 3.23 does not support TRUE and FALSE ++ if self.is_sqlite3: ++ self.TRUE = "1" ++ self.FALSE = "0" + + def Open(self, connection_name): + dbname = self.dbname +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile +index 1779923d7a7b..3e5474110dfd 100644 +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -203,7 +203,7 @@ ifdef INSTALL_PATH + @# included in the generated runlist. + for TARGET in $(TARGETS); do \ + BUILD_TARGET=$$BUILD/$$TARGET; \ +- [ ! -d $$INSTALL_PATH/$$TARGET ] && echo "Skipping non-existent dir: $$TARGET" && continue; \ ++ [ ! -d $(INSTALL_PATH)/$$TARGET ] && echo "Skipping non-existent dir: $$TARGET" && continue; \ + echo "[ -w /dev/kmsg ] && echo \"kselftest: Running tests in $$TARGET\" >> /dev/kmsg" >> $(ALL_SCRIPT); \ + echo "cd $$TARGET" >> $(ALL_SCRIPT); \ + echo -n "run_many" >> $(ALL_SCRIPT); \ +diff --git a/tools/testing/selftests/kvm/lib/assert.c b/tools/testing/selftests/kvm/lib/assert.c +index 4911fc77d0f6..d1cf9f6e0e6b 100644 +--- a/tools/testing/selftests/kvm/lib/assert.c ++++ b/tools/testing/selftests/kvm/lib/assert.c +@@ -55,7 +55,7 @@ static void test_dump_stack(void) + #pragma GCC diagnostic pop + } + +-static pid_t gettid(void) ++static pid_t _gettid(void) + { + return syscall(SYS_gettid); + } +@@ -72,7 +72,7 @@ test_assert(bool exp, const char *exp_str, + fprintf(stderr, "==== Test Assertion Failure ====\n" + " %s:%u: %s\n" + " pid=%d tid=%d - %s\n", +- file, line, exp_str, getpid(), gettid(), ++ file, line, exp_str, getpid(), _gettid(), + strerror(errno)); + test_dump_stack(); + if (fmt) { +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index a4ad431c92a9..e821fe242dbc 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -363,8 +363,8 @@ retry: + int vgic_v3_save_pending_tables(struct kvm *kvm) + { + struct vgic_dist *dist = &kvm->arch.vgic; +- int last_byte_offset = -1; + struct vgic_irq *irq; ++ gpa_t last_ptr = ~(gpa_t)0; + int ret; + u8 val; + +@@ -384,11 +384,11 @@ int vgic_v3_save_pending_tables(struct kvm *kvm) + bit_nr = irq->intid % BITS_PER_BYTE; + ptr = pendbase + byte_offset; + +- if (byte_offset != last_byte_offset) { ++ if (ptr != last_ptr) { + ret = kvm_read_guest_lock(kvm, ptr, &val, 1); + if (ret) + return ret; +- last_byte_offset = byte_offset; ++ last_ptr = ptr; + } + + stored = val & (1U << bit_nr);
