Merge tag 'android11-5.4.289_r00' into android11-5.4

This merges the android11-5.4.289_r00 tag into the android11-5.4 branch, catching it up with the latest LTS releases. It contains the following commits: * b9aba1f4e2 Revert "netfilter: Replace zero-length array with flexible-array member" * 196c9546b3 Revert "tracing: Constify string literal data member in struct trace_event_call" * c32bcb5cc0 Revert "skb_expand_head() adjust skb->truesize incorrectly" * a85d92d704 Merge 5.4.289 into android11-5.4-lts |\ | * 7f0e075be1 Linux 5.4.289 | * 177516053e ftrace: use preempt_enable/disable notrace macros to avoid double fault | * 66cd37660e mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() | * bad27f62d8 drm: adv7511: Drop dsi single lane support | * 94b7ed0a48 net/sctp: Prevent autoclose integer overflow in sctp_association_init() | * 9efc2a85ed sky2: Add device ID 11ab:4373 for Marvell 88E8075 | * 788d9e9a41 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking | * c57721b24b RDMA/uverbs: Prevent integer overflow issue | * 213305a1cb modpost: fix the missed iteration for the max bit in do_input() | * f072e43697 modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host | * 6103478629 ARC: build: Try to guess GCC variant of cross compiler | * 512929f115 irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base | * 520e02b7fe net: usb: qmi_wwan: add Telit FE910C04 compositions | * f960a6b5d9 bpf: fix potential error return | * 8929492594 sound: usb: format: don't warn that raw DSD is unsupported | * 155f6a7e0a wifi: mac80211: wake the queues in case of failure in resume | * 1638f430f8 ila: serialize calls to nf_register_net_hooks() | * 560cbdd26b af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK | * 66ffb0cf21 af_packet: fix vlan_get_tci() vs MSG_PEEK | * 7b91cd2a43 ALSA: usb-audio: US16x08: Initialize array before use | * 6889d622b1 net: llc: reset skb->transport_header | * 352f8eaaab netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext | * 9857e028d4 netfilter: Replace zero-length array with flexible-array member | * 64e9f54a14 netrom: check buffer length before accessing it | * 53425075fb drm/bridge: adv7511_audio: Update Audio InfoFrame properly | * 6ffd9a346f drm: bridge: adv7511: Enable SPDIF DAI | * eea3fbfcbd RDMA/bnxt_re: Fix max_qp_wrs reported | * cddb0c59fc RDMA/bnxt_re: Fix reporting hw_ver in query_device | * 1dcf5cb17d RDMA/bnxt_re: Add check for path mtu in modify_qp | * 4e726e6b5f RDMA/mlx5: Enforce same type port association for multiport RoCE | * 63e7bc7261 net/mlx5: Make API mlx5_core_is_ecpf accept const pointer | * bb92b36156 IB/mlx5: Introduce and use mlx5_core_is_vf() | * f091a224a2 Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet | * f45a77dd24 selinux: ignore unknown extended permissions | * b3a3d5333c ipv6: prevent possible UAF in ip6_xmit() | * 43e7958cf7 skb_expand_head() adjust skb->truesize incorrectly | * 3d770d44dd btrfs: avoid monopolizing a core when activating a swap file | * 30080cdde6 tracing: Constify string literal data member in struct trace_event_call | * 078f7e1521 bpf: fix recursive lock when verdict program return SK_PASS | * ae8512e93f ipv6: fix possible UAF in ip6_finish_output2() | * 81d626b00b ipv6: use skb_expand_head in ip6_xmit | * 1598154fd2 ipv6: use skb_expand_head in ip6_finish_output2 | * 7e13e59bf6 skbuff: introduce skb_expand_head() | * 0d1a6cd2d7 MIPS: Probe toolchain support of -msym32 | * 59a9c2a351 epoll: Add synchronous wakeup support for ep_poll_callback | * d738f3215b virtio-blk: don't keep queue frozen during system suspend | * 4ed6d56e85 scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time | * 436df0cfe8 platform/x86: asus-nb-wmi: Ignore unknown event 0xCF | * c2dae50ddb regmap: Use correct format specifier for logging range errors | * 78afb9bfad scsi: megaraid_sas: Fix for a potential deadlock | * de349d2382 scsi: qla1280: Fix hw revision numbering for ISP1020/1040 | * 0146a07f95 tracing/kprobe: Make trace_kprobe's module callback called after jump_label update | * ca9818554b mtd: rawnand: fix double free in atmel_pmecc_create_user() | * 3d229600c5 dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset | * 3e351d0279 dmaengine: mv_xor: fix child node refcount handling in early exit | * 677e77d2b5 phy: core: Fix that API devm_phy_destroy() fails to destroy the phy | * ce14e466d5 phy: core: Fix that API devm_phy_put() fails to release the phy | * 696bb5ec8e phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() | * 99ac4a47a0 phy: core: Fix an OF node refcount leakage in _of_phy_get() | * 63055e47cf mtd: diskonchip: Cast an operand to prevent potential overflow | * aa577b51d5 nfsd: restore callback functionality for NFSv4.0 | * 06f6b1717c bpf: Check negative offsets in __bpf_skb_min_len() | * 035772fcd6 media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg | * f15dec32fb of: Fix refcount leakage for OF node returned by __of_get_dma_parent() | * 24937f999b of: Fix error path in of_parse_phandle_with_args_map() | * cb70f37c10 udmabuf: also check for F_SEAL_FUTURE_WRITE | * 55e4baa0d3 nilfs2: prevent use of deleted inode | * 353e49dd5d of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() | * 40c6a6b6bd NFS/pnfs: Fix a live lock between recalled layouts and layoutget | * 703388839b btrfs: tree-checker: reject inline extent items with 0 ref count | * 9202cc7852 zram: refuse to use zero sized block device as backing device | * fa6f0fbb1c sh: clk: Fix clk_enable() to return 0 on NULL clk | * a36572118c USB: serial: option: add Telit FE910C04 rmnet compositions | * dfe21fb44e USB: serial: option: add MediaTek T7XX compositions | * e3374308d2 USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready | * dafbc0d826 USB: serial: option: add MeiG Smart SLM770A | * a678147a6b USB: serial: option: add TCL IK512 MBIM & ECM | * dbb8df1d30 efivarfs: Fix error on non-existent file | * e062021441 i2c: riic: Always round-up when calculating bus period | * 8e9f1f405a chelsio/chtls: prevent potential integer overflow on 32bit | * 4b794b6e59 mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk | * f89fae2cd2 netfilter: ipset: Fix for recursive locking warning | * cb743fe159 net: ethernet: bgmac-platform: fix an OF node reference leak | * 5fcc7e6643 net: hinic: Fix cleanup in create_rxqs/txqs() | * fe65c3e36a ionic: use ee->offset when returning sprom data | * c9d5f2776c net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll | * 70a727901d erofs: fix incorrect symlink detection in fast symlink | * 17a0cdbd7b erofs: fix order >= MAX_ORDER warning due to crafted negative i_size | * 0430f13291 drm/i915: Fix memory leak by correcting cache object name in error handler | * e00e6283e9 i2c: pnx: Fix timeout in wait functions | * 7d7fed7f2a PCI: Add ACS quirk for Broadcom BCM5760X NIC | * 8f9e9c8d08 ALSA: usb: Fix UBSAN warning in parse_audio_unit() | * d41fcaa12a PCI/AER: Disable AER service on suspend | * f413230a1f usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled | * 44782565e1 net: sched: fix ordering of qlen adjustment * | 4d8aad9b5e Merge 5.4.288 into android11-5.4-lts |\| | * e0646975af Linux 5.4.288 | * 1102fb2aa4 ALSA: usb-audio: Fix a DMA to stack memory bug | * 20f7f0cf7a xen/netfront: fix crash when removing device | * 20df02cb98 tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe() | * fb5b4d675d KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status | * 2870cd0286 blk-iocost: Avoid using clamp() on inuse in __propagate_weights() | * a3b64f8ac1 blk-iocost: fix weight updates of inner active iocgs | * 24075e3895 blk-iocost: clamp inuse and skip noops in __propagate_weights() | * 8c29e7ece6 ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired | * 83c6ab12f0 net/sched: netem: account for backlog updates from child qdisc | * 26a5f515ef qca_spi: Make driver probing reliable | * f07818a854 qca_spi: Fix clock speed for multiple QCA7000 | * 0e7585572a ACPI: resource: Fix memory resource type union access | * 3aa2ef7ffd net: lapb: increase LAPB_HEADER_LEN | * d1d4dfb189 tipc: fix NULL deref in cleanup_bearer() | * 89d94cf7a7 batman-adv: Do not let TT changes list grows indefinitely | * 0d2fbae5f5 batman-adv: Remove uninitialized data in full table TT response | * 860e733982 batman-adv: Do not send uninitialized TT changes | * 1b0d7e51ac bpf, sockmap: Fix update element with same | * 0520483177 xfs: don't drop errno values when we fail to ficlone the entire range | * 4efdfdc32d usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer | * 357219c16f usb: ehci-hcd: fix call balance of clocks handling routines | * 2da6e4d35d usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature | * efd985332e ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() | * d4b2afe2fa usb: host: max3421-hcd: Correctly abort a USB request. * | d93411f753 Revert "cgroup: Make operations on the cgroup root_list RCU safe" * | 0f76afd374 Revert "cgroup: Move rcu_head up near the top of cgroup_root" * | ad8d63bdc6 Merge 5.4.287 into android11-5.4-lts |\| | * 6708005a36 Linux 5.4.287 | * 7eb794e1a9 bpf, xdp: Update devmap comments to reflect napi/rcu usage | * a632bdcb35 ALSA: usb-audio: Fix out of bounds reads when finding clock sources | * 4fed24bf45 PCI: rockchip-ep: Fix address translation unit programming | * e0e1cde240 Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()" | * 42c5ed5252 modpost: Add .irqentry.text to OTHER_SECTIONS | * 89236868a1 ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" | * 54832216f1 jffs2: Fix rtime decompressor | * 421f9e9f0f jffs2: Prevent rtime decompress memory corruption | * 4098c94097 KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE | * 0ba044be2b KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device | * 3c6c631f28 KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* | * c0978ecb28 perf/x86/intel/pt: Fix buffer full but size is 0 case | * 119f470a31 Revert "unicode: Don't special case ignorable code points" | * 0f170e91d3 bpf: fix OOB devmap writes when deleting elements | * 8b69c887f1 xdp: Simplify devmap cleanup | * 9ab3a1aaa5 misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle | * 0b94d83801 powerpc/prom_init: Fixup missing powermac #size-cells | * e99a36ed0c usb: chipidea: udc: handle USB Error Interrupt if IOC not set | * 9a2173660e i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock | * 44c73d8f4f PCI: Add ACS quirk for Wangxun FF5xxx NICs | * 88da5d46b6 PCI: Add 'reset_subordinate' to reset hierarchy below bridge | * ac8aaf78bd f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. | * 77ae53c490 nvdimm: rectify the illogical code within nd_dax_probe() | * 61b32d4af7 pinctrl: qcom-pmic-gpio: add support for PM8937 | * 631c1e6b68 scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset | * e6e6045f86 scsi: st: Don't modify unknown block number in MTIOCGET | * 84b42d5b5f leds: class: Protect brightness_show() with led_cdev->led_access mutex | * c67aeff289 tracing: Use atomic64_inc_return() in trace_clock_counter() | * 383833f04c netpoll: Use rcu_access_pointer() in __netpoll_setup | * 6978e400bf net/neighbor: clear error in case strict check is not set | * cf0d36cf00 rocker: fix link status detection in rocker_carrier_init() | * 97ecf3dbdd ASoC: hdmi-codec: reorder channel allocation list | * 802216bc7b Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables | * 342f87d263 wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() | * d336bf8680 wifi: ipw2x00: libipw_rx_any(): fix bad alignment | * b5807a0895 drm/amdgpu: set the right AMDGPU sg segment limitation | * b15000bcbe jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree | * b62f41aeec jfs: fix array-index-out-of-bounds in jfs_readdir | * bbb24ce7f0 jfs: fix shift-out-of-bounds in dbSplit | * 25f1e673ef jfs: array-index-out-of-bounds fix in dtReadFirst | * 685ee05004 wifi: ath5k: add PCI ID for Arcadyan devices | * b10be84272 wifi: ath5k: add PCI ID for SX76X | * f2709d1271 net: inet6: do not leave a dangling sk pointer in inet6_create() | * f8a3f255f7 net: inet: do not leave a dangling sk pointer in inet_create() | * 1d5fe782c0 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() | * 884ae8bcee net: af_can: do not leave a dangling sk pointer in can_create() | * f6ad641646 Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() | * 71b22837a5 af_packet: avoid erroring out after sock_init_data() in packet_create() | * 4803d81373 net/sched: cbs: Fix integer overflow in cbs_set_port_rate() | * fb5b3a35c6 net: ethernet: fs_enet: Use %pa to format resource_size_t | * e0e2dabcf0 net: fec_mpc52xx_phy: Use %pa to format resource_size_t | * c2c01ee592 samples/bpf: Fix a resource leak | * cb8ae56d73 drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() | * 4c245d6d19 drm/mcde: Enable module autoloading | * 920c9149bd drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model | * 30af4d9845 media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 | * a6ba781b0b media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera | * 238e3af849 s390/cpum_sf: Handle CPU hotplug remove during sampling | * 4eb49404de mmc: core: Further prevent card detect during shutdown | * f44895aa11 regmap: detach regmap from dev on regmap_exit | * 83df6a591a dma-buf: fix dma_fence_array_signaled v4 | * 4379c58284 bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again | * 09d6d05579 nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() | * 0bdf3905cd scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt | * ad7556f1b8 scsi: qla2xxx: Supported speed displayed incorrectly for VPorts | * 541236f95a scsi: qla2xxx: Fix NVMe and NPIV connect issue | * 4f394bf499 ocfs2: update seq_file index in ocfs2_dlm_seq_next | * a1c78bcc70 tracing: Fix cmp_entries_dup() to respect sort() comparison rules | * d031eef3cc HID: wacom: fix when get product name maybe null pointer | * f247471e3a bpf: Fix exact match conditions in trie_get_next_key() | * 50e06cbb60 bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie | * 911fcc95b5 ocfs2: free inode when ocfs2_get_init_inode() fails | * d0cde3911c spi: mpc52xx: Add cancel_work_sync before module remove | * 905d82e6e7 tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg | * 079484a928 drm/sti: Add __iomem for mixer_dbg_mxn's parameter | * 53ff0caa6a gpio: grgpio: Add NULL check in grgpio_probe | * c2d1bc4163 gpio: grgpio: use a helper variable to store the address of ofdev->dev | * eb30e6b51a crypto: x86/aegis128 - access 32-bit arguments as 32-bit | * 7475e47200 x86/asm: Reorder early variables | * 87106169b4 xen: Fix the issue of resource not being properly released in xenbus_dev_probe() | * 1c264dd643 xen/xenbus: fix locking | * 7c138d1284 xenbus/backend: Protect xenbus callback with lock | * bae18180aa xenbus/backend: Add memory pressure handler callback | * 892ad83f20 xen/xenbus: reference count registered modules | * 98d62cf0e2 netfilter: nft_set_hash: skip duplicated elements pending gc run | * e5e2d30247 netfilter: ipset: Hold module reference while requesting a module | * 4458046617 igb: Fix potential invalid memory access in igb_init_module() | * 5cabe42ead net/qed: allow old cards not supporting "num_images" to work | * 4e69457f9d tipc: Fix use-after-free of kernel socket in cleanup_bearer(). | * bd09e2482d tipc: add new AEAD key structure for user API | * 0b8f0026bb tipc: enable creating a "preliminary" node | * 6b7fbc30ec tipc: add reference counter to bearer | * 623be080ab dccp: Fix memory leak in dccp_feat_change_recv | * a95808252e net/ipv6: release expired exception dst cached in socket | * 224e606a8d can: j1939: j1939_session_new(): fix skb reference counting | * dfc2e58028 net/sched: tbf: correct backlog statistic for GSO packets | * 147a42bb02 netfilter: x_tables: fix LED ID check in led_tg_check() | * 31d1ddc1ce ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() | * 9c6c2d0d43 can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics | * f8138cba7b can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL | * 5ba0a19a6f watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() | * b467087053 iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call | * f145c9924c drm/etnaviv: flush shader L1 cache after user commandstream | * a85364f0d3 nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur | * e2fa0d0e32 nfsd: make sure exp active before svc_export_show | * c470d6194f dm thin: Add missing destroy_work_on_stack() | * c2f0ce2411 i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() | * 7cd787499d util_macros.h: fix/rework find_closest() macros | * 18fb33df1d ad7780: fix division by zero in ad7780_write_raw() | * a42d050d07 clk: qcom: gcc-qcs404: fix initial rate of GPLL3 | * 43ca32ce12 ftrace: Fix regression with module command in stack_trace_filter | * f9248e2f73 ovl: Filter invalid inodes with missing lookup function | * cf642904be media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() | * 6ef14ba50a media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() | * 214db0ab96 media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled | * ced1c04e82 media: ts2020: fix null-ptr-deref in ts2020_probe() | * 13193a97dd media: i2c: tc358743: Fix crash in the probe error path when using polling | * dfb9fe7de6 btrfs: ref-verify: fix use-after-free after invalid ref action | * a5abba5e0e quota: flush quota_release_work upon quota writeback | * 21fd6b2f0e ASoC: fsl_micfil: fix the naming style for mask definition | * d8de818df1 sh: intc: Fix use-after-free bug in register_intc_controller() | * cc91d59d34 sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport | * e89ac70361 SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE | * 768df674c5 SUNRPC: correct error code comment in xs_tcp_setup_socket() | * 3c5c4d1216 modpost: remove incorrect code in do_eisa_entry() | * 4c54ffc23b rtc: ab-eoz9: don't fail temperature reads on undervoltage notification | * d74b4b2970 9p/xen: fix release of IRQ | * be216f99df 9p/xen: fix init sequence | * 847d94e60e block: return unsigned int from bdev_io_min | * f4f31bd51e jffs2: fix use of uninitialized variable | * daac4aa182 ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit | * 871c148f8e ubi: fastmap: Fix duplicate slab cache names while attaching | * f1f685b3dd ubifs: Correct the total block count by deducting journal reservation | * 44b3257ff7 rtc: check if __rtc_read_time was successful in rtc_timer_do_work() | * 1a7d4c093b rtc: abx80x: Fix WDT bit position of the status register | * 0bce88e065 rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() | * 7bf6bf130a NFSv4.0: Fix a use-after-free problem in the asynchronous open() | * 9e497ef3a6 um: Always dump trace for specified task in show_stack | * 115e3e51b1 um: Clean up stacktrace dump | * abf08999d9 um: add show_stack_loglvl() | * 3103837c50 um/sysrq: remove needless variable sp | * ea8b2f3718 um: Fix the return value of elf_core_copy_task_fpregs | * 5c710f4581 um: Fix potential integer overflow during physmem setup | * 5398de330c rpmsg: glink: Propagate TX failures in intentless mode as well | * e9be26735d SUNRPC: make sure cache entry active before cache_show | * 90adbae9dd NFSD: Prevent a potential integer overflow | * af1db93c94 lib: string_helpers: silence snprintf() output truncation warning | * a70316b52e usb: dwc3: gadget: Fix checking for number of TRBs left | * 2a9cbaeb4c ALSA: hda/realtek: Apply quirk for Medion E15433 | * 7f57353abc ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max | * 937a94c977 ALSA: hda/realtek: Set PCBeep to default value for ALC274 | * 2be4e4fe88 ALSA: hda/realtek: Update ALC225 depop procedure | * 3c818ad07e media: wl128x: Fix atomicity violation in fmc_send_cmd() | * c8e5e170d9 HID: wacom: Interpret tilt data from Intuos Pro BT as signed values | * 383455a9aa block: fix ordering between checking BLK_MQ_S_STOPPED request adding | * 25ace006e9 arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled | * f8f26cf690 sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK | * 376c7f0beb um: vector: Do not use drvdata in release | * 7b5e40abd1 serial: 8250: omap: Move pm_runtime_get_sync | * 8d9d174d3f um: net: Do not use drvdata in release | * 300e277e46 um: ubd: Do not use drvdata in release | * 7cf819ea37 ubi: wl: Put source PEB into correct list if trying locking LEB failed | * 2afe950e49 spi: Fix acpi deferred irq probe | * 78b0f2028f netfilter: ipset: add missing range check in bitmap_ip_uadt | * 2d64a005ba Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" | * 0fd14b63fa serial: sh-sci: Clean sci_ports[0] after at earlycon exit | * eff104b29c Revert "usb: gadget: composite: fix OS descriptors w_value logic" | * 37fb0fd3fb Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() | * 1ebbcaf0d5 tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler | * 57f048c2d2 comedi: Flush partial mappings in error case | * d0ddd2c92b PCI: Fix use-after-free of slot->bus on hot remove | * 02ca7b6027 ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() | * 6e39b681d1 jfs: xattr: check invalid xattr size more strictly | * dc331ed4cc ext4: fix FS_IOC_GETFSMAP handling | * 56b8416193 ext4: supress data-race warnings in ext4_free_inodes_{count,set}() | * 9b8460a2a7 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices | * f7b0952a70 soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() | * 047f0ee8b5 cgroup: Move rcu_head up near the top of cgroup_root | * 92f6ebead8 cgroup: Make operations on the cgroup root_list RCU safe | * a35767ab80 usb: ehci-spear: fix call balance of sehci clk handling routines | * 2c312ab8f2 apparmor: fix 'Do simple duplicate message elimination' | * d6de1aaa0f staging: greybus: uart: clean up TIOCGSERIAL | * aabb00874a misc: apds990x: Fix missing pm_runtime_disable() | * 7aacc23608 USB: chaoskey: Fix possible deadlock chaoskey_list_lock | * a6b88ed51e USB: chaoskey: fail open after removal | * bcb28ed2e1 usb: yurex: make waiting on yurex_write interruptible | * 516e667442 usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() | * b4ccc582ef ipmr: fix tables suspicious RCU usage | * 59be0c8afc ipmr: convert /proc handlers to rcu_read_lock() | * 5743a2db46 net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken | * 9be33a1eb0 marvell: pxa168_eth: fix call balance of pep->clk handling routines | * d720e8ccc2 net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration | * 1604c6d440 tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets | * 7b99620a9f net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device | * c423afa170 power: supply: core: Remove might_sleep() from power_supply_put() | * 7d121f66b6 vfio/pci: Properly hide first-in-list PCIe extended capability | * d68d5f63b6 NFSD: Fix nfsd4_shutdown_copy() | * c6dc01d04c NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() | * cac1405e3f NFSD: Prevent NULL dereference in nfsd4_process_cb_update() | * 68c3b7cdef rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length | * 83f8eb3280 rpmsg: glink: Fix GLINK command prefix | * 6094d8c3d2 rpmsg: glink: Send READ_NOTIFY command in FIFO full case | * 4e318b935d rpmsg: glink: Add TX_DATA_CONT command while sending | * 82137bab80 perf trace: Avoid garbage when not printing a syscall's arguments | * e2956feece perf trace: Do not lose last events in a race | * 7a78e2865a m68k: coldfire/device.c: only build FEC when HW macros are defined | * 32d587a538 m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x | * 5ad6ca7662 PCI: cpqphp: Fix PCIBIOS_* return value confusion | * d8392686ad PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads | * 25b338db0c perf probe: Correct demangled symbols in C++ program | * 1ed167325c perf cs-etm: Don't flush when packet_queue fills up | * b106f718fc clk: clk-axi-clkgen: make sure to enable the AXI bus clock | * 31fe8bc84b clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand | * 17aad93e2b dt-bindings: clock: axi-clkgen: include AXI clk | * 80d2319709 dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format | * d48cbfa90d fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() | * dd3a6d5441 fbdev/sh7760fb: Alloc DMA memory from hardware device | * 1403e7b10c powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static | * f4078ef38d ocfs2: fix uninitialized value in ocfs2_file_read_iter() | * eaf92fad1f scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() | * 97384449dd scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() | * c7da99b2d4 scsi: fusion: Remove unused variable 'rc' | * 3932c753f8 scsi: bfa: Fix use-after-free in bfad_im_module_exit() | * 5ea4b832b5 mfd: rt5033: Fix missing regmap_del_irq_chip() | * 171bb5aefc RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey | * 22fbbc37ed mtd: rawnand: atmel: Fix possible memory leak | * b3617ac6aa cpufreq: loongson2: Unregister platform_driver on failure | * 6ea17c03ed mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices | * b7c7c400de mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device | * 0997e77c51 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device | * 851f94e403 mfd: intel_soc_pmic_bxtwc: Use dev_err_probe() | * a4eb13644d mfd: da9052-spi: Change read-mask to write-mask | * 321d24f9a5 mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race | * 7022d187cb powerpc/vdso: Flag VDSO64 entry points as functions | * 598b156722 trace/trace_event_perf: remove duplicate samples on the first tracepoint event | * 85cf038c39 netpoll: Use rcu_access_pointer() in netpoll_poll_lock | * 273eec2346 ALSA: 6fire: Release resources at card release | * ebad462eec ALSA: caiaq: Use snd_card_free_when_closed() at disconnection | * 75f418b249 ALSA: us122l: Use snd_card_free_when_closed() at disconnection | * 71d55e19fe net: rfkill: gpio: Add check for clk_enable() | * cb158d79b1 selftests: net: really check for bg process completion | * 3d106b2f9f bpf, sockmap: Fix sk_msg_reset_curr | * d3f5763b30 bpf, sockmap: Several fixes to bpf_msg_pop_data | * 962932ee62 bpf, sockmap: Several fixes to bpf_msg_push_data | * 2cc97daab5 drm/etnaviv: hold GPU lock across perfmon sampling | * b8132704a6 drm/etnaviv: fix power register offset on GC300 | * b8777d076e drm/etnaviv: dump: fix sparse warnings | * 41c7200d66 drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() | * 8b49ea3418 drm/panfrost: Remove unused id_mask from struct panfrost_model | * 1de0ca1d73 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() | * de94dc8a1f bpf: Fix the xdp_adjust_tail sample prog issue | * 7913bf6f8c ASoC: fsl_micfil: fix regmap_write_bits usage | * c5cde68215 ASoC: fsl_micfil: use GENMASK to define register bit fields | * d7b49f67c7 ASoC: fsl_micfil: do not define SHIFT/MASK for single bits | * f8fe5b13ab ASoC: fsl_micfil: Drop unnecessary register read | * 50383e18bf dt-bindings: vendor-prefixes: Add NeoFidelity, Inc | * 22e700ee09 drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() | * d766e4dfae wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() | * 0e720766e0 wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() | * 6dfbea145a drm/omap: Fix locking in omap_gem_new_dmabuf() | * cb480ae80f wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() | * 5665bb4371 drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused | * 8be4e51f3e firmware: arm_scpi: Check the DVFS OPP count returned by the firmware | * 3491404405 regmap: irq: Set lockdep class for hierarchical IRQ domains | * a6e1387e9f ARM: dts: cubieboard4: Fix DCDC5 regulator constraints | * 6f0093c15f tpm: fix signed/unsigned bug when checking event logs | * 2fc27a7fc5 efi/tpm: Pass correct address to memblock_reserve | * 5ad7dc9748 mmc: mmc_spi: drop buggy snprintf() | * 7a3465b79e soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() | * 6ebcbacbcf soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() | * 054de36e91 time: Fix references to _msecs_to_jiffies() handling of values | * 3428cc5047 crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() | * 75e1e38e5d crypto: bcm - add error check in the ahash_hmac_init function | * 2d721b961d crypto: cavium - Fix the if condition to exit loop after timeout | * fca8aed122 crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY | * adadb7167a EDAC/fsl_ddr: Fix bad bit shift operations | * 8cc31cfa36 EDAC/bluefield: Fix potential integer overflow | * de5d5b84a6 firmware: google: Unregister driver_info on failure | * 659e78fe61 firmware: google: Unregister driver_info on failure and exit in gsmi | * f57725bcc5 hfsplus: don't query the device logical block size multiple times | * b76579701b s390/syscalls: Avoid creation of arch/arch/ directory | * 52a1c2242e acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() | * b3b2838426 m68k: mvme147: Reinstate early console | * 83ba8219bf m68k: mvme16x: Add and use "mvme16x.h" | * f1441a0dce m68k: mvme147: Fix SCSI controller IRQ numbers | * ac22240540 nvme-pci: fix freeing of the HMB descriptor table | * c509b1acbd initramfs: avoid filename buffer overrun | * 30608827e8 mips: asm: fix warning when disabling MIPS_FP_SUPPORT | * b214a6dd48 x86/xen/pvh: Annotate indirect branch as safe | * 7f591ed125 nvme: fix metadata handling in nvme-passthrough | * ab64809049 NFSD: Force all NFSv4.2 COPY requests to be synchronous | * 7b222d6cb8 cifs: Fix buffer overflow when parsing NFS reparse points | * bdd8bfe75d ipmr: Fix access to mfc_cache_list without lock held | * bff0f725c7 proc/softirqs: replace seq_printf with seq_put_decimal_ull_width | * 1c3c3d8177 ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() | * 05fc0c3d6f ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate() | * 43cec71ce2 regulator: rk808: Add apply_bit for BUCK3 on RK809 | * e5137997b8 soc: qcom: Add check devm_kasprintf() returned value | * 3b084fe40c net: usb: qmi_wwan: add Quectel RG650V | * ffa5b6230a x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB | * cb3309b9ae ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13 | * 50c946b263 selftests/watchdog-test: Fix system accidentally reset after watchdog-test | * a862a826cb mac80211: fix user-power when emulating chanctx | * ab38b9267f ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet | * a3c65022d8 mm: revert "mm: shmem: fix data-race in shmem_getattr()" | * b8a78600ce kbuild: Use uname for LINUX_COMPILE_HOST detection | * e3439cc573 media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set | * 47693ba35b Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" | * 0ce59fb1c7 nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint | * a3abb97830 ocfs2: fix UBSAN warning in ocfs2_verify_volume() | * 6438f3f42c nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint | * c3742319d0 KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN | * 5ae8cc0b0c ocfs2: uncache inode which has failed entering the group | * a0ddb20a74 net/mlx5e: kTLS, Fix incorrect page refcounting | * 0d568258f9 net/mlx5: fs, lock FTE when checking if active | * 598c956b62 netlink: terminate outstanding dump on socket close * 4ed1e6725b Merge branch 'android11-5.4' into android11-5.4-lts Change-Id: I6fbef186b3de42a158c8ad0e8a06de08f08e6509 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-01-17 09:32:47 +00:00 · 2025-01-17 09:32:47 +00:00 · 4c8fb32758
commit 4c8fb32758
parent bf5b85fe24 b9aba1f4e2
387 changed files with 2922 additions and 1669 deletions
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@ -125,6 +125,17 @@ Description:
 		will be present in sysfs.  Writing 1 to this file
 		will perform reset.

+What:		/sys/bus/pci/devices/.../reset_subordinate
+Date:		October 2024
+Contact:	linux-pci@vger.kernel.org
+Description:
+		This is visible only for bridge devices. If you want to reset
+		all devices attached through the subordinate bus of a specific
+		bridge device, writing 1 to this will try to do it.  This will
+		affect all devices attached to the system through this bridge
+		similiar to writing 1 to their individual "reset" file, so use
+		with caution.
+
 What:		/sys/bus/pci/devices/.../vpd
 Date:		February 2008
 Contact:	Ben Hutchings <bwh@kernel.org>
--- a/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
+++ b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
@ -0,0 +1,67 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/adi,axi-clkgen.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Binding for Analog Devices AXI clkgen pcore clock generator
+
+maintainers:
+  - Lars-Peter Clausen <lars@metafoo.de>
+  - Michael Hennerich <michael.hennerich@analog.com>
+
+description: |
+  The axi_clkgen IP core is a software programmable clock generator,
+  that can be synthesized on various FPGA platforms.
+
+  Link: https://wiki.analog.com/resources/fpga/docs/axi_clkgen
+
+properties:
+  compatible:
+    enum:
+      - adi,axi-clkgen-2.00.a
+
+  clocks:
+    description:
+      Specifies the reference clock(s) from which the output frequency is
+      derived. This must either reference one clock if only the first clock
+      input is connected or two if both clock inputs are connected. The last
+      clock is the AXI bus clock that needs to be enabled so we can access the
+      core registers.
+    minItems: 2
+    maxItems: 3
+
+  clock-names:
+    oneOf:
+      - items:
+          - const: clkin1
+          - const: s_axi_aclk
+      - items:
+          - const: clkin1
+          - const: clkin2
+          - const: s_axi_aclk
+
+  '#clock-cells':
+    const: 0
+
+  reg:
+    maxItems: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - clock-names
+  - '#clock-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    clock-controller@ff000000 {
+      compatible = "adi,axi-clkgen-2.00.a";
+      #clock-cells = <0>;
+      reg = <0xff000000 0x1000>;
+      clocks = <&osc 1>, <&clkc 15>;
+      clock-names = "clkin1", "s_axi_aclk";
+    };
--- a/Documentation/devicetree/bindings/clock/axi-clkgen.txt
+++ b/Documentation/devicetree/bindings/clock/axi-clkgen.txt
@ -1,25 +0,0 @@
-Binding for the axi-clkgen clock generator
-
-This binding uses the common clock binding[1].
-
-[1] Documentation/devicetree/bindings/clock/clock-bindings.txt
-
-Required properties:
- compatible : shall be "adi,axi-clkgen-1.00.a" or "adi,axi-clkgen-2.00.a".
- #clock-cells : from common clock binding; Should always be set to 0.
- reg : Address and length of the axi-clkgen register set.
- clocks : Phandle and clock specifier for the parent clock(s). This must
-	either reference one clock if only the first clock input is connected or two
-	if both clock inputs are connected. For the later case the clock connected
-	to the first input must be specified first.
-
-Optional properties:
- clock-output-names : From common clock binding.
-
-Example:
-	clock@ff000000 {
-		compatible = "adi,axi-clkgen";
-		#clock-cells = <0>;
-		reg = <0xff000000 0x1000>;
-		clocks = <&osc 1>;
-	};
--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
@ -633,6 +633,8 @@ patternProperties:
    description: National Semiconductor
  "^nec,.*":
    description: NEC LCD Technologies, Ltd.
+  "^neofidelity,.*":
+    description: Neofidelity Inc.
  "^neonode,.*":
    description: Neonode Inc.
  "^netgear,.*":
--- a/2
+++ b/2
@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 286
+SUBLEVEL = 289
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus

--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@ -6,7 +6,7 @@
 KBUILD_DEFCONFIG := nsim_hs_defconfig

 ifeq ($(CROSS_COMPILE),)
-CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-)
+CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux- arc-linux-gnu-)
 endif

 cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
@ -280,8 +280,8 @@

 			reg_dcdc5: dcdc5 {
 				regulator-always-on;
-				regulator-min-microvolt = <1425000>;
-				regulator-max-microvolt = <1575000>;
+				regulator-min-microvolt = <1450000>;
+				regulator-max-microvolt = <1550000>;
 				regulator-name = "vcc-dram";
 			};

--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@ -433,7 +433,7 @@ static void tls_thread_switch(struct task_struct *next)

 	if (is_compat_thread(task_thread_info(next)))
 		write_sysreg(next->thread.uw.tp_value, tpidrro_el0);
-	else if (!arm64_kernel_unmapped_at_el0())
+	else
 		write_sysreg(0, tpidrro_el0);

 	write_sysreg(*task_user_tls(next), tpidr_el0);
--- a/arch/m68k/coldfire/device.c
+++ b/arch/m68k/coldfire/device.c
@ -92,7 +92,7 @@ static struct platform_device mcf_uart = {
 	.dev.platform_data	= mcf_uart_platform_data,
 };

-#if IS_ENABLED(CONFIG_FEC)
+#ifdef MCFFEC_BASE0

 #ifdef CONFIG_M5441x
 #define FEC_NAME	"enet-fec"
@ -144,6 +144,7 @@ static struct platform_device mcf_fec0 = {
 		.platform_data		= FEC_PDATA,
 	}
 };
+#endif /* MCFFEC_BASE0 */

 #ifdef MCFFEC_BASE1
 static struct resource mcf_fec1_resources[] = {
@ -181,7 +182,6 @@ static struct platform_device mcf_fec1 = {
 	}
 };
 #endif /* MCFFEC_BASE1 */
-#endif /* CONFIG_FEC */

 #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 /*
@ -556,12 +556,12 @@ static struct platform_device mcf_edma = {

 static struct platform_device *mcf_devices[] __initdata = {
 	&mcf_uart,
-#if IS_ENABLED(CONFIG_FEC)
+#ifdef MCFFEC_BASE0
 	&mcf_fec0,
+#endif
 #ifdef MCFFEC_BASE1
 	&mcf_fec1,
 #endif
-#endif
 #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 	&mcf_qspi,
 #endif
--- a/arch/m68k/include/asm/mcfgpio.h
+++ b/arch/m68k/include/asm/mcfgpio.h
@ -144,7 +144,7 @@ static inline void gpio_free(unsigned gpio)
 * read-modify-write as well as those controlled by the EPORT and GPIO modules.
 */
 #define MCFGPIO_SCR_START		40
-#elif defined(CONFIGM5441x)
+#elif defined(CONFIG_M5441x)
 /* The m5441x EPORT doesn't have its own GPIO port, uses PORT C */
 #define MCFGPIO_SCR_START		0
 #else
--- a/arch/m68k/include/asm/mvme147hw.h
+++ b/arch/m68k/include/asm/mvme147hw.h
@ -93,8 +93,8 @@ struct pcc_regs {
 #define M147_SCC_B_ADDR		0xfffe3000
 #define M147_SCC_PCLK		5000000

-#define MVME147_IRQ_SCSI_PORT	(IRQ_USER+0x45)
-#define MVME147_IRQ_SCSI_DMA	(IRQ_USER+0x46)
+#define MVME147_IRQ_SCSI_PORT	(IRQ_USER + 5)
+#define MVME147_IRQ_SCSI_DMA	(IRQ_USER + 6)

 /* SCC interrupts, for MVME147 */

--- a/arch/m68k/kernel/early_printk.c
+++ b/arch/m68k/kernel/early_printk.c
@ -12,8 +12,9 @@
 #include <linux/string.h>
 #include <asm/setup.h>

-extern void mvme16x_cons_write(struct console *co,
-			       const char *str, unsigned count);
+
+#include "../mvme147/mvme147.h"
+#include "../mvme16x/mvme16x.h"

 asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);

@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c,
 {
 #if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
      defined(CONFIG_COLDFIRE))
-	if (MACH_IS_MVME16x)
+	if (MACH_IS_MVME147)
+		mvme147_scc_write(c, s, n);
+	else if (MACH_IS_MVME16x)
 		mvme16x_cons_write(c, s, n);
 	else
 		debug_cons_nputs(s, n);
--- a/arch/m68k/mvme147/config.c
+++ b/arch/m68k/mvme147/config.c
@ -36,6 +36,7 @@
 #include <asm/machdep.h>
 #include <asm/mvme147hw.h>

+#include "mvme147.h"

 static void mvme147_get_model(char *model);
 extern void mvme147_sched_init(irq_handler_t handler);
@ -189,3 +190,32 @@ int mvme147_hwclk(int op, struct rtc_time *t)
 	}
 	return 0;
 }
+
+static void scc_delay(void)
+{
+	__asm__ __volatile__ ("nop; nop;");
+}
+
+static void scc_write(char ch)
+{
+	do {
+		scc_delay();
+	} while (!(in_8(M147_SCC_A_ADDR) & BIT(2)));
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, 8);
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, ch);
+}
+
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	while (count--)	{
+		if (*str == '\n')
+			scc_write('\r');
+		scc_write(*str++);
+	}
+	local_irq_restore(flags);
+}
--- a/arch/m68k/mvme147/mvme147.h
+++ b/arch/m68k/mvme147/mvme147.h
@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+struct console;
+
+/* config.c */
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count);
--- a/arch/m68k/mvme16x/config.c
+++ b/arch/m68k/mvme16x/config.c
@ -39,6 +39,8 @@
 #include <asm/machdep.h>
 #include <asm/mvme16xhw.h>

+#include "mvme16x.h"
+
 extern t_bdid mvme_bdid;

 static MK48T08ptr_t volatile rtc = (MK48T08ptr_t)MVME_RTC_BASE;
--- a/arch/m68k/mvme16x/mvme16x.h
+++ b/arch/m68k/mvme16x/mvme16x.h
@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+struct console;
+
+/* config.c */
+void mvme16x_cons_write(struct console *co, const char *str, unsigned count);
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@ -272,7 +272,7 @@ drivers-$(CONFIG_PCI)		+= arch/mips/pci/
 ifdef CONFIG_64BIT
  ifndef KBUILD_SYM32
    ifeq ($(shell expr $(load-y) \< 0xffffffff80000000), 0)
-      KBUILD_SYM32 = y
+      KBUILD_SYM32 = $(call cc-option-yn, -msym32)
    endif
  endif

--- a/arch/mips/include/asm/switch_to.h
+++ b/arch/mips/include/asm/switch_to.h
@ -97,7 +97,7 @@ do {									\
 	}								\
 } while (0)
 #else
-# define __sanitize_fcr31(next)
+# define __sanitize_fcr31(next) do { (void) (next); } while (0)
 #endif

 /*
--- a/arch/powerpc/include/asm/sstep.h
+++ b/arch/powerpc/include/asm/sstep.h
@ -160,9 +160,4 @@ extern int emulate_step(struct pt_regs *regs, unsigned int instr);
 */
 extern int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op);

-extern void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
-			     const void *mem, bool cross_endian);
-extern void emulate_vsx_store(struct instruction_op *op,
-			      const union vsx_reg *reg, void *mem,
-			      bool cross_endian);
 extern int emulate_dcbz(unsigned long ea, struct pt_regs *regs);
--- a/arch/powerpc/include/asm/vdso.h
+++ b/arch/powerpc/include/asm/vdso.h
@ -49,6 +49,7 @@ int vdso_getcpu_init(void);

 #define V_FUNCTION_BEGIN(name)		\
 	.globl name;			\
+	.type name,@function; 		\
 	name:				\

 #define V_FUNCTION_END(name)		\
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@ -2856,7 +2856,7 @@ static void __init fixup_device_tree_chrp(void)
 #endif

 #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC)
-static void __init fixup_device_tree_pmac(void)
+static void __init fixup_device_tree_pmac64(void)
 {
 	phandle u3, i2c, mpic;
 	u32 u3_rev;
@ -2896,7 +2896,31 @@ static void __init fixup_device_tree_pmac(void)
 		     &parent, sizeof(parent));
 }
 #else
-#define fixup_device_tree_pmac()
+#define fixup_device_tree_pmac64()
+#endif
+
+#ifdef CONFIG_PPC_PMAC
+static void __init fixup_device_tree_pmac(void)
+{
+	__be32 val = 1;
+	char type[8];
+	phandle node;
+
+	// Some pmacs are missing #size-cells on escc nodes
+	for (node = 0; prom_next_node(&node); ) {
+		type[0] = '\0';
+		prom_getprop(node, "device_type", type, sizeof(type));
+		if (prom_strcmp(type, "escc"))
+			continue;
+
+		if (prom_getproplen(node, "#size-cells") != PROM_ERROR)
+			continue;
+
+		prom_setprop(node, NULL, "#size-cells", &val, sizeof(val));
+	}
+}
+#else
+static inline void fixup_device_tree_pmac(void) { }
 #endif

 #ifdef CONFIG_PPC_EFIKA
@ -3121,6 +3145,7 @@ static void __init fixup_device_tree(void)
 	fixup_device_tree_maple_memory_controller();
 	fixup_device_tree_chrp();
 	fixup_device_tree_pmac();
+	fixup_device_tree_pmac64();
 	fixup_device_tree_efika();
 	fixup_device_tree_pasemi();
 }
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@ -663,8 +663,8 @@ static nokprobe_inline int emulate_stq(struct pt_regs *regs, unsigned long ea,
 #endif /* __powerpc64 */

 #ifdef CONFIG_VSX
-void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
-		      const void *mem, bool rev)
+static nokprobe_inline void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
+					     const void *mem, bool rev)
 {
 	int size, read_size;
 	int i, j;
@ -744,11 +744,9 @@ void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
 		break;
 	}
 }
-EXPORT_SYMBOL_GPL(emulate_vsx_load);
-NOKPROBE_SYMBOL(emulate_vsx_load);

-void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
-		       void *mem, bool rev)
+static nokprobe_inline void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
+					      void *mem, bool rev)
 {
 	int size, write_size;
 	int i, j;
@ -820,8 +818,6 @@ void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
 		break;
 	}
 }
-EXPORT_SYMBOL_GPL(emulate_vsx_store);
-NOKPROBE_SYMBOL(emulate_vsx_store);

 static nokprobe_inline int do_vsx_load(struct instruction_op *op,
 				       unsigned long ea, struct pt_regs *regs,
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@ -1862,7 +1862,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags)
 	event->hw.state |= PERF_HES_STOPPED;

 	if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) {
-		hw_perf_event_update(event, 1);
+		/* CPU hotplug off removes SDBs. No samples to extract. */
+		if (cpuhw->flags & PMU_F_RESERVED)
+			hw_perf_event_update(event, 1);
 		event->hw.state |= PERF_HES_UPTODATE;
 	}
 	perf_pmu_enable(event->pmu);
--- a/arch/s390/kernel/syscalls/Makefile
+++ b/arch/s390/kernel/syscalls/Makefile
@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h
 uapi-hdrs-y := $(uapi)/unistd_32.h
 uapi-hdrs-y += $(uapi)/unistd_64.h

-targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))
+targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))

 PHONY += kapi uapi

--- a/arch/sh/kernel/cpu/proc.c
+++ b/arch/sh/kernel/cpu/proc.c
@ -133,7 +133,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)

 static void *c_start(struct seq_file *m, loff_t *pos)
 {
-	return *pos < NR_CPUS ? cpu_data + *pos : NULL;
+	return *pos < nr_cpu_ids ? cpu_data + *pos : NULL;
 }
 static void *c_next(struct seq_file *m, void *v, loff_t *pos)
 {
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@ -347,7 +347,7 @@ static struct platform_driver uml_net_driver = {

 static void net_device_release(struct device *dev)
 {
-	struct uml_net *device = dev_get_drvdata(dev);
+	struct uml_net *device = container_of(dev, struct uml_net, pdev.dev);
 	struct net_device *netdev = device->dev;
 	struct uml_net_private *lp = netdev_priv(netdev);

--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@ -860,7 +860,7 @@ static int ubd_open_dev(struct ubd *ubd_dev)

 static void ubd_device_release(struct device *dev)
 {
-	struct ubd *ubd_dev = dev_get_drvdata(dev);
+	struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev);

 	blk_cleanup_queue(ubd_dev->queue);
 	blk_mq_free_tag_set(&ubd_dev->tag_set);
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@ -802,7 +802,8 @@ static struct platform_driver uml_net_driver = {

 static void vector_device_release(struct device *dev)
 {
-	struct vector_device *device = dev_get_drvdata(dev);
+	struct vector_device *device =
+		container_of(dev, struct vector_device, pdev.dev);
 	struct net_device *netdev = device->dev;

 	list_del(&device->list);
--- a/arch/um/kernel/physmem.c
+++ b/arch/um/kernel/physmem.c
@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end,
 			  unsigned long len, unsigned long long highmem)
 {
 	unsigned long reserve = reserve_end - start;
-	long map_size = len - reserve;
+	unsigned long map_size = len - reserve;
 	int err;

-	if(map_size <= 0) {
+	if (len <= reserve) {
 		os_warn("Too few physical memory! Needed=%lu, given=%lu\n",
 			reserve, len);
 		exit(1);
@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end,
 	err = os_map_memory((void *) reserve_end, physmem_fd, reserve,
 			    map_size, 1, 1, 1);
 	if (err < 0) {
-		os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p "
+		os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p "
 			"failed - errno = %d\n", map_size,
 			(void *) reserve_end, err);
 		exit(1);
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@ -444,6 +444,6 @@ int elf_core_copy_fpregs(struct task_struct *t, elf_fpregset_t *fpu)
 {
 	int cpu = current_thread_info()->cpu;

-	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu);
+	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu) == 0;
 }

--- a/arch/um/kernel/sysrq.c
+++ b/arch/um/kernel/sysrq.c
@ -17,7 +17,9 @@

 static void _print_addr(void *data, unsigned long address, int reliable)
 {
-	pr_info(" [<%08lx>] %s%pS\n", address, reliable ? "" : "? ",
+	const char *loglvl = data;
+
+	printk("%s [<%08lx>] %s%pS\n", loglvl, address, reliable ? "" : "? ",
 		(void *)address);
 }

@ -25,9 +27,9 @@ static const struct stacktrace_ops stackops = {
 	.address = _print_addr
 };

-void show_stack(struct task_struct *task, unsigned long *stack)
+void show_stack_loglvl(struct task_struct *task, unsigned long *stack,
+		       const char *loglvl)
 {
-	unsigned long *sp = stack;
 	struct pt_regs *segv_regs = current->thread.segv_regs;
 	int i;

@ -38,10 +40,9 @@ void show_stack(struct task_struct *task, unsigned long *stack)
 	}

 	if (!stack)
-		sp = get_stack_pointer(task, segv_regs);
+		stack = get_stack_pointer(task, segv_regs);

-	pr_info("Stack:\n");
-	stack = sp;
+	printk("%sStack:\n", loglvl);
 	for (i = 0; i < 3 * STACKSLOTS_PER_LINE; i++) {
 		if (kstack_end(stack))
 			break;
@ -49,9 +50,12 @@ void show_stack(struct task_struct *task, unsigned long *stack)
 			pr_cont("\n");
 		pr_cont(" %08lx", *stack++);
 	}
-	pr_cont("\n");

-	pr_info("Call Trace:\n");
-	dump_trace(current, &stackops, NULL);
-	pr_info("\n");
+	printk("%sCall Trace:\n", loglvl);
+	dump_trace(task ?: current, &stackops, (void *)loglvl);
+}
+
+void show_stack(struct task_struct *task, unsigned long *stack)
+{
+	show_stack_loglvl(task, stack, KERN_INFO);
 }
--- a/arch/x86/crypto/aegis128-aesni-asm.S
+++ b/arch/x86/crypto/aegis128-aesni-asm.S
@ -20,7 +20,7 @@
 #define T1	%xmm7

 #define STATEP	%rdi
-#define LEN	%rsi
+#define LEN	%esi
 #define SRC	%rdx
 #define DST	%rcx

@ -75,32 +75,32 @@ __load_partial:
 	xor %r9d, %r9d
 	pxor MSG, MSG

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1, %r8
 	jz .Lld_partial_1

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1E, %r8
 	add SRC, %r8
 	mov (%r8), %r9b

 .Lld_partial_1:
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x2, %r8
 	jz .Lld_partial_2

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1C, %r8
 	add SRC, %r8
 	shl $0x10, %r9
 	mov (%r8), %r9w

 .Lld_partial_2:
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x4, %r8
 	jz .Lld_partial_4

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x18, %r8
 	add SRC, %r8
 	shl $32, %r9
@ -110,11 +110,11 @@ __load_partial:
 .Lld_partial_4:
 	movq %r9, MSG

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x8, %r8
 	jz .Lld_partial_8

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x10, %r8
 	add SRC, %r8
 	pslldq $8, MSG
@ -138,7 +138,7 @@ ENDPROC(__load_partial)
 *   %r10
 */
 __store_partial:
-	mov LEN, %r8
+	mov LEN, %r8d
 	mov DST, %r9

 	movq T0, %r10
@ -676,7 +676,7 @@ ENTRY(crypto_aegis128_aesni_dec_tail)
 	call __store_partial

 	/* mask with byte count: */
-	movq LEN, T0
+	movd LEN, T0
 	punpcklbw T0, T0
 	punpcklbw T0, T0
 	punpcklbw T0, T0
@ -701,7 +701,8 @@ ENDPROC(crypto_aegis128_aesni_dec_tail)

 /*
 * void crypto_aegis128_aesni_final(void *state, void *tag_xor,
- *                                  u64 assoclen, u64 cryptlen);
+ *                                  unsigned int assoclen,
+ *                                  unsigned int cryptlen);
 */
 ENTRY(crypto_aegis128_aesni_final)
 	FRAME_BEGIN
@ -714,8 +715,8 @@ ENTRY(crypto_aegis128_aesni_final)
 	movdqu 0x40(STATEP), STATE4

 	/* prepare length block: */
-	movq %rdx, MSG
-	movq %rcx, T0
+	movd %edx, MSG
+	movd %ecx, T0
 	pslldq $8, T0
 	pxor T0, MSG
 	psllq $3, MSG /* multiply by 8 (to get bit count) */
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@ -782,11 +782,13 @@ static void pt_buffer_advance(struct pt_buffer *buf)
 	buf->cur_idx++;

 	if (buf->cur_idx == buf->cur->last) {
-		if (buf->cur == buf->last)
+		if (buf->cur == buf->last) {
 			buf->cur = buf->first;
-		else
+			buf->wrapped = true;
+		} else {
 			buf->cur = list_entry(buf->cur->list.next, struct topa,
 					      list);
+		}
 		buf->cur_idx = 0;
 	}
 }
@ -800,8 +802,11 @@ static void pt_buffer_advance(struct pt_buffer *buf)
 static void pt_update_head(struct pt *pt)
 {
 	struct pt_buffer *buf = perf_get_aux(&pt->handle);
+	bool wrapped = buf->wrapped;
 	u64 topa_idx, base, old;

+	buf->wrapped = false;
+
 	/* offset of the first region in this table from the beginning of buf */
 	base = buf->cur->offset + buf->output_off;

@ -814,7 +819,7 @@ static void pt_update_head(struct pt *pt)
 	} else {
 		old = (local64_xchg(&buf->head, base) &
 		       ((buf->nr_pages << PAGE_SHIFT) - 1));
-		if (base < old)
+		if (base < old || (base == old && wrapped))
 			base += buf->nr_pages << PAGE_SHIFT;

 		local_add(base - old, &buf->data_size);
--- a/arch/x86/events/intel/pt.h
+++ b/arch/x86/events/intel/pt.h
@ -64,6 +64,7 @@ struct pt_pmu {
 * @lost:	if data was lost/truncated
 * @head:	logical write offset inside the buffer
 * @snapshot:	if this is for a snapshot/overwrite counter
+ * @wrapped:	buffer advance wrapped back to the first topa table
 * @stop_pos:	STOP topa entry index
 * @intr_pos:	INT topa entry index
 * @stop_te:	STOP topa entry pointer
@ -80,6 +81,7 @@ struct pt_buffer {
 	local_t			data_size;
 	local64_t		head;
 	bool			snapshot;
+	bool			wrapped;
 	long			stop_pos, intr_pos;
 	struct topa_entry	*stop_te, *intr_te;
 	void			**data_pages;
--- a/arch/x86/include/asm/amd_nb.h
+++ b/arch/x86/include/asm/amd_nb.h
@ -118,7 +118,10 @@ static inline bool amd_gart_present(void)

 #define amd_nb_num(x)		0
 #define amd_nb_has_feature(x)	false
-#define node_to_amd_nb(x)	NULL
+static inline struct amd_northbridge *node_to_amd_nb(int node)
+{
+	return NULL;
+}
 #define amd_gart_present(x)	false

 #endif
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@ -335,12 +335,6 @@ early_idt_handler_common:
 	jmp restore_regs_and_return_to_kernel
 END(early_idt_handler_common)

-	__INITDATA
-
-	.balign 4
-GLOBAL(early_recursion_flag)
-	.long 0
-
 #define NEXT_PAGE(name) \
 	.balign	PAGE_SIZE; \
 GLOBAL(name)
@ -375,6 +369,8 @@ GLOBAL(name)
 	.endr

 	__INITDATA
+	.balign 4
+
 NEXT_PGD_PAGE(early_top_pgt)
 	.fill	512,8,0
 	.fill	PTI_USER_PGD_FILL,8,0
@ -382,6 +378,9 @@ NEXT_PGD_PAGE(early_top_pgt)
 NEXT_PAGE(early_dynamic_pgts)
 	.fill	512*EARLY_DYNAMIC_PAGE_TABLES,8,0

+GLOBAL(early_recursion_flag)
+	.long 0
+
 	.data

 #if defined(CONFIG_XEN_PV) || defined(CONFIG_PVH)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@ -179,9 +179,11 @@ module_param(ple_window_shrink, uint, 0444);
 static unsigned int ple_window_max        = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
 module_param(ple_window_max, uint, 0444);

-/* Default is SYSTEM mode, 1 for host-guest mode */
+/* Default is SYSTEM mode, 1 for host-guest mode (which is BROKEN) */
 int __read_mostly pt_mode = PT_MODE_SYSTEM;
+#ifdef CONFIG_BROKEN
 module_param(pt_mode, int, S_IRUGO);
+#endif

 static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
 static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
--- a/arch/x86/platform/pvh/head.S
+++ b/arch/x86/platform/pvh/head.S
@ -16,6 +16,7 @@
 #include <asm/boot.h>
 #include <asm/processor-flags.h>
 #include <asm/msr.h>
+#include <asm/nospec-branch.h>
 #include <xen/interface/elfnote.h>

 	__HEAD
@ -105,6 +106,7 @@ ENTRY(pvh_start_xen)
 	/* startup_64 expects boot_params in %rsi. */
 	mov $_pa(pvh_bootparams), %rsi
 	mov $_pa(startup_64), %rax
+	ANNOTATE_RETPOLINE_SAFE
 	jmp *%rax

 #else /* CONFIG_X86_64 */
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@ -907,7 +907,27 @@ static void __propagate_active_weight(struct ioc_gq *iocg, u32 active, u32 inuse

 	lockdep_assert_held(&ioc->lock);

-	inuse = min(active, inuse);
+	/*
+	 * For an active leaf node, its inuse shouldn't be zero or exceed
+	 * @active. An active internal node's inuse is solely determined by the
+	 * inuse to active ratio of its children regardless of @inuse.
+	 */
+	if (list_empty(&iocg->active_list) && iocg->child_active_sum) {
+		inuse = DIV64_U64_ROUND_UP(active * iocg->child_inuse_sum,
+					   iocg->child_active_sum);
+	} else {
+		/*
+		 * It may be tempting to turn this into a clamp expression with
+		 * a lower limit of 1 but active may be 0, which cannot be used
+		 * as an upper limit in that situation. This expression allows
+		 * active to clamp inuse unless it is 0, in which case inuse
+		 * becomes 1.
+		 */
+		inuse = min(inuse, active) ?: 1;
+	}
+
+	if (active == iocg->active && inuse == iocg->inuse)
+		return;

 	for (lvl = iocg->level - 1; lvl >= 0; lvl--) {
 		struct ioc_gq *parent = iocg->ancestors[lvl];
@ -917,7 +937,7 @@ static void __propagate_active_weight(struct ioc_gq *iocg, u32 active, u32 inuse
 		/* update the level sums */
 		parent->child_active_sum += (s32)(active - child->active);
 		parent->child_inuse_sum += (s32)(inuse - child->inuse);
-		/* apply the udpates */
+		/* apply the updates */
 		child->active = active;
 		child->inuse = inuse;

--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@ -1652,6 +1652,12 @@ void blk_mq_start_stopped_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
 		return;

 	clear_bit(BLK_MQ_S_STOPPED, &hctx->state);
+	/*
+	 * Pairs with the smp_mb() in blk_mq_hctx_stopped() to order the
+	 * clearing of BLK_MQ_S_STOPPED above and the checking of dispatch
+	 * list in the subsequent routine.
+	 */
+	smp_mb__after_atomic();
 	blk_mq_run_hw_queue(hctx, async);
 }
 EXPORT_SYMBOL_GPL(blk_mq_start_stopped_hw_queue);
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@ -178,6 +178,19 @@ static inline struct blk_mq_tags *blk_mq_tags_from_data(struct blk_mq_alloc_data

 static inline bool blk_mq_hctx_stopped(struct blk_mq_hw_ctx *hctx)
 {
+	/* Fast path: hardware queue is not stopped most of the time. */
+	if (likely(!test_bit(BLK_MQ_S_STOPPED, &hctx->state)))
+		return false;
+
+	/*
+	 * This barrier is used to order adding of dispatch list before and
+	 * the test of BLK_MQ_S_STOPPED below. Pairs with the memory barrier
+	 * in blk_mq_start_stopped_hw_queue() so that dispatch code could
+	 * either see BLK_MQ_S_STOPPED is cleared or dispatch list is not
+	 * empty to avoid missing dispatching requests.
+	 */
+	smp_mb();
+
 	return test_bit(BLK_MQ_S_STOPPED, &hctx->state);
 }

--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@ -118,8 +118,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req)
 	err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu);
 	if (!err)
 		return -EINPROGRESS;
-	if (err == -EBUSY)
-		return -EAGAIN;
+	if (err == -EBUSY) {
+		/* try non-parallel mode */
+		return crypto_aead_encrypt(creq);
+	}

 	return err;
 }
@ -167,8 +169,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req)
 	err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu);
 	if (!err)
 		return -EINPROGRESS;
-	if (err == -EBUSY)
-		return -EAGAIN;
+	if (err == -EBUSY) {
+		/* try non-parallel mode */
+		return crypto_aead_decrypt(creq);
+	}

 	return err;
 }
--- a/drivers/acpi/acpica/evxfregn.c
+++ b/drivers/acpi/acpica/evxfregn.c
@ -201,8 +201,6 @@ acpi_remove_address_space_handler(acpi_handle device,

 			/* Now we can delete the handler object */

-			acpi_os_release_mutex(handler_obj->address_space.
-					      context_mutex);
 			acpi_ut_remove_reference(handler_obj);
 			goto unlock_and_exit;
 		}
--- a/drivers/acpi/arm64/gtdt.c
+++ b/drivers/acpi/arm64/gtdt.c
@ -283,7 +283,7 @@ error:
 		if (frame->virt_irq > 0)
 			acpi_unregister_gsi(gtdt_frame->virtual_timer_interrupt);
 		frame->virt_irq = 0;
-	} while (i-- >= 0 && gtdt_frame--);
+	} while (i-- > 0 && gtdt_frame--);

 	return -EINVAL;
 }
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@ -250,6 +250,9 @@ static bool acpi_decode_space(struct resource_win *win,
 	switch (addr->resource_type) {
 	case ACPI_MEMORY_RANGE:
 		acpi_dev_memresource_flags(res, len, wp);
+
+		if (addr->info.mem.caching == ACPI_PREFETCHABLE_MEMORY)
+			res->flags |= IORESOURCE_PREFETCH;
 		break;
 	case ACPI_IO_RANGE:
 		acpi_dev_ioresource_flags(res, len, iodec,
@ -265,9 +268,6 @@ static bool acpi_decode_space(struct resource_win *win,
 	if (addr->producer_consumer == ACPI_PRODUCER)
 		res->flags |= IORESOURCE_WINDOW;

-	if (addr->info.mem.caching == ACPI_PREFETCHABLE_MEMORY)
-		res->flags |= IORESOURCE_PREFETCH;
-
 	return !(res->flags & IORESOURCE_DISABLED);
 }

--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@ -348,6 +348,7 @@ static int highbank_initialize_phys(struct device *dev, void __iomem *addr)
 			phy_nodes[phy] = phy_data.np;
 			cphy_base[phy] = of_iomap(phy_nodes[phy], 0);
 			if (cphy_base[phy] == NULL) {
+				of_node_put(phy_data.np);
 				return 0;
 			}
 			phy_count += 1;
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@ -522,12 +522,16 @@ exit:
 		return IRQ_NONE;
 }

+static struct lock_class_key regmap_irq_lock_class;
+static struct lock_class_key regmap_irq_request_class;
+
 static int regmap_irq_map(struct irq_domain *h, unsigned int virq,
 			  irq_hw_number_t hw)
 {
 	struct regmap_irq_chip_data *data = h->host_data;

 	irq_set_chip_data(virq, data);
+	irq_set_lockdep_class(virq, &regmap_irq_lock_class, &regmap_irq_request_class);
 	irq_set_chip(virq, &data->irq_chip);
 	irq_set_nested_thread(virq, 1);
 	irq_set_parent(virq, data->irq);
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@ -603,6 +603,17 @@ int regmap_attach_dev(struct device *dev, struct regmap *map,
 }
 EXPORT_SYMBOL_GPL(regmap_attach_dev);

+static int dev_get_regmap_match(struct device *dev, void *res, void *data);
+
+static int regmap_detach_dev(struct device *dev, struct regmap *map)
+{
+	if (!dev)
+		return 0;
+
+	return devres_release(dev, dev_get_regmap_release,
+			      dev_get_regmap_match, (void *)map->name);
+}
+
 static enum regmap_endian regmap_get_reg_endian(const struct regmap_bus *bus,
 					const struct regmap_config *config)
 {
@ -1048,13 +1059,13 @@ skip_format_initialization:

 		/* Sanity check */
 		if (range_cfg->range_max < range_cfg->range_min) {
-			dev_err(map->dev, "Invalid range %d: %d < %d\n", i,
+			dev_err(map->dev, "Invalid range %d: %u < %u\n", i,
 				range_cfg->range_max, range_cfg->range_min);
 			goto err_range;
 		}

 		if (range_cfg->range_max > map->max_register) {
-			dev_err(map->dev, "Invalid range %d: %d > %d\n", i,
+			dev_err(map->dev, "Invalid range %d: %u > %u\n", i,
 				range_cfg->range_max, map->max_register);
 			goto err_range;
 		}
@ -1331,6 +1342,7 @@ void regmap_exit(struct regmap *map)
 {
 	struct regmap_async *async;

+	regmap_detach_dev(map->dev, map);
 	regcache_exit(map);
 	regmap_debugfs_exit(map);
 	regmap_range_exit(map);
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@ -1066,9 +1066,12 @@ static void virtblk_remove(struct virtio_device *vdev)
 static int virtblk_freeze(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;
+	struct request_queue *q = vblk->disk->queue;

 	/* Ensure no requests in virtqueues before deleting vqs. */
-	blk_mq_freeze_queue(vblk->disk->queue);
+	blk_mq_freeze_queue(q);
+	blk_mq_quiesce_queue_nowait(q);
+	blk_mq_unfreeze_queue(q);

 	/* Ensure we don't receive any more interrupts */
 	vdev->config->reset(vdev);
@ -1092,8 +1095,8 @@ static int virtblk_restore(struct virtio_device *vdev)
 		return ret;

 	virtio_device_ready(vdev);
+	blk_mq_unquiesce_queue(vblk->disk->queue);

-	blk_mq_unfreeze_queue(vblk->disk->queue);
 	return 0;
 }
 #endif
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@ -495,6 +495,12 @@ static ssize_t backing_dev_store(struct device *dev,
 	}

 	nr_pages = i_size_read(inode) >> PAGE_SHIFT;
+	/* Refuse to use zero sized device (also prevents self reference) */
+	if (!nr_pages) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long);
 	bitmap = kvzalloc(bitmap_sz, GFP_KERNEL);
 	if (!bitmap) {
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@ -372,6 +372,8 @@ static const struct usb_device_id blacklist_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0489, 0xe123), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },

--- a/drivers/clk/clk-axi-clkgen.c
+++ b/drivers/clk/clk-axi-clkgen.c
@ -7,6 +7,7 @@
 */

 #include <linux/platform_device.h>
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/slab.h>
 #include <linux/io.h>
@ -412,7 +413,7 @@ static int axi_clkgen_probe(struct platform_device *pdev)
 	struct clk_init_data init;
 	const char *parent_names[2];
 	const char *clk_name;
-	struct resource *mem;
+	struct clk *axi_clk;
 	unsigned int i;
 	int ret;

@ -427,14 +428,29 @@ static int axi_clkgen_probe(struct platform_device *pdev)
 	if (!axi_clkgen)
 		return -ENOMEM;

-	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	axi_clkgen->base = devm_ioremap_resource(&pdev->dev, mem);
+	axi_clkgen->base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(axi_clkgen->base))
 		return PTR_ERR(axi_clkgen->base);

 	init.num_parents = of_clk_get_parent_count(pdev->dev.of_node);
-	if (init.num_parents < 1 || init.num_parents > 2)
-		return -EINVAL;
+
+	axi_clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk");
+	if (!IS_ERR(axi_clk)) {
+		if (init.num_parents < 2 || init.num_parents > 3)
+			return -EINVAL;
+
+		init.num_parents -= 1;
+	} else {
+		/*
+		 * Legacy... So that old DTs which do not have clock-names still
+		 * work. In this case we don't explicitly enable the AXI bus
+		 * clock.
+		 */
+		if (PTR_ERR(axi_clk) != -ENOENT)
+			return PTR_ERR(axi_clk);
+		if (init.num_parents < 1 || init.num_parents > 2)
+			return -EINVAL;
+	}

 	for (i = 0; i < init.num_parents; i++) {
 		parent_names[i] = of_clk_get_parent_name(pdev->dev.of_node, i);
--- a/drivers/clk/qcom/gcc-qcs404.c
+++ b/drivers/clk/qcom/gcc-qcs404.c
@ -337,6 +337,7 @@ static struct clk_alpha_pll gpll1_out_main = {
 /* 930MHz configuration */
 static const struct alpha_pll_config gpll3_config = {
 	.l = 48,
+	.alpha_hi = 0x70,
 	.alpha = 0x0,
 	.alpha_en_mask = BIT(24),
 	.post_div_mask = 0xf << 8,
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@ -167,7 +167,9 @@ static int __init cpufreq_init(void)

 	ret = cpufreq_register_driver(&loongson2_cpufreq_driver);

-	if (!ret && !nowait) {
+	if (ret) {
+		platform_driver_unregister(&platform_driver);
+	} else if (!nowait) {
 		saved_cpu_wait = cpu_wait;
 		cpu_wait = loongson2_cpu_wait;
 	}
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@ -2478,6 +2478,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key,

 static int ahash_hmac_init(struct ahash_request *req)
 {
+	int ret;
 	struct iproc_reqctx_s *rctx = ahash_request_ctx(req);
 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
 	struct iproc_ctx_s *ctx = crypto_ahash_ctx(tfm);
@ -2487,7 +2488,9 @@ static int ahash_hmac_init(struct ahash_request *req)
 	flow_log("ahash_hmac_init()\n");

 	/* init the context as a hash */
-	ahash_init(req);
+	ret = ahash_init(req);
+	if (ret)
+		return ret;

 	if (!spu_no_incr_hash(ctx)) {
 		/* SPU-M can do incr hashing but needs sw for outer HMAC */
--- a/drivers/crypto/cavium/cpt/cptpf_main.c
+++ b/drivers/crypto/cavium/cpt/cptpf_main.c
@ -45,7 +45,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask,
 		dev_err(dev, "Cores still busy %llx", coremask);
 		grp = cpt_read_csr64(cpt->reg_base,
 				     CPTX_PF_EXEC_BUSY(0));
-		if (timeout--)
+		if (!timeout--)
 			break;

 		udelay(CSR_DELAY);
@ -303,6 +303,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)

 	ret = do_cpt_init(cpt, mcode);
 	if (ret) {
+		dma_free_coherent(&cpt->pdev->dev, mcode->code_size,
+				  mcode->code, mcode->phys_base);
 		dev_err(dev, "do_cpt_init failed with ret: %d\n", ret);
 		goto fw_release;
 	}
@ -395,7 +397,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt)
 		dev_err(dev, "Cores still busy");
 		grp = cpt_read_csr64(cpt->reg_base,
 				     CPTX_PF_EXEC_BUSY(0));
-		if (timeout--)
+		if (!timeout--)
 			break;

 		udelay(CSR_DELAY);
--- a/drivers/crypto/chelsio/chtls/chtls_main.c
+++ b/drivers/crypto/chelsio/chtls/chtls_main.c
@ -339,8 +339,9 @@ static struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl,
 	 * driver. Once driver synthesizes cpl_pass_accpet_req the skb will go
 	 * through the regular cpl_pass_accept_req processing in TOM.
 	 */
-	skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req)
-			- pktshift, GFP_ATOMIC);
+	skb = alloc_skb(size_add(gl->tot_len,
+				 sizeof(struct cpl_pass_accept_req)) -
+			pktshift, GFP_ATOMIC);
 	if (unlikely(!skb))
 		return NULL;
 	__skb_put(skb, gl->tot_len + sizeof(struct cpl_pass_accept_req)
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@ -103,10 +103,36 @@ static bool dma_fence_array_enable_signaling(struct dma_fence *fence)
 static bool dma_fence_array_signaled(struct dma_fence *fence)
 {
 	struct dma_fence_array *array = to_dma_fence_array(fence);
+	int num_pending;
+	unsigned int i;

-	if (atomic_read(&array->num_pending) > 0)
+	/*
+	 * We need to read num_pending before checking the enable_signal bit
+	 * to avoid racing with the enable_signaling() implementation, which
+	 * might decrement the counter, and cause a partial check.
+	 * atomic_read_acquire() pairs with atomic_dec_and_test() in
+	 * dma_fence_array_enable_signaling()
+	 *
+	 * The !--num_pending check is here to account for the any_signaled case
+	 * if we race with enable_signaling(), that means the !num_pending check
+	 * in the is_signalling_enabled branch might be outdated (num_pending
+	 * might have been decremented), but that's fine. The user will get the
+	 * right value when testing again later.
+	 */
+	num_pending = atomic_read_acquire(&array->num_pending);
+	if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &array->base.flags)) {
+		if (num_pending <= 0)
+			goto signal;
 		return false;
+	}

+	for (i = 0; i < array->num_fences; ++i) {
+		if (dma_fence_is_signaled(array->fences[i]) && !--num_pending)
+			goto signal;
+	}
+	return false;
+
+signal:
 	dma_fence_array_clear_pending_error(array);
 	return true;
 }
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@ -120,7 +120,7 @@ static const struct dma_buf_ops udmabuf_ops = {
 };

 #define SEALS_WANTED (F_SEAL_SHRINK)
-#define SEALS_DENIED (F_SEAL_WRITE)
+#define SEALS_DENIED (F_SEAL_WRITE|F_SEAL_FUTURE_WRITE)

 static long udmabuf_create(const struct udmabuf_create_list *head,
 			   const struct udmabuf_create_item *list)
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@ -1214,6 +1214,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value,
 		return NULL;

 	desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value);
+	if (!desc)
+		return NULL;
 	list_add_tail(&desc->desc_node, &desc->descs_list);

 	desc->tx_dma_desc.cookie = -EBUSY;
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@ -1394,6 +1394,7 @@ static int mv_xor_probe(struct platform_device *pdev)
 			irq = irq_of_parse_and_map(np, 0);
 			if (!irq) {
 				ret = -ENODEV;
+				of_node_put(np);
 				goto err_channel_add;
 			}

@ -1402,6 +1403,7 @@ static int mv_xor_probe(struct platform_device *pdev)
 			if (IS_ERR(chan)) {
 				ret = PTR_ERR(chan);
 				irq_dispose_mapping(irq);
+				of_node_put(np);
 				goto err_channel_add;
 			}

--- a/drivers/edac/bluefield_edac.c
+++ b/drivers/edac/bluefield_edac.c
@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci)
 static void bluefield_edac_init_dimms(struct mem_ctl_info *mci)
 {
 	struct bluefield_edac_priv *priv = mci->pvt_info;
-	int mem_ctrl_idx = mci->mc_idx;
+	u64 mem_ctrl_idx = mci->mc_idx;
 	struct dimm_info *dimm;
 	u64 smc_info, smc_arg;
 	int is_empty = 1, i;
--- a/drivers/edac/fsl_ddr_edac.c
+++ b/drivers/edac/fsl_ddr_edac.c
@ -331,21 +331,25 @@ static void fsl_mc_check(struct mem_ctl_info *mci)
 	 * TODO: Add support for 32-bit wide buses
 	 */
 	if ((err_detect & DDR_EDE_SBE) && (bus_width == 64)) {
+		u64 cap = (u64)cap_high << 32 | cap_low;
+		u32 s = syndrome;
+
 		sbe_ecc_decode(cap_high, cap_low, syndrome,
 				&bad_data_bit, &bad_ecc_bit);

-		if (bad_data_bit != -1)
-			fsl_mc_printk(mci, KERN_ERR,
-				"Faulty Data bit: %d\n", bad_data_bit);
-		if (bad_ecc_bit != -1)
-			fsl_mc_printk(mci, KERN_ERR,
-				"Faulty ECC bit: %d\n", bad_ecc_bit);
+		if (bad_data_bit >= 0) {
+			fsl_mc_printk(mci, KERN_ERR, "Faulty Data bit: %d\n", bad_data_bit);
+			cap ^= 1ULL << bad_data_bit;
+		}
+
+		if (bad_ecc_bit >= 0) {
+			fsl_mc_printk(mci, KERN_ERR, "Faulty ECC bit: %d\n", bad_ecc_bit);
+			s ^= 1 << bad_ecc_bit;
+		}

 		fsl_mc_printk(mci, KERN_ERR,
 			"Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n",
-			cap_high ^ (1 << (bad_data_bit - 32)),
-			cap_low ^ (1 << bad_data_bit),
-			syndrome ^ (1 << bad_ecc_bit));
+			upper_32_bits(cap), lower_32_bits(cap), s);
 	}

 	fsl_mc_printk(mci, KERN_ERR,
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@ -627,6 +627,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain)
 	if (ret)
 		return ERR_PTR(ret);

+	if (!buf.opp_count)
+		return ERR_PTR(-ENOENT);
+
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
 		return ERR_PTR(-ENOMEM);
--- a/drivers/firmware/efi/tpm.c
+++ b/drivers/firmware/efi/tpm.c
@ -40,7 +40,8 @@ int __init efi_tpm_eventlog_init(void)
 {
 	struct linux_efi_tpm_eventlog *log_tbl;
 	struct efi_tcg2_final_events_table *final_tbl;
-	int tbl_size;
+	unsigned int tbl_size;
+	int final_tbl_size;
 	int ret = 0;

 	if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
@ -80,26 +81,26 @@ int __init efi_tpm_eventlog_init(void)
 		goto out;
 	}

-	tbl_size = 0;
+	final_tbl_size = 0;
 	if (final_tbl->nr_events != 0) {
 		void *events = (void *)efi.tpm_final_log
 				+ sizeof(final_tbl->version)
 				+ sizeof(final_tbl->nr_events);

-		tbl_size = tpm2_calc_event_log_size(events,
-						    final_tbl->nr_events,
-						    log_tbl->log);
+		final_tbl_size = tpm2_calc_event_log_size(events,
+							  final_tbl->nr_events,
+							  log_tbl->log);
 	}

-	if (tbl_size < 0) {
+	if (final_tbl_size < 0) {
 		pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
 		ret = -EINVAL;
 		goto out_calc;
 	}

-	memblock_reserve((unsigned long)final_tbl,
-			 tbl_size + sizeof(*final_tbl));
-	efi_tpm_final_log_size = tbl_size;
+	memblock_reserve(efi.tpm_final_log,
+			 final_tbl_size + sizeof(*final_tbl));
+	efi_tpm_final_log_size = final_tbl_size;

 out_calc:
 	early_memunmap(final_tbl, sizeof(*final_tbl));
--- a/drivers/firmware/google/gsmi.c
+++ b/drivers/firmware/google/gsmi.c
@ -898,7 +898,8 @@ static __init int gsmi_init(void)
 	gsmi_dev.pdev = platform_device_register_full(&gsmi_dev_info);
 	if (IS_ERR(gsmi_dev.pdev)) {
 		printk(KERN_ERR "gsmi: unable to register platform device\n");
-		return PTR_ERR(gsmi_dev.pdev);
+		ret = PTR_ERR(gsmi_dev.pdev);
+		goto out_unregister;
 	}

 	/* SMI access needs to be serialized */
@ -1025,6 +1026,10 @@ out_err:
 	gsmi_buf_free(gsmi_dev.name_buf);
 	dma_pool_destroy(gsmi_dev.dma_pool);
 	platform_device_unregister(gsmi_dev.pdev);
+out_unregister:
+#ifdef CONFIG_PM
+	platform_driver_unregister(&gsmi_driver_info);
+#endif
 	pr_info("gsmi: failed to load: %d\n", ret);
 	return ret;
 }
@ -1047,6 +1052,9 @@ static void __exit gsmi_exit(void)
 	gsmi_buf_free(gsmi_dev.name_buf);
 	dma_pool_destroy(gsmi_dev.dma_pool);
 	platform_device_unregister(gsmi_dev.pdev);
+#ifdef CONFIG_PM
+	platform_driver_unregister(&gsmi_driver_info);
+#endif
 }

 module_init(gsmi_init);
--- a/drivers/gpio/gpio-grgpio.c
+++ b/drivers/gpio/gpio-grgpio.c
@ -328,6 +328,7 @@ static const struct irq_domain_ops grgpio_irq_domain_ops = {
 static int grgpio_probe(struct platform_device *ofdev)
 {
 	struct device_node *np = ofdev->dev.of_node;
+	struct device *dev = &ofdev->dev;
 	void  __iomem *regs;
 	struct gpio_chip *gc;
 	struct grgpio_priv *priv;
@ -337,7 +338,7 @@ static int grgpio_probe(struct platform_device *ofdev)
 	int size;
 	int i;

-	priv = devm_kzalloc(&ofdev->dev, sizeof(*priv), GFP_KERNEL);
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;

@ -346,29 +347,32 @@ static int grgpio_probe(struct platform_device *ofdev)
 		return PTR_ERR(regs);

 	gc = &priv->gc;
-	err = bgpio_init(gc, &ofdev->dev, 4, regs + GRGPIO_DATA,
+	err = bgpio_init(gc, dev, 4, regs + GRGPIO_DATA,
 			 regs + GRGPIO_OUTPUT, NULL, regs + GRGPIO_DIR, NULL,
 			 BGPIOF_BIG_ENDIAN_BYTE_ORDER);
 	if (err) {
-		dev_err(&ofdev->dev, "bgpio_init() failed\n");
+		dev_err(dev, "bgpio_init() failed\n");
 		return err;
 	}

 	priv->regs = regs;
 	priv->imask = gc->read_reg(regs + GRGPIO_IMASK);
-	priv->dev = &ofdev->dev;
+	priv->dev = dev;

 	gc->of_node = np;
 	gc->owner = THIS_MODULE;
 	gc->to_irq = grgpio_to_irq;
-	gc->label = devm_kasprintf(&ofdev->dev, GFP_KERNEL, "%pOF", np);
+	gc->label = devm_kasprintf(dev, GFP_KERNEL, "%pOF", np);
+	if (!gc->label)
+		return -ENOMEM;
+
 	gc->base = -1;

 	err = of_property_read_u32(np, "nbits", &prop);
 	if (err || prop <= 0 || prop > GRGPIO_MAX_NGPIO) {
 		gc->ngpio = GRGPIO_MAX_NGPIO;
-		dev_dbg(&ofdev->dev,
-			"No or invalid nbits property: assume %d\n", gc->ngpio);
+		dev_dbg(dev, "No or invalid nbits property: assume %d\n",
+			gc->ngpio);
 	} else {
 		gc->ngpio = prop;
 	}
@ -380,7 +384,7 @@ static int grgpio_probe(struct platform_device *ofdev)
 	irqmap = (s32 *)of_get_property(np, "irqmap", &size);
 	if (irqmap) {
 		if (size < gc->ngpio) {
-			dev_err(&ofdev->dev,
+			dev_err(dev,
 				"irqmap shorter than ngpio (%d < %d)\n",
 				size, gc->ngpio);
 			return -EINVAL;
@ -390,7 +394,7 @@ static int grgpio_probe(struct platform_device *ofdev)
 						     &grgpio_irq_domain_ops,
 						     priv);
 		if (!priv->domain) {
-			dev_err(&ofdev->dev, "Could not add irq domain\n");
+			dev_err(dev, "Could not add irq domain\n");
 			return -EINVAL;
 		}

@ -420,13 +424,13 @@ static int grgpio_probe(struct platform_device *ofdev)

 	err = gpiochip_add_data(gc, priv);
 	if (err) {
-		dev_err(&ofdev->dev, "Could not add gpiochip\n");
+		dev_err(dev, "Could not add gpiochip\n");
 		if (priv->domain)
 			irq_domain_remove(priv->domain);
 		return err;
 	}

-	dev_info(&ofdev->dev, "regs=0x%p, base=%d, ngpio=%d, irqs=%s\n",
+	dev_info(dev, "regs=0x%p, base=%d, ngpio=%d, irqs=%s\n",
 		 priv->regs, gc->base, gc->ngpio, priv->domain ? "on" : "off");

 	return 0;
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@ -395,7 +395,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
 	if (!adev->smc_rreg)
 		return -EOPNOTSUPP;

-	if (size > 4096 || size & 0x3 || *pos & 0x3)
+	if (size & 0x3 || *pos & 0x3)
 		return -EINVAL;

 	while (size) {
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@ -1678,6 +1678,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)

 	mutex_init(&adev->mman.gtt_window_lock);

+	dma_set_max_seg_size(adev->dev, UINT_MAX);
 	/* No others user of address space so set it to 0 */
 	r = ttm_bo_device_init(&adev->mman.bdev,
 			       &amdgpu_bo_driver,
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
@ -121,6 +121,9 @@ int adv7511_hdmi_hw_params(struct device *dev, void *data,
 		audio_source = ADV7511_AUDIO_SOURCE_I2S;
 		i2s_format = ADV7511_I2S_FORMAT_LEFT_J;
 		break;
+	case HDMI_SPDIF:
+		audio_source = ADV7511_AUDIO_SOURCE_SPDIF;
+		break;
 	default:
 		return -EINVAL;
 	}
@ -144,7 +147,16 @@ int adv7511_hdmi_hw_params(struct device *dev, void *data,
 			   ADV7511_AUDIO_CFG3_LEN_MASK, len);
 	regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG,
 			   ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4);
-	regmap_write(adv7511->regmap, 0x73, 0x1);
+
+	/* send current Audio infoframe values while updating */
+	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+			   BIT(5), BIT(5));
+
+	regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1);
+
+	/* use Audio infoframe updated info */
+	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+			   BIT(5), 0);

 	return 0;
 }
@ -175,13 +187,24 @@ static int audio_startup(struct device *dev, void *data)
 	regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0),
 				BIT(7) | BIT(6), BIT(7));
 	/* use Audio infoframe updated info */
-	regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(1),
+	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
 				BIT(5), 0);
+
+	/* enable SPDIF receiver */
+	if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF)
+		regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG,
+				   BIT(7), BIT(7));
+
 	return 0;
 }

 static void audio_shutdown(struct device *dev, void *data)
 {
+	struct adv7511 *adv7511 = dev_get_drvdata(dev);
+
+	if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF)
+		regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG,
+				   BIT(7), 0);
 }

 static int adv7511_hdmi_i2s_get_dai_id(struct snd_soc_component *component,
@ -215,6 +238,7 @@ static const struct hdmi_codec_pdata codec_data = {
 	.ops = &adv7511_codec_ops,
 	.max_i2s_channels = 2,
 	.i2s = 1,
+	.spdif = 1,
 };

 int adv7511_audio_init(struct device *dev, struct adv7511 *adv7511)
--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c
@ -193,7 +193,7 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv)

 	of_property_read_u32(np, "adi,dsi-lanes", &num_lanes);

-	if (num_lanes < 1 || num_lanes > 4)
+	if (num_lanes < 2 || num_lanes > 4)
 		return -EINVAL;

 	adv->num_dsi_lanes = num_lanes;
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@ -154,7 +154,7 @@ static void show_leaks(struct drm_mm *mm) { }

 INTERVAL_TREE_DEFINE(struct drm_mm_node, rb,
 		     u64, __subtree_last,
-		     START, LAST, static inline, drm_mm_interval_tree)
+		     START, LAST, static inline __maybe_unused, drm_mm_interval_tree)

 struct drm_mm_node *
 __drm_mm_interval_first(const struct drm_mm *mm, u64 start, u64 last)
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@ -166,6 +166,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* AYA NEO AYANEO 2 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"),
+		},
+		.driver_data = (void *)&lcd1200x1920_rightside_up,
 	}, {	/* AYA NEO 2021 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@ -481,7 +481,8 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
 	} else {
 		CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE,
 				       VIVS_GL_FLUSH_CACHE_DEPTH |
-				       VIVS_GL_FLUSH_CACHE_COLOR);
+				       VIVS_GL_FLUSH_CACHE_COLOR |
+				       VIVS_GL_FLUSH_CACHE_SHADER_L1);
 		if (has_blt) {
 			CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1);
 			CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1);
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@ -75,7 +75,7 @@ static void etnaviv_core_dump_header(struct core_dump_iterator *iter,
 	hdr->file_size = cpu_to_le32(data_end - iter->data);

 	iter->hdr++;
-	iter->data += hdr->file_size;
+	iter->data += le32_to_cpu(hdr->file_size);
 }

 static void etnaviv_core_dump_registers(struct core_dump_iterator *iter,
@ -83,10 +83,15 @@ static void etnaviv_core_dump_registers(struct core_dump_iterator *iter,
 {
 	struct etnaviv_dump_registers *reg = iter->data;
 	unsigned int i;
+	u32 read_addr;

 	for (i = 0; i < ARRAY_SIZE(etnaviv_dump_registers); i++, reg++) {
-		reg->reg = etnaviv_dump_registers[i];
-		reg->value = gpu_read(gpu, etnaviv_dump_registers[i]);
+		read_addr = etnaviv_dump_registers[i];
+		if (read_addr >= VIVS_PM_POWER_CONTROLS &&
+		    read_addr <= VIVS_PM_PULSE_EATER)
+			read_addr = gpu_fix_power_address(gpu, read_addr);
+		reg->reg = cpu_to_le32(etnaviv_dump_registers[i]);
+		reg->value = cpu_to_le32(gpu_read(gpu, read_addr));
 	}

 	etnaviv_core_dump_header(iter, ETDUMP_BUF_REG, reg);
@ -207,7 +212,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)
 		if (!IS_ERR(pages)) {
 			int j;

-			iter.hdr->data[0] = bomap - bomap_start;
+			iter.hdr->data[0] = cpu_to_le32((bomap - bomap_start));

 			for (j = 0; j < obj->base.size >> PAGE_SHIFT; j++)
 				*bomap++ = cpu_to_le64(page_to_phys(*pages++));
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@ -566,7 +566,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu)
 	u32 pmc, ppc;

 	/* enable clock gating */
-	ppc = gpu_read(gpu, VIVS_PM_POWER_CONTROLS);
+	ppc = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
 	ppc |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;

 	/* Disable stall module clock gating for 4.3.0.1 and 4.3.0.2 revs */
@ -574,9 +574,9 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu)
 	    gpu->identity.revision == 0x4302)
 		ppc |= VIVS_PM_POWER_CONTROLS_DISABLE_STALL_MODULE_CLOCK_GATING;

-	gpu_write(gpu, VIVS_PM_POWER_CONTROLS, ppc);
+	gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, ppc);

-	pmc = gpu_read(gpu, VIVS_PM_MODULE_CONTROLS);
+	pmc = gpu_read_power(gpu, VIVS_PM_MODULE_CONTROLS);

 	/* Disable PA clock gating for GC400+ without bugfix except for GC420 */
 	if (gpu->identity.model >= chipModel_GC400 &&
@ -605,7 +605,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu)
 	pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_HZ;
 	pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_EZ;

-	gpu_write(gpu, VIVS_PM_MODULE_CONTROLS, pmc);
+	gpu_write_power(gpu, VIVS_PM_MODULE_CONTROLS, pmc);
 }

 void etnaviv_gpu_start_fe(struct etnaviv_gpu *gpu, u32 address, u16 prefetch)
@ -665,11 +665,11 @@ static void etnaviv_gpu_setup_pulse_eater(struct etnaviv_gpu *gpu)
 	    (gpu->identity.features & chipFeatures_PIPE_3D))
 	{
 		/* Performance fix: disable internal DFS */
-		pulse_eater = gpu_read(gpu, VIVS_PM_PULSE_EATER);
+		pulse_eater = gpu_read_power(gpu, VIVS_PM_PULSE_EATER);
 		pulse_eater |= BIT(18);
 	}

-	gpu_write(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
+	gpu_write_power(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
 }

 static void etnaviv_gpu_hw_init(struct etnaviv_gpu *gpu)
@ -1236,10 +1236,12 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,
 {
 	u32 val;

+	mutex_lock(&gpu->lock);
+
 	/* disable clock gating */
-	val = gpu_read(gpu, VIVS_PM_POWER_CONTROLS);
+	val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
 	val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;
-	gpu_write(gpu, VIVS_PM_POWER_CONTROLS, val);
+	gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val);

 	/* enable debug register */
 	val = gpu_read(gpu, VIVS_HI_CLOCK_CONTROL);
@ -1247,6 +1249,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,
 	gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, val);

 	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_PRE);
+
+	mutex_unlock(&gpu->lock);
 }

 static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
@ -1256,23 +1260,27 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
 	unsigned int i;
 	u32 val;

+	mutex_lock(&gpu->lock);
+
 	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST);

-	for (i = 0; i < submit->nr_pmrs; i++) {
-		const struct etnaviv_perfmon_request *pmr = submit->pmrs + i;
-
-		*pmr->bo_vma = pmr->sequence;
-	}
-
 	/* disable debug register */
 	val = gpu_read(gpu, VIVS_HI_CLOCK_CONTROL);
 	val |= VIVS_HI_CLOCK_CONTROL_DISABLE_DEBUG_REGISTERS;
 	gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, val);

 	/* enable clock gating */
-	val = gpu_read(gpu, VIVS_PM_POWER_CONTROLS);
+	val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
 	val |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;
-	gpu_write(gpu, VIVS_PM_POWER_CONTROLS, val);
+	gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val);
+
+	mutex_unlock(&gpu->lock);
+
+	for (i = 0; i < submit->nr_pmrs; i++) {
+		const struct etnaviv_perfmon_request *pmr = submit->pmrs + i;
+
+		*pmr->bo_vma = pmr->sequence;
+	}
 }


--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
@ -10,6 +10,7 @@
 #include "etnaviv_gem.h"
 #include "etnaviv_mmu.h"
 #include "etnaviv_drv.h"
+#include "common.xml.h"

 struct etnaviv_gem_submit;
 struct etnaviv_vram_mapping;
@ -158,6 +159,26 @@ static inline u32 gpu_read(struct etnaviv_gpu *gpu, u32 reg)
 	return readl(gpu->mmio + reg);
 }

+static inline u32 gpu_fix_power_address(struct etnaviv_gpu *gpu, u32 reg)
+{
+	/* Power registers in GC300 < 2.0 are offset by 0x100 */
+	if (gpu->identity.model == chipModel_GC300 &&
+	    gpu->identity.revision < 0x2000)
+		reg += 0x100;
+
+	return reg;
+}
+
+static inline void gpu_write_power(struct etnaviv_gpu *gpu, u32 reg, u32 data)
+{
+	writel(data, gpu->mmio + gpu_fix_power_address(gpu, reg));
+}
+
+static inline u32 gpu_read_power(struct etnaviv_gpu *gpu, u32 reg)
+{
+	return readl(gpu->mmio + gpu_fix_power_address(gpu, reg));
+}
+
 int etnaviv_gpu_get_param(struct etnaviv_gpu *gpu, u32 param, u64 *value);

 int etnaviv_gpu_init(struct etnaviv_gpu *gpu);
--- a/drivers/gpu/drm/i915/i915_scheduler.c
+++ b/drivers/gpu/drm/i915/i915_scheduler.c
@ -533,6 +533,6 @@ int __init i915_global_scheduler_init(void)
 	return 0;

 err_priorities:
-	kmem_cache_destroy(global.slab_priorities);
+	kmem_cache_destroy(global.slab_dependencies);
 	return -ENOMEM;
 }
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@ -411,14 +411,12 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
 	}

 	ipu_crtc->irq = ipu_plane_irq(ipu_crtc->plane[0]);
-	ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, 0,
-			"imx_drm", ipu_crtc);
+	ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler,
+			       IRQF_NO_AUTOEN, "imx_drm", ipu_crtc);
 	if (ret < 0) {
 		dev_err(ipu_crtc->dev, "irq request failed with %d.\n", ret);
 		goto err_put_plane1_res;
 	}
-	/* Only enable IRQ when we actually need it to trigger work. */
-	disable_irq(ipu_crtc->irq);

 	return 0;

--- a/drivers/gpu/drm/mcde/mcde_drv.c
+++ b/drivers/gpu/drm/mcde/mcde_drv.c
@ -533,6 +533,7 @@ static const struct of_device_id mcde_of_match[] = {
 	},
 	{},
 };
+MODULE_DEVICE_TABLE(of, mcde_of_match);

 static struct platform_driver mcde_driver = {
 	.driver = {
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@ -1152,15 +1152,13 @@ static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev,

 	irq = platform_get_irq_byname(pdev, name);

-	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH, name, gmu);
+	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, name, gmu);
 	if (ret) {
 		DRM_DEV_ERROR(&pdev->dev, "Unable to get interrupt %s %d\n",
 			      name, ret);
 		return ret;
 	}

-	disable_irq(irq);
-
 	return irq;
 }

--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@ -1244,8 +1244,6 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,

 	omap_obj = to_omap_bo(obj);

-	mutex_lock(&omap_obj->lock);
-
 	omap_obj->sgt = sgt;

 	if (sgt->orig_nents == 1) {
@ -1261,8 +1259,7 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,
 		pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
 		if (!pages) {
 			omap_gem_free_object(obj);
-			obj = ERR_PTR(-ENOMEM);
-			goto done;
+			return ERR_PTR(-ENOMEM);
 		}

 		omap_obj->pages = pages;
@ -1275,13 +1272,10 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,

 		if (WARN_ON(i != npages)) {
 			omap_gem_free_object(obj);
-			obj = ERR_PTR(-ENOMEM);
-			goto done;
+			return ERR_PTR(-ENOMEM);
 		}
 	}

-done:
-	mutex_unlock(&omap_obj->lock);
 	return obj;
 }

--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
@ -153,7 +153,6 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev)
 struct panfrost_model {
 	const char *name;
 	u32 id;
-	u32 id_mask;
 	u64 features;
 	u64 issues;
 	struct {
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@ -2104,7 +2104,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
 				return -EINVAL;
 			}

-			offset = radeon_get_ib_value(p, idx+1) << 8;
+			offset = (u64)radeon_get_ib_value(p, idx+1) << 8;
 			if (offset != track->vgt_strmout_bo_offset[idx_value]) {
 				DRM_ERROR("bad STRMOUT_BASE_UPDATE, bo offset does not match: 0x%llx, 0x%x\n",
 					  offset, track->vgt_strmout_bo_offset[idx_value]);
--- a/drivers/gpu/drm/sti/sti_mixer.c
+++ b/drivers/gpu/drm/sti/sti_mixer.c
@ -137,7 +137,7 @@ static void mixer_dbg_crb(struct seq_file *s, int val)
 	}
 }

-static void mixer_dbg_mxn(struct seq_file *s, void *addr)
+static void mixer_dbg_mxn(struct seq_file *s, void __iomem *addr)
 {
 	int i;

--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@ -2242,7 +2242,8 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
 		if (hid_is_usb(wacom->hdev)) {
 			struct usb_interface *intf = to_usb_interface(wacom->hdev->dev.parent);
 			struct usb_device *dev = interface_to_usbdev(intf);
-			product_name = dev->product;
+			if (dev->product != NULL)
+				product_name = dev->product;
 		}

 		if (wacom->hdev->bus == BUS_I2C) {
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@ -1394,9 +1394,9 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
 					rotation -= 1800;

 				input_report_abs(pen_input, ABS_TILT_X,
-						 (char)frame[7]);
+						 (signed char)frame[7]);
 				input_report_abs(pen_input, ABS_TILT_Y,
-						 (char)frame[8]);
+						 (signed char)frame[8]);
 				input_report_abs(pen_input, ABS_Z, rotation);
 				input_report_abs(pen_input, ABS_WHEEL,
 						 get_unaligned_le16(&frame[11]));
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@ -749,6 +749,12 @@ hv_kvp_init(struct hv_util_service *srv)
 	 */
 	kvp_transaction.state = HVUTIL_DEVICE_INIT;

+	return 0;
+}
+
+int
+hv_kvp_init_transport(void)
+{
 	hvt = hvutil_transport_init(kvp_devname, CN_KVP_IDX, CN_KVP_VAL,
 				    kvp_on_msg, kvp_on_reset);
 	if (!hvt)
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@ -368,6 +368,12 @@ hv_vss_init(struct hv_util_service *srv)
 	 */
 	vss_transaction.state = HVUTIL_DEVICE_INIT;

+	return 0;
+}
+
+int
+hv_vss_init_transport(void)
+{
 	hvt = hvutil_transport_init(vss_devname, CN_VSS_IDX, CN_VSS_VAL,
 				    vss_on_msg, vss_on_reset);
 	if (!hvt) {
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@ -98,12 +98,14 @@ static struct hv_util_service util_heartbeat = {
 static struct hv_util_service util_kvp = {
 	.util_cb = hv_kvp_onchannelcallback,
 	.util_init = hv_kvp_init,
+	.util_init_transport = hv_kvp_init_transport,
 	.util_deinit = hv_kvp_deinit,
 };

 static struct hv_util_service util_vss = {
 	.util_cb = hv_vss_onchannelcallback,
 	.util_init = hv_vss_init,
+	.util_init_transport = hv_vss_init_transport,
 	.util_deinit = hv_vss_deinit,
 };

@ -431,6 +433,13 @@ static int util_probe(struct hv_device *dev,
 	if (ret)
 		goto error;

+	if (srv->util_init_transport) {
+		ret = srv->util_init_transport();
+		if (ret) {
+			vmbus_close(dev->channel);
+			goto error;
+		}
+	}
 	return 0;

 error:
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@ -353,10 +353,12 @@ void vmbus_on_event(unsigned long data);
 void vmbus_on_msg_dpc(unsigned long data);

 int hv_kvp_init(struct hv_util_service *srv);
+int hv_kvp_init_transport(void);
 void hv_kvp_deinit(void);
 void hv_kvp_onchannelcallback(void *context);

 int hv_vss_init(struct hv_util_service *srv);
+int hv_vss_init_transport(void);
 void hv_vss_deinit(void);
 void hv_vss_onchannelcallback(void *context);

--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@ -95,7 +95,7 @@ enum {

 static inline int wait_timeout(struct i2c_pnx_algo_data *data)
 {
-	long timeout = data->timeout;
+	long timeout = jiffies_to_msecs(data->timeout);
 	while (timeout > 0 &&
 			(ioread32(I2C_REG_STS(data)) & mstatus_active)) {
 		mdelay(1);
@ -106,7 +106,7 @@ static inline int wait_timeout(struct i2c_pnx_algo_data *data)

 static inline int wait_reset(struct i2c_pnx_algo_data *data)
 {
-	long timeout = data->timeout;
+	long timeout = jiffies_to_msecs(data->timeout);
 	while (timeout > 0 &&
 			(ioread32(I2C_REG_CTL(data)) & mcntrl_reset)) {
 		mdelay(1);
--- a/drivers/i2c/busses/i2c-riic.c
+++ b/drivers/i2c/busses/i2c-riic.c
@ -323,7 +323,7 @@ static int riic_init_hw(struct riic_dev *riic, struct i2c_timings *t)
 		if (brl <= (0x1F + 3))
 			break;

-		total_ticks /= 2;
+		total_ticks = DIV_ROUND_UP(total_ticks, 2);
 		rate /= 2;
 	}

--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@ -257,7 +257,8 @@ static int i3c_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 	struct i3c_device_info devinfo;
 	u16 manuf, part, ext;

-	i3c_device_get_info(i3cdev, &devinfo);
+	if (i3cdev->desc)
+		devinfo = i3cdev->desc->info;
 	manuf = I3C_PID_MANUF_ID(devinfo.pid);
 	part = I3C_PID_PART_ID(devinfo.pid);
 	ext = I3C_PID_EXTRA_INFO(devinfo.pid);
@ -1263,7 +1264,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev)
 					     I3C_ADDR_SLOT_FREE);

 	if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
-		i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr,
+		i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr,
 					     I3C_ADDR_SLOT_FREE);
 }

--- a/drivers/iio/adc/ad7780.c
+++ b/drivers/iio/adc/ad7780.c
@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_dev *indio_dev,

 	switch (m) {
 	case IIO_CHAN_INFO_SCALE:
-		if (val != 0)
+		if (val != 0 || val2 == 0)
 			return -EINVAL;

 		vref = st->int_vref_mv * 1000000LL;
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@ -161,7 +161,7 @@ static const void __user *uverbs_request_next_ptr(struct uverbs_req_iter *iter,
 {
 	const void __user *res = iter->cur;

-	if (iter->cur + len > iter->end)
+	if (len > iter->end - iter->cur)
 		return (void __force __user *)ERR_PTR(-ENOSPC);
 	iter->cur += len;
 	return res;
@ -2024,11 +2024,13 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs)
 	ret = uverbs_request_start(attrs, &iter, &cmd, sizeof(cmd));
 	if (ret)
 		return ret;
-	wqes = uverbs_request_next_ptr(&iter, cmd.wqe_size * cmd.wr_count);
+	wqes = uverbs_request_next_ptr(&iter, size_mul(cmd.wqe_size,
+						       cmd.wr_count));
 	if (IS_ERR(wqes))
 		return PTR_ERR(wqes);
-	sgls = uverbs_request_next_ptr(
-		&iter, cmd.sge_count * sizeof(struct ib_uverbs_sge));
+	sgls = uverbs_request_next_ptr(&iter,
+				       size_mul(cmd.sge_count,
+						sizeof(struct ib_uverbs_sge)));
 	if (IS_ERR(sgls))
 		return PTR_ERR(sgls);
 	ret = uverbs_request_finish(&iter);
@ -2213,11 +2215,11 @@ ib_uverbs_unmarshall_recv(struct uverbs_req_iter *iter, u32 wr_count,
 	if (wqe_size < sizeof (struct ib_uverbs_recv_wr))
 		return ERR_PTR(-EINVAL);

-	wqes = uverbs_request_next_ptr(iter, wqe_size * wr_count);
+	wqes = uverbs_request_next_ptr(iter, size_mul(wqe_size, wr_count));
 	if (IS_ERR(wqes))
 		return ERR_CAST(wqes);
-	sgls = uverbs_request_next_ptr(
-		iter, sge_count * sizeof(struct ib_uverbs_sge));
+	sgls = uverbs_request_next_ptr(iter, size_mul(sge_count,
+						      sizeof(struct ib_uverbs_sge)));
 	if (IS_ERR(sgls))
 		return ERR_CAST(sgls);
 	ret = uverbs_request_finish(iter);
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@ -137,7 +137,7 @@ int bnxt_re_query_device(struct ib_device *ibdev,

 	ib_attr->vendor_id = rdev->en_dev->pdev->vendor;
 	ib_attr->vendor_part_id = rdev->en_dev->pdev->device;
-	ib_attr->hw_ver = rdev->en_dev->pdev->subsystem_device;
+	ib_attr->hw_ver = rdev->en_dev->pdev->revision;
 	ib_attr->max_qp = dev_attr->max_qp;
 	ib_attr->max_qp_wr = dev_attr->max_qp_wqes;
 	ib_attr->device_cap_flags =
@ -1852,18 +1852,20 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 		}
 	}

-	if (qp_attr_mask & IB_QP_PATH_MTU) {
-		qp->qplib_qp.modify_flags |=
-				CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
-		qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu);
-		qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu);
-	} else if (qp_attr->qp_state == IB_QPS_RTR) {
-		qp->qplib_qp.modify_flags |=
-			CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
-		qp->qplib_qp.path_mtu =
-			__from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu));
-		qp->qplib_qp.mtu =
-			ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
+	if (qp_attr->qp_state == IB_QPS_RTR) {
+		enum ib_mtu qpmtu;
+
+		qpmtu = iboe_get_mtu(rdev->netdev->mtu);
+		if (qp_attr_mask & IB_QP_PATH_MTU) {
+			if (ib_mtu_enum_to_int(qp_attr->path_mtu) >
+			    ib_mtu_enum_to_int(qpmtu))
+				return -EINVAL;
+			qpmtu = qp_attr->path_mtu;
+		}
+
+		qp->qplib_qp.modify_flags |= CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
+		qp->qplib_qp.path_mtu = __from_ib_mtu(qpmtu);
+		qp->qplib_qp.mtu = ib_mtu_enum_to_int(qpmtu);
 	}

 	if (qp_attr_mask & IB_QP_TIMEOUT) {
@ -3250,7 +3252,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp,
 	wc->byte_len = orig_cqe->length;
 	wc->qp = &gsi_qp->ib_qp;

-	wc->ex.imm_data = cpu_to_be32(le32_to_cpu(orig_cqe->immdata));
+	wc->ex.imm_data = cpu_to_be32(orig_cqe->immdata);
 	wc->src_qp = orig_cqe->src_qp;
 	memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
 	if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
@ -3391,7 +3393,10 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
 				continue;
 			}
 			wc->qp = &qp->ib_qp;
-			wc->ex.imm_data = cpu_to_be32(le32_to_cpu(cqe->immdata));
+			if (cqe->flags & CQ_RES_RC_FLAGS_IMM)
+				wc->ex.imm_data = cpu_to_be32(cqe->immdata);
+			else
+				wc->ex.invalidate_rkey = cqe->invrkey;
 			wc->src_qp = cqe->src_qp;
 			memcpy(wc->smac, cqe->smac, ETH_ALEN);
 			wc->port_num = 1;
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@ -350,7 +350,7 @@ struct bnxt_qplib_cqe {
 	u16				cfa_meta;
 	u64				wr_id;
 	union {
-		__le32			immdata;
+		u32			immdata;
 		u32			invrkey;
 	};
 	u64				qp_handle;
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@ -118,7 +118,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
 	 * 128 WQEs needs to be reserved for the HW (8916). Prevent
 	 * reporting the max number
 	 */
-	attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS;
+	attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS + 1;
 	attr->max_qp_sges = bnxt_qplib_is_chip_gen_p5(rcfw->res->cctx) ?
 			    6 : sb->max_sge;
 	attr->max_cq = le32_to_cpu(sb->max_cq);
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@ -1034,7 +1034,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
 	if (MLX5_CAP_GEN(mdev, cd))
 		props->device_cap_flags |= IB_DEVICE_CROSS_CHANNEL;

-	if (!mlx5_core_is_pf(mdev))
+	if (mlx5_core_is_vf(mdev))
 		props->device_cap_flags |= IB_DEVICE_VIRTUAL_FUNCTION;

 	if (mlx5_ib_port_link_layer(ibdev, 1) ==
@ -5980,7 +5980,8 @@ static int mlx5_ib_init_multiport_master(struct mlx5_ib_dev *dev)
 		list_for_each_entry(mpi, &mlx5_ib_unaffiliated_port_list,
 				    list) {
 			if (dev->sys_image_guid == mpi->sys_image_guid &&
-			    (mlx5_core_native_port_num(mpi->mdev) - 1) == i) {
+			    (mlx5_core_native_port_num(mpi->mdev) - 1) == i &&
+			    mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) {
 				bound = mlx5_ib_bind_slave_port(dev, mpi);
 			}

@ -6874,7 +6875,8 @@ static void *mlx5_ib_add_slave_port(struct mlx5_core_dev *mdev)

 	mutex_lock(&mlx5_ib_multiport_mutex);
 	list_for_each_entry(dev, &mlx5_ib_dev_list, ib_dev_list) {
-		if (dev->sys_image_guid == mpi->sys_image_guid)
+		if (dev->sys_image_guid == mpi->sys_image_guid &&
+		    mlx5_core_same_coredev_type(dev->mdev, mpi->mdev))
 			bound = mlx5_ib_bind_slave_port(dev, mpi);

 		if (bound) {
--- a/Show more
+++ b/Show more