commit: 846b5c8dfd662eeb27662203d4051d758f9300a0 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Sep 4 13:51:34 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Sep 4 13:51:34 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=846b5c8d
Linux patch 6.6.49 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1048_linux-6.6.49.patch | 3833 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3837 insertions(+) diff --git a/0000_README b/0000_README index 97fe4c15..47c3c149 100644 --- a/0000_README +++ b/0000_README @@ -235,6 +235,10 @@ Patch: 1047_linux-6.6.48.patch From: https://www.kernel.org Desc: Linux 6.6.48 +Patch: 1048_linux-6.6.49.patch +From: https://www.kernel.org +Desc: Linux 6.6.49 + Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch Desc: Enable link security restrictions by default. diff --git a/1048_linux-6.6.49.patch b/1048_linux-6.6.49.patch new file mode 100644 index 00000000..e30e76bb --- /dev/null +++ b/1048_linux-6.6.49.patch @@ -0,0 +1,3833 @@ +diff --git a/Makefile b/Makefile +index cef1e15ad7606..008fa9137c732 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 48 ++SUBLEVEL = 49 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +diff --git a/arch/alpha/kernel/pci_iommu.c b/arch/alpha/kernel/pci_iommu.c +index 7fcf3e9b71030..c81183935e970 100644 +--- a/arch/alpha/kernel/pci_iommu.c ++++ b/arch/alpha/kernel/pci_iommu.c +@@ -929,7 +929,7 @@ const struct dma_map_ops alpha_pci_ops = { + .dma_supported = alpha_pci_supported, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + EXPORT_SYMBOL(alpha_pci_ops); +diff --git a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi +index 52a0f6ee426f9..bcf4d9c870ec9 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi +@@ -274,24 +274,24 @@ leds: led-controller@30 { + + led@0 { + chan-name = "R"; +- led-cur = /bits/ 8 <0x20>; +- max-cur = /bits/ 8 <0x60>; ++ led-cur = /bits/ 8 <0x6e>; ++ max-cur = /bits/ 8 <0xc8>; + reg = <0>; + color = <LED_COLOR_ID_RED>; + }; + + led@1 { + chan-name = "G"; +- led-cur = /bits/ 8 <0x20>; +- max-cur = /bits/ 8 <0x60>; ++ led-cur = /bits/ 8 <0xbe>; ++ max-cur = /bits/ 8 <0xc8>; + reg = <1>; + color = <LED_COLOR_ID_GREEN>; + }; + + led@2 { + chan-name = "B"; +- led-cur = /bits/ 8 <0x20>; +- max-cur = /bits/ 8 <0x60>; ++ led-cur = /bits/ 8 <0xbe>; ++ max-cur = /bits/ 8 <0xc8>; + reg = <2>; + color = <LED_COLOR_ID_BLUE>; + }; +diff --git a/arch/arm/boot/dts/ti/omap/omap3-n900.dts b/arch/arm/boot/dts/ti/omap/omap3-n900.dts +index d334853412517..036e472b77beb 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-n900.dts ++++ b/arch/arm/boot/dts/ti/omap/omap3-n900.dts +@@ -781,7 +781,7 @@ accelerometer@1d { + + mount-matrix = "-1", "0", "0", + "0", "1", "0", +- "0", "0", "1"; ++ "0", "0", "-1"; + }; + + cam1: camera@3e { +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts b/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts +index acd265d8b58ed..e094f409028dd 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts +@@ -163,13 +163,12 @@ sound-wm8962 { + + simple-audio-card,cpu { + sound-dai = <&sai3>; ++ frame-master; ++ bitclock-master; + }; + + simple-audio-card,codec { + sound-dai = <&wm8962>; +- clocks = <&clk IMX8MP_CLK_IPP_DO_CLKO1>; +- frame-master; +- bitclock-master; + }; + }; + }; +@@ -381,10 +380,9 @@ &pcie_phy { + &sai3 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai3>; +- assigned-clocks = <&clk IMX8MP_CLK_SAI3>, +- <&clk IMX8MP_AUDIO_PLL2> ; +- assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>; +- assigned-clock-rates = <12288000>, <361267200>; ++ assigned-clocks = <&clk IMX8MP_CLK_SAI3>; ++ assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL1_OUT>; ++ assigned-clock-rates = <12288000>; + fsl,sai-mclk-direction-output; + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +index 3c5c67ebee5d3..aaf9685ef0fbb 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +@@ -437,7 +437,7 @@ &usdhc2 { + pinctrl-0 = <&pinctrl_usdhc2_hs>, <&pinctrl_usdhc2_gpio>; + pinctrl-1 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>; + pinctrl-2 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>; +- cd-gpios = <&gpio3 00 GPIO_ACTIVE_LOW>; ++ cd-gpios = <&gpio3 0 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; + bus-width = <4>; + no-sdio; +diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi b/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +index f6e422dc2663e..b6f3c076fe54a 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +@@ -19,7 +19,7 @@ reserved-memory { + linux,cma { + compatible = "shared-dma-pool"; + reusable; +- alloc-ranges = <0 0x60000000 0 0x40000000>; ++ alloc-ranges = <0 0x80000000 0 0x40000000>; + size = <0 0x10000000>; + linux,cma-default; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index 943b7e6655634..35155b009dd24 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -786,6 +786,8 @@ fec: ethernet@42890000 { + fsl,num-tx-queues = <3>; + fsl,num-rx-queues = <3>; + fsl,stop-mode = <&wakeupmix_gpr 0x0c 1>; ++ nvmem-cells = <ð_mac1>; ++ nvmem-cell-names = "mac-address"; + status = "disabled"; + }; + +@@ -807,7 +809,9 @@ eqos: ethernet@428a0000 { + <&clk IMX93_CLK_SYS_PLL_PFD0_DIV2>; + assigned-clock-rates = <100000000>, <250000000>; + intf_mode = <&wakeupmix_gpr 0x28>; +- snps,clk-csr = <0>; ++ snps,clk-csr = <6>; ++ nvmem-cells = <ð_mac2>; ++ nvmem-cell-names = "mac-address"; + status = "disabled"; + }; + +@@ -888,6 +892,15 @@ ocotp: efuse@47510000 { + reg = <0x47510000 0x10000>; + #address-cells = <1>; + #size-cells = <1>; ++ ++ eth_mac1: mac-address@4ec { ++ reg = <0x4ec 0x6>; ++ }; ++ ++ eth_mac2: mac-address@4f2 { ++ reg = <0x4f2 0x6>; ++ }; ++ + }; + + s4muap: mailbox@47520000 { +diff --git a/arch/loongarch/include/asm/dma-direct.h b/arch/loongarch/include/asm/dma-direct.h +deleted file mode 100644 +index 75ccd808a2af3..0000000000000 +--- a/arch/loongarch/include/asm/dma-direct.h ++++ /dev/null +@@ -1,11 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +-/* +- * Copyright (C) 2020-2022 Loongson Technology Corporation Limited +- */ +-#ifndef _LOONGARCH_DMA_DIRECT_H +-#define _LOONGARCH_DMA_DIRECT_H +- +-dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr); +-phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr); +- +-#endif /* _LOONGARCH_DMA_DIRECT_H */ +diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c +index c97b089b99029..eabddb89d221f 100644 +--- a/arch/mips/jazz/jazzdma.c ++++ b/arch/mips/jazz/jazzdma.c +@@ -617,7 +617,7 @@ const struct dma_map_ops jazz_dma_ops = { + .sync_sg_for_device = jazz_dma_sync_sg_for_device, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + EXPORT_SYMBOL(jazz_dma_ops); +diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c +index f0ae39e77e374..8920862ffd791 100644 +--- a/arch/powerpc/kernel/dma-iommu.c ++++ b/arch/powerpc/kernel/dma-iommu.c +@@ -216,6 +216,6 @@ const struct dma_map_ops dma_iommu_ops = { + .get_required_mask = dma_iommu_get_required_mask, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; +diff --git a/arch/powerpc/platforms/ps3/system-bus.c b/arch/powerpc/platforms/ps3/system-bus.c +index 56dc6b29a3e76..d6b5f5ecd5152 100644 +--- a/arch/powerpc/platforms/ps3/system-bus.c ++++ b/arch/powerpc/platforms/ps3/system-bus.c +@@ -695,7 +695,7 @@ static const struct dma_map_ops ps3_sb_dma_ops = { + .unmap_page = ps3_unmap_page, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + +@@ -709,7 +709,7 @@ static const struct dma_map_ops ps3_ioc0_dma_ops = { + .unmap_page = ps3_unmap_page, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + +diff --git a/arch/powerpc/platforms/pseries/vio.c b/arch/powerpc/platforms/pseries/vio.c +index 0c90fc4c37963..2dc9cbc4bcd8f 100644 +--- a/arch/powerpc/platforms/pseries/vio.c ++++ b/arch/powerpc/platforms/pseries/vio.c +@@ -611,7 +611,7 @@ static const struct dma_map_ops vio_dma_mapping_ops = { + .get_required_mask = dma_iommu_get_required_mask, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + +diff --git a/arch/x86/kernel/amd_gart_64.c b/arch/x86/kernel/amd_gart_64.c +index 842a0ec5eaa9e..56a917df410d3 100644 +--- a/arch/x86/kernel/amd_gart_64.c ++++ b/arch/x86/kernel/amd_gart_64.c +@@ -676,7 +676,7 @@ static const struct dma_map_ops gart_dma_ops = { + .get_sgtable = dma_common_get_sgtable, + .dma_supported = dma_direct_supported, + .get_required_mask = dma_direct_get_required_mask, +- .alloc_pages_op = dma_direct_alloc_pages, ++ .alloc_pages = dma_direct_alloc_pages, + .free_pages = dma_direct_free_pages, + }; + +diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c +index b5d40e0e05f31..814dd966b1a45 100644 +--- a/drivers/bluetooth/btnxpuart.c ++++ b/drivers/bluetooth/btnxpuart.c +@@ -29,6 +29,7 @@ + #define BTNXPUART_CHECK_BOOT_SIGNATURE 3 + #define BTNXPUART_SERDEV_OPEN 4 + #define BTNXPUART_IR_IN_PROGRESS 5 ++#define BTNXPUART_FW_DOWNLOAD_ABORT 6 + + /* NXP HW err codes */ + #define BTNXPUART_IR_HW_ERR 0xb0 +@@ -126,6 +127,7 @@ struct ps_data { + struct hci_dev *hdev; + struct work_struct work; + struct timer_list ps_timer; ++ struct mutex ps_lock; + }; + + struct wakeup_cmd_payload { +@@ -158,6 +160,7 @@ struct btnxpuart_dev { + u8 fw_name[MAX_FW_FILE_NAME_LEN]; + u32 fw_dnld_v1_offset; + u32 fw_v1_sent_bytes; ++ u32 fw_dnld_v3_offset; + u32 fw_v3_offset_correction; + u32 fw_v1_expected_len; + u32 boot_reg_offset; +@@ -333,6 +336,9 @@ static void ps_start_timer(struct btnxpuart_dev *nxpdev) + + if (psdata->cur_psmode == PS_MODE_ENABLE) + mod_timer(&psdata->ps_timer, jiffies + msecs_to_jiffies(psdata->h2c_ps_interval)); ++ ++ if (psdata->ps_state == PS_STATE_AWAKE && psdata->ps_cmd == PS_CMD_ENTER_PS) ++ cancel_work_sync(&psdata->work); + } + + static void ps_cancel_timer(struct btnxpuart_dev *nxpdev) +@@ -353,6 +359,7 @@ static void ps_control(struct hci_dev *hdev, u8 ps_state) + !test_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state)) + return; + ++ mutex_lock(&psdata->ps_lock); + switch (psdata->cur_h2c_wakeupmode) { + case WAKEUP_METHOD_DTR: + if (ps_state == PS_STATE_AWAKE) +@@ -366,12 +373,15 @@ static void ps_control(struct hci_dev *hdev, u8 ps_state) + status = serdev_device_break_ctl(nxpdev->serdev, 0); + else + status = serdev_device_break_ctl(nxpdev->serdev, -1); ++ msleep(20); /* Allow chip to detect UART-break and enter sleep */ + bt_dev_dbg(hdev, "Set UART break: %s, status=%d", + str_on_off(ps_state == PS_STATE_SLEEP), status); + break; + } + if (!status) + psdata->ps_state = ps_state; ++ mutex_unlock(&psdata->ps_lock); ++ + if (ps_state == PS_STATE_AWAKE) + btnxpuart_tx_wakeup(nxpdev); + } +@@ -407,17 +417,42 @@ static void ps_setup(struct hci_dev *hdev) + + psdata->hdev = hdev; + INIT_WORK(&psdata->work, ps_work_func); ++ mutex_init(&psdata->ps_lock); + timer_setup(&psdata->ps_timer, ps_timeout_func, 0); + } + +-static void ps_wakeup(struct btnxpuart_dev *nxpdev) ++static bool ps_wakeup(struct btnxpuart_dev *nxpdev) + { + struct ps_data *psdata = &nxpdev->psdata; ++ u8 ps_state; + +- if (psdata->ps_state != PS_STATE_AWAKE) { ++ mutex_lock(&psdata->ps_lock); ++ ps_state = psdata->ps_state; ++ mutex_unlock(&psdata->ps_lock); ++ ++ if (ps_state != PS_STATE_AWAKE) { + psdata->ps_cmd = PS_CMD_EXIT_PS; + schedule_work(&psdata->work); ++ return true; + } ++ return false; ++} ++ ++static void ps_cleanup(struct btnxpuart_dev *nxpdev) ++{ ++ struct ps_data *psdata = &nxpdev->psdata; ++ u8 ps_state; ++ ++ mutex_lock(&psdata->ps_lock); ++ ps_state = psdata->ps_state; ++ mutex_unlock(&psdata->ps_lock); ++ ++ if (ps_state != PS_STATE_AWAKE) ++ ps_control(psdata->hdev, PS_STATE_AWAKE); ++ ++ ps_cancel_timer(nxpdev); ++ cancel_work_sync(&psdata->work); ++ mutex_destroy(&psdata->ps_lock); + } + + static int send_ps_cmd(struct hci_dev *hdev, void *data) +@@ -550,6 +585,7 @@ static int nxp_download_firmware(struct hci_dev *hdev) + nxpdev->fw_v1_sent_bytes = 0; + nxpdev->fw_v1_expected_len = HDR_LEN; + nxpdev->boot_reg_offset = 0; ++ nxpdev->fw_dnld_v3_offset = 0; + nxpdev->fw_v3_offset_correction = 0; + nxpdev->baudrate_changed = false; + nxpdev->timeout_changed = false; +@@ -564,14 +600,23 @@ static int nxp_download_firmware(struct hci_dev *hdev) + !test_bit(BTNXPUART_FW_DOWNLOADING, + &nxpdev->tx_state), + msecs_to_jiffies(60000)); ++ ++ release_firmware(nxpdev->fw); ++ memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name)); ++ + if (err == 0) { +- bt_dev_err(hdev, "FW Download Timeout."); ++ bt_dev_err(hdev, "FW Download Timeout. offset: %d", ++ nxpdev->fw_dnld_v1_offset ? ++ nxpdev->fw_dnld_v1_offset : ++ nxpdev->fw_dnld_v3_offset); + return -ETIMEDOUT; + } ++ if (test_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state)) { ++ bt_dev_err(hdev, "FW Download Aborted"); ++ return -EINTR; ++ } + + serdev_device_set_flow_control(nxpdev->serdev, true); +- release_firmware(nxpdev->fw); +- memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name)); + + /* Allow the downloaded FW to initialize */ + msleep(1200); +@@ -982,8 +1027,9 @@ static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb) + goto free_skb; + } + +- serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + offset - +- nxpdev->fw_v3_offset_correction, len); ++ nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction; ++ serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + ++ nxpdev->fw_dnld_v3_offset, len); + + free_skb: + kfree_skb(skb); +@@ -1215,7 +1261,6 @@ static struct sk_buff *nxp_dequeue(void *data) + { + struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)data; + +- ps_wakeup(nxpdev); + ps_start_timer(nxpdev); + return skb_dequeue(&nxpdev->txq); + } +@@ -1230,6 +1275,9 @@ static void btnxpuart_tx_work(struct work_struct *work) + struct sk_buff *skb; + int len; + ++ if (ps_wakeup(nxpdev)) ++ return; ++ + while ((skb = nxp_dequeue(nxpdev))) { + len = serdev_device_write_buf(serdev, skb->data, skb->len); + hdev->stat.byte_tx += len; +@@ -1276,7 +1324,6 @@ static int btnxpuart_close(struct hci_dev *hdev) + { + struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev); + +- ps_wakeup(nxpdev); + serdev_device_close(nxpdev->serdev); + skb_queue_purge(&nxpdev->txq); + kfree_skb(nxpdev->rx_skb); +@@ -1412,16 +1459,22 @@ static void nxp_serdev_remove(struct serdev_device *serdev) + struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev); + struct hci_dev *hdev = nxpdev->hdev; + +- /* Restore FW baudrate to fw_init_baudrate if changed. +- * This will ensure FW baudrate is in sync with +- * driver baudrate in case this driver is re-inserted. +- */ +- if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) { +- nxpdev->new_baudrate = nxpdev->fw_init_baudrate; +- nxp_set_baudrate_cmd(hdev, NULL); ++ if (is_fw_downloading(nxpdev)) { ++ set_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state); ++ clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state); ++ wake_up_interruptible(&nxpdev->check_boot_sign_wait_q); ++ wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q); ++ } else { ++ /* Restore FW baudrate to fw_init_baudrate if changed. ++ * This will ensure FW baudrate is in sync with ++ * driver baudrate in case this driver is re-inserted. ++ */ ++ if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) { ++ nxpdev->new_baudrate = nxpdev->fw_init_baudrate; ++ nxp_set_baudrate_cmd(hdev, NULL); ++ } + } +- +- ps_cancel_timer(nxpdev); ++ ps_cleanup(nxpdev); + hci_unregister_dev(hdev); + hci_free_dev(hdev); + } +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 10e8f0715114f..e3f8db4fe909a 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -17,8 +17,8 @@ enum dw_hdma_control { + DW_HDMA_V0_CB = BIT(0), + DW_HDMA_V0_TCB = BIT(1), + DW_HDMA_V0_LLP = BIT(2), +- DW_HDMA_V0_LIE = BIT(3), +- DW_HDMA_V0_RIE = BIT(4), ++ DW_HDMA_V0_LWIE = BIT(3), ++ DW_HDMA_V0_RWIE = BIT(4), + DW_HDMA_V0_CCS = BIT(8), + DW_HDMA_V0_LLE = BIT(9), + }; +@@ -195,25 +195,14 @@ static void dw_hdma_v0_write_ll_link(struct dw_edma_chunk *chunk, + static void dw_hdma_v0_core_write_chunk(struct dw_edma_chunk *chunk) + { + struct dw_edma_burst *child; +- struct dw_edma_chan *chan = chunk->chan; + u32 control = 0, i = 0; +- int j; + + if (chunk->cb) + control = DW_HDMA_V0_CB; + +- j = chunk->bursts_alloc; +- list_for_each_entry(child, &chunk->burst->list, list) { +- j--; +- if (!j) { +- control |= DW_HDMA_V0_LIE; +- if (!(chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL)) +- control |= DW_HDMA_V0_RIE; +- } +- ++ list_for_each_entry(child, &chunk->burst->list, list) + dw_hdma_v0_write_ll_data(chunk, i++, control, child->sz, + child->sar, child->dar); +- } + + control = DW_HDMA_V0_LLP | DW_HDMA_V0_TCB; + if (!chunk->cb) +@@ -247,10 +236,11 @@ static void dw_hdma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + if (first) { + /* Enable engine */ + SET_CH_32(dw, chan->dir, chan->id, ch_en, BIT(0)); +- /* Interrupt enable&unmask - done, abort */ +- tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup) | +- HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK | +- HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN; ++ /* Interrupt unmask - stop, abort */ ++ tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup); ++ tmp &= ~(HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK); ++ /* Interrupt enable - stop, abort */ ++ tmp |= HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN; + if (!(dw->chip->flags & DW_EDMA_CHIP_LOCAL)) + tmp |= HDMA_V0_REMOTE_STOP_INT_EN | HDMA_V0_REMOTE_ABORT_INT_EN; + SET_CH_32(dw, chan->dir, chan->id, int_setup, tmp); +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 5f7d690e3dbae..b341a6f1b0438 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -16,6 +16,7 @@ + #include <linux/init.h> + #include <linux/interrupt.h> + #include <linux/io.h> ++#include <linux/log2.h> + #include <linux/mm.h> + #include <linux/module.h> + #include <linux/slab.h> +@@ -621,12 +622,10 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, + struct dw_desc *prev; + struct dw_desc *first; + u32 ctllo, ctlhi; +- u8 m_master = dwc->dws.m_master; +- u8 lms = DWC_LLP_LMS(m_master); ++ u8 lms = DWC_LLP_LMS(dwc->dws.m_master); + dma_addr_t reg; + unsigned int reg_width; + unsigned int mem_width; +- unsigned int data_width = dw->pdata->data_width[m_master]; + unsigned int i; + struct scatterlist *sg; + size_t total_len = 0; +@@ -660,7 +659,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, + mem = sg_dma_address(sg); + len = sg_dma_len(sg); + +- mem_width = __ffs(data_width | mem | len); ++ mem_width = __ffs(sconfig->src_addr_width | mem | len); + + slave_sg_todev_fill_desc: + desc = dwc_desc_get(dwc); +@@ -720,7 +719,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, + lli_write(desc, sar, reg); + lli_write(desc, dar, mem); + lli_write(desc, ctlhi, ctlhi); +- mem_width = __ffs(data_width | mem); ++ mem_width = __ffs(sconfig->dst_addr_width | mem); + lli_write(desc, ctllo, ctllo | DWC_CTLL_DST_WIDTH(mem_width)); + desc->len = dlen; + +@@ -780,17 +779,93 @@ bool dw_dma_filter(struct dma_chan *chan, void *param) + } + EXPORT_SYMBOL_GPL(dw_dma_filter); + ++static int dwc_verify_p_buswidth(struct dma_chan *chan) ++{ ++ struct dw_dma_chan *dwc = to_dw_dma_chan(chan); ++ struct dw_dma *dw = to_dw_dma(chan->device); ++ u32 reg_width, max_width; ++ ++ if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV) ++ reg_width = dwc->dma_sconfig.dst_addr_width; ++ else if (dwc->dma_sconfig.direction == DMA_DEV_TO_MEM) ++ reg_width = dwc->dma_sconfig.src_addr_width; ++ else /* DMA_MEM_TO_MEM */ ++ return 0; ++ ++ max_width = dw->pdata->data_width[dwc->dws.p_master]; ++ ++ /* Fall-back to 1-byte transfer width if undefined */ ++ if (reg_width == DMA_SLAVE_BUSWIDTH_UNDEFINED) ++ reg_width = DMA_SLAVE_BUSWIDTH_1_BYTE; ++ else if (!is_power_of_2(reg_width) || reg_width > max_width) ++ return -EINVAL; ++ else /* bus width is valid */ ++ return 0; ++ ++ /* Update undefined addr width value */ ++ if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV) ++ dwc->dma_sconfig.dst_addr_width = reg_width; ++ else /* DMA_DEV_TO_MEM */ ++ dwc->dma_sconfig.src_addr_width = reg_width; ++ ++ return 0; ++} ++ ++static int dwc_verify_m_buswidth(struct dma_chan *chan) ++{ ++ struct dw_dma_chan *dwc = to_dw_dma_chan(chan); ++ struct dw_dma *dw = to_dw_dma(chan->device); ++ u32 reg_width, reg_burst, mem_width; ++ ++ mem_width = dw->pdata->data_width[dwc->dws.m_master]; ++ ++ /* ++ * It's possible to have a data portion locked in the DMA FIFO in case ++ * of the channel suspension. Subsequent channel disabling will cause ++ * that data silent loss. In order to prevent that maintain the src and ++ * dst transfer widths coherency by means of the relation: ++ * (CTLx.SRC_TR_WIDTH * CTLx.SRC_MSIZE >= CTLx.DST_TR_WIDTH) ++ * Look for the details in the commit message that brings this change. ++ * ++ * Note the DMA configs utilized in the calculations below must have ++ * been verified to have correct values by this method call. ++ */ ++ if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV) { ++ reg_width = dwc->dma_sconfig.dst_addr_width; ++ if (mem_width < reg_width) ++ return -EINVAL; ++ ++ dwc->dma_sconfig.src_addr_width = mem_width; ++ } else if (dwc->dma_sconfig.direction == DMA_DEV_TO_MEM) { ++ reg_width = dwc->dma_sconfig.src_addr_width; ++ reg_burst = rounddown_pow_of_two(dwc->dma_sconfig.src_maxburst); ++ ++ dwc->dma_sconfig.dst_addr_width = min(mem_width, reg_width * reg_burst); ++ } ++ ++ return 0; ++} ++ + static int dwc_config(struct dma_chan *chan, struct dma_slave_config *sconfig) + { + struct dw_dma_chan *dwc = to_dw_dma_chan(chan); + struct dw_dma *dw = to_dw_dma(chan->device); ++ int ret; + + memcpy(&dwc->dma_sconfig, sconfig, sizeof(*sconfig)); + + dwc->dma_sconfig.src_maxburst = +- clamp(dwc->dma_sconfig.src_maxburst, 0U, dwc->max_burst); ++ clamp(dwc->dma_sconfig.src_maxburst, 1U, dwc->max_burst); + dwc->dma_sconfig.dst_maxburst = +- clamp(dwc->dma_sconfig.dst_maxburst, 0U, dwc->max_burst); ++ clamp(dwc->dma_sconfig.dst_maxburst, 1U, dwc->max_burst); ++ ++ ret = dwc_verify_p_buswidth(chan); ++ if (ret) ++ return ret; ++ ++ ret = dwc_verify_m_buswidth(chan); ++ if (ret) ++ return ret; + + dw->encode_maxburst(dwc, &dwc->dma_sconfig.src_maxburst); + dw->encode_maxburst(dwc, &dwc->dma_sconfig.dst_maxburst); +diff --git a/drivers/firmware/qcom_scm-smc.c b/drivers/firmware/qcom_scm-smc.c +index 16cf88acfa8ee..0a2a2c794d0ed 100644 +--- a/drivers/firmware/qcom_scm-smc.c ++++ b/drivers/firmware/qcom_scm-smc.c +@@ -71,7 +71,7 @@ int scm_get_wq_ctx(u32 *wq_ctx, u32 *flags, u32 *more_pending) + struct arm_smccc_res get_wq_res; + struct arm_smccc_args get_wq_ctx = {0}; + +- get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL, ++ get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, + ARM_SMCCC_SMC_64, ARM_SMCCC_OWNER_SIP, + SCM_SMC_FNID(QCOM_SCM_SVC_WAITQ, QCOM_SCM_WAITQ_GET_WQ_CTX)); + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +index cc74dd69acf2b..fa9f53b310793 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +@@ -28,6 +28,7 @@ + #include <drm/drm_blend.h> + #include <drm/drm_gem_atomic_helper.h> + #include <drm/drm_plane_helper.h> ++#include <drm/drm_gem_framebuffer_helper.h> + #include <drm/drm_fourcc.h> + + #include "amdgpu.h" +@@ -848,10 +849,14 @@ static int dm_plane_helper_prepare_fb(struct drm_plane *plane, + } + + afb = to_amdgpu_framebuffer(new_state->fb); +- obj = new_state->fb->obj[0]; ++ obj = drm_gem_fb_get_obj(new_state->fb, 0); ++ if (!obj) { ++ DRM_ERROR("Failed to get obj from framebuffer\n"); ++ return -EINVAL; ++ } ++ + rbo = gem_to_amdgpu_bo(obj); + adev = amdgpu_ttm_adev(rbo->tbo.bdev); +- + r = amdgpu_bo_reserve(rbo, true); + if (r) { + dev_err(adev->dev, "fail to reserve bo (%d)\n", r); +diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +index 1402e468aa90f..c9a9c758531bc 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1841,8 +1841,9 @@ static int smu_bump_power_profile_mode(struct smu_context *smu, + } + + static int smu_adjust_power_state_dynamic(struct smu_context *smu, +- enum amd_dpm_forced_level level, +- bool skip_display_settings) ++ enum amd_dpm_forced_level level, ++ bool skip_display_settings, ++ bool force_update) + { + int ret = 0; + int index = 0; +@@ -1871,7 +1872,7 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu, + } + } + +- if (smu_dpm_ctx->dpm_level != level) { ++ if (force_update || smu_dpm_ctx->dpm_level != level) { + ret = smu_asic_set_performance_level(smu, level); + if (ret) { + dev_err(smu->adev->dev, "Failed to set performance level!"); +@@ -1882,13 +1883,12 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu, + smu_dpm_ctx->dpm_level = level; + } + +- if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL && +- smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) { ++ if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) { + index = fls(smu->workload_mask); + index = index > 0 && index <= WORKLOAD_POLICY_MAX ? index - 1 : 0; + workload[0] = smu->workload_setting[index]; + +- if (smu->power_profile_mode != workload[0]) ++ if (force_update || smu->power_profile_mode != workload[0]) + smu_bump_power_profile_mode(smu, workload, 0); + } + +@@ -1909,11 +1909,13 @@ static int smu_handle_task(struct smu_context *smu, + ret = smu_pre_display_config_changed(smu); + if (ret) + return ret; +- ret = smu_adjust_power_state_dynamic(smu, level, false); ++ ret = smu_adjust_power_state_dynamic(smu, level, false, false); + break; + case AMD_PP_TASK_COMPLETE_INIT: ++ ret = smu_adjust_power_state_dynamic(smu, level, true, true); ++ break; + case AMD_PP_TASK_READJUST_POWER_STATE: +- ret = smu_adjust_power_state_dynamic(smu, level, true); ++ ret = smu_adjust_power_state_dynamic(smu, level, true, false); + break; + default: + break; +@@ -1960,8 +1962,7 @@ static int smu_switch_power_profile(void *handle, + workload[0] = smu->workload_setting[index]; + } + +- if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL && +- smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) ++ if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) + smu_bump_power_profile_mode(smu, workload, 0); + + return 0; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c b/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c +index 717d624e9a052..890a66a2361f4 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c +@@ -27,6 +27,8 @@ + **************************************************************************/ + + #include "vmwgfx_drv.h" ++ ++#include "vmwgfx_bo.h" + #include <linux/highmem.h> + + /* +@@ -420,13 +422,105 @@ static int vmw_bo_cpu_blit_line(struct vmw_bo_blit_line_data *d, + return 0; + } + ++static void *map_external(struct vmw_bo *bo, struct iosys_map *map) ++{ ++ struct vmw_private *vmw = ++ container_of(bo->tbo.bdev, struct vmw_private, bdev); ++ void *ptr = NULL; ++ int ret; ++ ++ if (bo->tbo.base.import_attach) { ++ ret = dma_buf_vmap(bo->tbo.base.dma_buf, map); ++ if (ret) { ++ drm_dbg_driver(&vmw->drm, ++ "Wasn't able to map external bo!\n"); ++ goto out; ++ } ++ ptr = map->vaddr; ++ } else { ++ ptr = vmw_bo_map_and_cache(bo); ++ } ++ ++out: ++ return ptr; ++} ++ ++static void unmap_external(struct vmw_bo *bo, struct iosys_map *map) ++{ ++ if (bo->tbo.base.import_attach) ++ dma_buf_vunmap(bo->tbo.base.dma_buf, map); ++ else ++ vmw_bo_unmap(bo); ++} ++ ++static int vmw_external_bo_copy(struct vmw_bo *dst, u32 dst_offset, ++ u32 dst_stride, struct vmw_bo *src, ++ u32 src_offset, u32 src_stride, ++ u32 width_in_bytes, u32 height, ++ struct vmw_diff_cpy *diff) ++{ ++ struct vmw_private *vmw = ++ container_of(dst->tbo.bdev, struct vmw_private, bdev); ++ size_t dst_size = dst->tbo.resource->size; ++ size_t src_size = src->tbo.resource->size; ++ struct iosys_map dst_map = {0}; ++ struct iosys_map src_map = {0}; ++ int ret, i; ++ int x_in_bytes; ++ u8 *vsrc; ++ u8 *vdst; ++ ++ vsrc = map_external(src, &src_map); ++ if (!vsrc) { ++ drm_dbg_driver(&vmw->drm, "Wasn't able to map src\n"); ++ ret = -ENOMEM; ++ goto out; ++ } ++ ++ vdst = map_external(dst, &dst_map); ++ if (!vdst) { ++ drm_dbg_driver(&vmw->drm, "Wasn't able to map dst\n"); ++ ret = -ENOMEM; ++ goto out; ++ } ++ ++ vsrc += src_offset; ++ vdst += dst_offset; ++ if (src_stride == dst_stride) { ++ dst_size -= dst_offset; ++ src_size -= src_offset; ++ memcpy(vdst, vsrc, ++ min(dst_stride * height, min(dst_size, src_size))); ++ } else { ++ WARN_ON(dst_stride < width_in_bytes); ++ for (i = 0; i < height; ++i) { ++ memcpy(vdst, vsrc, width_in_bytes); ++ vsrc += src_stride; ++ vdst += dst_stride; ++ } ++ } ++ ++ x_in_bytes = (dst_offset % dst_stride); ++ diff->rect.x1 = x_in_bytes / diff->cpp; ++ diff->rect.y1 = ((dst_offset - x_in_bytes) / dst_stride); ++ diff->rect.x2 = diff->rect.x1 + width_in_bytes / diff->cpp; ++ diff->rect.y2 = diff->rect.y1 + height; ++ ++ ret = 0; ++out: ++ unmap_external(src, &src_map); ++ unmap_external(dst, &dst_map); ++ ++ return ret; ++} ++ + /** + * vmw_bo_cpu_blit - in-kernel cpu blit. + * +- * @dst: Destination buffer object. ++ * @vmw_dst: Destination buffer object. + * @dst_offset: Destination offset of blit start in bytes. + * @dst_stride: Destination stride in bytes. +- * @src: Source buffer object. ++ * @vmw_src: Source buffer object. + * @src_offset: Source offset of blit start in bytes. + * @src_stride: Source stride in bytes. + * @w: Width of blit. +@@ -444,13 +538,15 @@ static int vmw_bo_cpu_blit_line(struct vmw_bo_blit_line_data *d, + * Neither of the buffer objects may be placed in PCI memory + * (Fixed memory in TTM terminology) when using this function. + */ +-int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, ++int vmw_bo_cpu_blit(struct vmw_bo *vmw_dst, + u32 dst_offset, u32 dst_stride, +- struct ttm_buffer_object *src, ++ struct vmw_bo *vmw_src, + u32 src_offset, u32 src_stride, + u32 w, u32 h, + struct vmw_diff_cpy *diff) + { ++ struct ttm_buffer_object *src = &vmw_src->tbo; ++ struct ttm_buffer_object *dst = &vmw_dst->tbo; + struct ttm_operation_ctx ctx = { + .interruptible = false, + .no_wait_gpu = false +@@ -460,6 +556,11 @@ int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, + int ret = 0; + struct page **dst_pages = NULL; + struct page **src_pages = NULL; ++ bool src_external = (src->ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0; ++ bool dst_external = (dst->ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0; ++ ++ if (WARN_ON(dst == src)) ++ return -EINVAL; + + /* Buffer objects need to be either pinned or reserved: */ + if (!(dst->pin_count)) +@@ -479,6 +580,11 @@ int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, + return ret; + } + ++ if (src_external || dst_external) ++ return vmw_external_bo_copy(vmw_dst, dst_offset, dst_stride, ++ vmw_src, src_offset, src_stride, ++ w, h, diff); ++ + if (!src->ttm->pages && src->ttm->sg) { + src_pages = kvmalloc_array(src->ttm->num_pages, + sizeof(struct page *), GFP_KERNEL); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +index 13423c7b0cbdb..ac3d7ff3f5bb9 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -1355,9 +1355,9 @@ void vmw_diff_memcpy(struct vmw_diff_cpy *diff, u8 *dest, const u8 *src, + + void vmw_memcpy(struct vmw_diff_cpy *diff, u8 *dest, const u8 *src, size_t n); + +-int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, ++int vmw_bo_cpu_blit(struct vmw_bo *dst, + u32 dst_offset, u32 dst_stride, +- struct ttm_buffer_object *src, ++ struct vmw_bo *src, + u32 src_offset, u32 src_stride, + u32 w, u32 h, + struct vmw_diff_cpy *diff); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +index cb03c589ab226..b22ae25db4e17 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +@@ -497,7 +497,7 @@ static void vmw_stdu_bo_cpu_commit(struct vmw_kms_dirty *dirty) + container_of(dirty->unit, typeof(*stdu), base); + s32 width, height; + s32 src_pitch, dst_pitch; +- struct ttm_buffer_object *src_bo, *dst_bo; ++ struct vmw_bo *src_bo, *dst_bo; + u32 src_offset, dst_offset; + struct vmw_diff_cpy diff = VMW_CPU_BLIT_DIFF_INITIALIZER(stdu->cpp); + +@@ -512,11 +512,11 @@ static void vmw_stdu_bo_cpu_commit(struct vmw_kms_dirty *dirty) + + /* Assume we are blitting from Guest (bo) to Host (display_srf) */ + src_pitch = stdu->display_srf->metadata.base_size.width * stdu->cpp; +- src_bo = &stdu->display_srf->res.guest_memory_bo->tbo; ++ src_bo = stdu->display_srf->res.guest_memory_bo; + src_offset = ddirty->top * src_pitch + ddirty->left * stdu->cpp; + + dst_pitch = ddirty->pitch; +- dst_bo = &ddirty->buf->tbo; ++ dst_bo = ddirty->buf; + dst_offset = ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp; + + (void) vmw_bo_cpu_blit(dst_bo, dst_offset, dst_pitch, +@@ -1136,7 +1136,7 @@ vmw_stdu_bo_populate_update_cpu(struct vmw_du_update_plane *update, void *cmd, + struct vmw_diff_cpy diff = VMW_CPU_BLIT_DIFF_INITIALIZER(0); + struct vmw_stdu_update_gb_image *cmd_img = cmd; + struct vmw_stdu_update *cmd_update; +- struct ttm_buffer_object *src_bo, *dst_bo; ++ struct vmw_bo *src_bo, *dst_bo; + u32 src_offset, dst_offset; + s32 src_pitch, dst_pitch; + s32 width, height; +@@ -1150,11 +1150,11 @@ vmw_stdu_bo_populate_update_cpu(struct vmw_du_update_plane *update, void *cmd, + + diff.cpp = stdu->cpp; + +- dst_bo = &stdu->display_srf->res.guest_memory_bo->tbo; ++ dst_bo = stdu->display_srf->res.guest_memory_bo; + dst_pitch = stdu->display_srf->metadata.base_size.width * stdu->cpp; + dst_offset = bb->y1 * dst_pitch + bb->x1 * stdu->cpp; + +- src_bo = &vfbbo->buffer->tbo; ++ src_bo = vfbbo->buffer; + src_pitch = update->vfb->base.pitches[0]; + src_offset = bo_update->fb_top * src_pitch + bo_update->fb_left * + stdu->cpp; +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index f5eb97726d1bb..2da969fc89900 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -1614,7 +1614,7 @@ static const struct dma_map_ops iommu_dma_ops = { + .flags = DMA_F_PCI_P2PDMA_SUPPORTED, + .alloc = iommu_dma_alloc, + .free = iommu_dma_free, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + .alloc_noncontiguous = iommu_dma_alloc_noncontiguous, + .free_noncontiguous = iommu_dma_free_noncontiguous, +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index 75f244a3e12df..06ffc683b28fe 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -552,9 +552,8 @@ static int arm_v7s_map_pages(struct io_pgtable_ops *ops, unsigned long iova, + paddr >= (1ULL << data->iop.cfg.oas))) + return -ERANGE; + +- /* If no access, then nothing to do */ + if (!(prot & (IOMMU_READ | IOMMU_WRITE))) +- return 0; ++ return -EINVAL; + + while (pgcount--) { + ret = __arm_v7s_map(data, iova, paddr, pgsize, prot, 1, data->pgd, +diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c +index 72dcdd468cf30..934dc97f5df9e 100644 +--- a/drivers/iommu/io-pgtable-arm.c ++++ b/drivers/iommu/io-pgtable-arm.c +@@ -480,9 +480,8 @@ static int arm_lpae_map_pages(struct io_pgtable_ops *ops, unsigned long iova, + if (WARN_ON(iaext || paddr >> cfg->oas)) + return -ERANGE; + +- /* If no access, then nothing to do */ + if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE))) +- return 0; ++ return -EINVAL; + + prot = arm_lpae_prot_to_pte(data, iommu_prot); + ret = __arm_lpae_map(data, iova, paddr, pgsize, pgcount, prot, lvl, +diff --git a/drivers/iommu/io-pgtable-dart.c b/drivers/iommu/io-pgtable-dart.c +index 74b1ef2b96bee..10811e0b773d3 100644 +--- a/drivers/iommu/io-pgtable-dart.c ++++ b/drivers/iommu/io-pgtable-dart.c +@@ -250,9 +250,8 @@ static int dart_map_pages(struct io_pgtable_ops *ops, unsigned long iova, + if (WARN_ON(paddr >> cfg->oas)) + return -ERANGE; + +- /* If no access, then nothing to do */ + if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE))) +- return 0; ++ return -EINVAL; + + tbl = dart_get_table(data, iova); + +diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c +index d5624577f79f1..0407e2b758ef4 100644 +--- a/drivers/iommu/iommufd/ioas.c ++++ b/drivers/iommu/iommufd/ioas.c +@@ -213,6 +213,10 @@ int iommufd_ioas_map(struct iommufd_ucmd *ucmd) + if (cmd->iova >= ULONG_MAX || cmd->length >= ULONG_MAX) + return -EOVERFLOW; + ++ if (!(cmd->flags & ++ (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE))) ++ return -EINVAL; ++ + ioas = iommufd_get_ioas(ucmd->ictx, cmd->ioas_id); + if (IS_ERR(ioas)) + return PTR_ERR(ioas); +@@ -253,6 +257,10 @@ int iommufd_ioas_copy(struct iommufd_ucmd *ucmd) + cmd->dst_iova >= ULONG_MAX) + return -EOVERFLOW; + ++ if (!(cmd->flags & ++ (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE))) ++ return -EINVAL; ++ + src_ioas = iommufd_get_ioas(ucmd->ictx, cmd->src_ioas_id); + if (IS_ERR(src_ioas)) + return PTR_ERR(src_ioas); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 566b02ca78261..53a7b53618d94 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -427,6 +427,8 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs, + struct netlink_ext_ack *extack) + { + struct net_device *bond_dev = xs->xso.dev; ++ struct net_device *real_dev; ++ netdevice_tracker tracker; + struct bond_ipsec *ipsec; + struct bonding *bond; + struct slave *slave; +@@ -438,74 +440,80 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs, + rcu_read_lock(); + bond = netdev_priv(bond_dev); + slave = rcu_dereference(bond->curr_active_slave); +- if (!slave) { +- rcu_read_unlock(); +- return -ENODEV; ++ real_dev = slave ? slave->dev : NULL; ++ netdev_hold(real_dev, &tracker, GFP_ATOMIC); ++ rcu_read_unlock(); ++ if (!real_dev) { ++ err = -ENODEV; ++ goto out; + } + +- if (!slave->dev->xfrmdev_ops || +- !slave->dev->xfrmdev_ops->xdo_dev_state_add || +- netif_is_bond_master(slave->dev)) { ++ if (!real_dev->xfrmdev_ops || ++ !real_dev->xfrmdev_ops->xdo_dev_state_add || ++ netif_is_bond_master(real_dev)) { + NL_SET_ERR_MSG_MOD(extack, "Slave does not support ipsec offload"); +- rcu_read_unlock(); +- return -EINVAL; ++ err = -EINVAL; ++ goto out; + } + +- ipsec = kmalloc(sizeof(*ipsec), GFP_ATOMIC); ++ ipsec = kmalloc(sizeof(*ipsec), GFP_KERNEL); + if (!ipsec) { +- rcu_read_unlock(); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto out; + } +- xs->xso.real_dev = slave->dev; + +- err = slave->dev->xfrmdev_ops->xdo_dev_state_add(xs, extack); ++ xs->xso.real_dev = real_dev; ++ err = real_dev->xfrmdev_ops->xdo_dev_state_add(xs, extack); + if (!err) { + ipsec->xs = xs; + INIT_LIST_HEAD(&ipsec->list); +- spin_lock_bh(&bond->ipsec_lock); ++ mutex_lock(&bond->ipsec_lock); + list_add(&ipsec->list, &bond->ipsec_list); +- spin_unlock_bh(&bond->ipsec_lock); ++ mutex_unlock(&bond->ipsec_lock); + } else { + kfree(ipsec); + } +- rcu_read_unlock(); ++out: ++ netdev_put(real_dev, &tracker); + return err; + } + + static void bond_ipsec_add_sa_all(struct bonding *bond) + { + struct net_device *bond_dev = bond->dev; ++ struct net_device *real_dev; + struct bond_ipsec *ipsec; + struct slave *slave; + +- rcu_read_lock(); +- slave = rcu_dereference(bond->curr_active_slave); +- if (!slave) +- goto out; ++ slave = rtnl_dereference(bond->curr_active_slave); ++ real_dev = slave ? slave->dev : NULL; ++ if (!real_dev) ++ return; + +- if (!slave->dev->xfrmdev_ops || +- !slave->dev->xfrmdev_ops->xdo_dev_state_add || +- netif_is_bond_master(slave->dev)) { +- spin_lock_bh(&bond->ipsec_lock); ++ mutex_lock(&bond->ipsec_lock); ++ if (!real_dev->xfrmdev_ops || ++ !real_dev->xfrmdev_ops->xdo_dev_state_add || ++ netif_is_bond_master(real_dev)) { + if (!list_empty(&bond->ipsec_list)) +- slave_warn(bond_dev, slave->dev, ++ slave_warn(bond_dev, real_dev, + "%s: no slave xdo_dev_state_add\n", + __func__); +- spin_unlock_bh(&bond->ipsec_lock); + goto out; + } + +- spin_lock_bh(&bond->ipsec_lock); + list_for_each_entry(ipsec, &bond->ipsec_list, list) { +- ipsec->xs->xso.real_dev = slave->dev; +- if (slave->dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) { +- slave_warn(bond_dev, slave->dev, "%s: failed to add SA\n", __func__); ++ /* If new state is added before ipsec_lock acquired */ ++ if (ipsec->xs->xso.real_dev == real_dev) ++ continue; ++ ++ ipsec->xs->xso.real_dev = real_dev; ++ if (real_dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) { ++ slave_warn(bond_dev, real_dev, "%s: failed to add SA\n", __func__); + ipsec->xs->xso.real_dev = NULL; + } + } +- spin_unlock_bh(&bond->ipsec_lock); + out: +- rcu_read_unlock(); ++ mutex_unlock(&bond->ipsec_lock); + } + + /** +@@ -515,6 +523,8 @@ static void bond_ipsec_add_sa_all(struct bonding *bond) + static void bond_ipsec_del_sa(struct xfrm_state *xs) + { + struct net_device *bond_dev = xs->xso.dev; ++ struct net_device *real_dev; ++ netdevice_tracker tracker; + struct bond_ipsec *ipsec; + struct bonding *bond; + struct slave *slave; +@@ -525,6 +535,9 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) + rcu_read_lock(); + bond = netdev_priv(bond_dev); + slave = rcu_dereference(bond->curr_active_slave); ++ real_dev = slave ? slave->dev : NULL; ++ netdev_hold(real_dev, &tracker, GFP_ATOMIC); ++ rcu_read_unlock(); + + if (!slave) + goto out; +@@ -532,18 +545,19 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) + if (!xs->xso.real_dev) + goto out; + +- WARN_ON(xs->xso.real_dev != slave->dev); ++ WARN_ON(xs->xso.real_dev != real_dev); + +- if (!slave->dev->xfrmdev_ops || +- !slave->dev->xfrmdev_ops->xdo_dev_state_delete || +- netif_is_bond_master(slave->dev)) { +- slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__); ++ if (!real_dev->xfrmdev_ops || ++ !real_dev->xfrmdev_ops->xdo_dev_state_delete || ++ netif_is_bond_master(real_dev)) { ++ slave_warn(bond_dev, real_dev, "%s: no slave xdo_dev_state_delete\n", __func__); + goto out; + } + +- slave->dev->xfrmdev_ops->xdo_dev_state_delete(xs); ++ real_dev->xfrmdev_ops->xdo_dev_state_delete(xs); + out: +- spin_lock_bh(&bond->ipsec_lock); ++ netdev_put(real_dev, &tracker); ++ mutex_lock(&bond->ipsec_lock); + list_for_each_entry(ipsec, &bond->ipsec_list, list) { + if (ipsec->xs == xs) { + list_del(&ipsec->list); +@@ -551,40 +565,72 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) + break; + } + } +- spin_unlock_bh(&bond->ipsec_lock); +- rcu_read_unlock(); ++ mutex_unlock(&bond->ipsec_lock); + } + + static void bond_ipsec_del_sa_all(struct bonding *bond) + { + struct net_device *bond_dev = bond->dev; ++ struct net_device *real_dev; + struct bond_ipsec *ipsec; + struct slave *slave; + +- rcu_read_lock(); +- slave = rcu_dereference(bond->curr_active_slave); +- if (!slave) { +- rcu_read_unlock(); ++ slave = rtnl_dereference(bond->curr_active_slave); ++ real_dev = slave ? slave->dev : NULL; ++ if (!real_dev) + return; +- } + +- spin_lock_bh(&bond->ipsec_lock); ++ mutex_lock(&bond->ipsec_lock); + list_for_each_entry(ipsec, &bond->ipsec_list, list) { + if (!ipsec->xs->xso.real_dev) + continue; + +- if (!slave->dev->xfrmdev_ops || +- !slave->dev->xfrmdev_ops->xdo_dev_state_delete || +- netif_is_bond_master(slave->dev)) { +- slave_warn(bond_dev, slave->dev, ++ if (!real_dev->xfrmdev_ops || ++ !real_dev->xfrmdev_ops->xdo_dev_state_delete || ++ netif_is_bond_master(real_dev)) { ++ slave_warn(bond_dev, real_dev, + "%s: no slave xdo_dev_state_delete\n", + __func__); + } else { +- slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs); ++ real_dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs); ++ if (real_dev->xfrmdev_ops->xdo_dev_state_free) ++ real_dev->xfrmdev_ops->xdo_dev_state_free(ipsec->xs); + } + } +- spin_unlock_bh(&bond->ipsec_lock); ++ mutex_unlock(&bond->ipsec_lock); ++} ++ ++static void bond_ipsec_free_sa(struct xfrm_state *xs) ++{ ++ struct net_device *bond_dev = xs->xso.dev; ++ struct net_device *real_dev; ++ netdevice_tracker tracker; ++ struct bonding *bond; ++ struct slave *slave; ++ ++ if (!bond_dev) ++ return; ++ ++ rcu_read_lock(); ++ bond = netdev_priv(bond_dev); ++ slave = rcu_dereference(bond->curr_active_slave); ++ real_dev = slave ? slave->dev : NULL; ++ netdev_hold(real_dev, &tracker, GFP_ATOMIC); + rcu_read_unlock(); ++ ++ if (!slave) ++ goto out; ++ ++ if (!xs->xso.real_dev) ++ goto out; ++ ++ WARN_ON(xs->xso.real_dev != real_dev); ++ ++ if (real_dev && real_dev->xfrmdev_ops && ++ real_dev->xfrmdev_ops->xdo_dev_state_free) ++ real_dev->xfrmdev_ops->xdo_dev_state_free(xs); ++out: ++ netdev_put(real_dev, &tracker); + } + + /** +@@ -627,6 +673,7 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) + static const struct xfrmdev_ops bond_xfrmdev_ops = { + .xdo_dev_state_add = bond_ipsec_add_sa, + .xdo_dev_state_delete = bond_ipsec_del_sa, ++ .xdo_dev_state_free = bond_ipsec_free_sa, + .xdo_dev_offload_ok = bond_ipsec_offload_ok, + }; + #endif /* CONFIG_XFRM_OFFLOAD */ +@@ -5897,7 +5944,7 @@ void bond_setup(struct net_device *bond_dev) + /* set up xfrm device ops (only supported in active-backup right now) */ + bond_dev->xfrmdev_ops = &bond_xfrmdev_ops; + INIT_LIST_HEAD(&bond->ipsec_list); +- spin_lock_init(&bond->ipsec_lock); ++ mutex_init(&bond->ipsec_lock); + #endif /* CONFIG_XFRM_OFFLOAD */ + + /* don't acquire bond device's netif_tx_lock when transmitting */ +@@ -5946,6 +5993,10 @@ static void bond_uninit(struct net_device *bond_dev) + __bond_release_one(bond_dev, slave->dev, true, true); + netdev_info(bond_dev, "Released all slaves\n"); + ++#ifdef CONFIG_XFRM_OFFLOAD ++ mutex_destroy(&bond->ipsec_lock); ++#endif /* CONFIG_XFRM_OFFLOAD */ ++ + bond_set_slave_arr(bond, NULL, NULL); + + list_del(&bond->bond_list); +diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c +index 01fed4fe84185..236daa0535ba0 100644 +--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c ++++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c +@@ -51,9 +51,33 @@ static int mana_hwc_verify_resp_msg(const struct hwc_caller_ctx *caller_ctx, + return 0; + } + ++static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, ++ struct hwc_work_request *req) ++{ ++ struct device *dev = hwc_rxq->hwc->dev; ++ struct gdma_sge *sge; ++ int err; ++ ++ sge = &req->sge; ++ sge->address = (u64)req->buf_sge_addr; ++ sge->mem_key = hwc_rxq->msg_buf->gpa_mkey; ++ sge->size = req->buf_len; ++ ++ memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request)); ++ req->wqe_req.sgl = sge; ++ req->wqe_req.num_sge = 1; ++ req->wqe_req.client_data_unit = 0; ++ ++ err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL); ++ if (err) ++ dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err); ++ return err; ++} ++ + static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32 resp_len, +- const struct gdma_resp_hdr *resp_msg) ++ struct hwc_work_request *rx_req) + { ++ const struct gdma_resp_hdr *resp_msg = rx_req->buf_va; + struct hwc_caller_ctx *ctx; + int err; + +@@ -61,6 +85,7 @@ static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32 resp_len, + hwc->inflight_msg_res.map)) { + dev_err(hwc->dev, "hwc_rx: invalid msg_id = %u\n", + resp_msg->response.hwc_msg_id); ++ mana_hwc_post_rx_wqe(hwc->rxq, rx_req); + return; + } + +@@ -74,30 +99,13 @@ static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32 resp_len, + memcpy(ctx->output_buf, resp_msg, resp_len); + out: + ctx->error = err; +- complete(&ctx->comp_event); +-} +- +-static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, +- struct hwc_work_request *req) +-{ +- struct device *dev = hwc_rxq->hwc->dev; +- struct gdma_sge *sge; +- int err; +- +- sge = &req->sge; +- sge->address = (u64)req->buf_sge_addr; +- sge->mem_key = hwc_rxq->msg_buf->gpa_mkey; +- sge->size = req->buf_len; + +- memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request)); +- req->wqe_req.sgl = sge; +- req->wqe_req.num_sge = 1; +- req->wqe_req.client_data_unit = 0; ++ /* Must post rx wqe before complete(), otherwise the next rx may ++ * hit no_wqe error. ++ */ ++ mana_hwc_post_rx_wqe(hwc->rxq, rx_req); + +- err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL); +- if (err) +- dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err); +- return err; ++ complete(&ctx->comp_event); + } + + static void mana_hwc_init_event_handler(void *ctx, struct gdma_queue *q_self, +@@ -234,14 +242,12 @@ static void mana_hwc_rx_event_handler(void *ctx, u32 gdma_rxq_id, + return; + } + +- mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, resp); ++ mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, rx_req); + +- /* Do no longer use 'resp', because the buffer is posted to the HW +- * in the below mana_hwc_post_rx_wqe(). ++ /* Can no longer use 'resp', because the buffer is posted to the HW ++ * in mana_hwc_handle_resp() above. + */ + resp = NULL; +- +- mana_hwc_post_rx_wqe(hwc_rxq, rx_req); + } + + static void mana_hwc_tx_event_handler(void *ctx, u32 gdma_txq_id, +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 931b65591f4d1..9b0b22b65cb25 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1220,7 +1220,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, + sock = sockfd_lookup(fd, &err); + if (!sock) { + pr_debug("gtp socket fd=%d not found\n", fd); +- return NULL; ++ return ERR_PTR(err); + } + + sk = sock->sk; +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +index 2cda1dcfd059a..9943e2d21a8f5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +@@ -867,22 +867,25 @@ int iwl_sar_get_wgds_table(struct iwl_fw_runtime *fwrt) + entry = &wifi_pkg->package.elements[entry_idx]; + entry_idx++; + if (entry->type != ACPI_TYPE_INTEGER || +- entry->integer.value > num_profiles) { ++ entry->integer.value > num_profiles || ++ entry->integer.value < ++ rev_data[idx].min_profiles) { + ret = -EINVAL; + goto out_free; + } +- num_profiles = entry->integer.value; + + /* +- * this also validates >= min_profiles since we +- * otherwise wouldn't have gotten the data when +- * looking up in ACPI ++ * Check to see if we received package count ++ * same as max # of profiles + */ + if (wifi_pkg->package.count != + hdr_size + profile_size * num_profiles) { + ret = -EINVAL; + goto out_free; + } ++ ++ /* Number of valid profiles */ ++ num_profiles = entry->integer.value; + } + goto read_table; + } +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 6f01b7573b23c..b7ead0cd00450 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -4362,11 +4362,27 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter) + if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info)) + wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); + +- wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz; +- if (adapter->config_bands & BAND_A) +- wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz; +- else ++ wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev, ++ &mwifiex_band_2ghz, ++ sizeof(mwifiex_band_2ghz), ++ GFP_KERNEL); ++ if (!wiphy->bands[NL80211_BAND_2GHZ]) { ++ ret = -ENOMEM; ++ goto err; ++ } ++ ++ if (adapter->config_bands & BAND_A) { ++ wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev, ++ &mwifiex_band_5ghz, ++ sizeof(mwifiex_band_5ghz), ++ GFP_KERNEL); ++ if (!wiphy->bands[NL80211_BAND_5GHZ]) { ++ ret = -ENOMEM; ++ goto err; ++ } ++ } else { + wiphy->bands[NL80211_BAND_5GHZ] = NULL; ++ } + + if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info)) + wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs; +@@ -4460,8 +4476,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter) + if (ret < 0) { + mwifiex_dbg(adapter, ERROR, + "%s: wiphy_register failed: %d\n", __func__, ret); +- wiphy_free(wiphy); +- return ret; ++ goto err; + } + + if (!adapter->regd) { +@@ -4503,4 +4518,9 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter) + + adapter->wiphy = wiphy; + return ret; ++ ++err: ++ wiphy_free(wiphy); ++ ++ return ret; + } +diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c +index 871667650dbef..048a552e9da1d 100644 +--- a/drivers/net/wireless/silabs/wfx/sta.c ++++ b/drivers/net/wireless/silabs/wfx/sta.c +@@ -370,8 +370,11 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif) + + ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset, + skb->len - ieoffset); +- if (unlikely(!ptr)) ++ if (!ptr) { ++ /* No RSN IE is fine in open networks */ ++ ret = 0; + goto free_skb; ++ } + + ptr += pairwise_cipher_suite_count_offset; + if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index b19c39dcfbd93..e2bc67300a915 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -1723,6 +1723,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, + } + + pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); ++ if (!dev->poll_mod_count) { ++ nfc_err(dev->dev, ++ "Poll mod list is empty\n"); ++ return -EINVAL; ++ } + + /* Do not always start polling from the same modulation */ + get_random_bytes(&rand_mod, sizeof(rand_mod)); +diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c +index feef537257d05..9ce0d20a6c581 100644 +--- a/drivers/parisc/ccio-dma.c ++++ b/drivers/parisc/ccio-dma.c +@@ -1022,7 +1022,7 @@ static const struct dma_map_ops ccio_ops = { + .map_sg = ccio_map_sg, + .unmap_sg = ccio_unmap_sg, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + +diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c +index 6f5b919280ff0..05e7103d1d407 100644 +--- a/drivers/parisc/sba_iommu.c ++++ b/drivers/parisc/sba_iommu.c +@@ -1090,7 +1090,7 @@ static const struct dma_map_ops sba_ops = { + .map_sg = sba_map_sg, + .unmap_sg = sba_unmap_sg, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + }; + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index 0b9a59d5b8f02..adc6394626ce8 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -176,7 +176,7 @@ static void imx8m_get_phy_tuning_data(struct imx8mq_usb_phy *imx_phy) + imx_phy->comp_dis_tune = + phy_comp_dis_tune_from_property(imx_phy->comp_dis_tune); + +- if (device_property_read_u32(dev, "fsl,pcs-tx-deemph-3p5db-attenuation-db", ++ if (device_property_read_u32(dev, "fsl,phy-pcs-tx-deemph-3p5db-attenuation-db", + &imx_phy->pcs_tx_deemph_3p5db)) + imx_phy->pcs_tx_deemph_3p5db = PHY_TUNE_DEFAULT; + else +diff --git a/drivers/phy/xilinx/phy-zynqmp.c b/drivers/phy/xilinx/phy-zynqmp.c +index 0cb5088e460b5..8c8b1ca31e4c4 100644 +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -166,6 +166,24 @@ + /* Timeout values */ + #define TIMEOUT_US 1000 + ++/* Lane 0/1/2/3 offset */ ++#define DIG_8(n) ((0x4000 * (n)) + 0x1074) ++#define ILL13(n) ((0x4000 * (n)) + 0x1994) ++#define DIG_10(n) ((0x4000 * (n)) + 0x107c) ++#define RST_DLY(n) ((0x4000 * (n)) + 0x19a4) ++#define BYP_15(n) ((0x4000 * (n)) + 0x1038) ++#define BYP_12(n) ((0x4000 * (n)) + 0x102c) ++#define MISC3(n) ((0x4000 * (n)) + 0x19ac) ++#define EQ11(n) ((0x4000 * (n)) + 0x1978) ++ ++static u32 save_reg_address[] = { ++ /* Lane 0/1/2/3 Register */ ++ DIG_8(0), ILL13(0), DIG_10(0), RST_DLY(0), BYP_15(0), BYP_12(0), MISC3(0), EQ11(0), ++ DIG_8(1), ILL13(1), DIG_10(1), RST_DLY(1), BYP_15(1), BYP_12(1), MISC3(1), EQ11(1), ++ DIG_8(2), ILL13(2), DIG_10(2), RST_DLY(2), BYP_15(2), BYP_12(2), MISC3(2), EQ11(2), ++ DIG_8(3), ILL13(3), DIG_10(3), RST_DLY(3), BYP_15(3), BYP_12(3), MISC3(3), EQ11(3), ++}; ++ + struct xpsgtr_dev; + + /** +@@ -214,6 +232,7 @@ struct xpsgtr_phy { + * @tx_term_fix: fix for GT issue + * @saved_icm_cfg0: stored value of ICM CFG0 register + * @saved_icm_cfg1: stored value of ICM CFG1 register ++ * @saved_regs: registers to be saved/restored during suspend/resume + */ + struct xpsgtr_dev { + struct device *dev; +@@ -226,6 +245,7 @@ struct xpsgtr_dev { + bool tx_term_fix; + unsigned int saved_icm_cfg0; + unsigned int saved_icm_cfg1; ++ u32 *saved_regs; + }; + + /* +@@ -299,6 +319,32 @@ static inline void xpsgtr_clr_set_phy(struct xpsgtr_phy *gtr_phy, + writel((readl(addr) & ~clr) | set, addr); + } + ++/** ++ * xpsgtr_save_lane_regs - Saves registers on suspend ++ * @gtr_dev: pointer to phy controller context structure ++ */ ++static void xpsgtr_save_lane_regs(struct xpsgtr_dev *gtr_dev) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(save_reg_address); i++) ++ gtr_dev->saved_regs[i] = xpsgtr_read(gtr_dev, ++ save_reg_address[i]); ++} ++ ++/** ++ * xpsgtr_restore_lane_regs - Restores registers on resume ++ * @gtr_dev: pointer to phy controller context structure ++ */ ++static void xpsgtr_restore_lane_regs(struct xpsgtr_dev *gtr_dev) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(save_reg_address); i++) ++ xpsgtr_write(gtr_dev, save_reg_address[i], ++ gtr_dev->saved_regs[i]); ++} ++ + /* + * Hardware Configuration + */ +@@ -839,6 +885,8 @@ static int xpsgtr_runtime_suspend(struct device *dev) + gtr_dev->saved_icm_cfg0 = xpsgtr_read(gtr_dev, ICM_CFG0); + gtr_dev->saved_icm_cfg1 = xpsgtr_read(gtr_dev, ICM_CFG1); + ++ xpsgtr_save_lane_regs(gtr_dev); ++ + return 0; + } + +@@ -849,6 +897,8 @@ static int xpsgtr_runtime_resume(struct device *dev) + unsigned int i; + bool skip_phy_init; + ++ xpsgtr_restore_lane_regs(gtr_dev); ++ + icm_cfg0 = xpsgtr_read(gtr_dev, ICM_CFG0); + icm_cfg1 = xpsgtr_read(gtr_dev, ICM_CFG1); + +@@ -994,6 +1044,12 @@ static int xpsgtr_probe(struct platform_device *pdev) + return ret; + } + ++ gtr_dev->saved_regs = devm_kmalloc(gtr_dev->dev, ++ sizeof(save_reg_address), ++ GFP_KERNEL); ++ if (!gtr_dev->saved_regs) ++ return -ENOMEM; ++ + return 0; + } + +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +index b7921b59eb7b1..54301fbba524a 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +@@ -709,32 +709,35 @@ static int mtk_pinconf_bias_set_rsel(struct mtk_pinctrl *hw, + { + int err, rsel_val; + +- if (!pullup && arg == MTK_DISABLE) +- return 0; +- + if (hw->rsel_si_unit) { + /* find pin rsel_index from pin_rsel array*/ + err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val); + if (err) +- goto out; ++ return err; + } else { +- if (arg < MTK_PULL_SET_RSEL_000 || +- arg > MTK_PULL_SET_RSEL_111) { +- err = -EINVAL; +- goto out; +- } ++ if (arg < MTK_PULL_SET_RSEL_000 || arg > MTK_PULL_SET_RSEL_111) ++ return -EINVAL; + + rsel_val = arg - MTK_PULL_SET_RSEL_000; + } + +- err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val); +- if (err) +- goto out; ++ return mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val); ++} + +- err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, MTK_ENABLE); ++static int mtk_pinconf_bias_set_pu_pd_rsel(struct mtk_pinctrl *hw, ++ const struct mtk_pin_desc *desc, ++ u32 pullup, u32 arg) ++{ ++ u32 enable = arg == MTK_DISABLE ? MTK_DISABLE : MTK_ENABLE; ++ int err; + +-out: +- return err; ++ if (arg != MTK_DISABLE) { ++ err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg); ++ if (err) ++ return err; ++ } ++ ++ return mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, enable); + } + + int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw, +@@ -750,22 +753,22 @@ int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw, + try_all_type = MTK_PULL_TYPE_MASK; + + if (try_all_type & MTK_PULL_RSEL_TYPE) { +- err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg); ++ err = mtk_pinconf_bias_set_pu_pd_rsel(hw, desc, pullup, arg); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PU_PD_TYPE) { + err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, arg); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PULLSEL_TYPE) { + err = mtk_pinconf_bias_set_pullsel_pullen(hw, desc, + pullup, arg); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE) +@@ -803,9 +806,9 @@ static int mtk_rsel_get_si_unit(struct mtk_pinctrl *hw, + return 0; + } + +-static int mtk_pinconf_bias_get_rsel(struct mtk_pinctrl *hw, +- const struct mtk_pin_desc *desc, +- u32 *pullup, u32 *enable) ++static int mtk_pinconf_bias_get_pu_pd_rsel(struct mtk_pinctrl *hw, ++ const struct mtk_pin_desc *desc, ++ u32 *pullup, u32 *enable) + { + int pu, pd, rsel, err; + +@@ -939,22 +942,22 @@ int mtk_pinconf_bias_get_combo(struct mtk_pinctrl *hw, + try_all_type = MTK_PULL_TYPE_MASK; + + if (try_all_type & MTK_PULL_RSEL_TYPE) { +- err = mtk_pinconf_bias_get_rsel(hw, desc, pullup, enable); ++ err = mtk_pinconf_bias_get_pu_pd_rsel(hw, desc, pullup, enable); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PU_PD_TYPE) { + err = mtk_pinconf_bias_get_pu_pd(hw, desc, pullup, enable); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PULLSEL_TYPE) { + err = mtk_pinconf_bias_get_pullsel_pullen(hw, desc, + pullup, enable); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE) +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index b02eaba010d10..b5a02335617d7 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3802,7 +3802,7 @@ static struct rockchip_pin_bank rk3328_pin_banks[] = { + PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(1, 32, "gpio1", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(2, 32, "gpio2", 0, +- 0, ++ IOMUX_WIDTH_2BIT, + IOMUX_WIDTH_3BIT, + 0), + PIN_BANK_IOMUX_FLAGS(3, 32, "gpio3", +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 17e08f21756c3..bbe7cc894b1a1 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -349,6 +349,8 @@ static int pcs_get_function(struct pinctrl_dev *pctldev, unsigned pin, + return -ENOTSUPP; + fselector = setting->func; + function = pinmux_generic_get_function(pctldev, fselector); ++ if (!function) ++ return -EINVAL; + *func = function->data; + if (!(*func)) { + dev_err(pcs->dev, "%s could not find function%i\n", +diff --git a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c +index b4f7995726894..a3fee55479d20 100644 +--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c ++++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c +@@ -805,12 +805,12 @@ static int jh7110_irq_set_type(struct irq_data *d, unsigned int trigger) + case IRQ_TYPE_LEVEL_HIGH: + irq_type = 0; /* 0: level triggered */ + edge_both = 0; /* 0: ignored */ +- polarity = mask; /* 1: high level */ ++ polarity = 0; /* 0: high level */ + break; + case IRQ_TYPE_LEVEL_LOW: + irq_type = 0; /* 0: level triggered */ + edge_both = 0; /* 0: ignored */ +- polarity = 0; /* 0: low level */ ++ polarity = mask; /* 1: low level */ + break; + default: + return -EINVAL; +diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c +index 44c6301f5f174..5b3681b9100c1 100644 +--- a/drivers/power/supply/qcom_battmgr.c ++++ b/drivers/power/supply/qcom_battmgr.c +@@ -1384,12 +1384,16 @@ static int qcom_battmgr_probe(struct auxiliary_device *adev, + "failed to register wireless charing power supply\n"); + } + +- battmgr->client = devm_pmic_glink_register_client(dev, +- PMIC_GLINK_OWNER_BATTMGR, +- qcom_battmgr_callback, +- qcom_battmgr_pdr_notify, +- battmgr); +- return PTR_ERR_OR_ZERO(battmgr->client); ++ battmgr->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_BATTMGR, ++ qcom_battmgr_callback, ++ qcom_battmgr_pdr_notify, ++ battmgr); ++ if (IS_ERR(battmgr->client)) ++ return PTR_ERR(battmgr->client); ++ ++ pmic_glink_client_register(battmgr->client); ++ ++ return 0; + } + + static const struct auxiliary_device_id qcom_battmgr_id_table[] = { +diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c +index bd99c5492b7d4..0f64b02443037 100644 +--- a/drivers/scsi/aacraid/comminit.c ++++ b/drivers/scsi/aacraid/comminit.c +@@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) + + if (aac_comm_init(dev)<0){ + kfree(dev->queues); ++ dev->queues = NULL; + return NULL; + } + /* +@@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) + */ + if (aac_fib_setup(dev) < 0) { + kfree(dev->queues); ++ dev->queues = NULL; + return NULL; + } + +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 6dd43fff07ad5..4fce7cc32cb2c 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1690,13 +1690,15 @@ static int sd_sync_cache(struct scsi_disk *sdkp) + (sshdr.asc == 0x74 && sshdr.ascq == 0x71)) /* drive is password locked */ + /* this is no error here */ + return 0; ++ + /* +- * This drive doesn't support sync and there's not much +- * we can do because this is called during shutdown +- * or suspend so just return success so those operations +- * can proceed. ++ * If a format is in progress or if the drive does not ++ * support sync, there is not much we can do because ++ * this is called during shutdown or suspend so just ++ * return success so those operations can proceed. + */ +- if (sshdr.sense_key == ILLEGAL_REQUEST) ++ if ((sshdr.asc == 0x04 && sshdr.ascq == 0x04) || ++ sshdr.sense_key == ILLEGAL_REQUEST) + return 0; + } + +diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c +index c2d0e8fb7141a..ab2418d2fe43a 100644 +--- a/drivers/soc/qcom/cmd-db.c ++++ b/drivers/soc/qcom/cmd-db.c +@@ -354,7 +354,7 @@ static int cmd_db_dev_probe(struct platform_device *pdev) + return -EINVAL; + } + +- cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB); ++ cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WC); + if (!cmd_db_header) { + ret = -ENOMEM; + cmd_db_header = NULL; +diff --git a/drivers/soc/qcom/pmic_glink.c b/drivers/soc/qcom/pmic_glink.c +index 71d261ac8aa45..7e50eeb4cc6f2 100644 +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -69,15 +69,14 @@ static void _devm_pmic_glink_release_client(struct device *dev, void *res) + spin_unlock_irqrestore(&pg->client_lock, flags); + } + +-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, +- unsigned int id, +- void (*cb)(const void *, size_t, void *), +- void (*pdr)(void *, int), +- void *priv) ++struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev, ++ unsigned int id, ++ void (*cb)(const void *, size_t, void *), ++ void (*pdr)(void *, int), ++ void *priv) + { + struct pmic_glink_client *client; + struct pmic_glink *pg = dev_get_drvdata(dev->parent); +- unsigned long flags; + + client = devres_alloc(_devm_pmic_glink_release_client, sizeof(*client), GFP_KERNEL); + if (!client) +@@ -88,6 +87,18 @@ struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, + client->cb = cb; + client->pdr_notify = pdr; + client->priv = priv; ++ INIT_LIST_HEAD(&client->node); ++ ++ devres_add(dev, client); ++ ++ return client; ++} ++EXPORT_SYMBOL_GPL(devm_pmic_glink_client_alloc); ++ ++void pmic_glink_client_register(struct pmic_glink_client *client) ++{ ++ struct pmic_glink *pg = client->pg; ++ unsigned long flags; + + mutex_lock(&pg->state_lock); + spin_lock_irqsave(&pg->client_lock, flags); +@@ -98,11 +109,8 @@ struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, + spin_unlock_irqrestore(&pg->client_lock, flags); + mutex_unlock(&pg->state_lock); + +- devres_add(dev, client); +- +- return client; + } +-EXPORT_SYMBOL_GPL(devm_pmic_glink_register_client); ++EXPORT_SYMBOL_GPL(pmic_glink_client_register); + + int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len) + { +@@ -178,7 +186,7 @@ static void pmic_glink_state_notify_clients(struct pmic_glink *pg) + if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept) + new_state = SERVREG_SERVICE_STATE_UP; + } else { +- if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept) ++ if (pg->pdr_state == SERVREG_SERVICE_STATE_DOWN || !pg->ept) + new_state = SERVREG_SERVICE_STATE_DOWN; + } + +diff --git a/drivers/soc/qcom/pmic_glink_altmode.c b/drivers/soc/qcom/pmic_glink_altmode.c +index a35df66bb07b5..60b0d79efb0f1 100644 +--- a/drivers/soc/qcom/pmic_glink_altmode.c ++++ b/drivers/soc/qcom/pmic_glink_altmode.c +@@ -529,12 +529,17 @@ static int pmic_glink_altmode_probe(struct auxiliary_device *adev, + return ret; + } + +- altmode->client = devm_pmic_glink_register_client(dev, +- altmode->owner_id, +- pmic_glink_altmode_callback, +- pmic_glink_altmode_pdr_notify, +- altmode); +- return PTR_ERR_OR_ZERO(altmode->client); ++ altmode->client = devm_pmic_glink_client_alloc(dev, ++ altmode->owner_id, ++ pmic_glink_altmode_callback, ++ pmic_glink_altmode_pdr_notify, ++ altmode); ++ if (IS_ERR(altmode->client)) ++ return PTR_ERR(altmode->client); ++ ++ pmic_glink_client_register(altmode->client); ++ ++ return 0; + } + + static const struct auxiliary_device_id pmic_glink_altmode_id_table[] = { +diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c +index 68d54887992d9..cf69d5c415fbf 100644 +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -1286,18 +1286,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_prop(struct sdw_slave *slave, + unsigned int port_num) + { + struct sdw_dpn_prop *dpn_prop; +- u8 num_ports; ++ unsigned long mask; + int i; + + if (direction == SDW_DATA_DIR_TX) { +- num_ports = hweight32(slave->prop.source_ports); ++ mask = slave->prop.source_ports; + dpn_prop = slave->prop.src_dpn_prop; + } else { +- num_ports = hweight32(slave->prop.sink_ports); ++ mask = slave->prop.sink_ports; + dpn_prop = slave->prop.sink_dpn_prop; + } + +- for (i = 0; i < num_ports; i++) { ++ for_each_set_bit(i, &mask, 32) { + if (dpn_prop[i].num == port_num) + return &dpn_prop[i]; + } +diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c +index d5174f11b91c2..d8dfcd49695d3 100644 +--- a/drivers/thermal/thermal_of.c ++++ b/drivers/thermal/thermal_of.c +@@ -123,7 +123,7 @@ static int thermal_of_populate_trip(struct device_node *np, + static struct thermal_trip *thermal_of_trips_init(struct device_node *np, int *ntrips) + { + struct thermal_trip *tt; +- struct device_node *trips, *trip; ++ struct device_node *trips; + int ret, count; + + trips = of_get_child_by_name(np, "trips"); +@@ -148,7 +148,7 @@ static struct thermal_trip *thermal_of_trips_init(struct device_node *np, int *n + *ntrips = count; + + count = 0; +- for_each_child_of_node(trips, trip) { ++ for_each_child_of_node_scoped(trips, trip) { + ret = thermal_of_populate_trip(trip, &tt[count++]); + if (ret) + goto out_kfree; +@@ -182,14 +182,14 @@ static struct device_node *of_thermal_zone_find(struct device_node *sensor, int + * Search for each thermal zone, a defined sensor + * corresponding to the one passed as parameter + */ +- for_each_available_child_of_node(np, tz) { ++ for_each_available_child_of_node_scoped(np, child) { + + int count, i; + +- count = of_count_phandle_with_args(tz, "thermal-sensors", ++ count = of_count_phandle_with_args(child, "thermal-sensors", + "#thermal-sensor-cells"); + if (count <= 0) { +- pr_err("%pOFn: missing thermal sensor\n", tz); ++ pr_err("%pOFn: missing thermal sensor\n", child); + tz = ERR_PTR(-EINVAL); + goto out; + } +@@ -198,18 +198,19 @@ static struct device_node *of_thermal_zone_find(struct device_node *sensor, int + + int ret; + +- ret = of_parse_phandle_with_args(tz, "thermal-sensors", ++ ret = of_parse_phandle_with_args(child, "thermal-sensors", + "#thermal-sensor-cells", + i, &sensor_specs); + if (ret < 0) { +- pr_err("%pOFn: Failed to read thermal-sensors cells: %d\n", tz, ret); ++ pr_err("%pOFn: Failed to read thermal-sensors cells: %d\n", child, ret); + tz = ERR_PTR(ret); + goto out; + } + + if ((sensor == sensor_specs.np) && id == (sensor_specs.args_count ? + sensor_specs.args[0] : 0)) { +- pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, tz); ++ pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, child); ++ tz = no_free_ptr(child); + goto out; + } + } +diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h +index e1b5801fdddf8..9a5577a772af6 100644 +--- a/drivers/usb/cdns3/cdnsp-gadget.h ++++ b/drivers/usb/cdns3/cdnsp-gadget.h +@@ -811,6 +811,7 @@ struct cdnsp_stream_info { + * generate Missed Service Error Event. + * Set skip flag when receive a Missed Service Error Event and + * process the missed tds on the endpoint ring. ++ * @wa1_nop_trb: hold pointer to NOP trb. + */ + struct cdnsp_ep { + struct usb_ep endpoint; +@@ -838,6 +839,8 @@ struct cdnsp_ep { + #define EP_UNCONFIGURED BIT(7) + + bool skip; ++ union cdnsp_trb *wa1_nop_trb; ++ + }; + + /** +diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c +index 275a6a2fa671e..e0e97a1386662 100644 +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -402,7 +402,7 @@ static u64 cdnsp_get_hw_deq(struct cdnsp_device *pdev, + struct cdnsp_stream_ctx *st_ctx; + struct cdnsp_ep *pep; + +- pep = &pdev->eps[stream_id]; ++ pep = &pdev->eps[ep_index]; + + if (pep->ep_state & EP_HAS_STREAMS) { + st_ctx = &pep->stream_info.stream_ctx_array[stream_id]; +@@ -1904,6 +1904,23 @@ int cdnsp_queue_bulk_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq) + if (ret) + return ret; + ++ /* ++ * workaround 1: STOP EP command on LINK TRB with TC bit set to 1 ++ * causes that internal cycle bit can have incorrect state after ++ * command complete. In consequence empty transfer ring can be ++ * incorrectly detected when EP is resumed. ++ * NOP TRB before LINK TRB avoid such scenario. STOP EP command is ++ * then on NOP TRB and internal cycle bit is not changed and have ++ * correct value. ++ */ ++ if (pep->wa1_nop_trb) { ++ field = le32_to_cpu(pep->wa1_nop_trb->trans_event.flags); ++ field ^= TRB_CYCLE; ++ ++ pep->wa1_nop_trb->trans_event.flags = cpu_to_le32(field); ++ pep->wa1_nop_trb = NULL; ++ } ++ + /* + * Don't give the first TRB to the hardware (by toggling the cycle bit) + * until we've finished creating all the other TRBs. The ring's cycle +@@ -1999,6 +2016,17 @@ int cdnsp_queue_bulk_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq) + send_addr = addr; + } + ++ if (cdnsp_trb_is_link(ring->enqueue + 1)) { ++ field = TRB_TYPE(TRB_TR_NOOP) | TRB_IOC; ++ if (!ring->cycle_state) ++ field |= TRB_CYCLE; ++ ++ pep->wa1_nop_trb = ring->enqueue; ++ ++ cdnsp_queue_trb(pdev, ring, 0, 0x0, 0x0, ++ TRB_INTR_TARGET(0), field); ++ } ++ + cdnsp_check_trb_math(preq, enqd_len); + ret = cdnsp_giveback_first_trb(pdev, pep, preq->request.stream_id, + start_cycle, start_trb); +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 0e7439dba8fe8..0c1b69d944ca4 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1761,6 +1761,9 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ + .driver_info = SINGLE_RX_URB, + }, ++ { USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */ ++ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */ ++ }, + { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, +diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c +index f91f543ec636d..164edebc7f1f5 100644 +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -668,6 +668,7 @@ static int add_power_attributes(struct device *dev) + + static void remove_power_attributes(struct device *dev) + { ++ sysfs_unmerge_group(&dev->kobj, &usb3_hardware_lpm_attr_group); + sysfs_unmerge_group(&dev->kobj, &usb2_hardware_lpm_attr_group); + sysfs_unmerge_group(&dev->kobj, &power_attr_group); + } +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 5ce276cb39d0d..21ff6cbe5e49f 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -553,9 +553,17 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc) + void dwc3_event_buffers_cleanup(struct dwc3 *dwc) + { + struct dwc3_event_buffer *evt; ++ u32 reg; + + if (!dwc->ev_buf) + return; ++ /* ++ * Exynos platforms may not be able to access event buffer if the ++ * controller failed to halt on dwc3_core_exit(). ++ */ ++ reg = dwc3_readl(dwc->regs, DWC3_DSTS); ++ if (!(reg & DWC3_DSTS_DEVCTRLHLT)) ++ return; + + evt = dwc->ev_buf; + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index d5c77db4daa92..2a11fc0ee84f1 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -522,11 +522,13 @@ static int dwc3_omap_probe(struct platform_device *pdev) + if (ret) { + dev_err(dev, "failed to request IRQ #%d --> %d\n", + omap->irq, ret); +- goto err1; ++ goto err2; + } + dwc3_omap_enable_irqs(omap); + return 0; + ++err2: ++ of_platform_depopulate(dev); + err1: + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); +diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c +index 211360eee95a0..c8c7cd0c17969 100644 +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) + dwc3_data->regmap = regmap; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); +- if (!res) { +- ret = -ENXIO; +- goto undo_platform_dev_alloc; +- } ++ if (!res) ++ return -ENXIO; + + dwc3_data->syscfg_reg_off = res->start; + +@@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) + devm_reset_control_get_exclusive(dev, "powerdown"); + if (IS_ERR(dwc3_data->rstc_pwrdn)) { + dev_err(&pdev->dev, "could not get power controller\n"); +- ret = PTR_ERR(dwc3_data->rstc_pwrdn); +- goto undo_platform_dev_alloc; ++ return PTR_ERR(dwc3_data->rstc_pwrdn); + } + + /* Manage PowerDown */ +@@ -269,7 +266,7 @@ static int st_dwc3_probe(struct platform_device *pdev) + if (!child_pdev) { + dev_err(dev, "failed to find dwc3 core device\n"); + ret = -ENODEV; +- goto err_node_put; ++ goto depopulate; + } + + dwc3_data->dr_mode = usb_get_dr_mode(&child_pdev->dev); +@@ -285,6 +282,7 @@ static int st_dwc3_probe(struct platform_device *pdev) + ret = st_dwc3_drd_init(dwc3_data); + if (ret) { + dev_err(dev, "drd initialisation failed\n"); ++ of_platform_depopulate(dev); + goto undo_softreset; + } + +@@ -294,14 +292,14 @@ static int st_dwc3_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dwc3_data); + return 0; + ++depopulate: ++ of_platform_depopulate(dev); + err_node_put: + of_node_put(child); + undo_softreset: + reset_control_assert(dwc3_data->rstc_rst); + undo_powerdown: + reset_control_assert(dwc3_data->rstc_pwrdn); +-undo_platform_dev_alloc: +- platform_device_put(pdev); + return ret; + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 311040f9b9352..176f38750ad58 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -619,6 +619,8 @@ static void option_instat_callback(struct urb *urb); + + /* MeiG Smart Technology products */ + #define MEIGSMART_VENDOR_ID 0x2dee ++/* MeiG Smart SRM825L based on Qualcomm 315 */ ++#define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 + +@@ -2366,6 +2368,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 7db9c382c354d..e053b6e99b9e4 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -2403,7 +2403,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port) + { + struct usb_power_delivery_desc desc = { port->negotiated_rev }; + struct usb_power_delivery_capabilities_desc caps = { }; +- struct usb_power_delivery_capabilities *cap; ++ struct usb_power_delivery_capabilities *cap = port->partner_source_caps; + + if (!port->partner_pd) + port->partner_pd = usb_power_delivery_register(NULL, &desc); +@@ -2413,6 +2413,11 @@ static int tcpm_register_source_caps(struct tcpm_port *port) + memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps); + caps.role = TYPEC_SOURCE; + ++ if (cap) { ++ usb_power_delivery_unregister_capabilities(cap); ++ port->partner_source_caps = NULL; ++ } ++ + cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps); + if (IS_ERR(cap)) + return PTR_ERR(cap); +@@ -2426,7 +2431,7 @@ static int tcpm_register_sink_caps(struct tcpm_port *port) + { + struct usb_power_delivery_desc desc = { port->negotiated_rev }; + struct usb_power_delivery_capabilities_desc caps = { }; +- struct usb_power_delivery_capabilities *cap = port->partner_source_caps; ++ struct usb_power_delivery_capabilities *cap; + + if (!port->partner_pd) + port->partner_pd = usb_power_delivery_register(NULL, &desc); +@@ -2436,11 +2441,6 @@ static int tcpm_register_sink_caps(struct tcpm_port *port) + memcpy(caps.pdo, port->sink_caps, sizeof(u32) * port->nr_sink_caps); + caps.role = TYPEC_SINK; + +- if (cap) { +- usb_power_delivery_unregister_capabilities(cap); +- port->partner_source_caps = NULL; +- } +- + cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps); + if (IS_ERR(cap)) + return PTR_ERR(cap); +diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c +index 7625e28e12a80..94f2df02f06ee 100644 +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -376,12 +376,16 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, + "failed to acquire orientation-switch\n"); + } + +- ucsi->client = devm_pmic_glink_register_client(dev, +- PMIC_GLINK_OWNER_USBC, +- pmic_glink_ucsi_callback, +- pmic_glink_ucsi_pdr_notify, +- ucsi); +- return PTR_ERR_OR_ZERO(ucsi->client); ++ ucsi->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_USBC, ++ pmic_glink_ucsi_callback, ++ pmic_glink_ucsi_pdr_notify, ++ ucsi); ++ if (IS_ERR(ucsi->client)) ++ return PTR_ERR(ucsi->client); ++ ++ pmic_glink_client_register(ucsi->client); ++ ++ return 0; + } + + static void pmic_glink_ucsi_remove(struct auxiliary_device *adev) +diff --git a/drivers/xen/grant-dma-ops.c b/drivers/xen/grant-dma-ops.c +index 29257d2639dbf..76f6f26265a3b 100644 +--- a/drivers/xen/grant-dma-ops.c ++++ b/drivers/xen/grant-dma-ops.c +@@ -282,7 +282,7 @@ static int xen_grant_dma_supported(struct device *dev, u64 mask) + static const struct dma_map_ops xen_grant_dma_ops = { + .alloc = xen_grant_dma_alloc, + .free = xen_grant_dma_free, +- .alloc_pages_op = xen_grant_dma_alloc_pages, ++ .alloc_pages = xen_grant_dma_alloc_pages, + .free_pages = xen_grant_dma_free_pages, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c +index 1c4ef5111651d..0e6c6c25d154f 100644 +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -403,7 +403,7 @@ const struct dma_map_ops xen_swiotlb_dma_ops = { + .dma_supported = xen_swiotlb_dma_supported, + .mmap = dma_common_mmap, + .get_sgtable = dma_common_get_sgtable, +- .alloc_pages_op = dma_common_alloc_pages, ++ .alloc_pages = dma_common_alloc_pages, + .free_pages = dma_common_free_pages, + .max_mapping_size = swiotlb_max_mapping_size, + }; +diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c +index e47eb248309f8..650972895652d 100644 +--- a/fs/btrfs/bio.c ++++ b/fs/btrfs/bio.c +@@ -646,7 +646,6 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) + { + struct btrfs_inode *inode = bbio->inode; + struct btrfs_fs_info *fs_info = bbio->fs_info; +- struct btrfs_bio *orig_bbio = bbio; + struct bio *bio = &bbio->bio; + u64 logical = bio->bi_iter.bi_sector << SECTOR_SHIFT; + u64 length = bio->bi_iter.bi_size; +@@ -682,7 +681,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) + bbio->saved_iter = bio->bi_iter; + ret = btrfs_lookup_bio_sums(bbio); + if (ret) +- goto fail_put_bio; ++ goto fail; + } + + if (btrfs_op(bio) == BTRFS_MAP_WRITE) { +@@ -704,13 +703,13 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) + + ret = btrfs_bio_csum(bbio); + if (ret) +- goto fail_put_bio; ++ goto fail; + } else if (use_append || + (btrfs_is_zoned(fs_info) && inode && + inode->flags & BTRFS_INODE_NODATASUM)) { + ret = btrfs_alloc_dummy_sum(bbio); + if (ret) +- goto fail_put_bio; ++ goto fail; + } + } + +@@ -718,12 +717,23 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) + done: + return map_length == length; + +-fail_put_bio: +- if (map_length < length) +- btrfs_cleanup_bio(bbio); + fail: + btrfs_bio_counter_dec(fs_info); +- btrfs_bio_end_io(orig_bbio, ret); ++ /* ++ * We have split the original bbio, now we have to end both the current ++ * @bbio and remaining one, as the remaining one will never be submitted. ++ */ ++ if (map_length < length) { ++ struct btrfs_bio *remaining = bbio->private; ++ ++ ASSERT(bbio->bio.bi_pool == &btrfs_clone_bioset); ++ ASSERT(remaining); ++ ++ remaining->bio.bi_status = ret; ++ btrfs_orig_bbio_end_io(remaining); ++ } ++ bbio->bio.bi_status = ret; ++ btrfs_orig_bbio_end_io(bbio); + /* Do not submit another chunk */ + return true; + } +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index efe84be65a440..74b82390fe847 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3762,6 +3762,8 @@ static int try_flush_qgroup(struct btrfs_root *root) + return 0; + } + ++ btrfs_run_delayed_iputs(root->fs_info); ++ btrfs_wait_on_delayed_iputs(root->fs_info); + ret = btrfs_start_delalloc_snapshot(root, true); + if (ret < 0) + goto out; +diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c +index 488f920f79d28..0f3768cf9e871 100644 +--- a/fs/overlayfs/params.c ++++ b/fs/overlayfs/params.c +@@ -357,6 +357,8 @@ static void ovl_add_layer(struct fs_context *fc, enum ovl_opt layer, + case Opt_datadir_add: + ctx->nr_data++; + fallthrough; ++ case Opt_lowerdir: ++ fallthrough; + case Opt_lowerdir_add: + WARN_ON(ctx->nr >= ctx->capacity); + l = &ctx->lower[ctx->nr++]; +@@ -369,10 +371,9 @@ static void ovl_add_layer(struct fs_context *fc, enum ovl_opt layer, + } + } + +-static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param, +- enum ovl_opt layer) ++static int ovl_parse_layer(struct fs_context *fc, const char *layer_name, enum ovl_opt layer) + { +- char *name = kstrdup(param->string, GFP_KERNEL); ++ char *name = kstrdup(layer_name, GFP_KERNEL); + bool upper = (layer == Opt_upperdir || layer == Opt_workdir); + struct path path; + int err; +@@ -380,7 +381,7 @@ static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param, + if (!name) + return -ENOMEM; + +- if (upper) ++ if (upper || layer == Opt_lowerdir) + err = ovl_mount_dir(name, &path); + else + err = ovl_mount_dir_noesc(name, &path); +@@ -436,7 +437,6 @@ static int ovl_parse_param_lowerdir(const char *name, struct fs_context *fc) + { + int err; + struct ovl_fs_context *ctx = fc->fs_private; +- struct ovl_fs_context_layer *l; + char *dup = NULL, *iter; + ssize_t nr_lower, nr; + bool data_layer = false; +@@ -453,7 +453,7 @@ static int ovl_parse_param_lowerdir(const char *name, struct fs_context *fc) + return 0; + + if (*name == ':') { +- pr_err("cannot append lower layer"); ++ pr_err("cannot append lower layer\n"); + return -EINVAL; + } + +@@ -476,35 +476,11 @@ static int ovl_parse_param_lowerdir(const char *name, struct fs_context *fc) + goto out_err; + } + +- if (nr_lower > ctx->capacity) { +- err = -ENOMEM; +- l = krealloc_array(ctx->lower, nr_lower, sizeof(*ctx->lower), +- GFP_KERNEL_ACCOUNT); +- if (!l) +- goto out_err; +- +- ctx->lower = l; +- ctx->capacity = nr_lower; +- } +- + iter = dup; +- l = ctx->lower; +- for (nr = 0; nr < nr_lower; nr++, l++) { +- ctx->nr++; +- memset(l, 0, sizeof(*l)); +- +- err = ovl_mount_dir(iter, &l->path); ++ for (nr = 0; nr < nr_lower; nr++) { ++ err = ovl_parse_layer(fc, iter, Opt_lowerdir); + if (err) +- goto out_put; +- +- err = ovl_mount_dir_check(fc, &l->path, Opt_lowerdir, iter, false); +- if (err) +- goto out_put; +- +- err = -ENOMEM; +- l->name = kstrdup(iter, GFP_KERNEL_ACCOUNT); +- if (!l->name) +- goto out_put; ++ goto out_err; + + if (data_layer) + ctx->nr_data++; +@@ -521,8 +497,8 @@ static int ovl_parse_param_lowerdir(const char *name, struct fs_context *fc) + * there are no data layers. + */ + if (ctx->nr_data > 0) { +- pr_err("regular lower layers cannot follow data lower layers"); +- goto out_put; ++ pr_err("regular lower layers cannot follow data lower layers\n"); ++ goto out_err; + } + + data_layer = false; +@@ -536,9 +512,6 @@ static int ovl_parse_param_lowerdir(const char *name, struct fs_context *fc) + kfree(dup); + return 0; + +-out_put: +- ovl_reset_lowerdirs(ctx); +- + out_err: + kfree(dup); + +@@ -586,7 +559,7 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param) + case Opt_datadir_add: + case Opt_upperdir: + case Opt_workdir: +- err = ovl_parse_layer(fc, param, opt); ++ err = ovl_parse_layer(fc, param->string, opt); + break; + case Opt_default_permissions: + config->default_permissions = true; +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 66cfce456263b..012d6ec12a691 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -3251,6 +3251,7 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + struct inode *inode = file_inode(file); + struct cifsFileInfo *cfile = file->private_data; + struct file_zero_data_information fsctl_buf; ++ unsigned long long end = offset + len, i_size, remote_i_size; + long rc; + unsigned int xid; + __u8 set_sparse = 1; +@@ -3282,6 +3283,27 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + (char *)&fsctl_buf, + sizeof(struct file_zero_data_information), + CIFSMaxBufSize, NULL, NULL); ++ ++ if (rc) ++ goto unlock; ++ ++ /* If there's dirty data in the buffer that would extend the EOF if it ++ * were written, then we need to move the EOF marker over to the lower ++ * of the high end of the hole and the proposed EOF. The problem is ++ * that we locally hole-punch the tail of the dirty data, the proposed ++ * EOF update will end up in the wrong place. ++ */ ++ i_size = i_size_read(inode); ++ remote_i_size = netfs_inode(inode)->remote_i_size; ++ if (end > remote_i_size && i_size > remote_i_size) { ++ unsigned long long extend_to = umin(end, i_size); ++ rc = SMB2_set_eof(xid, tcon, cfile->fid.persistent_fid, ++ cfile->fid.volatile_fid, cfile->pid, extend_to); ++ if (rc >= 0) ++ netfs_inode(inode)->remote_i_size = extend_to; ++ } ++ ++unlock: + filemap_invalidate_unlock(inode->i_mapping); + out: + inode_unlock(inode); +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 61df8a5c68242..bf45b8652e580 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -4431,7 +4431,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len, + * If we want to do a RDMA write, fill in and append + * smbd_buffer_descriptor_v1 to the end of read request + */ +- if (smb3_use_rdma_offload(io_parms)) { ++ if (rdata && smb3_use_rdma_offload(io_parms)) { + struct smbd_buffer_descriptor_v1 *v1; + bool need_invalidate = server->dialect == SMB30_PROT_ID; + +diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h +index 3a8a015fdd2ed..f2fc203fb8a1a 100644 +--- a/include/linux/dma-map-ops.h ++++ b/include/linux/dma-map-ops.h +@@ -28,7 +28,7 @@ struct dma_map_ops { + unsigned long attrs); + void (*free)(struct device *dev, size_t size, void *vaddr, + dma_addr_t dma_handle, unsigned long attrs); +- struct page *(*alloc_pages_op)(struct device *dev, size_t size, ++ struct page *(*alloc_pages)(struct device *dev, size_t size, + dma_addr_t *dma_handle, enum dma_data_direction dir, + gfp_t gfp); + void (*free_pages)(struct device *dev, size_t size, struct page *vaddr, +diff --git a/include/linux/of.h b/include/linux/of.h +index 6a9ddf20e79ab..024dda54b9c77 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -13,6 +13,7 @@ + */ + #include <linux/types.h> + #include <linux/bitops.h> ++#include <linux/cleanup.h> + #include <linux/errno.h> + #include <linux/kobject.h> + #include <linux/mod_devicetable.h> +@@ -134,6 +135,7 @@ static inline struct device_node *of_node_get(struct device_node *node) + } + static inline void of_node_put(struct device_node *node) { } + #endif /* !CONFIG_OF_DYNAMIC */ ++DEFINE_FREE(device_node, struct device_node *, if (_T) of_node_put(_T)) + + /* Pointer for first entry in chain of all nodes. */ + extern struct device_node *of_root; +@@ -1428,10 +1430,23 @@ static inline int of_property_read_s32(const struct device_node *np, + #define for_each_child_of_node(parent, child) \ + for (child = of_get_next_child(parent, NULL); child != NULL; \ + child = of_get_next_child(parent, child)) ++ ++#define for_each_child_of_node_scoped(parent, child) \ ++ for (struct device_node *child __free(device_node) = \ ++ of_get_next_child(parent, NULL); \ ++ child != NULL; \ ++ child = of_get_next_child(parent, child)) ++ + #define for_each_available_child_of_node(parent, child) \ + for (child = of_get_next_available_child(parent, NULL); child != NULL; \ + child = of_get_next_available_child(parent, child)) + ++#define for_each_available_child_of_node_scoped(parent, child) \ ++ for (struct device_node *child __free(device_node) = \ ++ of_get_next_available_child(parent, NULL); \ ++ child != NULL; \ ++ child = of_get_next_available_child(parent, child)) ++ + #define for_each_of_cpu_node(cpu) \ + for (cpu = of_get_next_cpu_node(NULL); cpu != NULL; \ + cpu = of_get_next_cpu_node(cpu)) +diff --git a/include/linux/soc/qcom/pmic_glink.h b/include/linux/soc/qcom/pmic_glink.h +index fd124aa18c81a..7cddf10277528 100644 +--- a/include/linux/soc/qcom/pmic_glink.h ++++ b/include/linux/soc/qcom/pmic_glink.h +@@ -23,10 +23,11 @@ struct pmic_glink_hdr { + + int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len); + +-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, +- unsigned int id, +- void (*cb)(const void *, size_t, void *), +- void (*pdr)(void *, int), +- void *priv); ++struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev, ++ unsigned int id, ++ void (*cb)(const void *, size_t, void *), ++ void (*pdr)(void *, int), ++ void *priv); ++void pmic_glink_client_register(struct pmic_glink_client *client); + + #endif +diff --git a/include/net/bonding.h b/include/net/bonding.h +index 5b8b1b644a2db..94594026a5c55 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -258,7 +258,7 @@ struct bonding { + #ifdef CONFIG_XFRM_OFFLOAD + struct list_head ipsec_list; + /* protecting ipsec_list */ +- spinlock_t ipsec_lock; ++ struct mutex ipsec_lock; + #endif /* CONFIG_XFRM_OFFLOAD */ + struct bpf_prog *xdp_prog; + }; +diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h +index 4dabeb6c76d31..9f2ce4d05c265 100644 +--- a/include/net/busy_poll.h ++++ b/include/net/busy_poll.h +@@ -64,7 +64,7 @@ static inline bool sk_can_busy_loop(struct sock *sk) + static inline unsigned long busy_loop_current_time(void) + { + #ifdef CONFIG_NET_RX_BUSY_POLL +- return (unsigned long)(local_clock() >> 10); ++ return (unsigned long)(ktime_get_ns() >> 10); + #else + return 0; + #endif +diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h +index 60a7d0ce30804..fcf967286e37c 100644 +--- a/include/net/netfilter/nf_tables_ipv4.h ++++ b/include/net/netfilter/nf_tables_ipv4.h +@@ -19,7 +19,7 @@ static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt) + static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) + { + struct iphdr *iph, _iph; +- u32 len, thoff; ++ u32 len, thoff, skb_len; + + iph = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb), + sizeof(*iph), &_iph); +@@ -30,8 +30,10 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) + return -1; + + len = iph_totlen(pkt->skb, iph); +- thoff = skb_network_offset(pkt->skb) + (iph->ihl * 4); +- if (pkt->skb->len < len) ++ thoff = iph->ihl * 4; ++ skb_len = pkt->skb->len - skb_network_offset(pkt->skb); ++ ++ if (skb_len < len) + return -1; + else if (len < thoff) + return -1; +@@ -40,7 +42,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) + + pkt->flags = NFT_PKTINFO_L4PROTO; + pkt->tprot = iph->protocol; +- pkt->thoff = thoff; ++ pkt->thoff = skb_network_offset(pkt->skb) + thoff; + pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET; + + return 0; +diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h +index 467d59b9e5334..a0633eeaec977 100644 +--- a/include/net/netfilter/nf_tables_ipv6.h ++++ b/include/net/netfilter/nf_tables_ipv6.h +@@ -31,8 +31,8 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt) + struct ipv6hdr *ip6h, _ip6h; + unsigned int thoff = 0; + unsigned short frag_off; ++ u32 pkt_len, skb_len; + int protohdr; +- u32 pkt_len; + + ip6h = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb), + sizeof(*ip6h), &_ip6h); +@@ -43,7 +43,8 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt) + return -1; + + pkt_len = ntohs(ip6h->payload_len); +- if (pkt_len + sizeof(*ip6h) > pkt->skb->len) ++ skb_len = pkt->skb->len - skb_network_offset(pkt->skb); ++ if (pkt_len + sizeof(*ip6h) > skb_len) + return -1; + + protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags); +diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c +index 2923f3b2dd2c7..f1d9f01b283d7 100644 +--- a/kernel/dma/mapping.c ++++ b/kernel/dma/mapping.c +@@ -570,9 +570,9 @@ static struct page *__dma_alloc_pages(struct device *dev, size_t size, + size = PAGE_ALIGN(size); + if (dma_alloc_direct(dev, ops)) + return dma_direct_alloc_pages(dev, size, dma_handle, dir, gfp); +- if (!ops->alloc_pages_op) ++ if (!ops->alloc_pages) + return NULL; +- return ops->alloc_pages_op(dev, size, dma_handle, dir, gfp); ++ return ops->alloc_pages(dev, size, dma_handle, dir, gfp); + } + + struct page *dma_alloc_pages(struct device *dev, size_t size, +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 02b727a54648f..3db42bae73f8e 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -1555,6 +1555,29 @@ static inline void *event_file_data(struct file *filp) + extern struct mutex event_mutex; + extern struct list_head ftrace_events; + ++/* ++ * When the trace_event_file is the filp->i_private pointer, ++ * it must be taken under the event_mutex lock, and then checked ++ * if the EVENT_FILE_FL_FREED flag is set. If it is, then the ++ * data pointed to by the trace_event_file can not be trusted. ++ * ++ * Use the event_file_file() to access the trace_event_file from ++ * the filp the first time under the event_mutex and check for ++ * NULL. If it is needed to be retrieved again and the event_mutex ++ * is still held, then the event_file_data() can be used and it ++ * is guaranteed to be valid. ++ */ ++static inline struct trace_event_file *event_file_file(struct file *filp) ++{ ++ struct trace_event_file *file; ++ ++ lockdep_assert_held(&event_mutex); ++ file = READ_ONCE(file_inode(filp)->i_private); ++ if (!file || file->flags & EVENT_FILE_FL_FREED) ++ return NULL; ++ return file; ++} ++ + extern const struct file_operations event_trigger_fops; + extern const struct file_operations event_hist_fops; + extern const struct file_operations event_hist_debug_fops; +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 2ae0f2807438a..c68dc50c8becf 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -1386,12 +1386,12 @@ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt, + char buf[4] = "0"; + + mutex_lock(&event_mutex); +- file = event_file_data(filp); ++ file = event_file_file(filp); + if (likely(file)) + flags = file->flags; + mutex_unlock(&event_mutex); + +- if (!file || flags & EVENT_FILE_FL_FREED) ++ if (!file) + return -ENODEV; + + if (flags & EVENT_FILE_FL_ENABLED && +@@ -1428,8 +1428,8 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt, + case 1: + ret = -ENODEV; + mutex_lock(&event_mutex); +- file = event_file_data(filp); +- if (likely(file && !(file->flags & EVENT_FILE_FL_FREED))) ++ file = event_file_file(filp); ++ if (likely(file)) + ret = ftrace_event_enable_disable(file, val); + mutex_unlock(&event_mutex); + break; +@@ -1538,7 +1538,8 @@ enum { + + static void *f_next(struct seq_file *m, void *v, loff_t *pos) + { +- struct trace_event_call *call = event_file_data(m->private); ++ struct trace_event_file *file = event_file_data(m->private); ++ struct trace_event_call *call = file->event_call; + struct list_head *common_head = &ftrace_common_fields; + struct list_head *head = trace_get_fields(call); + struct list_head *node = v; +@@ -1570,7 +1571,8 @@ static void *f_next(struct seq_file *m, void *v, loff_t *pos) + + static int f_show(struct seq_file *m, void *v) + { +- struct trace_event_call *call = event_file_data(m->private); ++ struct trace_event_file *file = event_file_data(m->private); ++ struct trace_event_call *call = file->event_call; + struct ftrace_event_field *field; + const char *array_descriptor; + +@@ -1625,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) + + static void *f_start(struct seq_file *m, loff_t *pos) + { ++ struct trace_event_file *file; + void *p = (void *)FORMAT_HEADER; + loff_t l = 0; + + /* ->stop() is called even if ->start() fails */ + mutex_lock(&event_mutex); +- if (!event_file_data(m->private)) ++ file = event_file_file(m->private); ++ if (!file) + return ERR_PTR(-ENODEV); + + while (l < *pos && p) +@@ -1704,8 +1708,8 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt, + trace_seq_init(s); + + mutex_lock(&event_mutex); +- file = event_file_data(filp); +- if (file && !(file->flags & EVENT_FILE_FL_FREED)) ++ file = event_file_file(filp); ++ if (file) + print_event_filter(file, s); + mutex_unlock(&event_mutex); + +@@ -1734,9 +1738,13 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, + return PTR_ERR(buf); + + mutex_lock(&event_mutex); +- file = event_file_data(filp); +- if (file) +- err = apply_event_filter(file, buf); ++ file = event_file_file(filp); ++ if (file) { ++ if (file->flags & EVENT_FILE_FL_FREED) ++ err = -ENODEV; ++ else ++ err = apply_event_filter(file, buf); ++ } + mutex_unlock(&event_mutex); + + kfree(buf); +@@ -2451,7 +2459,6 @@ static int event_callback(const char *name, umode_t *mode, void **data, + if (strcmp(name, "format") == 0) { + *mode = TRACE_MODE_READ; + *fops = &ftrace_event_format_fops; +- *data = call; + return 1; + } + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 68aaf0bd7a78d..dd16faf0d1500 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -5609,7 +5609,7 @@ static int hist_show(struct seq_file *m, void *v) + + mutex_lock(&event_mutex); + +- event_file = event_file_data(m->private); ++ event_file = event_file_file(m->private); + if (unlikely(!event_file)) { + ret = -ENODEV; + goto out_unlock; +@@ -5888,7 +5888,7 @@ static int hist_debug_show(struct seq_file *m, void *v) + + mutex_lock(&event_mutex); + +- event_file = event_file_data(m->private); ++ event_file = event_file_file(m->private); + if (unlikely(!event_file)) { + ret = -ENODEV; + goto out_unlock; +diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events_inject.c +index 8650562bdaa98..a8f076809db4d 100644 +--- a/kernel/trace/trace_events_inject.c ++++ b/kernel/trace/trace_events_inject.c +@@ -299,7 +299,7 @@ event_inject_write(struct file *filp, const char __user *ubuf, size_t cnt, + strim(buf); + + mutex_lock(&event_mutex); +- file = event_file_data(filp); ++ file = event_file_file(filp); + if (file) { + call = file->event_call; + size = parse_entry(buf, call, &entry); +diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c +index b33c3861fbbbf..76abc9a45f971 100644 +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -159,7 +159,7 @@ static void *trigger_start(struct seq_file *m, loff_t *pos) + + /* ->stop() is called even if ->start() fails */ + mutex_lock(&event_mutex); +- event_file = event_file_data(m->private); ++ event_file = event_file_file(m->private); + if (unlikely(!event_file)) + return ERR_PTR(-ENODEV); + +@@ -213,7 +213,7 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file) + + mutex_lock(&event_mutex); + +- if (unlikely(!event_file_data(file))) { ++ if (unlikely(!event_file_file(file))) { + mutex_unlock(&event_mutex); + return -ENODEV; + } +@@ -293,7 +293,7 @@ static ssize_t event_trigger_regex_write(struct file *file, + strim(buf); + + mutex_lock(&event_mutex); +- event_file = event_file_data(file); ++ event_file = event_file_file(file); + if (unlikely(!event_file)) { + mutex_unlock(&event_mutex); + kfree(buf); +diff --git a/mm/truncate.c b/mm/truncate.c +index 8e3aa9e8618ed..70c09213bb920 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -174,7 +174,7 @@ static void truncate_cleanup_folio(struct folio *folio) + if (folio_mapped(folio)) + unmap_mapping_folio(folio); + +- if (folio_has_private(folio)) ++ if (folio_needs_release(folio)) + folio_invalidate(folio, 0, folio_size(folio)); + + /* +@@ -235,7 +235,7 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end) + */ + folio_zero_range(folio, offset, length); + +- if (folio_has_private(folio)) ++ if (folio_needs_release(folio)) + folio_invalidate(folio, offset, length); + if (!folio_test_large(folio)) + return true; +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index e660b3d661dae..1b56355c40eaf 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -2394,10 +2394,16 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, + /* To avoid a potential race with hci_unregister_dev. */ + hci_dev_hold(hdev); + +- if (action == PM_SUSPEND_PREPARE) ++ switch (action) { ++ case PM_HIBERNATION_PREPARE: ++ case PM_SUSPEND_PREPARE: + ret = hci_suspend_dev(hdev); +- else if (action == PM_POST_SUSPEND) ++ break; ++ case PM_POST_HIBERNATION: ++ case PM_POST_SUSPEND: + ret = hci_resume_dev(hdev); ++ break; ++ } + + if (ret) + bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d", +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 5a9487af44e00..f7404bc679746 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -216,7 +216,7 @@ static ssize_t speed_show(struct device *dev, + if (!rtnl_trylock()) + return restart_syscall(); + +- if (netif_running(netdev) && netif_device_present(netdev)) { ++ if (netif_running(netdev)) { + struct ethtool_link_ksettings cmd; + + if (!__ethtool_get_link_ksettings(netdev, &cmd)) +diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c +index 7cb23bcf8ef7a..4486cbe2faf0c 100644 +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -438,6 +438,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, + if (!dev->ethtool_ops->get_link_ksettings) + return -EOPNOTSUPP; + ++ if (!netif_device_present(dev)) ++ return -ENODEV; ++ + memset(link_ksettings, 0, sizeof(*link_ksettings)); + return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); + } +diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c +index 3346c615f3efe..c42496bcb5e09 100644 +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -227,7 +227,9 @@ void mptcp_pm_add_addr_received(const struct sock *ssk, + } else { + __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP); + } +- } else if (!READ_ONCE(pm->accept_addr)) { ++ /* id0 should not have a different address */ ++ } else if ((addr->id == 0 && !mptcp_pm_nl_is_init_remote_addr(msk, addr)) || ++ (addr->id > 0 && !READ_ONCE(pm->accept_addr))) { + mptcp_pm_announce_addr(msk, addr, true); + mptcp_pm_add_addr_send_ack(msk); + } else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) { +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 441af74621465..7dd10bacc8d28 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -135,12 +135,15 @@ static bool lookup_subflow_by_daddr(const struct list_head *list, + { + struct mptcp_subflow_context *subflow; + struct mptcp_addr_info cur; +- struct sock_common *skc; + + list_for_each_entry(subflow, list, node) { +- skc = (struct sock_common *)mptcp_subflow_tcp_sock(subflow); ++ struct sock *ssk = mptcp_subflow_tcp_sock(subflow); ++ ++ if (!((1 << inet_sk_state_load(ssk)) & ++ (TCPF_ESTABLISHED | TCPF_SYN_SENT | TCPF_SYN_RECV))) ++ continue; + +- remote_address(skc, &cur); ++ remote_address((struct sock_common *)ssk, &cur); + if (mptcp_addresses_equal(&cur, daddr, daddr->port)) + return true; + } +@@ -593,6 +596,11 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) + + __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); + msk->pm.add_addr_signaled++; ++ ++ /* Special case for ID0: set the correct ID */ ++ if (local.addr.id == msk->mpc_endpoint_id) ++ local.addr.id = 0; ++ + mptcp_pm_announce_addr(msk, &local.addr, false); + mptcp_pm_nl_addr_send_ack(msk); + +@@ -615,8 +623,14 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) + + fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH); + +- msk->pm.local_addr_used++; + __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); ++ ++ /* Special case for ID0: set the correct ID */ ++ if (local.addr.id == msk->mpc_endpoint_id) ++ local.addr.id = 0; ++ else /* local_addr_used is not decr for ID 0 */ ++ msk->pm.local_addr_used++; ++ + nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs); + if (nr == 0) + continue; +@@ -745,13 +759,24 @@ static void mptcp_pm_nl_add_addr_received(struct mptcp_sock *msk) + spin_lock_bh(&msk->pm.lock); + + if (sf_created) { +- msk->pm.add_addr_accepted++; ++ /* add_addr_accepted is not decr for ID 0 */ ++ if (remote.id) ++ msk->pm.add_addr_accepted++; + if (msk->pm.add_addr_accepted >= add_addr_accept_max || + msk->pm.subflows >= subflows_max) + WRITE_ONCE(msk->pm.accept_addr, false); + } + } + ++bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk, ++ const struct mptcp_addr_info *remote) ++{ ++ struct mptcp_addr_info mpc_remote; ++ ++ remote_address((struct sock_common *)msk, &mpc_remote); ++ return mptcp_addresses_equal(&mpc_remote, remote, remote->port); ++} ++ + void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk) + { + struct mptcp_subflow_context *subflow; +@@ -763,9 +788,12 @@ void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk) + !mptcp_pm_should_rm_signal(msk)) + return; + +- subflow = list_first_entry_or_null(&msk->conn_list, typeof(*subflow), node); +- if (subflow) +- mptcp_pm_send_ack(msk, subflow, false, false); ++ mptcp_for_each_subflow(msk, subflow) { ++ if (__mptcp_subflow_active(subflow)) { ++ mptcp_pm_send_ack(msk, subflow, false, false); ++ break; ++ } ++ } + } + + int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk, +@@ -835,6 +863,8 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, + int how = RCV_SHUTDOWN | SEND_SHUTDOWN; + u8 id = subflow_get_local_id(subflow); + ++ if (inet_sk_state_load(ssk) == TCP_CLOSE) ++ continue; + if (rm_type == MPTCP_MIB_RMADDR && remote_id != rm_id) + continue; + if (rm_type == MPTCP_MIB_RMSUBFLOW && !mptcp_local_id_match(msk, id, rm_id)) +@@ -1338,20 +1368,27 @@ static struct pm_nl_pernet *genl_info_pm_nl(struct genl_info *info) + return pm_nl_get_pernet(genl_info_net(info)); + } + +-static int mptcp_nl_add_subflow_or_signal_addr(struct net *net) ++static int mptcp_nl_add_subflow_or_signal_addr(struct net *net, ++ struct mptcp_addr_info *addr) + { + struct mptcp_sock *msk; + long s_slot = 0, s_num = 0; + + while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) { + struct sock *sk = (struct sock *)msk; ++ struct mptcp_addr_info mpc_addr; + + if (!READ_ONCE(msk->fully_established) || + mptcp_pm_is_userspace(msk)) + goto next; + ++ /* if the endp linked to the init sf is re-added with a != ID */ ++ mptcp_local_address((struct sock_common *)msk, &mpc_addr); ++ + lock_sock(sk); + spin_lock_bh(&msk->pm.lock); ++ if (mptcp_addresses_equal(addr, &mpc_addr, addr->port)) ++ msk->mpc_endpoint_id = addr->id; + mptcp_pm_create_subflow_or_signal_addr(msk); + spin_unlock_bh(&msk->pm.lock); + release_sock(sk); +@@ -1424,7 +1461,7 @@ static int mptcp_nl_cmd_add_addr(struct sk_buff *skb, struct genl_info *info) + goto out_free; + } + +- mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk)); ++ mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk), &entry->addr); + return 0; + + out_free: +@@ -1540,6 +1577,8 @@ static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net, + spin_unlock_bh(&msk->pm.lock); + } + ++ if (msk->mpc_endpoint_id == entry->addr.id) ++ msk->mpc_endpoint_id = 0; + release_sock(sk); + + next: +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index c1d652a3f7a9b..0ae684624c820 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2289,7 +2289,7 @@ struct sock *mptcp_subflow_get_retrans(struct mptcp_sock *msk) + continue; + } + +- if (subflow->backup) { ++ if (subflow->backup || subflow->request_bkup) { + if (!backup) + backup = ssk; + continue; +@@ -2496,8 +2496,11 @@ static void __mptcp_close_subflow(struct sock *sk) + + mptcp_for_each_subflow_safe(msk, subflow, tmp) { + struct sock *ssk = mptcp_subflow_tcp_sock(subflow); ++ int ssk_state = inet_sk_state_load(ssk); + +- if (inet_sk_state_load(ssk) != TCP_CLOSE) ++ if (ssk_state != TCP_CLOSE && ++ (ssk_state != TCP_CLOSE_WAIT || ++ inet_sk_state_load(sk) != TCP_ESTABLISHED)) + continue; + + /* 'subflow_data_ready' will re-sched once rx queue is empty */ +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index 89dda24537d9e..20736f31dc534 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -907,6 +907,8 @@ void mptcp_pm_add_addr_received(const struct sock *ssk, + void mptcp_pm_add_addr_echoed(struct mptcp_sock *msk, + const struct mptcp_addr_info *addr); + void mptcp_pm_add_addr_send_ack(struct mptcp_sock *msk); ++bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk, ++ const struct mptcp_addr_info *remote); + void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk); + void mptcp_pm_rm_addr_received(struct mptcp_sock *msk, + const struct mptcp_rm_list *rm_list); +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 927c2d5997dc7..81050aa55f7b9 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1226,12 +1226,16 @@ static void mptcp_subflow_discard_data(struct sock *ssk, struct sk_buff *skb, + /* sched mptcp worker to remove the subflow if no more data is pending */ + static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ssk) + { +- if (likely(ssk->sk_state != TCP_CLOSE)) ++ struct sock *sk = (struct sock *)msk; ++ ++ if (likely(ssk->sk_state != TCP_CLOSE && ++ (ssk->sk_state != TCP_CLOSE_WAIT || ++ inet_sk_state_load(sk) != TCP_ESTABLISHED))) + return; + + if (skb_queue_empty(&ssk->sk_receive_queue) && + !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags)) +- mptcp_schedule_work((struct sock *)msk); ++ mptcp_schedule_work(sk); + } + + static bool subflow_can_fallback(struct mptcp_subflow_context *subflow) +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 08fdf1251f46a..3649a4e1eb9de 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -2259,12 +2259,6 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook( + } + } + +- /* Update socket peer label if first association. */ +- if (security_sctp_assoc_request(new_asoc, chunk->head_skb ?: chunk->skb)) { +- sctp_association_free(new_asoc); +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- } +- + /* Set temp so that it won't be added into hashtable */ + new_asoc->temp = 1; + +@@ -2273,6 +2267,22 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook( + */ + action = sctp_tietags_compare(new_asoc, asoc); + ++ /* In cases C and E the association doesn't enter the ESTABLISHED ++ * state, so there is no need to call security_sctp_assoc_request(). ++ */ ++ switch (action) { ++ case 'A': /* Association restart. */ ++ case 'B': /* Collision case B. */ ++ case 'D': /* Collision case D. */ ++ /* Update socket peer label if first association. */ ++ if (security_sctp_assoc_request((struct sctp_association *)asoc, ++ chunk->head_skb ?: chunk->skb)) { ++ sctp_association_free(new_asoc); ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ } ++ break; ++ } ++ + switch (action) { + case 'A': /* Association restart. */ + retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands, +diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c +index 5c9bde25e56df..2b8003eb4f463 100644 +--- a/security/apparmor/policy_unpack_test.c ++++ b/security/apparmor/policy_unpack_test.c +@@ -80,14 +80,14 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, + *(buf + 1) = strlen(TEST_U32_NAME) + 1; + strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32; +- *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA; ++ *((__le32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = cpu_to_le32(TEST_U32_DATA); + + buf = e->start + TEST_NAMED_U64_BUF_OFFSET; + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_U64_NAME) + 1; + strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64; +- *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA; ++ *((__le64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = cpu_to_le64(TEST_U64_DATA); + + buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET; + *buf = AA_NAME; +@@ -103,7 +103,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, + *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1; + strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY; +- *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE; ++ *((__le16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = cpu_to_le16(TEST_ARRAY_SIZE); + + return e; + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index d32d16d75795a..d4a99d98ec774 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -6553,8 +6553,8 @@ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen + */ + static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) + { +- return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, +- ctx, ctxlen, 0); ++ return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, ++ ctx, ctxlen, 0, NULL); + } + + static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 49d9da878ac61..6b92e09d3f780 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -4772,8 +4772,8 @@ static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) + + static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) + { +- return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, +- ctx, ctxlen, 0); ++ return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, ++ ctx, ctxlen, 0, NULL); + } + + static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 42a7051410501..e115fe1836349 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -537,6 +537,9 @@ static struct snd_seq_client *get_event_dest_client(struct snd_seq_event *event, + return NULL; + if (! dest->accept_input) + goto __not_avail; ++ if (snd_seq_ev_is_ump(event)) ++ return dest; /* ok - no filter checks */ ++ + if ((dest->filter & SNDRV_SEQ_FILTER_USE_EVENT) && + ! test_bit(event->type, dest->event_filter)) + goto __not_avail; +diff --git a/sound/soc/amd/acp/acp-legacy-mach.c b/sound/soc/amd/acp/acp-legacy-mach.c +index 6d57d17ddfd77..6e820c2edd1d8 100644 +--- a/sound/soc/amd/acp/acp-legacy-mach.c ++++ b/sound/soc/amd/acp/acp-legacy-mach.c +@@ -137,6 +137,8 @@ static const struct platform_device_id board_ids[] = { + }, + { } + }; ++MODULE_DEVICE_TABLE(platform, board_ids); ++ + static struct platform_driver acp_asoc_audio = { + .driver = { + .pm = &snd_soc_pm_ops, +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index add386f749ae9..bfed848de77c8 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -380,6 +380,7 @@ static int acp_power_on(struct snd_sof_dev *sdev) + const struct sof_amd_acp_desc *desc = get_chip_info(sdev->pdata); + unsigned int base = desc->pgfsm_base; + unsigned int val; ++ unsigned int acp_pgfsm_status_mask, acp_pgfsm_cntl_mask; + int ret; + + val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + PGFSM_STATUS_OFFSET); +@@ -387,9 +388,23 @@ static int acp_power_on(struct snd_sof_dev *sdev) + if (val == ACP_POWERED_ON) + return 0; + +- if (val & ACP_PGFSM_STATUS_MASK) ++ switch (desc->rev) { ++ case 3: ++ case 5: ++ acp_pgfsm_status_mask = ACP3X_PGFSM_STATUS_MASK; ++ acp_pgfsm_cntl_mask = ACP3X_PGFSM_CNTL_POWER_ON_MASK; ++ break; ++ case 6: ++ acp_pgfsm_status_mask = ACP6X_PGFSM_STATUS_MASK; ++ acp_pgfsm_cntl_mask = ACP6X_PGFSM_CNTL_POWER_ON_MASK; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ if (val & acp_pgfsm_status_mask) + snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + PGFSM_CONTROL_OFFSET, +- ACP_PGFSM_CNTL_POWER_ON_MASK); ++ acp_pgfsm_cntl_mask); + + ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, base + PGFSM_STATUS_OFFSET, val, + !val, ACP_REG_POLL_INTERVAL, ACP_REG_POLL_TIMEOUT_US); +diff --git a/sound/soc/sof/amd/acp.h b/sound/soc/sof/amd/acp.h +index 4dcceb7647694..133abed74f015 100644 +--- a/sound/soc/sof/amd/acp.h ++++ b/sound/soc/sof/amd/acp.h +@@ -25,8 +25,11 @@ + #define ACP_REG_POLL_TIMEOUT_US 2000 + #define ACP_DMA_COMPLETE_TIMEOUT_US 5000 + +-#define ACP_PGFSM_CNTL_POWER_ON_MASK 0x01 +-#define ACP_PGFSM_STATUS_MASK 0x03 ++#define ACP3X_PGFSM_CNTL_POWER_ON_MASK 0x01 ++#define ACP3X_PGFSM_STATUS_MASK 0x03 ++#define ACP6X_PGFSM_CNTL_POWER_ON_MASK 0x07 ++#define ACP6X_PGFSM_STATUS_MASK 0x0F ++ + #define ACP_POWERED_ON 0x00 + #define ACP_ASSERT_RESET 0x01 + #define ACP_RELEASE_RESET 0x00 +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index 33d08600be13d..890a81f4ff618 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -531,7 +531,7 @@ TEST_F(iommufd_ioas, copy_area) + { + struct iommu_ioas_copy copy_cmd = { + .size = sizeof(copy_cmd), +- .flags = IOMMU_IOAS_MAP_FIXED_IOVA, ++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE, + .dst_ioas_id = self->ioas_id, + .src_ioas_id = self->ioas_id, + .length = PAGE_SIZE, +@@ -1024,7 +1024,7 @@ TEST_F(iommufd_ioas, copy_sweep) + { + struct iommu_ioas_copy copy_cmd = { + .size = sizeof(copy_cmd), +- .flags = IOMMU_IOAS_MAP_FIXED_IOVA, ++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE, + .src_ioas_id = self->ioas_id, + .dst_iova = MOCK_APERTURE_START, + .length = MOCK_PAGE_SIZE, +@@ -1314,7 +1314,7 @@ TEST_F(iommufd_mock_domain, user_copy) + }; + struct iommu_ioas_copy copy_cmd = { + .size = sizeof(copy_cmd), +- .flags = IOMMU_IOAS_MAP_FIXED_IOVA, ++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE, + .dst_ioas_id = self->ioas_id, + .dst_iova = MOCK_APERTURE_START, + .length = BUFFER_SIZE, +diff --git a/tools/testing/selftests/net/forwarding/local_termination.sh b/tools/testing/selftests/net/forwarding/local_termination.sh +index c5b0cbc85b3e0..9b5a63519b949 100755 +--- a/tools/testing/selftests/net/forwarding/local_termination.sh ++++ b/tools/testing/selftests/net/forwarding/local_termination.sh +@@ -278,6 +278,10 @@ bridge() + cleanup() + { + pre_cleanup ++ ++ ip link set $h2 down ++ ip link set $h1 down ++ + vrf_cleanup + } + +diff --git a/tools/testing/selftests/net/forwarding/no_forwarding.sh b/tools/testing/selftests/net/forwarding/no_forwarding.sh +index af3b398d13f01..9e677aa64a06a 100755 +--- a/tools/testing/selftests/net/forwarding/no_forwarding.sh ++++ b/tools/testing/selftests/net/forwarding/no_forwarding.sh +@@ -233,6 +233,9 @@ cleanup() + { + pre_cleanup + ++ ip link set dev $swp2 down ++ ip link set dev $swp1 down ++ + h2_destroy + h1_destroy + +diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh +index e8726ec658ae4..2be13dd19ddd2 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -1256,26 +1256,26 @@ chk_csum_nr() + + print_check "sum" + count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtDataCsumErr") +- if [ "$count" != "$csum_ns1" ]; then ++ if [ -n "$count" ] && [ "$count" != "$csum_ns1" ]; then + extra_msg+=" ns1=$count" + fi + if [ -z "$count" ]; then + print_skip + elif { [ "$count" != $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 0 ]; } || +- { [ "$count" -lt $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 1 ]; }; then ++ { [ "$count" -lt $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 1 ]; }; then + fail_test "got $count data checksum error[s] expected $csum_ns1" + else + print_ok + fi + print_check "csum" + count=$(mptcp_lib_get_counter ${ns2} "MPTcpExtDataCsumErr") +- if [ "$count" != "$csum_ns2" ]; then ++ if [ -n "$count" ] && [ "$count" != "$csum_ns2" ]; then + extra_msg+=" ns2=$count" + fi + if [ -z "$count" ]; then + print_skip + elif { [ "$count" != $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 0 ]; } || +- { [ "$count" -lt $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 1 ]; }; then ++ { [ "$count" -lt $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 1 ]; }; then + fail_test "got $count data checksum error[s] expected $csum_ns2" + else + print_ok +@@ -1313,13 +1313,13 @@ chk_fail_nr() + + print_check "ftx" + count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtMPFailTx") +- if [ "$count" != "$fail_tx" ]; then ++ if [ -n "$count" ] && [ "$count" != "$fail_tx" ]; then + extra_msg+=",tx=$count" + fi + if [ -z "$count" ]; then + print_skip + elif { [ "$count" != "$fail_tx" ] && [ $allow_tx_lost -eq 0 ]; } || +- { [ "$count" -gt "$fail_tx" ] && [ $allow_tx_lost -eq 1 ]; }; then ++ { [ "$count" -gt "$fail_tx" ] && [ $allow_tx_lost -eq 1 ]; }; then + fail_test "got $count MP_FAIL[s] TX expected $fail_tx" + else + print_ok +@@ -1327,13 +1327,13 @@ chk_fail_nr() + + print_check "failrx" + count=$(mptcp_lib_get_counter ${ns_rx} "MPTcpExtMPFailRx") +- if [ "$count" != "$fail_rx" ]; then ++ if [ -n "$count" ] && [ "$count" != "$fail_rx" ]; then + extra_msg+=",rx=$count" + fi + if [ -z "$count" ]; then + print_skip + elif { [ "$count" != "$fail_rx" ] && [ $allow_rx_lost -eq 0 ]; } || +- { [ "$count" -gt "$fail_rx" ] && [ $allow_rx_lost -eq 1 ]; }; then ++ { [ "$count" -gt "$fail_rx" ] && [ $allow_rx_lost -eq 1 ]; }; then + fail_test "got $count MP_FAIL[s] RX expected $fail_rx" + else + print_ok +@@ -3578,27 +3578,28 @@ endpoint_tests() + + if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then +- pm_nl_set_limits $ns1 0 2 +- pm_nl_set_limits $ns2 0 2 ++ pm_nl_set_limits $ns1 0 3 ++ pm_nl_set_limits $ns2 0 3 ++ pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow + pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow +- test_linkfail=4 speed=20 \ ++ test_linkfail=4 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & + local tests_pid=$! + + wait_mpj $ns2 + pm_nl_check_endpoint "creation" \ + $ns2 10.0.2.2 id 2 flags subflow dev ns2eth2 +- chk_subflow_nr "before delete" 2 ++ chk_subflow_nr "before delete id 2" 2 + chk_mptcp_info subflows 1 subflows 1 + + pm_nl_del_endpoint $ns2 2 10.0.2.2 + sleep 0.5 +- chk_subflow_nr "after delete" 1 ++ chk_subflow_nr "after delete id 2" 1 + chk_mptcp_info subflows 0 subflows 0 + + pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow + wait_mpj $ns2 +- chk_subflow_nr "after re-add" 2 ++ chk_subflow_nr "after re-add id 2" 2 + chk_mptcp_info subflows 1 subflows 1 + + pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow +@@ -3613,10 +3614,23 @@ endpoint_tests() + chk_subflow_nr "after no reject" 3 + chk_mptcp_info subflows 2 subflows 2 + ++ local i ++ for i in $(seq 3); do ++ pm_nl_del_endpoint $ns2 1 10.0.1.2 ++ sleep 0.5 ++ chk_subflow_nr "after delete id 0 ($i)" 2 ++ chk_mptcp_info subflows 2 subflows 2 # only decr for additional sf ++ ++ pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow ++ wait_mpj $ns2 ++ chk_subflow_nr "after re-add id 0 ($i)" 3 ++ chk_mptcp_info subflows 3 subflows 3 ++ done ++ + mptcp_lib_kill_wait $tests_pid + +- chk_join_nr 3 3 3 +- chk_rm_nr 1 1 ++ chk_join_nr 6 6 6 ++ chk_rm_nr 4 4 + fi + } +
