Merge 6.12.2 into android16-6.12

GKI (arm64) relevant 159 out of 815 changes, affecting 226 files +2434/-822 a11e7e3d2a arm64: probes: Disable kprobes/uprobes on MOPS instructions [2 files, +6/-2] 78de864e8a block/fs: Pass an iocb to generic_atomic_write_valid() [3 files, +7/-7] cfe3e04e9a fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() [3 files, +19/-14] 63dfd728b3 brd: defer automatic disk creation until module initialization succeeds [1 file, +44/-22] 26cc5063e3 ext4: avoid remount errors with 'abort' mount option [1 file, +8/-3] fb83b093f7 initramfs: avoid filename buffer overrun [1 file, +15/-0] de56fa09a0 arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers [1 file, +1/-0] 582d9ed999 nvme-pci: fix freeing of the HMB descriptor table [1 file, +9/-7] 8ae5e37357 loop: fix type of block size [1 file, +3/-3] 7044259018 block: take chunk_sectors into account in bio_split_write_zeroes [1 file, +23/-12] 731d5bdc74 block: fix bio_split_rw_at to take zone_write_granularity into account [1 file, +9/-1] 61832ee7fa ext4: fix race in buffer_head read fault injection [10 files, +29/-29] 9abae59243 nvme-pci: reverse request order in nvme_queue_rqs [1 file, +17/-22] 475404eac5 virtio_blk: reverse request order in virtio_queue_rqs [1 file, +21/-25] d01d9005fb thermal: core: Initialize thermal zones before registering them [1 file, +1/-1] 933ef9360a thermal: core: Rearrange PM notification code [1 file, +46/-42] f52dc3c757 thermal: core: Represent suspend-related thermal zone flags as bits [2 files, +12/-10] 39a5ad6b63 thermal: core: Mark thermal zones as initializing to start with [2 files, +14/-3] 79cb9952e1 thermal: core: Fix race between zone registration and system suspend [1 file, +16/-2] 5ced426d97 rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu [1 file, +12/-2] 94f4e7b0eb cleanup: Remove address space of returned pointer [1 file, +2/-2] 5c3a9f6f7f time: Partially revert cleanup on msecs_to_jiffies() documentation [1 file, +1/-1] b62a8825d3 time: Fix references to _msecs_to_jiffies() handling of values [2 files, +2/-2] 1dfa6c5200 timers: Add missing READ_ONCE() in __run_timer_base() [1 file, +2/-1] 8dbd7603e4 kcsan, seqlock: Fix incorrect assumption in read_seqbegin() [1 file, +1/-11] 0916201308 sched/ext: Remove sched_fork() hack [2 files, +1/-7] 351bb7f9ec soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() [1 file, +2/-1] c365c1456e efi/libstub: fix efi_parse_options() ignoring the default command line [1 file, +1/-1] 30e42ac0bd tpm: fix signed/unsigned bug when checking event logs [1 file, +9/-8] dd6ade970d Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" [1 file, +1/-3] f390525e49 cgroup/bpf: only cgroup v2 can be attached by bpf programs [1 file, +11/-6] a5b7bc2747 regmap: irq: Set lockdep class for hierarchical IRQ domains [1 file, +4/-0] 9beaff47bc firmware: arm_scpi: Check the DVFS OPP count returned by the firmware [1 file, +3/-0] e369246067 pwm: Assume a disabled PWM to emit a constant inactive output [1 file, +7/-3] f9aaa841ac drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused [1 file, +1/-1] 4d8621151b bpf, arm64: Remove garbage frame for struct_ops trampoline [1 file, +31/-16] aa51be3fa9 bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable [1 file, +15/-0] 3634d4a310 bpf: Mark raw_tp arguments with PTR_MAYBE_NULL [4 files, +87/-9] e883c475c4 drm: use ATOMIC64_INIT() for atomic64_t [1 file, +1/-1] bc23584768 netlink: typographical error in nlmsg_type constants definition [1 file, +1/-1] ce06c450ac bpf, sockmap: Several fixes to bpf_msg_push_data [1 file, +33/-20] 275a9f3ef8 bpf, sockmap: Several fixes to bpf_msg_pop_data [1 file, +9/-6] 08baa3f0a1 bpf, sockmap: Fix sk_msg_reset_curr [1 file, +9/-11] 0e4c6faaef ipv6: release nexthop on device removal [1 file, +3/-3] 36ede57f0c bpf: Allow return values 0 and 1 for kprobe session [1 file, +9/-0] 9ff1b95ccd bpf: Force uprobe bpf program to always return 0 [1 file, +2/-3] 34a949e7a0 ipv6: Fix soft lockups in fib6_select_path under high next hop churn [4 files, +297/-19] 9c44c06123 bpf: Use function pointers count as struct_ops links count [1 file, +25/-10] 449b1a7178 bpf: Add kernel symbol for struct_ops trampoline [4 files, +89/-5] 3397001cfa Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() [1 file, +1/-3] a58d0f5dac Bluetooth: ISO: Use kref to track lifetime of iso_conn [1 file, +71/-17] 67ead8f86a Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending [4 files, +139/-40] 91d19383b7 Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending [5 files, +125/-16] 1360e5b6ce Bluetooth: ISO: Send BIG Create Sync via hci_sync [2 files, +25/-1] 7b277bd569 Bluetooth: fix use-after-free in device_for_each_child() [1 file, +4/-11] d5d346deb6 xsk: Free skb when TX metadata options are invalid [1 file, +6/-5] 5036f2f024 erofs: fix file-backed mounts over FUSE [2 files, +7/-4] 679d8537e5 erofs: fix blksize < PAGE_SIZE for file-backed mounts [1 file, +5/-1] daaf68fef4 erofs: handle NONHEAD !delta[1] lclusters gracefully [1 file, +9/-8] 6b8b9d9b06 netpoll: Use rcu_access_pointer() in netpoll_poll_lock [1 file, +1/-1] f84c5ef6ca bpf: fix recursive lock when verdict program return SK_PASS [1 file, +2/-2] 89933f8ab3 unicode: Fix utf8_load() error path [1 file, +1/-1] b746a3afa2 trace/trace_event_perf: remove duplicate samples on the first tracepoint event [1 file, +6/-0] e691826a3d kasan: move checks to do_strncpy_from_user [1 file, +3/-2] 843d366ff1 zram: fix NULL pointer in comp_algorithm_show() [1 file, +2/-3] fe6fae61f3 PCI: Fix reset_method_store() memory leak [1 file, +3/-2] a26ace3c6e f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks [1 file, +1/-1] 9e11b1d5fd f2fs: fix null-ptr-deref in f2fs_submit_page_bio() [1 file, +6/-6] 2bc07714dc virtiofs: use pages instead of pointer for kernel direct IO [3 files, +50/-19] c31c7b81c1 i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin [1 file, +9/-4] 9b57a3f7e3 f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block [1 file, +1/-1] abfd2c13ba f2fs: check curseg->inited before write_sum_page in change_curseg [1 file, +2/-1] 5e69964251 f2fs: Fix not used variable 'index' [1 file, +2/-2] 801092a2c9 f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() [3 files, +9/-9] a16e6f7966 PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported [1 file, +3/-1] c631207897 f2fs: fix race in concurrent f2fs_stop_gc_thread [1 file, +6/-3] a10cc033b2 f2fs: fix to map blocks correctly for direct write [1 file, +2/-1] bbe48e47b9 f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode [1 file, +5/-1] 45438da843 f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow [2 files, +4/-4] f7f7f22dbb power: supply: core: Remove might_sleep() from power_supply_put() [1 file, +0/-2] 28af028a71 netlink: fix false positive warning in extack during dumps [1 file, +11/-10] ad6e5bdca3 exfat: fix file being changed by unaligned direct write [1 file, +10/-0] a487cc8986 net/l2tp: fix warning in l2tp_exit_net found by syzbot [1 file, +19/-3] cb74207ef9 net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged [1 file, +29/-12] 87819234aa Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync [1 file, +9/-2] cac34e4428 Bluetooth: MGMT: Fix possible deadlocks [1 file, +18/-9] 6d84502860 tcp: Fix use-after-free of nreq in reqsk_timer_handler(). [1 file, +1/-1] ead7c1263e ip6mr: fix tables suspicious RCU usage [1 file, +27/-11] 14367e7170 usb: gadget: uvc: wake pump everytime we update the free list [1 file, +4/-0] f380f895db firmware_loader: Fix possible resource leak in fw_log_firmware_info() [1 file, +2/-3] 98b8725630 f2fs: fix fiemap failure issue when page size is 16KB [1 file, +1/-21] d716851d0a net_sched: sch_fq: don't follow the fast path if Tx is behind now [1 file, +6/-0] b521b53ac6 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices [1 file, +21/-6] 096bb5b43e ALSA: usb-audio: Fix out of bounds reads when finding clock sources [1 file, +23/-1] ec56ada623 ext4: supress data-race warnings in ext4_free_inodes_{count,set}() [1 file, +4/-4] ad34d9c738 ext4: fix FS_IOC_GETFSMAP handling [3 files, +68/-5] f594a5683a KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR [1 file, +6/-1] 8b6916f4cf KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status [1 file, +0/-1] d0571c3add KVM: arm64: Don't retire aborted MMIO instruction [1 file, +30/-2] eabd7ef140 KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE [1 file, +5/-1] fe425d5239 KVM: arm64: Get rid of userspace_irqchip_in_use [3 files, +4/-19] 46018a04c5 KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* [2 files, +31/-12] 1059f1e5f5 KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device [1 file, +4/-2] 69d2ceac11 PCI: Fix use-after-free of slot->bus on hot remove [1 file, +3/-1] a6b283526b fsnotify: fix sending inotify event with unexpected filename [1 file, +13/-10] 83af1cfa10 fsnotify: Fix ordering of iput() and watched_objects decrement [1 file, +9/-3] 53bbfa6896 tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler [1 file, +1/-1] 88232a223a locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() [1 file, +1/-1] a4fc6966d8 fcntl: make F_DUPFD_QUERY associative [1 file, +3/-0] c500b0cca2 exfat: fix uninit-value in __exfat_get_dentry_set [1 file, +1/-0] 3ddd1cb2b4 exfat: fix out-of-bounds access of directory entries [1 file, +16/-4] 9258c9ed32 xhci: Fix control transfer error on Etron xHCI host [1 file, +14/-0] 218796e95a xhci: Combine two if statements for Etron xHCI host [1 file, +2/-6] a92cd42097 xhci: Don't perform Soft Retry for Etron xHCI host [1 file, +1/-0] 827f963a0b xhci: Don't issue Reset Device command to Etron xHCI host [3 files, +21/-0] 33209e6f29 Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() [1 file, +6/-4] 2637e8c5fb usb: xhci: Limit Stop Endpoint retries [3 files, +27/-4] 61bce2d8ff usb: xhci: Fix TD invalidation under pending Set TR Dequeue [1 file, +13/-5] 6debdd82c3 usb: xhci: Avoid queuing redundant Stop Endpoint commands [3 files, +29/-4] 13111945c2 Revert "fs: don't block i_writecount during exec" [5 files, +49/-14] 0586f12896 Revert "f2fs: remove unreachable lazytime mount option parsing" [1 file, +10/-0] ca82b37c47 Revert "usb: gadget: composite: fix OS descriptors w_value logic" [1 file, +15/-3] d222fd21dd io_uring: fix corner case forgetting to vunmap [1 file, +3/-1] aaa90844af io_uring: check for overflows in io_pin_pages [1 file, +6/-1] 37c2ca4e89 blk-settings: round down io_opt to physical_block_size [1 file, +7/-0] 97b68bda72 spi: Fix acpi deferred irq probe [1 file, +10/-3] e881c8f0a7 serial: amba-pl011: Fix RX stall when DMA is used [1 file, +5/-0] 1fae444a61 serial: amba-pl011: fix build regression [1 file, +2/-0] 7baf942326 Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" [2 files, +5/-2] 43375e9bb7 block: Prevent potential deadlock in blk_revalidate_disk_zones() [1 file, +10/-4] 4ef8b6f7c4 ublk: fix ublk_ch_mmap() for 64K page size [1 file, +12/-3] e4d1f38bc0 arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled [1 file, +1/-1] 8b25c0a165 block: fix missing dispatching request when queue is started or unquiesced [1 file, +2/-0] 2094bd1b52 block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding [1 file, +34/-13] 4170346747 block: fix ordering between checking BLK_MQ_S_STOPPED request adding [2 files, +19/-0] aeb420ebdf blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long [1 file, +2/-1] 28d4191e19 HID: wacom: Interpret tilt data from Intuos Pro BT as signed values [1 file, +2/-2] 343e3e903c netdev-genl: Hold rcu_read_lock in napi_get [1 file, +2/-0] df225df839 ALSA: rawmidi: Fix kvfree() call in spinlock [1 file, +3/-1] 0c4c9bf5ea ALSA: pcm: Add sanity NULL check for the default mmap fault handler [1 file, +4/-2] 068aab9564 usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED [1 file, +1/-1] 2f6c3acece usb: dwc3: gadget: Fix checking for number of TRBs left [1 file, +6/-3] 70777a23a5 usb: dwc3: gadget: Fix looping of queued SG entries [1 file, +3/-3] 31e45c09a8 ublk: fix error code for unsupported command [1 file, +1/-1] 9517bc76ff lib: string_helpers: silence snprintf() output truncation warning [1 file, +1/-1] 0a5c8b3fbf f2fs: fix to do sanity check on node blkaddr in truncate_node() [1 file, +10/-0] e77bce0a8c rtc: check if __rtc_read_time was successful in rtc_timer_do_work() [1 file, +6/-1] 4eaa19c620 nvme/multipath: Fix RCU list traversal to use SRCU primitive [1 file, +14/-7] 9c3d53f113 blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs [2 files, +22/-0] a6fc2ba1c7 block: model freeze & enter queue as lock for supporting lockdep [5 files, +81/-13] 61092568f2 block: fix uaf for flush rq while iterating tags [2 files, +5/-10] 5e15cc7a1d block: return unsigned int from bdev_io_min [1 file, +1/-1] 5416b76a81 nvme-fabrics: fix kernel crash while shutting down controller [1 file, +5/-0] d5457349e5 block: Don't allow an atomic write be truncated in blkdev_write_iter() [1 file, +4/-1] e70c21daad modpost: remove incorrect code in do_eisa_entry() [1 file, +1/-4] 01a853faae block, bfq: fix bfqq uaf in bfq_limit_depth() [1 file, +24/-13] fbc342372a brd: decrease the number of allocated pages which discarded [1 file, +3/-1] b12cfcae8a block: always verify unfreeze lock on the owner task [4 files, +61/-10] 6cea47849d block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() [1 file, +8/-2] Changes in 6.12.2 MAINTAINERS: appoint myself the XFS maintainer for 6.12 LTS drm/amd/display: Skip Invalid Streams from DSC Policy drm/amd/display: Fix incorrect DSC recompute trigger s390/facilities: Fix warning about shadow of global variable s390/virtio_ccw: Fix dma_parm pointer not set up efs: fix the efs new mount api implementation arm64: probes: Disable kprobes/uprobes on MOPS instructions kselftest/arm64: hwcap: fix f8dp2 cpuinfo name kselftest/arm64: mte: fix printf type warnings about __u64 kselftest/arm64: mte: fix printf type warnings about longs block/fs: Pass an iocb to generic_atomic_write_valid() fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() s390/cio: Do not unregister the subchannel based on DNV s390/pageattr: Implement missing kernel_page_present() x86/pvh: Call C code via the kernel virtual mapping brd: defer automatic disk creation until module initialization succeeds ext4: avoid remount errors with 'abort' mount option mips: asm: fix warning when disabling MIPS_FP_SUPPORT s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex initramfs: avoid filename buffer overrun arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers kselftest/arm64: Fix encoding for SVE B16B16 test nvme-pci: fix freeing of the HMB descriptor table m68k: mvme147: Fix SCSI controller IRQ numbers m68k: mvme147: Reinstate early console arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() loop: fix type of block size cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter() cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() cachefiles: Fix NULL pointer dereference in object->file netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING block: take chunk_sectors into account in bio_split_write_zeroes block: fix bio_split_rw_at to take zone_write_granularity into account s390/syscalls: Avoid creation of arch/arch/ directory hfsplus: don't query the device logical block size multiple times ext4: fix race in buffer_head read fault injection nvme-pci: reverse request order in nvme_queue_rqs virtio_blk: reverse request order in virtio_queue_rqs crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys crypto: caam - Fix the pointer passed to caam_qi_shutdown() crypto: qat - remove check after debugfs_create_dir() crypto: qat/qat_420xx - fix off by one in uof_get_name() crypto: qat/qat_4xxx - fix off by one in uof_get_name() firmware: google: Unregister driver_info on failure EDAC/bluefield: Fix potential integer overflow crypto: qat - remove faulty arbiter config reset thermal: core: Initialize thermal zones before registering them thermal: core: Rearrange PM notification code thermal: core: Represent suspend-related thermal zone flags as bits thermal: core: Mark thermal zones as initializing to start with thermal: core: Fix race between zone registration and system suspend EDAC/fsl_ddr: Fix bad bit shift operations EDAC/skx_common: Differentiate memory error sources EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY crypto: cavium - Fix the if condition to exit loop after timeout cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update() amd-pstate: Set min_perf to nominal_perf for active mode performance gov crypto: hisilicon/qm - disable same error report before resetting EDAC/igen6: Avoid segmentation fault on module unload crypto: qat - Fix missing destroy_workqueue in adf_init_aer() crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() sched/cpufreq: Ensure sd is rebuilt for EAS check doc: rcu: update printed dynticks counter bits rcu/srcutiny: don't return before reenabling preemption rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu rcu/nocb: Fix missed RCU barrier on deoffloading hwmon: (pmbus/core) clear faults after setting smbalert mask hwmon: (nct6775-core) Fix overflows seen when writing limit attributes ACPI: CPPC: Fix _CPC register setting issue thermal: testing: Use DEFINE_FREE() and __free() to simplify code thermal: testing: Initialize some variables annoteded with _free() crypto: caam - add error check to caam_rsa_set_priv_key_form crypto: bcm - add error check in the ahash_hmac_init function crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() rcuscale: Do a proper cleanup if kfree_scale_init() fails tools/lib/thermal: Make more generic the command encoding function thermal/lib: Fix memory leak on error in thermal_genl_auto() x86/unwind/orc: Fix unwind for newly forked tasks Revert "scripts/faddr2line: Check only two symbols when calculating symbol size" cleanup: Remove address space of returned pointer time: Partially revert cleanup on msecs_to_jiffies() documentation time: Fix references to _msecs_to_jiffies() handling of values timers: Add missing READ_ONCE() in __run_timer_base() locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64() locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu() kcsan, seqlock: Support seqcount_latch_t kcsan, seqlock: Fix incorrect assumption in read_seqbegin() sched/ext: Remove sched_fork() hack locking/rt: Add sparse annotation PREEMPT_RT's sleeping locks. rust: helpers: Avoid raw_spin_lock initialization for PREEMPT_RT clocksource/drivers:sp804: Make user selectable clocksource/drivers/timer-ti-dm: Fix child node refcount handling irqchip/riscv-aplic: Prevent crash when MSI domain is missing regulator: qcom-smd: make smd_vreg_rpm static spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() microblaze: Export xmb_manager functions arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy arm64: dts: mt8195: Fix dtbs_check error for mutex node arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface arm64: dts: mt8183: Add port node to dpi node soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode mmc: mmc_spi: drop buggy snprintf() scripts/kernel-doc: Do not track section counter across processed files arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs openrisc: Implement fixmap to fix earlycon efi/libstub: fix efi_parse_options() ignoring the default command line tpm: fix signed/unsigned bug when checking event logs media: i2c: max96717: clean up on error in max96717_subdev_init() media: i2c: vgxy61: Fix an error handling path in vgxy61_detect() media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region kernel-doc: allow object-like macros in ReST output arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs gpio: sloppy-logic-analyzer remove reference to rcu_momentary_dyntick_idle() arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" cgroup/bpf: only cgroup v2 can be attached by bpf programs regulator: rk808: Restrict DVS GPIOs to the RK808 variant only power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF arm64: tegra: p2180: Add mandatory compatible for WiFi node arm64: dts: rockchip: Remove 'enable-active-low' from two boards arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle ARM: dts: cubieboard4: Fix DCDC5 regulator constraints arm64: dts: ti: k3-j7200: Fix register map for main domain pmx arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240 arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify pmdomain: ti-sci: Add missing of_node_put() for args.np spi: tegra210-quad: Avoid shift-out-of-bounds spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time regmap: irq: Set lockdep class for hierarchical IRQ domains arm64: dts: renesas: hihope: Drop #sound-dai-cells arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO arm64: dts: mediatek: mt6358: fix dtbs_check error arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators selftests/resctrl: Print accurate buffer size as part of MBM results selftests/resctrl: Fix memory overflow due to unhandled wraparound selftests/resctrl: Protect against array overrun during iMC config parsing firmware: arm_scpi: Check the DVFS OPP count returned by the firmware media: ipu6: Fix DMA and physical address debugging messages for 32-bit media: ipu6: not override the dma_ops of device in driver media: ipu6: remove architecture DMA ops dependency in Kconfig pwm: Assume a disabled PWM to emit a constant inactive output media: atomisp: Add check for rgby_data memory allocation failure arm64: dts: rockchip: correct analog audio name on Indiedroid Nova sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context HID: hyperv: streamline driver probe to avoid devres issues platform/x86: asus-wmi: Fix inconsistent use of thermal policies platform/x86/intel/pmt: allow user offset for PMT callbacks platform/x86: panasonic-laptop: Return errno correctly in show callback drm/imagination: Convert to use time_before macro drm/imagination: Use pvr_vm_context_get() drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused drm/vc4: hvs: Don't write gamma luts on 2711 drm/vc4: hdmi: Avoid hang with debug registers when suspended drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function drm/vc4: hvs: Correct logic on stopping an HVS channel wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() drm/omap: Fix possible NULL dereference drm/omap: Fix locking in omap_gem_new_dmabuf() drm/v3d: Appease lockdep while updating GPU stats wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() udmabuf: change folios array from kmalloc to kvmalloc udmabuf: fix vmap_udmabuf error page set drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() drm/panel: nt35510: Make new commands optional drm/v3d: Address race-condition in MMU flush drm/v3d: Flush the MMU before we supply more memory to the binner drm/amdgpu: Fix JPEG v4.0.3 register write wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 wifi: ath12k: Skip Rx TID cleanup for self peer dt-bindings: vendor-prefixes: Add NeoFidelity, Inc ASoC: fsl_micfil: fix regmap_write_bits usage ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios drm/bridge: anx7625: Drop EDID cache on bridge power off drm/bridge: it6505: Drop EDID cache on bridge power off libbpf: Fix expected_attach_type set handling in program load callback libbpf: Fix output .symtab byte-order during linking selftests/bpf: Fix uprobe_multi compilation error dlm: fix swapped args sb_flags vs sb_status wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled ASoC: amd: acp: fix for inconsistent indenting ASoC: amd: acp: fix for cpu dai index logic drm/amd/display: fix a memleak issue when driver is removed wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup() wifi: ath12k: fix one more memcpy size error libbpf: Add missing per-arch include path selftests: bpf: Add missing per-arch include path bpf: Fix the xdp_adjust_tail sample prog issue selftests/bpf: Fix backtrace printing for selftests crashes wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR selftests/bpf: add missing header include for htons wifi: cfg80211: check radio iface combination for multi radio per wiphy ice: consistently use q_idx in ice_vc_cfg_qs_msg() drm/vc4: hdmi: Increase audio MAI fifo dreq threshold drm/vc4: Introduce generation number enum drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush drm/vc4: Correct generation check in vc4_hvs_lut_load libbpf: fix sym_is_subprog() logic for weak global subprogs accel/ivpu: Prevent recovery invocation during probe and resume ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c libbpf: never interpret subprogs in .text as entry programs netdevsim: copy addresses for both in and out paths drm/bridge: tc358767: Fix link properties discovery drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE selftests/bpf: Fix msg_verify_data in test_sockmap selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap wifi: mwifiex: add missing locking for cfg80211 calls wifi: wilc1000: Set MAC after operation mode wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() drm: fsl-dcu: enable PIXCLK on LS1021A drm: panel: nv3052c: correct spi_device_id for RG35XX panel drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block drm/msm/dpu: drop LM_3 / LM_4 on SDM845 drm/msm/dpu: drop LM_3 / LM_4 on MSM8998 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c selftests/bpf: fix test_spin_lock_fail.c's global vars usage libbpf: move global data mmap()'ing into bpf_object__load() wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO wifi: rtw89: read bss_conf corresponding to the link wifi: rtw89: read link_sta corresponding to the link wifi: rtw89: refactor VIF related func ahead for MLO wifi: rtw89: refactor STA related func ahead for MLO wifi: rtw89: tweak driver architecture for impending MLO support wifi: rtw89: Fix TX fail with A2DP after scanning wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx() drm/panfrost: Remove unused id_mask from struct panfrost_model bpf, arm64: Remove garbage frame for struct_ops trampoline drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() drm/msm/gpu: Check the status of registration to PM QoS drm/xe/hdcp: Fix gsc structure check in fw check status drm/etnaviv: Request pages from DMA32 zone on addressing_limited drm/etnaviv: hold GPU lock across perfmon sampling drm/amd/display: Increase idle worker HPD detection time drm/amd/display: Reduce HPD Detection Interval for IPS drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() drm: zynqmp_kms: Unplug DRM device before removal drm: xlnx: zynqmp_disp: layer may be null while releasing wifi: wfx: Fix error handling in wfx_core_init() wifi: cw1200: Fix potential NULL dereference drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() bpf, bpftool: Fix incorrect disasm pc bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable drm/vkms: Drop unnecessary call to drm_crtc_cleanup() drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()' bpf: Mark raw_tp arguments with PTR_MAYBE_NULL drm: use ATOMIC64_INIT() for atomic64_t netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion netfilter: nf_tables: must hold rcu read lock while iterating expression type list netfilter: nf_tables: must hold rcu read lock while iterating object type list netlink: typographical error in nlmsg_type constants definition wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() drm/panfrost: Add missing OPP table refcnt decremental drm/panthor: introduce job cycle and timestamp accounting drm/panthor: record current and maximum device clock frequencies drm/panthor: Fix OPP refcnt leaks in devfreq initialisation isofs: avoid memory leak in iocharset selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap selftests/bpf: Fix SENDPAGE data logic in test_sockmap selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data bpf, sockmap: Fix sk_msg_reset_curr ipv6: release nexthop on device removal selftests: net: really check for bg process completion wifi: cfg80211: Remove the Medium Synchronization Delay validity check wifi: iwlwifi: allow fast resume on ax200 wifi: iwlwifi: mvm: tell iwlmei when we finished suspending drm/amdgpu: fix ACA bank count boundary check error drm/amdgpu: Fix map/unmap queue logic drm/amdkfd: Fix wrong usage of INIT_WORK() bpf: Allow return values 0 and 1 for kprobe session bpf: Force uprobe bpf program to always return 0 selftests/bpf: skip the timer_lockup test for single-CPU nodes ipv6: Fix soft lockups in fib6_select_path under high next hop churn net: rfkill: gpio: Add check for clk_enable() Revert "wifi: iwlegacy: do not skip frames with bad FCS" bpf: Use function pointers count as struct_ops links count bpf: Add kernel symbol for struct_ops trampoline ALSA: usx2y: Use snd_card_free_when_closed() at disconnection ALSA: us122l: Use snd_card_free_when_closed() at disconnection ALSA: caiaq: Use snd_card_free_when_closed() at disconnection ALSA: 6fire: Release resources at card release i2c: dev: Fix memory leak when underlying adapter does not support I2C selftests: netfilter: Fix missing return values in conntrack_dump_flush Bluetooth: btintel_pcie: Add handshake between driver and firmware Bluetooth: btintel: Do no pass vendor events to stack Bluetooth: btmtk: adjust the position to init iso data anchor Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() Bluetooth: ISO: Use kref to track lifetime of iso_conn Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending Bluetooth: ISO: Send BIG Create Sync via hci_sync Bluetooth: fix use-after-free in device_for_each_child() xsk: Free skb when TX metadata options are invalid erofs: fix file-backed mounts over FUSE erofs: fix blksize < PAGE_SIZE for file-backed mounts erofs: handle NONHEAD !delta[1] lclusters gracefully dlm: fix dlm_recover_members refcount on error eth: fbnic: don't disable the PCI device twice net: txgbe: remove GPIO interrupt controller net: txgbe: fix null pointer to pcs netpoll: Use rcu_access_pointer() in netpoll_poll_lock wireguard: selftests: load nf_conntrack if not present bpf: fix recursive lock when verdict program return SK_PASS unicode: Fix utf8_load() error path cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset pinctrl: renesas: rzg2l: Fix missing return in rzg2l_pinctrl_register() clk: mediatek: drop two dead config options trace/trace_event_perf: remove duplicate samples on the first tracepoint event pinctrl: zynqmp: drop excess struct member description pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650 iommu/s390: Implement blocking domain scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset powerpc/vdso: Flag VDSO64 entry points as functions mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race mfd: da9052-spi: Change read-mask to write-mask mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication cpufreq: loongson2: Unregister platform_driver on failure powerpc/fadump: Refactor and prepare fadump_cma_init for late init powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE mtd: rawnand: atmel: Fix possible memory leak clk: Allow kunit tests to run without OF_OVERLAY enabled powerpc/mm/fault: Fix kfence page fault reporting iommu/tegra241-cmdqv: Staticize cmdqv_debugfs_dir clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate() mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci RDMA/hns: Fix flush cqe error when racing with destroy qp RDMA/hns: Modify debugfs name RDMA/hns: Use dev_* printings in hem code instead of ibdev_* RDMA/hns: Fix cpu stuck caused by printings during reset RDMA/rxe: Fix the qp flush warnings in req RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset clk: renesas: rzg2l: Fix FOUTPOSTDIV clk RDMA/rxe: Set queue pair cur_qp_state when being queried RDMA/mlx5: Call dev_put() after the blocking notifier RDMA/core: Implement RoCE GID port rescan and export delete function RDMA/mlx5: Ensure active slave attachment to the bond IB device RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation riscv: kvm: Fix out-of-bounds array access clk: imx: lpcg-scu: SW workaround for errata (e10858) clk: imx: fracn-gppll: correct PLL initialization flow clk: imx: fracn-gppll: fix pll power up clk: imx: clk-scu: fix clk enable state save and restore clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains() iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() iommu/vt-d: Fix checks and print in pgtable_walk() checkpatch: always parse orig_commit in fixes tag mfd: rt5033: Fix missing regmap_del_irq_chip() leds: max5970: Fix unreleased fwnode_handle in probe function leds: ktd2692: Set missing timing properties fs/proc/kcore.c: fix coccinelle reported ERROR instances scsi: target: Fix incorrect function name in pscsi_create_type_disk() scsi: bfa: Fix use-after-free in bfad_im_module_exit() scsi: fusion: Remove unused variable 'rc' scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() scsi: sg: Enable runtime power management x86/tdx: Introduce wrappers to read and write TD metadata x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() x86/tdx: Dynamically disable SEPT violations from causing #VEs powerpc/fadump: allocate memory for additional parameters early fadump: reserve param area if below boot_mem_top RDMA/hns: Fix out-of-order issue of requester when setting FENCE RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() cpufreq: loongson3: Check for error code from devm_mutex_init() call cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() kasan: move checks to do_strncpy_from_user kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL ocfs2: fix uninitialized value in ocfs2_file_read_iter() zram: ZRAM_DEF_COMP should depend on ZRAM iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift dax: delete a stale directory pmem KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static RDMA/hns: Fix different dgids mapping to the same dip_idx KVM: PPC: Book3S HV: Fix kmv -> kvm typo powerpc/kexec: Fix return of uninitialized variable fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() RDMA/mlx5: Move events notifier registration to be after device registration clk: clk-apple-nco: Add NULL check in applnco_probe clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration clk: en7523: move clock_register in hw_init callback clk: en7523: introduce chip_scu regmap clk: en7523: fix estimation of fixed rate for EN7581 dt-bindings: clock: axi-clkgen: include AXI clk clk: clk-axi-clkgen: make sure to enable the AXI bus clock zram: permit only one post-processing operation at a time zram: fix NULL pointer in comp_algorithm_show() RDMA/bnxt_re: Correct the sequence of device suspend arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw pinctrl: k210: Undef K210_PC_DEFAULT rtla/timerlat: Do not set params->user_workload with -U smb: cached directories can be more than root file handle mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() x86: fix off-by-one in access_ok() perf cs-etm: Don't flush when packet_queue fills up gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE gfs2: Allow immediate GLF_VERIFY_DELETE work gfs2: Fix unlinked inode cleanup perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC} dt-bindings: PCI: mediatek-gen3: Allow exact number of clocks only PCI: Fix reset_method_store() memory leak perf jevents: Don't stop at the first matched pmu when searching a events table perf stat: Close cork_fd when create_perf_stat_counter() failed perf stat: Fix affinity memory leaks on error path perf trace: Keep exited threads for summary perf test attr: Add back missing topdown events rust: rbtree: fix `SAFETY` comments that should be `# Safety` sections f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks f2fs: fix null-ptr-deref in f2fs_submit_page_bio() mailbox, remoteproc: k3-m4+: fix compile testing f2fs: fix to account dirty data in __get_secs_required() perf dso: Fix symtab_type for kmod compression perf disasm: Fix capstone memory leak perf probe: Fix libdw memory leak perf probe: Correct demangled symbols in C++ program rust: kernel: fix THIS_MODULE header path in ThisModule doc comment rust: macros: fix documentation of the paste! macro PCI: cpqphp: Fix PCIBIOS_* return value confusion rust: block: fix formatting of `kernel::block::mq::request` module perf disasm: Use disasm_line__free() to properly free disasm_line perf disasm: Fix not cleaning up disasm_line in symbol__disassemble_raw() virtiofs: use pages instead of pointer for kernel direct IO perf ftrace latency: Fix unit on histogram first entry when using --use-nsec i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block f2fs: check curseg->inited before write_sum_page in change_curseg f2fs: Fix not used variable 'index' f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds perf build: Add missing cflags when building with custom libtraceevent f2fs: fix race in concurrent f2fs_stop_gc_thread f2fs: fix to map blocks correctly for direct write f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode perf trace: avoid garbage when not printing a trace event's arguments m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x m68k: coldfire/device.c: only build FEC when HW macros are defined svcrdma: Address an integer overflow nfsd: drop inode parameter from nfsd4_change_attribute() perf list: Fix topic and pmu_name argument order perf trace: Fix tracing itself, creating feedback loops perf trace: Do not lose last events in a race perf trace: Avoid garbage when not printing a syscall's arguments remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe() remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe() remoteproc: qcom: pas: add minidump_id to SM8350 resources rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() nfsd: release svc_expkey/svc_export with rcu_work svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() NFSD: Fix nfsd4_shutdown_copy() nfs_common: must not hold RCU while calling nfsd_file_put_local f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow perf bpf-filter: Return -ENOMEM directly when pfi allocation fails hwmon: (tps23861) Fix reporting of negative temperatures hwmon: (aquacomputer_d5next) Fix length of speed_input array phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out() phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l() phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll() phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions vdpa/mlx5: Fix suboptimal range on iotlb iteration vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data() selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels gpio: zevio: Add missed label initialisation vfio/pci: Properly hide first-in-list PCIe extended capability fs_parser: update mount_api doc to match function signature LoongArch: Fix build failure with GCC 15 (-std=gnu23) LoongArch: BPF: Sign-extend return values power: supply: core: Remove might_sleep() from power_supply_put() power: supply: bq27xxx: Fix registers of bq27426 power: supply: rt9471: Fix wrong WDT function regfield declaration power: supply: rt9471: Use IC status regfield to report real charger status fs/ntfs3: Equivalent transition from page to folio power: reset: ep93xx: add AUXILIARY_BUS dependency net: usb: lan78xx: Fix double free issue with interrupt buffer allocation net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration net: microchip: vcap: Add typegroup table terminators in kunit tests netlink: fix false positive warning in extack during dumps exfat: fix file being changed by unaligned direct write net/l2tp: fix warning in l2tp_exit_net found by syzbot s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() rtase: Refactor the rtase_check_mac_version_valid() function rtase: Correct the speed for RTL907XD-V1 rtase: Corrects error handling of the rtase_check_mac_version_valid() net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged net: mdio-ipq4019: add missing error check marvell: pxa168_eth: fix call balance of pep->clk handling routines net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken octeontx2-af: RPM: Fix mismatch in lmac type octeontx2-af: RPM: Fix low network performance octeontx2-af: RPM: fix stale RSFEC counters octeontx2-af: RPM: fix stale FCFEC counters octeontx2-af: Quiesce traffic before NIX block reset spi: atmel-quadspi: Fix register name in verbose logging function net: hsr: fix hsr_init_sk() vs network/transport headers. bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down bnxt_en: Set backplane link modes correctly for ethtool bnxt_en: Fix queue start to update vnic RSS table bnxt_en: Fix receive ring space parameters when XDP is active bnxt_en: Refactor bnxt_ptp_init() bnxt_en: Unregister PTP during PCI shutdown and suspend Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Bluetooth: MGMT: Fix possible deadlocks llc: Improve setsockopt() handling of malformed user input rxrpc: Improve setsockopt() handling of malformed user input tcp: Fix use-after-free of nreq in reqsk_timer_handler(). ip6mr: fix tables suspicious RCU usage ipmr: fix tables suspicious RCU usage iio: light: al3010: Fix an error handling path in al3010_probe() usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() usb: yurex: make waiting on yurex_write interruptible USB: chaoskey: fail open after removal USB: chaoskey: Fix possible deadlock chaoskey_list_lock misc: apds990x: Fix missing pm_runtime_disable() devres: Fix page faults when tracing devres from unloaded modules usb: gadget: uvc: wake pump everytime we update the free list interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency iio: backend: fix wrong pointer passed to IS_ERR() iio: adc: ad4000: fix reading unsigned data iio: adc: ad4000: Check for error code from devm_mutex_init() call iio: adc: pac1921: Check for error code from devm_mutex_init() call iio: accel: adxl380: fix raw sample read phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe counter: stm32-timer-cnt: Add check for clk_enable() counter: ti-ecap-capture: Add check for clk_enable() bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian usb: typec: fix potential array underflow in ucsi_ccg_sync_control() firmware_loader: Fix possible resource leak in fw_log_firmware_info() ALSA: hda/realtek: Update ALC256 depop procedure drm/radeon: Fix spurious unplug event on radeon HDMI drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp ASoC: imx-audmix: Add NULL check in imx_audmix_probe drm/xe/ufence: Wake up waiters after setting ufence->signalled apparmor: fix 'Do simple duplicate message elimination' ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe s390/pci: Fix potential double remove of hotplug slot f2fs: fix fiemap failure issue when page size is 16KB net_sched: sch_fq: don't follow the fast path if Tx is behind now xen: Fix the issue of resource not being properly released in xenbus_dev_probe() ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices ALSA: usb-audio: Fix out of bounds reads when finding clock sources usb: ehci-spear: fix call balance of sehci clk handling routines usb: typec: ucsi: glink: fix off-by-one in connector_status xfs: fix simplify extent lookup in xfs_can_free_eofblocks ext4: supress data-race warnings in ext4_free_inodes_{count,set}() ext4: fix FS_IOC_GETFSMAP handling MAINTAINERS: update location of media main tree docs: media: update location of the media patches jfs: xattr: check invalid xattr size more strictly ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() ASoC: da7213: Populate max_register to regmap_config perf/x86/intel/pt: Fix buffer full but size is 0 case crypto: x86/aegis128 - access 32-bit arguments as 32-bit KVM: x86: switch hugepage recovery thread to vhost_task KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE KVM: x86: add back X86_LOCAL_APIC dependency KVM: x86: Break CONFIG_KVM_X86's direct dependency on KVM_INTEL || KVM_AMD powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()" KVM: arm64: Don't retire aborted MMIO instruction KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: arm64: Get rid of userspace_irqchip_in_use KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device Compiler Attributes: disable __counted_by for clang < 19.1.3 PCI: Fix use-after-free of slot->bus on hot remove LoongArch: Explicitly specify code model in Makefile clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access fsnotify: fix sending inotify event with unexpected filename fsnotify: Fix ordering of iput() and watched_objects decrement comedi: Flush partial mappings in error case apparmor: test: Fix memory leak for aa_unpack_strdup() iio: dac: adi-axi-dac: fix wrong register bitfield tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() tools/nolibc: s390: include std.h fcntl: make F_DUPFD_QUERY associative pinctrl: qcom: spmi: fix debugfs drive strength dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks dt-bindings: iio: dac: ad3552r: fix maximum spi speed exfat: fix uninit-value in __exfat_get_dentry_set exfat: fix out-of-bounds access of directory entries xhci: Fix control transfer error on Etron xHCI host xhci: Combine two if statements for Etron xHCI host xhci: Don't perform Soft Retry for Etron xHCI host xhci: Don't issue Reset Device command to Etron xHCI host Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() usb: xhci: Limit Stop Endpoint retries usb: xhci: Fix TD invalidation under pending Set TR Dequeue usb: xhci: Avoid queuing redundant Stop Endpoint commands ARM: dts: omap36xx: declare 1GHz OPP as turbo again wifi: ath12k: fix warning when unbinding wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan wifi: ath12k: fix crash when unbinding wifi: brcmfmac: release 'root' node in all execution paths Revert "fs: don't block i_writecount during exec" Revert "f2fs: remove unreachable lazytime mount option parsing" Revert "usb: gadget: composite: fix OS descriptors w_value logic" serial: sh-sci: Clean sci_ports[0] after at earlycon exit Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" io_uring: fix corner case forgetting to vunmap io_uring: check for overflows in io_pin_pages blk-settings: round down io_opt to physical_block_size gpio: exar: set value when external pull-up or pull-down is present netfilter: ipset: add missing range check in bitmap_ip_uadt spi: Fix acpi deferred irq probe mtd: spi-nor: core: replace dummy buswidth from addr to data cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() cifs: support mounting with alternate password to allow password rotation parisc/ftrace: Fix function graph tracing disablement RISC-V: Scalar unaligned access emulated on hotplug CPUs RISC-V: Check scalar unaligned access on all CPUs ksmbd: fix use-after-free in SMB request handling smb: client: fix NULL ptr deref in crypto_aead_setkey() platform/chrome: cros_ec_typec: fix missing fwnode reference decrement irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain x86/CPU/AMD: Terminate the erratum_1386_microcode array ubi: wl: Put source PEB into correct list if trying locking LEB failed um: ubd: Do not use drvdata in release um: net: Do not use drvdata in release dt-bindings: serial: rs485: Fix rs485-rts-delay property serial: 8250_fintek: Add support for F81216E serial: 8250: omap: Move pm_runtime_get_sync serial: amba-pl011: Fix RX stall when DMA is used serial: amba-pl011: fix build regression Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode() block: Prevent potential deadlock in blk_revalidate_disk_zones() um: vector: Do not use drvdata in release sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK iio: gts: Fix uninitialized symbol 'ret' ublk: fix ublk_ch_mmap() for 64K page size arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled block: fix missing dispatching request when queue is started or unquiesced block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding block: fix ordering between checking BLK_MQ_S_STOPPED request adding blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long gve: Flow steering trigger reset only for timeout error HID: wacom: Interpret tilt data from Intuos Pro BT as signed values i40e: Fix handling changed priv flags media: wl128x: Fix atomicity violation in fmc_send_cmd() media: intel/ipu6: do not handle interrupts when device is disabled arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes netdev-genl: Hold rcu_read_lock in napi_get soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() media: v4l2-core: v4l2-dv-timings: check cvt/gtf result x86/mm: Carve out INVLPG inline asm for use by others x86/microcode/AMD: Flush patch buffer mapping after application ALSA: rawmidi: Fix kvfree() call in spinlock ALSA: ump: Fix evaluation of MIDI 1.0 FB info ALSA: pcm: Add sanity NULL check for the default mmap fault handler ALSA: hda/realtek: Update ALC225 depop procedure ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform ALSA: hda/realtek: Set PCBeep to default value for ALC274 ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i ALSA: hda/realtek: Apply quirk for Medion E15433 fs/smb/client: implement chmod() for SMB3 POSIX Extensions smb: client: fix use-after-free of signing key smb3: request handle caching when caching directories smb: client: handle max length for SMB symlinks smb: Don't leak cfid when reconnect races with open_cached_dir smb: prevent use-after-free due to open_cached_dir error paths smb: During unmount, ensure all cached dir instances drop their dentry usb: misc: ljca: set small runtime autosuspend delay usb: misc: ljca: move usb_autopm_put_interface() after wait for response usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED usb: musb: Fix hardware lockup on first Rx endpoint request usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic usb: dwc3: gadget: Fix checking for number of TRBs left usb: dwc3: gadget: Fix looping of queued SG entries staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node counter: stm32-timer-cnt: fix device_node handling in probe_encoder() ublk: fix error code for unsupported command lib: string_helpers: silence snprintf() output truncation warning f2fs: fix to do sanity check on node blkaddr in truncate_node() ipc: fix memleak if msg_init_ns failed in create_ipc_ns Input: cs40l50 - fix wrong usage of INIT_WORK() NFSD: Prevent a potential integer overflow SUNRPC: make sure cache entry active before cache_show um: Fix potential integer overflow during physmem setup um: Fix the return value of elf_core_copy_task_fpregs kfifo: don't include dma-mapping.h in kfifo.h um: ubd: Initialize ubd's disk pointer in ubd_add um: Always dump trace for specified task in show_stack NFSv4.0: Fix a use-after-free problem in the asynchronous open() nfs/localio: must clear res.replen in nfs_local_read_done rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() rtc: abx80x: Fix WDT bit position of the status register rtc: check if __rtc_read_time was successful in rtc_timer_do_work() ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty ubifs: Correct the total block count by deducting journal reservation ubi: fastmap: Fix duplicate slab cache names while attaching ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit jffs2: fix use of uninitialized variable hostfs: Fix the NULL vs IS_ERR() bug for __filemap_get_folio() net/9p/usbg: fix handling of the failed kzalloc() memory allocation rtc: rzn1: fix BCD to rtc_time conversion errors Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests" nvme/multipath: Fix RCU list traversal to use SRCU primitive blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs block: model freeze & enter queue as lock for supporting lockdep block: fix uaf for flush rq while iterating tags block: return unsigned int from bdev_io_min nvme-fabrics: fix kernel crash while shutting down controller 9p/xen: fix init sequence 9p/xen: fix release of IRQ perf/arm-smmuv3: Fix lockdep assert in ->event_init() perf/arm-cmn: Ensure port and device id bits are set properly smb: client: disable directory caching when dir_cache_timeout is zero x86/Documentation: Update algo in init_size description of boot protocol cifs: Fix parsing native symlinks relative to the export cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session rtc: ab-eoz9: don't fail temperature reads on undervoltage notification Rename .data.unlikely to .data..unlikely Rename .data.once to .data..once to fix resetting WARN*_ONCE kbuild: deb-pkg: Don't fail if modules.order is missing smb: Initialize cfid->tcon before performing network ops block: Don't allow an atomic write be truncated in blkdev_write_iter() modpost: remove incorrect code in do_eisa_entry() cifs: during remount, make sure passwords are in sync cifs: unlock on error in smb3_reconfigure() nfs: ignore SB_RDONLY when mounting nfs sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket nfs/blocklayout: Don't attempt unregister for invalid block device nfs/blocklayout: Limit repeat device registration on failure block, bfq: fix bfqq uaf in bfq_limit_depth() brd: decrease the number of allocated pages which discarded sh: intc: Fix use-after-free bug in register_intc_controller() tools/power turbostat: Fix trailing '\n' parsing tools/power turbostat: Fix child's argument forwarding block: always verify unfreeze lock on the owner task block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() Linux 6.12.2 Change-Id: Ifebddb35b5a6a6ff2a65eb795a912633639aca9a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-12-13 16:16:30 +00:00
parent 496f174a41 fa10f348fd
commit 144a77d178
198 changed files with 2047 additions and 1113 deletions
@@ -15,7 +15,7 @@ Please notice, however, that, if:

 you should use the main media development tree ``master`` branch:

-    https://git.linuxtv.org/media_tree.git/
+    https://git.linuxtv.org/media.git/

 In this case, you may find some useful information at the
 `LinuxTv wiki pages <https://linuxtv.org/wiki>`_:
@@ -67,7 +67,7 @@ Changes / Fixes
 Please mail to linux-media AT vger.kernel.org unified diffs against
 the linux media git tree:

-    https://git.linuxtv.org/media_tree.git/
+    https://git.linuxtv.org/media.git/

 This is done by committing a patch at a clone of the git tree and
 submitting the patch using ``git send-email``. Don't forget to
@@ -896,10 +896,19 @@ Offset/size:	0x260/4

  The kernel runtime start address is determined by the following algorithm::

-	if (relocatable_kernel)
-	runtime_start = align_up(load_address, kernel_alignment)
-	else
-	runtime_start = pref_address
+   	if (relocatable_kernel) {
+   		if (load_address < pref_address)
+   			load_address = pref_address;
+   		runtime_start = align_up(load_address, kernel_alignment);
+   	} else {
+   		runtime_start = pref_address;
+   	}
+
+Hence the necessary memory window location and size can be estimated by
+a boot loader as::
+
+   	memory_window_start = runtime_start;
+   	memory_window_size = init_size;

 ============	===============
 Field name:	handover_offset
@@ -30,7 +30,7 @@ properties:
    maxItems: 1

  spi-max-frequency:
-    maximum: 30000000
+    maximum: 66000000

  reset-gpios:
    maxItems: 1
@@ -91,14 +91,17 @@ allOf:
  - if:
      properties:
        compatible:
-          # Match without "contains", to skip newer variants which are still
-          # compatible with samsung,exynos7-wakeup-eint
-          enum:
-            - samsung,s5pv210-wakeup-eint
-            - samsung,exynos4210-wakeup-eint
-            - samsung,exynos5433-wakeup-eint
-            - samsung,exynos7-wakeup-eint
-            - samsung,exynos7885-wakeup-eint
+          oneOf:
+            # Match without "contains", to skip newer variants which are still
+            # compatible with samsung,exynos7-wakeup-eint
+            - enum:
+                - samsung,exynos4210-wakeup-eint
+                - samsung,exynos7-wakeup-eint
+                - samsung,s5pv210-wakeup-eint
+            - contains:
+                enum:
+                  - samsung,exynos5433-wakeup-eint
+                  - samsung,exynos7885-wakeup-eint
    then:
      properties:
        interrupts:
@@ -18,16 +18,15 @@ properties:
    description: prop-encoded-array <a b>
    $ref: /schemas/types.yaml#/definitions/uint32-array
    items:
-      items:
-        - description: Delay between rts signal and beginning of data sent in
-            milliseconds. It corresponds to the delay before sending data.
-          default: 0
-          maximum: 100
-        - description: Delay between end of data sent and rts signal in milliseconds.
-            It corresponds to the delay after sending data and actual release
-            of the line.
-          default: 0
-          maximum: 100
+      - description: Delay between rts signal and beginning of data sent in
+          milliseconds. It corresponds to the delay before sending data.
+        default: 0
+        maximum: 100
+      - description: Delay between end of data sent and rts signal in milliseconds.
+          It corresponds to the delay after sending data and actual release
+          of the line.
+        default: 0
+        maximum: 100

  rs485-rts-active-high:
    description: drive RTS high when sending (this is the default).
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 12
-SUBLEVEL = 1
+SUBLEVEL = 2
 EXTRAVERSION =
 NAME = Baby Opossum Posse

@@ -72,6 +72,7 @@
 					 <1375000 1375000 1375000>;
 			/* only on am/dm37x with speed-binned bit set */
 			opp-supported-hw = <0xffffffff 2>;
+			turbo-mode;
 		};
 	};

@@ -10,12 +10,6 @@

 / {
 	chassis-type = "laptop";
-
-	max98360a: max98360a {
-		compatible = "maxim,max98360a";
-		sdmode-gpios = <&pio 150 GPIO_ACTIVE_HIGH>;
-		#sound-dai-cells = <0>;
-	};
 };

 &cpu6 {
@@ -59,19 +53,14 @@
 	opp-hz = /bits/ 64 <2200000000>;
 };

-&rt1019p{
-	status = "disabled";
-};
-
 &sound {
 	compatible = "mediatek,mt8186-mt6366-rt5682s-max98360-sound";
-	status = "okay";
+};

-	spk-hdmi-playback-dai-link {
-		codec {
-			sound-dai = <&it6505dptx>, <&max98360a>;
-		};
-	};
+&speaker_codec {
+	compatible = "maxim,max98360a";
+	sdmode-gpios = <&pio 150 GPIO_ACTIVE_HIGH>;
+	/delete-property/ sdb-gpios;
 };

 &spmi {
@@ -259,15 +259,15 @@
 			mediatek,clk-provider = "cpu";
 			/* RT1019P and IT6505 connected to the same I2S line */
 			codec {
-				sound-dai = <&it6505dptx>, <&rt1019p>;
+				sound-dai = <&it6505dptx>, <&speaker_codec>;
 			};
 		};
 	};

-	rt1019p: speaker-codec {
+	speaker_codec: speaker-codec {
 		compatible = "realtek,rt1019p";
 		pinctrl-names = "default";
-		pinctrl-0 = <&rt1019p_pins_default>;
+		pinctrl-0 = <&speaker_codec_pins_default>;
 		#sound-dai-cells = <0>;
 		sdb-gpios = <&pio 150 GPIO_ACTIVE_HIGH>;
 	};
@@ -1179,7 +1179,7 @@
 		};
 	};

-	rt1019p_pins_default: rt1019p-default-pins {
+	speaker_codec_pins_default: speaker-codec-default-pins {
 		pins-sdb {
 			pinmux = <PINMUX_GPIO150__FUNC_GPIO150>;
 			output-low;
@@ -74,8 +74,6 @@ enum kvm_mode kvm_get_mode(void);
 static inline enum kvm_mode kvm_get_mode(void) { return KVM_MODE_NONE; };
 #endif

-DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
-
 extern unsigned int __ro_after_init kvm_sve_max_vl;
 extern unsigned int __ro_after_init kvm_host_sve_max_vl;
 int __init kvm_arm_init_sve(void);
@@ -445,7 +445,7 @@ static void tls_thread_switch(struct task_struct *next)

 	if (is_compat_thread(task_thread_info(next)))
 		write_sysreg(next->thread.uw.tp_value, tpidrro_el0);
-	else if (!arm64_kernel_unmapped_at_el0())
+	else
 		write_sysreg(0, tpidrro_el0);

 	write_sysreg(*task_user_tls(next), tpidr_el0);
@@ -207,8 +207,7 @@ void get_timer_map(struct kvm_vcpu *vcpu, struct timer_map *map)

 static inline bool userspace_irqchip(struct kvm *kvm)
 {
-	return static_branch_unlikely(&userspace_irqchip_in_use) &&
-		unlikely(!irqchip_in_kernel(kvm));
+	return unlikely(!irqchip_in_kernel(kvm));
 }

 static void soft_timer_start(struct hrtimer *hrt, u64 ns)
@@ -73,7 +73,6 @@ DECLARE_KVM_NVHE_PER_CPU(struct kvm_cpu_context, kvm_hyp_ctxt);
 static bool vgic_present, kvm_arm_initialised;

 static DEFINE_PER_CPU(unsigned char, kvm_hyp_initialized);
-DEFINE_STATIC_KEY_FALSE(userspace_irqchip_in_use);

 bool is_kvm_arm_initialised(void)
 {
@@ -529,17 +528,7 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)

 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 {
-	if (vcpu_has_run_once(vcpu) && unlikely(!irqchip_in_kernel(vcpu->kvm)))
-		static_branch_dec(&userspace_irqchip_in_use);
-
-	if (is_protected_kvm_enabled()) {
-		atomic64_sub(vcpu->arch.stage2_mc.nr_pages << PAGE_SHIFT,
-			     &vcpu->kvm->stat.protected_hyp_mem);
-		free_hyp_memcache(&vcpu->arch.stage2_mc);
-	} else {
-		kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache);
-	}
-
+	kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache);
 	kvm_timer_vcpu_terminate(vcpu);
 	kvm_pmu_vcpu_destroy(vcpu);
 	kvm_vgic_vcpu_destroy(vcpu);
@@ -906,14 +895,6 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu)
 			return ret;
 	}

-	if (!irqchip_in_kernel(kvm)) {
-		/*
-		 * Tell the rest of the code that there are userspace irqchip
-		 * VMs in the wild.
-		 */
-		static_branch_inc(&userspace_irqchip_in_use);
-	}
-
 	mutex_lock(&kvm->arch.config_lock);
 	set_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags);
 	mutex_unlock(&kvm->arch.config_lock);
@@ -1127,7 +1108,7 @@ static bool kvm_vcpu_exit_request(struct kvm_vcpu *vcpu, int *ret)
 	 * state gets updated in kvm_timer_update_run and
 	 * kvm_pmu_update_run below).
 	 */
-	if (static_branch_unlikely(&userspace_irqchip_in_use)) {
+	if (unlikely(!irqchip_in_kernel(vcpu->kvm))) {
 		if (kvm_timer_should_notify_user(vcpu) ||
 		    kvm_pmu_should_notify_user(vcpu)) {
 			*ret = -EINTR;
@@ -1249,7 +1230,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
 			vcpu->mode = OUTSIDE_GUEST_MODE;
 			isb(); /* Ensure work in x_flush_hwstate is committed */
 			kvm_pmu_sync_hwstate(vcpu);
-			if (static_branch_unlikely(&userspace_irqchip_in_use))
+			if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
 				kvm_timer_sync_user(vcpu);
 			kvm_vgic_sync_hwstate(vcpu);
 			local_irq_enable();
@@ -1295,7 +1276,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
 		 * we don't want vtimer interrupts to race with syncing the
 		 * timer virtual interrupt state.
 		 */
-		if (static_branch_unlikely(&userspace_irqchip_in_use))
+		if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
 			kvm_timer_sync_user(vcpu);

 		kvm_arch_vcpu_ctxsync_fp(vcpu);
@@ -72,6 +72,31 @@ unsigned long kvm_mmio_read_buf(const void *buf, unsigned int len)
 	return data;
 }

+static bool kvm_pending_sync_exception(struct kvm_vcpu *vcpu)
+{
+	if (!vcpu_get_flag(vcpu, PENDING_EXCEPTION))
+		return false;
+
+	if (vcpu_el1_is_32bit(vcpu)) {
+		switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) {
+		case unpack_vcpu_flag(EXCEPT_AA32_UND):
+		case unpack_vcpu_flag(EXCEPT_AA32_IABT):
+		case unpack_vcpu_flag(EXCEPT_AA32_DABT):
+			return true;
+		default:
+			return false;
+		}
+	} else {
+		switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) {
+		case unpack_vcpu_flag(EXCEPT_AA64_EL1_SYNC):
+		case unpack_vcpu_flag(EXCEPT_AA64_EL2_SYNC):
+			return true;
+		default:
+			return false;
+		}
+	}
+}
+
 /**
 * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation
 *			     or in-kernel IO emulation
@@ -84,8 +109,11 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu)
 	unsigned int len;
 	int mask;

-	/* Detect an already handled MMIO return */
-	if (unlikely(!vcpu->mmio_needed))
+	/*
+	 * Detect if the MMIO return was already handled or if userspace aborted
+	 * the MMIO access.
+	 */
+	if (unlikely(!vcpu->mmio_needed || kvm_pending_sync_exception(vcpu)))
 		return 1;

 	vcpu->mmio_needed = 0;
@@ -342,7 +342,6 @@ static u64 kvm_pmu_overflow_status(struct kvm_vcpu *vcpu)

 	if ((kvm_vcpu_read_pmcr(vcpu) & ARMV8_PMU_PMCR_E)) {
 		reg = __vcpu_sys_reg(vcpu, PMOVSSET_EL0);
-		reg &= __vcpu_sys_reg(vcpu, PMCNTENSET_EL0);
 		reg &= __vcpu_sys_reg(vcpu, PMINTENSET_EL1);
 	}

@@ -782,6 +782,9 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its,

 	ite = find_ite(its, device_id, event_id);
 	if (ite && its_is_collection_mapped(ite->collection)) {
+		struct its_device *device = find_its_device(its, device_id);
+		int ite_esz = vgic_its_get_abi(its)->ite_esz;
+		gpa_t gpa = device->itt_addr + ite->event_id * ite_esz;
 		/*
 		 * Though the spec talks about removing the pending state, we
 		 * don't bother here since we clear the ITTE anyway and the
@@ -790,7 +793,8 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its,
 		vgic_its_invalidate_cache(its);

 		its_free_ite(kvm, ite);
-		return 0;
+
+		return vgic_its_write_entry_lock(its, gpa, 0, ite_esz);
 	}

 	return E_ITS_DISCARD_UNMAPPED_INTERRUPT;
@@ -1139,9 +1143,11 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its,
 	bool valid = its_cmd_get_validbit(its_cmd);
 	u8 num_eventid_bits = its_cmd_get_size(its_cmd);
 	gpa_t itt_addr = its_cmd_get_ittaddr(its_cmd);
+	int dte_esz = vgic_its_get_abi(its)->dte_esz;
 	struct its_device *device;
+	gpa_t gpa;

-	if (!vgic_its_check_id(its, its->baser_device_table, device_id, NULL))
+	if (!vgic_its_check_id(its, its->baser_device_table, device_id, &gpa))
 		return E_ITS_MAPD_DEVICE_OOR;

 	if (valid && num_eventid_bits > VITS_TYPER_IDBITS)
@@ -1162,7 +1168,7 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its,
 	 * is an error, so we are done in any case.
 	 */
 	if (!valid)
-		return 0;
+		return vgic_its_write_entry_lock(its, gpa, 0, dte_esz);

 	device = vgic_its_alloc_device(its, device_id, itt_addr,
 				       num_eventid_bits);
@@ -2086,7 +2092,6 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz,
 static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
 			      struct its_ite *ite, gpa_t gpa, int ite_esz)
 {
-	struct kvm *kvm = its->dev->kvm;
 	u32 next_offset;
 	u64 val;

@@ -2095,7 +2100,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
 	       ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) |
 		ite->collection->collection_id;
 	val = cpu_to_le64(val);
-	return vgic_write_guest_lock(kvm, gpa, &val, ite_esz);
+
+	return vgic_its_write_entry_lock(its, gpa, val, ite_esz);
 }

 /**
@@ -2239,7 +2245,6 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
 static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
 			     gpa_t ptr, int dte_esz)
 {
-	struct kvm *kvm = its->dev->kvm;
 	u64 val, itt_addr_field;
 	u32 next_offset;

@@ -2250,7 +2255,8 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
 	       (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
 		(dev->num_eventid_bits - 1));
 	val = cpu_to_le64(val);
-	return vgic_write_guest_lock(kvm, ptr, &val, dte_esz);
+
+	return vgic_its_write_entry_lock(its, ptr, val, dte_esz);
 }

 /**
@@ -2437,7 +2443,8 @@ static int vgic_its_save_cte(struct vgic_its *its,
 	       ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
 	       collection->collection_id);
 	val = cpu_to_le64(val);
-	return vgic_write_guest_lock(its->dev->kvm, gpa, &val, esz);
+
+	return vgic_its_write_entry_lock(its, gpa, val, esz);
 }

 /*
@@ -2453,8 +2460,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
 	u64 val;
 	int ret;

-	BUG_ON(esz > sizeof(val));
-	ret = kvm_read_guest_lock(kvm, gpa, &val, esz);
+	ret = vgic_its_read_entry_lock(its, gpa, &val, esz);
 	if (ret)
 		return ret;
 	val = le64_to_cpu(val);
@@ -2492,7 +2498,6 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
 	u64 baser = its->baser_coll_table;
 	gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser);
 	struct its_collection *collection;
-	u64 val;
 	size_t max_size, filled = 0;
 	int ret, cte_esz = abi->cte_esz;

@@ -2516,10 +2521,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
 	 * table is not fully filled, add a last dummy element
 	 * with valid bit unset
 	 */
-	val = 0;
-	BUG_ON(cte_esz > sizeof(val));
-	ret = vgic_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
-	return ret;
+	return vgic_its_write_entry_lock(its, gpa, 0, cte_esz);
 }

 /*
@@ -530,6 +530,7 @@ static void vgic_mmio_write_invlpi(struct kvm_vcpu *vcpu,
 				   unsigned long val)
 {
 	struct vgic_irq *irq;
+	u32 intid;

 	/*
 	 * If the guest wrote only to the upper 32bit part of the
@@ -541,9 +542,13 @@ static void vgic_mmio_write_invlpi(struct kvm_vcpu *vcpu,
 	if ((addr & 4) || !vgic_lpis_enabled(vcpu))
 		return;

+	intid = lower_32_bits(val);
+	if (intid < VGIC_MIN_LPI)
+		return;
+
 	vgic_set_rdist_busy(vcpu, true);

-	irq = vgic_get_irq(vcpu->kvm, NULL, lower_32_bits(val));
+	irq = vgic_get_irq(vcpu->kvm, NULL, intid);
 	if (irq) {
 		vgic_its_inv_lpi(vcpu->kvm, irq);
 		vgic_put_irq(vcpu->kvm, irq);
@@ -146,6 +146,29 @@ static inline int vgic_write_guest_lock(struct kvm *kvm, gpa_t gpa,
 	return ret;
 }

+static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr,
+					   u64 *eval, unsigned long esize)
+{
+	struct kvm *kvm = its->dev->kvm;
+
+	if (KVM_BUG_ON(esize != sizeof(*eval), kvm))
+		return -EINVAL;
+
+	return kvm_read_guest_lock(kvm, eaddr, eval, esize);
+
+}
+
+static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr,
+					    u64 eval, unsigned long esize)
+{
+	struct kvm *kvm = its->dev->kvm;
+
+	if (KVM_BUG_ON(esize != sizeof(eval), kvm))
+		return -EINVAL;
+
+	return vgic_write_guest_lock(kvm, eaddr, &eval, esize);
+}
+
 /*
 * This struct provides an intermediate representation of the fields contained
 * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC
@@ -59,7 +59,7 @@ endif

 ifdef CONFIG_64BIT
 ld-emul			= $(64bit-emul)
-cflags-y		+= -mabi=lp64s
+cflags-y		+= -mabi=lp64s -mcmodel=normal
 endif

 cflags-y			+= -pipe $(CC_FLAGS_NO_FPU)
@@ -104,7 +104,7 @@ ifdef CONFIG_OBJTOOL
 KBUILD_CFLAGS			+= -fno-jump-tables
 endif

-KBUILD_RUSTFLAGS		+= --target=loongarch64-unknown-none-softfloat
+KBUILD_RUSTFLAGS		+= --target=loongarch64-unknown-none-softfloat -Ccode-model=small
 KBUILD_RUSTFLAGS_KERNEL		+= -Zdirect-access-external-data=yes
 KBUILD_RUSTFLAGS_MODULE		+= -Zdirect-access-external-data=no

@@ -87,7 +87,7 @@ int ftrace_enable_ftrace_graph_caller(void)

 int ftrace_disable_ftrace_graph_caller(void)
 {
-	static_key_enable(&ftrace_graph_enable.key);
+	static_key_disable(&ftrace_graph_enable.key);
 	return 0;
 }
 #endif
@@ -920,6 +920,7 @@ static int __init disable_hardlockup_detector(void)
 	hardlockup_detector_disable();
 #else
 	if (firmware_has_feature(FW_FEATURE_LPAR)) {
+		check_kvm_guest();
 		if (is_kvm_guest())
 			hardlockup_detector_disable();
 	}
@@ -8,6 +8,7 @@

 #include <linux/bitmap.h>
 #include <linux/jump_label.h>
+#include <linux/workqueue.h>
 #include <asm/hwcap.h>
 #include <asm/alternative-macros.h>
 #include <asm/errno.h>
@@ -60,6 +61,7 @@ void riscv_user_isa_enable(void);

 #if defined(CONFIG_RISCV_MISALIGNED)
 bool check_unaligned_access_emulated_all_cpus(void);
+void check_unaligned_access_emulated(struct work_struct *work __always_unused);
 void unaligned_emulation_finish(void);
 bool unaligned_ctl_available(void);
 DECLARE_PER_CPU(long, misaligned_access_speed);
@@ -524,11 +524,11 @@ int handle_misaligned_store(struct pt_regs *regs)
 	return 0;
 }

-static bool check_unaligned_access_emulated(int cpu)
+void check_unaligned_access_emulated(struct work_struct *work __always_unused)
 {
+	int cpu = smp_processor_id();
 	long *mas_ptr = per_cpu_ptr(&misaligned_access_speed, cpu);
 	unsigned long tmp_var, tmp_val;
-	bool misaligned_emu_detected;

 	*mas_ptr = RISCV_HWPROBE_MISALIGNED_SCALAR_UNKNOWN;

@@ -536,19 +536,16 @@ static bool check_unaligned_access_emulated(int cpu)
 		"       "REG_L" %[tmp], 1(%[ptr])\n"
 		: [tmp] "=r" (tmp_val) : [ptr] "r" (&tmp_var) : "memory");

-	misaligned_emu_detected = (*mas_ptr == RISCV_HWPROBE_MISALIGNED_SCALAR_EMULATED);
 	/*
 	 * If unaligned_ctl is already set, this means that we detected that all
 	 * CPUS uses emulated misaligned access at boot time. If that changed
 	 * when hotplugging the new cpu, this is something we don't handle.
 	 */
-	if (unlikely(unaligned_ctl && !misaligned_emu_detected)) {
+	if (unlikely(unaligned_ctl && (*mas_ptr != RISCV_HWPROBE_MISALIGNED_SCALAR_EMULATED))) {
 		pr_crit("CPU misaligned accesses non homogeneous (expected all emulated)\n");
 		while (true)
 			cpu_relax();
 	}
-
-	return misaligned_emu_detected;
 }

 bool check_unaligned_access_emulated_all_cpus(void)
@@ -560,8 +557,11 @@ bool check_unaligned_access_emulated_all_cpus(void)
 	 * accesses emulated since tasks requesting such control can run on any
 	 * CPU.
 	 */
+	schedule_on_each_cpu(check_unaligned_access_emulated);
+
 	for_each_online_cpu(cpu)
-		if (!check_unaligned_access_emulated(cpu))
+		if (per_cpu(misaligned_access_speed, cpu)
+		    != RISCV_HWPROBE_MISALIGNED_SCALAR_EMULATED)
 			return false;

 	unaligned_ctl = true;
@@ -191,6 +191,7 @@ static int riscv_online_cpu(unsigned int cpu)
 	if (per_cpu(misaligned_access_speed, cpu) != RISCV_HWPROBE_MISALIGNED_SCALAR_UNKNOWN)
 		goto exit;

+	check_unaligned_access_emulated(NULL);
 	buf = alloc_pages(GFP_KERNEL, MISALIGNED_BUFFER_ORDER);
 	if (!buf) {
 		pr_warn("Allocation failure, not measuring misaligned performance\n");
@@ -132,7 +132,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)

 static void *c_start(struct seq_file *m, loff_t *pos)
 {
-	return *pos < NR_CPUS ? cpu_data + *pos : NULL;
+	return *pos < nr_cpu_ids ? cpu_data + *pos : NULL;
 }
 static void *c_next(struct seq_file *m, void *v, loff_t *pos)
 {
@@ -336,7 +336,7 @@ static struct platform_driver uml_net_driver = {

 static void net_device_release(struct device *dev)
 {
-	struct uml_net *device = dev_get_drvdata(dev);
+	struct uml_net *device = container_of(dev, struct uml_net, pdev.dev);
 	struct net_device *netdev = device->dev;
 	struct uml_net_private *lp = netdev_priv(netdev);

@@ -779,7 +779,7 @@ static int ubd_open_dev(struct ubd *ubd_dev)

 static void ubd_device_release(struct device *dev)
 {
-	struct ubd *ubd_dev = dev_get_drvdata(dev);
+	struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev);

 	blk_mq_free_tag_set(&ubd_dev->tag_set);
 	*ubd_dev = ((struct ubd) DEFAULT_UBD);
@@ -898,6 +898,8 @@ static int ubd_add(int n, char **error_out)
 	if (err)
 		goto out_cleanup_disk;

+	ubd_dev->disk = disk;
+
 	return 0;

 out_cleanup_disk:
@@ -815,7 +815,8 @@ static struct platform_driver uml_net_driver = {

 static void vector_device_release(struct device *dev)
 {
-	struct vector_device *device = dev_get_drvdata(dev);
+	struct vector_device *device =
+		container_of(dev, struct vector_device, pdev.dev);
 	struct net_device *netdev = device->dev;

 	list_del(&device->list);
@@ -81,10 +81,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end,
 			  unsigned long len, unsigned long long highmem)
 {
 	unsigned long reserve = reserve_end - start;
-	long map_size = len - reserve;
+	unsigned long map_size = len - reserve;
 	int err;

-	if(map_size <= 0) {
+	if (len <= reserve) {
 		os_warn("Too few physical memory! Needed=%lu, given=%lu\n",
 			reserve, len);
 		exit(1);
@@ -95,7 +95,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end,
 	err = os_map_memory((void *) reserve_end, physmem_fd, reserve,
 			    map_size, 1, 1, 1);
 	if (err < 0) {
-		os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p "
+		os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p "
 			"failed - errno = %d\n", map_size,
 			(void *) reserve_end, err);
 		exit(1);
@@ -292,6 +292,6 @@ int elf_core_copy_task_fpregs(struct task_struct *t, elf_fpregset_t *fpu)
 {
 	int cpu = current_thread_info()->cpu;

-	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu);
+	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu) == 0;
 }

@@ -52,5 +52,5 @@ void show_stack(struct task_struct *task, unsigned long *stack,
 	}

 	printk("%sCall Trace:\n", loglvl);
-	dump_trace(current, &stackops, (void *)loglvl);
+	dump_trace(task ?: current, &stackops, (void *)loglvl);
 }
@@ -21,7 +21,7 @@
 #define T1	%xmm7

 #define STATEP	%rdi
-#define LEN	%rsi
+#define LEN	%esi
 #define SRC	%rdx
 #define DST	%rcx

@@ -76,32 +76,32 @@ SYM_FUNC_START_LOCAL(__load_partial)
 	xor %r9d, %r9d
 	pxor MSG, MSG

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1, %r8
 	jz .Lld_partial_1

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1E, %r8
 	add SRC, %r8
 	mov (%r8), %r9b

 .Lld_partial_1:
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x2, %r8
 	jz .Lld_partial_2

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1C, %r8
 	add SRC, %r8
 	shl $0x10, %r9
 	mov (%r8), %r9w

 .Lld_partial_2:
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x4, %r8
 	jz .Lld_partial_4

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x18, %r8
 	add SRC, %r8
 	shl $32, %r9
@@ -111,11 +111,11 @@ SYM_FUNC_START_LOCAL(__load_partial)
 .Lld_partial_4:
 	movq %r9, MSG

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x8, %r8
 	jz .Lld_partial_8

-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x10, %r8
 	add SRC, %r8
 	pslldq $8, MSG
@@ -139,7 +139,7 @@ SYM_FUNC_END(__load_partial)
 *   %r10
 */
 SYM_FUNC_START_LOCAL(__store_partial)
-	mov LEN, %r8
+	mov LEN, %r8d
 	mov DST, %r9

 	movq T0, %r10
@@ -677,7 +677,7 @@ SYM_TYPED_FUNC_START(crypto_aegis128_aesni_dec_tail)
 	call __store_partial

 	/* mask with byte count: */
-	movq LEN, T0
+	movd LEN, T0
 	punpcklbw T0, T0
 	punpcklbw T0, T0
 	punpcklbw T0, T0
@@ -702,7 +702,8 @@ SYM_FUNC_END(crypto_aegis128_aesni_dec_tail)

 /*
 * void crypto_aegis128_aesni_final(void *state, void *tag_xor,
- *                                  u64 assoclen, u64 cryptlen);
+ *                                  unsigned int assoclen,
+ *                                  unsigned int cryptlen);
 */
 SYM_FUNC_START(crypto_aegis128_aesni_final)
 	FRAME_BEGIN
@@ -715,8 +716,8 @@ SYM_FUNC_START(crypto_aegis128_aesni_final)
 	movdqu 0x40(STATEP), STATE4

 	/* prepare length block: */
-	movq %rdx, MSG
-	movq %rcx, T0
+	movd %edx, MSG
+	movd %ecx, T0
 	pslldq $8, T0
 	pxor T0, MSG
 	psllq $3, MSG /* multiply by 8 (to get bit count) */
@@ -828,11 +828,13 @@ static void pt_buffer_advance(struct pt_buffer *buf)
 	buf->cur_idx++;

 	if (buf->cur_idx == buf->cur->last) {
-		if (buf->cur == buf->last)
+		if (buf->cur == buf->last) {
 			buf->cur = buf->first;
-		else
+			buf->wrapped = true;
+		} else {
 			buf->cur = list_entry(buf->cur->list.next, struct topa,
 					      list);
+		}
 		buf->cur_idx = 0;
 	}
 }
@@ -846,8 +848,11 @@ static void pt_buffer_advance(struct pt_buffer *buf)
 static void pt_update_head(struct pt *pt)
 {
 	struct pt_buffer *buf = perf_get_aux(&pt->handle);
+	bool wrapped = buf->wrapped;
 	u64 topa_idx, base, old;

+	buf->wrapped = false;
+
 	if (buf->single) {
 		local_set(&buf->data_size, buf->output_off);
 		return;
@@ -865,7 +870,7 @@ static void pt_update_head(struct pt *pt)
 	} else {
 		old = (local64_xchg(&buf->head, base) &
 		       ((buf->nr_pages << PAGE_SHIFT) - 1));
-		if (base < old)
+		if (base < old || (base == old && wrapped))
 			base += buf->nr_pages << PAGE_SHIFT;

 		local_add(base - old, &buf->data_size);
@@ -65,6 +65,7 @@ struct pt_pmu {
 * @head:	logical write offset inside the buffer
 * @snapshot:	if this is for a snapshot/overwrite counter
 * @single:	use Single Range Output instead of ToPA
+ * @wrapped:	buffer advance wrapped back to the first topa table
 * @stop_pos:	STOP topa entry index
 * @intr_pos:	INT topa entry index
 * @stop_te:	STOP topa entry pointer
@@ -82,6 +83,7 @@ struct pt_buffer {
 	local64_t		head;
 	bool			snapshot;
 	bool			single;
+	bool			wrapped;
 	long			stop_pos, intr_pos;
 	struct topa_entry	*stop_te, *intr_te;
 	void			**data_pages;
@@ -26,6 +26,7 @@
 #include <linux/irqbypass.h>
 #include <linux/hyperv.h>
 #include <linux/kfifo.h>
+#include <linux/sched/vhost_task.h>

 #include <asm/apic.h>
 #include <asm/pvclock-abi.h>
@@ -1443,7 +1444,8 @@ struct kvm_arch {
 	bool sgx_provisioning_allowed;

 	struct kvm_x86_pmu_event_filter __rcu *pmu_event_filter;
-	struct task_struct *nx_huge_page_recovery_thread;
+	struct vhost_task *nx_huge_page_recovery_thread;
+	u64 nx_huge_page_last;

 #ifdef CONFIG_X86_64
 	/* The number of TDP MMU pages across all roots. */
@@ -34,4 +34,8 @@ static inline void __tlb_remove_table(void *table)
 	free_page_and_swap_cache(table);
 }

+static inline void invlpg(unsigned long addr)
+{
+	asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
+}
 #endif /* _ASM_X86_TLB_H */
@@ -798,6 +798,7 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
 static const struct x86_cpu_desc erratum_1386_microcode[] = {
 	AMD_CPU_DESC(0x17,  0x1, 0x2, 0x0800126e),
 	AMD_CPU_DESC(0x17, 0x31, 0x0, 0x08301052),
+	{},
 };

 static void fix_erratum_1386(struct cpuinfo_x86 *c)
@@ -34,6 +34,7 @@
 #include <asm/setup.h>
 #include <asm/cpu.h>
 #include <asm/msr.h>
+#include <asm/tlb.h>

 #include "internal.h"

@@ -483,11 +484,25 @@ static void scan_containers(u8 *ucode, size_t size, struct cont_desc *desc)
 	}
 }

-static int __apply_microcode_amd(struct microcode_amd *mc)
+static int __apply_microcode_amd(struct microcode_amd *mc, unsigned int psize)
 {
+	unsigned long p_addr = (unsigned long)&mc->hdr.data_code;
 	u32 rev, dummy;

-	native_wrmsrl(MSR_AMD64_PATCH_LOADER, (u64)(long)&mc->hdr.data_code);
+	native_wrmsrl(MSR_AMD64_PATCH_LOADER, p_addr);
+
+	if (x86_family(bsp_cpuid_1_eax) == 0x17) {
+		unsigned long p_addr_end = p_addr + psize - 1;
+
+		invlpg(p_addr);
+
+		/*
+		 * Flush next page too if patch image is crossing a page
+		 * boundary.
+		 */
+		if (p_addr >> PAGE_SHIFT != p_addr_end >> PAGE_SHIFT)
+			invlpg(p_addr_end);
+	}

 	/* verify patch application was successful */
 	native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
@@ -529,7 +544,7 @@ static bool early_apply_microcode(u32 old_rev, void *ucode, size_t size)
 	if (old_rev > mc->hdr.patch_id)
 		return ret;

-	return !__apply_microcode_amd(mc);
+	return !__apply_microcode_amd(mc, desc.psize);
 }

 static bool get_builtin_microcode(struct cpio_data *cp)
@@ -745,7 +760,7 @@ void reload_ucode_amd(unsigned int cpu)
 	rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);

 	if (rev < mc->hdr.patch_id) {
-		if (!__apply_microcode_amd(mc))
+		if (!__apply_microcode_amd(mc, p->size))
 			pr_info_once("reload revision: 0x%08x\n", mc->hdr.patch_id);
 	}
 }
@@ -798,7 +813,7 @@ static enum ucode_state apply_microcode_amd(int cpu)
 		goto out;
 	}

-	if (__apply_microcode_amd(mc_amd)) {
+	if (__apply_microcode_amd(mc_amd, p->size)) {
 		pr_err("CPU%d: update failed for patch_level=0x%08x\n",
 			cpu, mc_amd->hdr.patch_id);
 		return UCODE_ERROR;
@@ -18,8 +18,7 @@ menuconfig VIRTUALIZATION
 if VIRTUALIZATION

 config KVM_X86
-	def_tristate KVM if KVM_INTEL || KVM_AMD
-	depends on X86_LOCAL_APIC
+	def_tristate KVM if (KVM_INTEL != n || KVM_AMD != n)
 	select KVM_COMMON
 	select KVM_GENERIC_MMU_NOTIFIER
 	select HAVE_KVM_IRQCHIP
@@ -29,6 +28,7 @@ config KVM_X86
 	select HAVE_KVM_IRQ_BYPASS
 	select HAVE_KVM_IRQ_ROUTING
 	select HAVE_KVM_READONLY_MEM
+	select VHOST_TASK
 	select KVM_ASYNC_PF
 	select USER_RETURN_NOTIFIER
 	select KVM_MMIO
@@ -49,6 +49,7 @@ config KVM_X86

 config KVM
 	tristate "Kernel-based Virtual Machine (KVM) support"
+	depends on X86_LOCAL_APIC
 	help
 	  Support hosting fully virtualized guest machines using hardware
 	  virtualization extensions.  You will need a fairly recent
@@ -7281,7 +7281,7 @@ static int set_nx_huge_pages(const char *val, const struct kernel_param *kp)
 			kvm_mmu_zap_all_fast(kvm);
 			mutex_unlock(&kvm->slots_lock);

-			wake_up_process(kvm->arch.nx_huge_page_recovery_thread);
+			vhost_task_wake(kvm->arch.nx_huge_page_recovery_thread);
 		}
 		mutex_unlock(&kvm_lock);
 	}
@@ -7427,7 +7427,7 @@ static int set_nx_huge_pages_recovery_param(const char *val, const struct kernel
 		mutex_lock(&kvm_lock);

 		list_for_each_entry(kvm, &vm_list, vm_list)
-			wake_up_process(kvm->arch.nx_huge_page_recovery_thread);
+			vhost_task_wake(kvm->arch.nx_huge_page_recovery_thread);

 		mutex_unlock(&kvm_lock);
 	}
@@ -7530,62 +7530,56 @@ static void kvm_recover_nx_huge_pages(struct kvm *kvm)
 	srcu_read_unlock(&kvm->srcu, rcu_idx);
 }

-static long get_nx_huge_page_recovery_timeout(u64 start_time)
+static void kvm_nx_huge_page_recovery_worker_kill(void *data)
 {
-	bool enabled;
-	uint period;
-
-	enabled = calc_nx_huge_pages_recovery_period(&period);
-
-	return enabled ? start_time + msecs_to_jiffies(period) - get_jiffies_64()
-		       : MAX_SCHEDULE_TIMEOUT;
 }

-static int kvm_nx_huge_page_recovery_worker(struct kvm *kvm, uintptr_t data)
+static bool kvm_nx_huge_page_recovery_worker(void *data)
 {
-	u64 start_time;
+	struct kvm *kvm = data;
+	bool enabled;
+	uint period;
 	long remaining_time;

-	while (true) {
-		start_time = get_jiffies_64();
-		remaining_time = get_nx_huge_page_recovery_timeout(start_time);
+	enabled = calc_nx_huge_pages_recovery_period(&period);
+	if (!enabled)
+		return false;

-		set_current_state(TASK_INTERRUPTIBLE);
-		while (!kthread_should_stop() && remaining_time > 0) {
-			schedule_timeout(remaining_time);
-			remaining_time = get_nx_huge_page_recovery_timeout(start_time);
-			set_current_state(TASK_INTERRUPTIBLE);
-		}
-
-		set_current_state(TASK_RUNNING);
-
-		if (kthread_should_stop())
-			return 0;
-
-		kvm_recover_nx_huge_pages(kvm);
+	remaining_time = kvm->arch.nx_huge_page_last + msecs_to_jiffies(period)
+		- get_jiffies_64();
+	if (remaining_time > 0) {
+		schedule_timeout(remaining_time);
+		/* check for signals and come back */
+		return true;
 	}
+
+	__set_current_state(TASK_RUNNING);
+	kvm_recover_nx_huge_pages(kvm);
+	kvm->arch.nx_huge_page_last = get_jiffies_64();
+	return true;
 }

 int kvm_mmu_post_init_vm(struct kvm *kvm)
 {
-	int err;
-
 	if (nx_hugepage_mitigation_hard_disabled)
 		return 0;

-	err = kvm_vm_create_worker_thread(kvm, kvm_nx_huge_page_recovery_worker, 0,
-					  "kvm-nx-lpage-recovery",
-					  &kvm->arch.nx_huge_page_recovery_thread);
-	if (!err)
-		kthread_unpark(kvm->arch.nx_huge_page_recovery_thread);
+	kvm->arch.nx_huge_page_last = get_jiffies_64();
+	kvm->arch.nx_huge_page_recovery_thread = vhost_task_create(
+		kvm_nx_huge_page_recovery_worker, kvm_nx_huge_page_recovery_worker_kill,
+		kvm, "kvm-nx-lpage-recovery");

-	return err;
+	if (!kvm->arch.nx_huge_page_recovery_thread)
+		return -ENOMEM;
+
+	vhost_task_start(kvm->arch.nx_huge_page_recovery_thread);
+	return 0;
 }

 void kvm_mmu_pre_destroy_vm(struct kvm *kvm)
 {
 	if (kvm->arch.nx_huge_page_recovery_thread)
-		kthread_stop(kvm->arch.nx_huge_page_recovery_thread);
+		vhost_task_stop(kvm->arch.nx_huge_page_recovery_thread);
 }

 #ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES
@@ -226,12 +226,20 @@ bool make_spte(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
 		spte |= PT_WRITABLE_MASK | shadow_mmu_writable_mask;

 		/*
-		 * Optimization: for pte sync, if spte was writable the hash
-		 * lookup is unnecessary (and expensive). Write protection
-		 * is responsibility of kvm_mmu_get_page / kvm_mmu_sync_roots.
-		 * Same reasoning can be applied to dirty page accounting.
+		 * When overwriting an existing leaf SPTE, and the old SPTE was
+		 * writable, skip trying to unsync shadow pages as any relevant
+		 * shadow pages must already be unsync, i.e. the hash lookup is
+		 * unnecessary (and expensive).
+		 *
+		 * The same reasoning applies to dirty page/folio accounting;
+		 * KVM will mark the folio dirty using the old SPTE, thus
+		 * there's no need to immediately mark the new SPTE as dirty.
+		 *
+		 * Note, both cases rely on KVM not changing PFNs without first
+		 * zapping the old SPTE, which is guaranteed by both the shadow
+		 * MMU and the TDP MMU.
 		 */
-		if (is_writable_pte(old_spte))
+		if (is_last_spte(old_spte, level) && is_writable_pte(old_spte))
 			goto out;

 		/*
@@ -2551,28 +2551,6 @@ static bool cpu_has_sgx(void)
 	return cpuid_eax(0) >= 0x12 && (cpuid_eax(0x12) & BIT(0));
 }

-/*
- * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they
- * can't be used due to errata where VM Exit may incorrectly clear
- * IA32_PERF_GLOBAL_CTRL[34:32]. Work around the errata by using the
- * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL.
- */
-static bool cpu_has_perf_global_ctrl_bug(void)
-{
-	switch (boot_cpu_data.x86_vfm) {
-	case INTEL_NEHALEM_EP:	/* AAK155 */
-	case INTEL_NEHALEM:	/* AAP115 */
-	case INTEL_WESTMERE:	/* AAT100 */
-	case INTEL_WESTMERE_EP:	/* BC86,AAY89,BD102 */
-	case INTEL_NEHALEM_EX:	/* BA97 */
-		return true;
-	default:
-		break;
-	}
-
-	return false;
-}
-
 static int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt, u32 msr, u32 *result)
 {
 	u32 vmx_msr_low, vmx_msr_high;
@@ -2732,6 +2710,27 @@ static int setup_vmcs_config(struct vmcs_config *vmcs_conf,
 		_vmexit_control &= ~x_ctrl;
 	}

+	/*
+	 * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they
+	 * can't be used due to an errata where VM Exit may incorrectly clear
+	 * IA32_PERF_GLOBAL_CTRL[34:32].  Workaround the errata by using the
+	 * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL.
+	 */
+	switch (boot_cpu_data.x86_vfm) {
+	case INTEL_NEHALEM_EP:	/* AAK155 */
+	case INTEL_NEHALEM:	/* AAP115 */
+	case INTEL_WESTMERE:	/* AAT100 */
+	case INTEL_WESTMERE_EP:	/* BC86,AAY89,BD102 */
+	case INTEL_NEHALEM_EX:	/* BA97 */
+		_vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+		_vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+		pr_warn_once("VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
+			     "does not work properly. Using workaround\n");
+		break;
+	default:
+		break;
+	}
+
 	rdmsrl(MSR_IA32_VMX_BASIC, basic_msr);

 	/* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
@@ -4422,9 +4421,6 @@ static u32 vmx_vmentry_ctrl(void)
 			  VM_ENTRY_LOAD_IA32_EFER |
 			  VM_ENTRY_IA32E_MODE);

-	if (cpu_has_perf_global_ctrl_bug())
-		vmentry_ctrl &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
-
 	return vmentry_ctrl;
 }

@@ -4442,10 +4438,6 @@ static u32 vmx_vmexit_ctrl(void)
 	if (vmx_pt_mode_is_system())
 		vmexit_ctrl &= ~(VM_EXIT_PT_CONCEAL_PIP |
 				 VM_EXIT_CLEAR_IA32_RTIT_CTL);
-
-	if (cpu_has_perf_global_ctrl_bug())
-		vmexit_ctrl &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
-
 	/* Loading of EFER and PERF_GLOBAL_CTRL are toggled dynamically */
 	return vmexit_ctrl &
 		~(VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL | VM_EXIT_LOAD_IA32_EFER);
@@ -8400,10 +8392,6 @@ __init int vmx_hardware_setup(void)
 	if (setup_vmcs_config(&vmcs_config, &vmx_capability) < 0)
 		return -EIO;

-	if (cpu_has_perf_global_ctrl_bug())
-		pr_warn_once("VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
-			     "does not work properly. Using workaround\n");
-
 	if (boot_cpu_has(X86_FEATURE_NX))
 		kvm_enable_efer_bits(EFER_NX);

@@ -20,6 +20,7 @@
 #include <asm/cacheflush.h>
 #include <asm/apic.h>
 #include <asm/perf_event.h>
+#include <asm/tlb.h>

 #include "mm_internal.h"

@@ -1140,7 +1141,7 @@ STATIC_NOPV void native_flush_tlb_one_user(unsigned long addr)
 	bool cpu_pcide;

 	/* Flush 'addr' from the kernel PCID: */
-	asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
+	invlpg(addr);

 	/* If PTI is off there is no user PCID and nothing to flush. */
 	if (!static_cpu_has(X86_FEATURE_PTI))
@@ -736,6 +736,7 @@ static void bfq_sync_bfqq_move(struct bfq_data *bfqd,
 		 */
 		bfq_put_cooperator(sync_bfqq);
 		bic_set_bfqq(bic, NULL, true, act_idx);
+		bfq_release_process_ref(bfqd, sync_bfqq);
 	}
 }

@@ -582,23 +582,31 @@ static struct request *bfq_choose_req(struct bfq_data *bfqd,
 #define BFQ_LIMIT_INLINE_DEPTH 16

 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-static bool bfqq_request_over_limit(struct bfq_queue *bfqq, int limit)
+static bool bfqq_request_over_limit(struct bfq_data *bfqd,
+				    struct bfq_io_cq *bic, blk_opf_t opf,
+				    unsigned int act_idx, int limit)
 {
-	struct bfq_data *bfqd = bfqq->bfqd;
-	struct bfq_entity *entity = &bfqq->entity;
 	struct bfq_entity *inline_entities[BFQ_LIMIT_INLINE_DEPTH];
 	struct bfq_entity **entities = inline_entities;
-	int depth, level, alloc_depth = BFQ_LIMIT_INLINE_DEPTH;
-	int class_idx = bfqq->ioprio_class - 1;
+	int alloc_depth = BFQ_LIMIT_INLINE_DEPTH;
 	struct bfq_sched_data *sched_data;
+	struct bfq_entity *entity;
+	struct bfq_queue *bfqq;
 	unsigned long wsum;
 	bool ret = false;
-
-	if (!entity->on_st_or_in_serv)
-		return false;
+	int depth;
+	int level;

 retry:
 	spin_lock_irq(&bfqd->lock);
+	bfqq = bic_to_bfqq(bic, op_is_sync(opf), act_idx);
+	if (!bfqq)
+		goto out;
+
+	entity = &bfqq->entity;
+	if (!entity->on_st_or_in_serv)
+		goto out;
+
 	/* +1 for bfqq entity, root cgroup not included */
 	depth = bfqg_to_blkg(bfqq_group(bfqq))->blkcg->css.cgroup->level + 1;
 	if (depth > alloc_depth) {
@@ -643,7 +651,7 @@ retry:
 			 * class.
 			 */
 			wsum = 0;
-			for (i = 0; i <= class_idx; i++) {
+			for (i = 0; i <= bfqq->ioprio_class - 1; i++) {
 				wsum = wsum * IOPRIO_BE_NR +
 					sched_data->service_tree[i].wsum;
 			}
@@ -666,7 +674,9 @@ out:
 	return ret;
 }
 #else
-static bool bfqq_request_over_limit(struct bfq_queue *bfqq, int limit)
+static bool bfqq_request_over_limit(struct bfq_data *bfqd,
+				    struct bfq_io_cq *bic, blk_opf_t opf,
+				    unsigned int act_idx, int limit)
 {
 	return false;
 }
@@ -704,8 +714,9 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
 	}

 	for (act_idx = 0; bic && act_idx < bfqd->num_actuators; act_idx++) {
-		struct bfq_queue *bfqq =
-			bic_to_bfqq(bic, op_is_sync(opf), act_idx);
+		/* Fast path to check if bfqq is already allocated. */
+		if (!bic_to_bfqq(bic, op_is_sync(opf), act_idx))
+			continue;

 		/*
 		 * Does queue (or any parent entity) exceed number of
@@ -713,7 +724,7 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
 		 * limit depth so that it cannot consume more
 		 * available requests and thus starve other entities.
 		 */
-		if (bfqq && bfqq_request_over_limit(bfqq, limit)) {
+		if (bfqq_request_over_limit(bfqd, bic, opf, act_idx, limit)) {
 			depth = 1;
 			break;
 		}
@@ -5434,8 +5445,6 @@ void bfq_put_cooperator(struct bfq_queue *bfqq)
 		bfq_put_queue(__bfqq);
 		__bfqq = next;
 	}
-
-	bfq_release_process_ref(bfqq->bfqd, bfqq);
 }

 static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
@@ -5448,6 +5457,8 @@ static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
 	bfq_log_bfqq(bfqd, bfqq, "exit_bfqq: %p, %d", bfqq, bfqq->ref);

 	bfq_put_cooperator(bfqq);
+
+	bfq_release_process_ref(bfqd, bfqq);
 }

 static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync,
@@ -6734,6 +6745,8 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
 	bic_set_bfqq(bic, NULL, true, bfqq->actuator_idx);

 	bfq_put_cooperator(bfqq);
+
+	bfq_release_process_ref(bfqq->bfqd, bfqq);
 	return NULL;
 }

@@ -261,6 +261,8 @@ static void blk_free_queue(struct request_queue *q)
 		blk_mq_release(q);

 	ida_free(&blk_queue_ida, q->id);
+	lockdep_unregister_key(&q->io_lock_cls_key);
+	lockdep_unregister_key(&q->q_lock_cls_key);
 	call_rcu(&q->rcu_head, blk_free_queue_rcu);
 }

@@ -278,18 +280,20 @@ void blk_put_queue(struct request_queue *q)
 }
 EXPORT_SYMBOL(blk_put_queue);

-void blk_queue_start_drain(struct request_queue *q)
+bool blk_queue_start_drain(struct request_queue *q)
 {
 	/*
 	 * When queue DYING flag is set, we need to block new req
 	 * entering queue, so we call blk_freeze_queue_start() to
 	 * prevent I/O from crossing blk_queue_enter().
 	 */
-	blk_freeze_queue_start(q);
+	bool freeze = __blk_freeze_queue_start(q, current);
 	if (queue_is_mq(q))
 		blk_mq_wake_waiters(q);
 	/* Make blk_queue_enter() reexamine the DYING flag. */
 	wake_up_all(&q->mq_freeze_wq);
+
+	return freeze;
 }

 /**
@@ -321,6 +325,8 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 			return -ENODEV;
 	}

+	rwsem_acquire_read(&q->q_lockdep_map, 0, 0, _RET_IP_);
+	rwsem_release(&q->q_lockdep_map, _RET_IP_);
 	return 0;
 }

@@ -352,6 +358,8 @@ int __bio_queue_enter(struct request_queue *q, struct bio *bio)
 			goto dead;
 	}

+	rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
+	rwsem_release(&q->io_lockdep_map, _RET_IP_);
 	return 0;
 dead:
 	bio_io_error(bio);
@@ -441,6 +449,12 @@ struct request_queue *blk_alloc_queue(struct queue_limits *lim, int node_id)
 				PERCPU_REF_INIT_ATOMIC, GFP_KERNEL);
 	if (error)
 		goto fail_stats;
+	lockdep_register_key(&q->io_lock_cls_key);
+	lockdep_register_key(&q->q_lock_cls_key);
+	lockdep_init_map(&q->io_lockdep_map, "&q->q_usage_counter(io)",
+			 &q->io_lock_cls_key, 0);
+	lockdep_init_map(&q->q_lockdep_map, "&q->q_usage_counter(queue)",
+			 &q->q_lock_cls_key, 0);

 	q->nr_requests = BLKDEV_DEFAULT_RQ;

@@ -120,9 +120,59 @@ void blk_mq_in_flight_rw(struct request_queue *q, struct block_device *part,
 	inflight[1] = mi.inflight[1];
 }

-void blk_freeze_queue_start(struct request_queue *q)
+#ifdef CONFIG_LOCKDEP
+static bool blk_freeze_set_owner(struct request_queue *q,
+				 struct task_struct *owner)
 {
+	if (!owner)
+		return false;
+
+	if (!q->mq_freeze_depth) {
+		q->mq_freeze_owner = owner;
+		q->mq_freeze_owner_depth = 1;
+		return true;
+	}
+
+	if (owner == q->mq_freeze_owner)
+		q->mq_freeze_owner_depth += 1;
+	return false;
+}
+
+/* verify the last unfreeze in owner context */
+static bool blk_unfreeze_check_owner(struct request_queue *q)
+{
+	if (!q->mq_freeze_owner)
+		return false;
+	if (q->mq_freeze_owner != current)
+		return false;
+	if (--q->mq_freeze_owner_depth == 0) {
+		q->mq_freeze_owner = NULL;
+		return true;
+	}
+	return false;
+}
+
+#else
+
+static bool blk_freeze_set_owner(struct request_queue *q,
+				 struct task_struct *owner)
+{
+	return false;
+}
+
+static bool blk_unfreeze_check_owner(struct request_queue *q)
+{
+	return false;
+}
+#endif
+
+bool __blk_freeze_queue_start(struct request_queue *q,
+			      struct task_struct *owner)
+{
+	bool freeze;
+
 	mutex_lock(&q->mq_freeze_lock);
+	freeze = blk_freeze_set_owner(q, owner);
 	if (++q->mq_freeze_depth == 1) {
 		percpu_ref_kill(&q->q_usage_counter);
 		mutex_unlock(&q->mq_freeze_lock);
@@ -131,6 +181,14 @@ void blk_freeze_queue_start(struct request_queue *q)
 	} else {
 		mutex_unlock(&q->mq_freeze_lock);
 	}
+
+	return freeze;
+}
+
+void blk_freeze_queue_start(struct request_queue *q)
+{
+	if (__blk_freeze_queue_start(q, current))
+		blk_freeze_acquire_lock(q, false, false);
 }
 EXPORT_SYMBOL_GPL(blk_freeze_queue_start);

@@ -176,8 +234,10 @@ void blk_mq_freeze_queue(struct request_queue *q)
 }
 EXPORT_SYMBOL_GPL(blk_mq_freeze_queue);

-void __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
+bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 {
+	bool unfreeze;
+
 	mutex_lock(&q->mq_freeze_lock);
 	if (force_atomic)
 		q->q_usage_counter.data->force_atomic = true;
@@ -187,15 +247,39 @@ void __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 		percpu_ref_resurrect(&q->q_usage_counter);
 		wake_up_all(&q->mq_freeze_wq);
 	}
+	unfreeze = blk_unfreeze_check_owner(q);
 	mutex_unlock(&q->mq_freeze_lock);
+
+	return unfreeze;
 }

 void blk_mq_unfreeze_queue(struct request_queue *q)
 {
-	__blk_mq_unfreeze_queue(q, false);
+	if (__blk_mq_unfreeze_queue(q, false))
+		blk_unfreeze_release_lock(q, false, false);
 }
 EXPORT_SYMBOL_GPL(blk_mq_unfreeze_queue);

+/*
+ * non_owner variant of blk_freeze_queue_start
+ *
+ * Unlike blk_freeze_queue_start, the queue doesn't need to be unfrozen
+ * by the same task.  This is fragile and should not be used if at all
+ * possible.
+ */
+void blk_freeze_queue_start_non_owner(struct request_queue *q)
+{
+	__blk_freeze_queue_start(q, NULL);
+}
+EXPORT_SYMBOL_GPL(blk_freeze_queue_start_non_owner);
+
+/* non_owner variant of blk_mq_unfreeze_queue */
+void blk_mq_unfreeze_queue_non_owner(struct request_queue *q)
+{
+	__blk_mq_unfreeze_queue(q, false);
+}
+EXPORT_SYMBOL_GPL(blk_mq_unfreeze_queue_non_owner);
+
 /*
 * FIXME: replace the scsi_internal_device_*block_nowait() calls in the
 * mpt3sas driver such that this function can be removed.
@@ -283,8 +367,9 @@ void blk_mq_quiesce_tagset(struct blk_mq_tag_set *set)
 		if (!blk_queue_skip_tagset_quiesce(q))
 			blk_mq_quiesce_queue_nowait(q);
 	}
-	blk_mq_wait_quiesce_done(set);
 	mutex_unlock(&set->tag_list_lock);
+
+	blk_mq_wait_quiesce_done(set);
 }
 EXPORT_SYMBOL_GPL(blk_mq_quiesce_tagset);

@@ -2200,6 +2285,24 @@ void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs)
 }
 EXPORT_SYMBOL(blk_mq_delay_run_hw_queue);

+static inline bool blk_mq_hw_queue_need_run(struct blk_mq_hw_ctx *hctx)
+{
+	bool need_run;
+
+	/*
+	 * When queue is quiesced, we may be switching io scheduler, or
+	 * updating nr_hw_queues, or other things, and we can't run queue
+	 * any more, even blk_mq_hctx_has_pending() can't be called safely.
+	 *
+	 * And queue will be rerun in blk_mq_unquiesce_queue() if it is
+	 * quiesced.
+	 */
+	__blk_mq_run_dispatch_ops(hctx->queue, false,
+		need_run = !blk_queue_quiesced(hctx->queue) &&
+		blk_mq_hctx_has_pending(hctx));
+	return need_run;
+}
+
 /**
 * blk_mq_run_hw_queue - Start to run a hardware queue.
 * @hctx: Pointer to the hardware queue to run.
@@ -2220,20 +2323,23 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)

 	might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING);

-	/*
-	 * When queue is quiesced, we may be switching io scheduler, or
-	 * updating nr_hw_queues, or other things, and we can't run queue
-	 * any more, even __blk_mq_hctx_has_pending() can't be called safely.
-	 *
-	 * And queue will be rerun in blk_mq_unquiesce_queue() if it is
-	 * quiesced.
-	 */
-	__blk_mq_run_dispatch_ops(hctx->queue, false,
-		need_run = !blk_queue_quiesced(hctx->queue) &&
-		blk_mq_hctx_has_pending(hctx));
+	need_run = blk_mq_hw_queue_need_run(hctx);
+	if (!need_run) {
+		unsigned long flags;

-	if (!need_run)
-		return;
+		/*
+		 * Synchronize with blk_mq_unquiesce_queue(), because we check
+		 * if hw queue is quiesced locklessly above, we need the use
+		 * ->queue_lock to make sure we see the up-to-date status to
+		 * not miss rerunning the hw queue.
+		 */
+		spin_lock_irqsave(&hctx->queue->queue_lock, flags);
+		need_run = blk_mq_hw_queue_need_run(hctx);
+		spin_unlock_irqrestore(&hctx->queue->queue_lock, flags);
+
+		if (!need_run)
+			return;
+	}

 	if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) {
 		blk_mq_delay_run_hw_queue(hctx, 0);
@@ -2390,6 +2496,12 @@ void blk_mq_start_stopped_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
 		return;

 	clear_bit(BLK_MQ_S_STOPPED, &hctx->state);
+	/*
+	 * Pairs with the smp_mb() in blk_mq_hctx_stopped() to order the
+	 * clearing of BLK_MQ_S_STOPPED above and the checking of dispatch
+	 * list in the subsequent routine.
+	 */
+	smp_mb__after_atomic();
 	blk_mq_run_hw_queue(hctx, async);
 }
 EXPORT_SYMBOL_GPL(blk_mq_start_stopped_hw_queue);
@@ -2620,6 +2732,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,

 	if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) {
 		blk_mq_insert_request(rq, 0);
+		blk_mq_run_hw_queue(hctx, false);
 		return;
 	}

@@ -2650,6 +2763,7 @@ static blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last)

 	if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) {
 		blk_mq_insert_request(rq, 0);
+		blk_mq_run_hw_queue(hctx, false);
 		return BLK_STS_OK;
 	}

@@ -230,6 +230,19 @@ static inline struct blk_mq_tags *blk_mq_tags_from_data(struct blk_mq_alloc_data

 static inline bool blk_mq_hctx_stopped(struct blk_mq_hw_ctx *hctx)
 {
+	/* Fast path: hardware queue is not stopped most of the time. */
+	if (likely(!test_bit(BLK_MQ_S_STOPPED, &hctx->state)))
+		return false;
+
+	/*
+	 * This barrier is used to order adding of dispatch list before and
+	 * the test of BLK_MQ_S_STOPPED below. Pairs with the memory barrier
+	 * in blk_mq_start_stopped_hw_queue() so that dispatch code could
+	 * either see BLK_MQ_S_STOPPED is cleared or dispatch list is not
+	 * empty to avoid missing dispatching requests.
+	 */
+	smp_mb();
+
 	return test_bit(BLK_MQ_S_STOPPED, &hctx->state);
 }

@@ -249,6 +249,13 @@ static int blk_validate_limits(struct queue_limits *lim)
 	if (lim->io_min < lim->physical_block_size)
 		lim->io_min = lim->physical_block_size;

+	/*
+	 * The optimal I/O size may not be aligned to physical block size
+	 * (because it may be limited by dma engines which have no clue about
+	 * block size of the disks attached to them), so we round it down here.
+	 */
+	lim->io_opt = round_down(lim->io_opt, lim->physical_block_size);
+
 	/*
 	 * max_hw_sectors has a somewhat weird default for historical reason,
 	 * but driver really should set their own instead of relying on this
@@ -794,10 +794,8 @@ int blk_register_queue(struct gendisk *disk)
 	 * faster to shut down and is made fully functional here as
 	 * request_queues for non-existent devices never get registered.
 	 */
-	if (!blk_queue_init_done(q)) {
-		blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
-		percpu_ref_switch_to_percpu(&q->q_usage_counter);
-	}
+	blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
+	percpu_ref_switch_to_percpu(&q->q_usage_counter);

 	return ret;

@@ -1541,6 +1541,7 @@ static int disk_update_zone_resources(struct gendisk *disk,
 	unsigned int nr_seq_zones, nr_conv_zones = 0;
 	unsigned int pool_size;
 	struct queue_limits lim;
+	int ret;

 	disk->nr_zones = args->nr_zones;
 	disk->zone_capacity = args->zone_capacity;
@@ -1593,7 +1594,11 @@ static int disk_update_zone_resources(struct gendisk *disk,
 	}

 commit:
-	return queue_limits_commit_update(q, &lim);
+	blk_mq_freeze_queue(q);
+	ret = queue_limits_commit_update(q, &lim);
+	blk_mq_unfreeze_queue(q);
+
+	return ret;
 }

 static int blk_revalidate_conv_zone(struct blk_zone *zone, unsigned int idx,
@@ -1814,14 +1819,15 @@ int blk_revalidate_disk_zones(struct gendisk *disk)
 	 * Set the new disk zone parameters only once the queue is frozen and
 	 * all I/Os are completed.
 	 */
-	blk_mq_freeze_queue(q);
 	if (ret > 0)
 		ret = disk_update_zone_resources(disk, &args);
 	else
 		pr_warn("%s: failed to revalidate zones\n", disk->disk_name);
-	if (ret)
+	if (ret) {
+		blk_mq_freeze_queue(q);
 		disk_free_zone_resources(disk);
-	blk_mq_unfreeze_queue(q);
+		blk_mq_unfreeze_queue(q);
+	}

 	kfree(args.conv_zones_bitmap);

@@ -4,6 +4,7 @@

 #include <linux/bio-integrity.h>
 #include <linux/blk-crypto.h>
+#include <linux/lockdep.h>
 #include <linux/memblock.h>	/* for max_pfn/max_low_pfn */
 #include <linux/sched/sysctl.h>
 #include <linux/timekeeping.h>
@@ -35,8 +36,10 @@ struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
 void blk_free_flush_queue(struct blk_flush_queue *q);

 void blk_freeze_queue(struct request_queue *q);
-void __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic);
-void blk_queue_start_drain(struct request_queue *q);
+bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic);
+bool blk_queue_start_drain(struct request_queue *q);
+bool __blk_freeze_queue_start(struct request_queue *q,
+			      struct task_struct *owner);
 int __bio_queue_enter(struct request_queue *q, struct bio *bio);
 void submit_bio_noacct_nocheck(struct bio *bio);
 void bio_await_chain(struct bio *bio);
@@ -69,8 +72,11 @@ static inline int bio_queue_enter(struct bio *bio)
 {
 	struct request_queue *q = bdev_get_queue(bio->bi_bdev);

-	if (blk_try_enter_queue(q, false))
+	if (blk_try_enter_queue(q, false)) {
+		rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
+		rwsem_release(&q->io_lockdep_map, _RET_IP_);
 		return 0;
+	}
 	return __bio_queue_enter(q, bio);
 }

@@ -734,4 +740,22 @@ void blk_integrity_verify(struct bio *bio);
 void blk_integrity_prepare(struct request *rq);
 void blk_integrity_complete(struct request *rq, unsigned int nr_bytes);

+static inline void blk_freeze_acquire_lock(struct request_queue *q, bool
+		disk_dead, bool queue_dying)
+{
+	if (!disk_dead)
+		rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
+	if (!queue_dying)
+		rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
+}
+
+static inline void blk_unfreeze_release_lock(struct request_queue *q, bool
+		disk_dead, bool queue_dying)
+{
+	if (!queue_dying)
+		rwsem_release(&q->q_lockdep_map, _RET_IP_);
+	if (!disk_dead)
+		rwsem_release(&q->io_lockdep_map, _RET_IP_);
+}
+
 #endif /* BLK_INTERNAL_H */
@@ -598,13 +598,19 @@ void elevator_init_mq(struct request_queue *q)
 	 * drain any dispatch activities originated from passthrough
 	 * requests, then no need to quiesce queue which may add long boot
 	 * latency, especially when lots of disks are involved.
+	 *
+	 * Disk isn't added yet, so verifying queue lock only manually.
 	 */
-	blk_mq_freeze_queue(q);
+	blk_freeze_queue_start_non_owner(q);
+	blk_freeze_acquire_lock(q, true, false);
+	blk_mq_freeze_queue_wait(q);
+
 	blk_mq_cancel_work_sync(q);

 	err = blk_mq_init_sched(q, e);

-	blk_mq_unfreeze_queue(q);
+	blk_unfreeze_release_lock(q, true, false);
+	blk_mq_unfreeze_queue_non_owner(q);

 	if (err) {
 		pr_warn("\"%s\" elevator initialization failed, "
@@ -677,6 +677,7 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	struct file *file = iocb->ki_filp;
 	struct inode *bd_inode = bdev_file_inode(file);
 	struct block_device *bdev = I_BDEV(bd_inode);
+	bool atomic = iocb->ki_flags & IOCB_ATOMIC;
 	loff_t size = bdev_nr_bytes(bdev);
 	size_t shorted = 0;
 	ssize_t ret;
@@ -696,7 +697,7 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	if ((iocb->ki_flags & (IOCB_NOWAIT | IOCB_DIRECT)) == IOCB_NOWAIT)
 		return -EOPNOTSUPP;

-	if (iocb->ki_flags & IOCB_ATOMIC) {
+	if (atomic) {
 		ret = generic_atomic_write_valid(iocb, from);
 		if (ret)
 			return ret;
@@ -704,6 +705,8 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)

 	size -= iocb->ki_pos;
 	if (iov_iter_count(from) > size) {
+		if (atomic)
+			return -EINVAL;
 		shorted = iov_iter_count(from) - size;
 		iov_iter_truncate(from, size);
 	}
@@ -581,13 +581,13 @@ static void blk_report_disk_dead(struct gendisk *disk, bool surprise)
 	rcu_read_unlock();
 }

-static void __blk_mark_disk_dead(struct gendisk *disk)
+static bool __blk_mark_disk_dead(struct gendisk *disk)
 {
 	/*
 	 * Fail any new I/O.
 	 */
 	if (test_and_set_bit(GD_DEAD, &disk->state))
-		return;
+		return false;

 	if (test_bit(GD_OWNS_QUEUE, &disk->state))
 		blk_queue_flag_set(QUEUE_FLAG_DYING, disk->queue);
@@ -600,7 +600,7 @@ static void __blk_mark_disk_dead(struct gendisk *disk)
 	/*
 	 * Prevent new I/O from crossing bio_queue_enter().
 	 */
-	blk_queue_start_drain(disk->queue);
+	return blk_queue_start_drain(disk->queue);
 }

 /**
@@ -641,6 +641,7 @@ void del_gendisk(struct gendisk *disk)
 	struct request_queue *q = disk->queue;
 	struct block_device *part;
 	unsigned long idx;
+	bool start_drain, queue_dying;

 	might_sleep();

@@ -668,7 +669,10 @@ void del_gendisk(struct gendisk *disk)
 	 * Drop all partitions now that the disk is marked dead.
 	 */
 	mutex_lock(&disk->open_mutex);
-	__blk_mark_disk_dead(disk);
+	start_drain = __blk_mark_disk_dead(disk);
+	queue_dying = blk_queue_dying(q);
+	if (start_drain)
+		blk_freeze_acquire_lock(q, true, queue_dying);
 	xa_for_each_start(&disk->part_tbl, idx, part, 1)
 		drop_partition(part);
 	mutex_unlock(&disk->open_mutex);
@@ -718,13 +722,13 @@ void del_gendisk(struct gendisk *disk)
 	 * If the disk does not own the queue, allow using passthrough requests
 	 * again.  Else leave the queue frozen to fail all I/O.
 	 */
-	if (!test_bit(GD_OWNS_QUEUE, &disk->state)) {
-		blk_queue_flag_clear(QUEUE_FLAG_INIT_DONE, q);
+	if (!test_bit(GD_OWNS_QUEUE, &disk->state))
 		__blk_mq_unfreeze_queue(q, true);
-	} else {
-		if (queue_is_mq(q))
-			blk_mq_exit_queue(q);
-	}
+	else if (queue_is_mq(q))
+		blk_mq_exit_queue(q);
+
+	if (start_drain)
+		blk_unfreeze_release_lock(q, true, queue_dying);
 }
 EXPORT_SYMBOL(del_gendisk);

@@ -231,8 +231,10 @@ static void brd_do_discard(struct brd_device *brd, sector_t sector, u32 size)
 	xa_lock(&brd->brd_pages);
 	while (size >= PAGE_SIZE && aligned_sector < rd_size * 2) {
 		page = __xa_erase(&brd->brd_pages, aligned_sector >> PAGE_SECTORS_SHIFT);
-		if (page)
+		if (page) {
 			__free_page(page);
+			brd->brd_nr_pages--;
+		}
 		aligned_sector += PAGE_SECTORS;
 		size -= PAGE_SIZE;
 	}
@@ -664,12 +664,21 @@ static inline char *ublk_queue_cmd_buf(struct ublk_device *ub, int q_id)
 	return ublk_get_queue(ub, q_id)->io_cmd_buf;
 }

+static inline int __ublk_queue_cmd_buf_size(int depth)
+{
+	return round_up(depth * sizeof(struct ublksrv_io_desc), PAGE_SIZE);
+}
+
 static inline int ublk_queue_cmd_buf_size(struct ublk_device *ub, int q_id)
 {
 	struct ublk_queue *ubq = ublk_get_queue(ub, q_id);

-	return round_up(ubq->q_depth * sizeof(struct ublksrv_io_desc),
-			PAGE_SIZE);
+	return __ublk_queue_cmd_buf_size(ubq->q_depth);
+}
+
+static int ublk_max_cmd_buf_size(void)
+{
+	return __ublk_queue_cmd_buf_size(UBLK_MAX_QUEUE_DEPTH);
 }

 static inline bool ublk_queue_can_use_recovery_reissue(
@@ -1322,7 +1331,7 @@ static int ublk_ch_mmap(struct file *filp, struct vm_area_struct *vma)
 {
 	struct ublk_device *ub = filp->private_data;
 	size_t sz = vma->vm_end - vma->vm_start;
-	unsigned max_sz = UBLK_MAX_QUEUE_DEPTH * sizeof(struct ublksrv_io_desc);
+	unsigned max_sz = ublk_max_cmd_buf_size();
 	unsigned long pfn, end, phys_off = vma->vm_pgoff << PAGE_SHIFT;
 	int q_id, ret = 0;

@@ -2965,7 +2974,7 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
 		ret = ublk_ctrl_end_recovery(ub, cmd);
 		break;
 	default:
-		ret = -ENOTSUPP;
+		ret = -EOPNOTSUPP;
 		break;
 	}

@@ -29,8 +29,10 @@ enum loongson2_clk_type {
 struct loongson2_clk_provider {
 	void __iomem *base;
 	struct device *dev;
-	struct clk_hw_onecell_data clk_data;
 	spinlock_t clk_lock;	/* protect access to DIV registers */
+
+	/* Must be last --ends in a flexible-array member. */
+	struct clk_hw_onecell_data clk_data;
 };

 struct loongson2_clk_data {
@@ -304,7 +306,7 @@ static int loongson2_clk_probe(struct platform_device *pdev)
 		return PTR_ERR(clp->base);

 	spin_lock_init(&clp->clk_lock);
-	clp->clk_data.num = clks_num + 1;
+	clp->clk_data.num = clks_num;
 	clp->dev = dev;

 	for (i = 0; i < clks_num; i++) {
@@ -2407,6 +2407,18 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)

 			start += PAGE_SIZE;
 		}
+
+#ifdef CONFIG_MMU
+		/*
+		 * Leaving behind a partial mapping of a buffer we're about to
+		 * drop is unsafe, see remap_pfn_range_notrack().
+		 * We need to zap the range here ourselves instead of relying
+		 * on the automatic zapping in remap_pfn_range() because we call
+		 * remap_pfn_range() in a loop.
+		 */
+		if (retval)
+			zap_vma_ptes(vma, vma->vm_start, size);
+#endif
 	}

 	if (retval == 0) {
@@ -700,6 +700,7 @@ static int stm32_timer_cnt_probe_encoder(struct device *dev,
 	}

 	ret = of_property_read_u32(tnode, "reg", &idx);
+	of_node_put(tnode);
 	if (ret) {
 		dev_err(dev, "Can't get index (%d)\n", ret);
 		return ret;
@@ -62,7 +62,7 @@ mtk_cpufreq_get_cpu_power(struct device *cpu_dev, unsigned long *uW,

 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
 	if (!policy)
-		return 0;
+		return -EINVAL;

 	data = policy->driver_data;

@@ -99,11 +99,13 @@ static void exar_set_value(struct gpio_chip *chip, unsigned int offset,
 	struct exar_gpio_chip *exar_gpio = gpiochip_get_data(chip);
 	unsigned int addr = exar_offset_to_lvl_addr(exar_gpio, offset);
 	unsigned int bit = exar_offset_to_bit(exar_gpio, offset);
+	unsigned int bit_value = value ? BIT(bit) : 0;

-	if (value)
-		regmap_set_bits(exar_gpio->regmap, addr, BIT(bit));
-	else
-		regmap_clear_bits(exar_gpio->regmap, addr, BIT(bit));
+	/*
+	 * regmap_write_bits() forces value to be written when an external
+	 * pull up/down might otherwise indicate value was already set.
+	 */
+	regmap_write_bits(exar_gpio->regmap, addr, BIT(bit), bit_value);
 }

 static int exar_direction_output(struct gpio_chip *chip, unsigned int offset,
@@ -1353,9 +1353,9 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
 					rotation -= 1800;

 				input_report_abs(pen_input, ABS_TILT_X,
-						 (char)frame[7]);
+						 (signed char)frame[7]);
 				input_report_abs(pen_input, ABS_TILT_Y,
-						 (char)frame[8]);
+						 (signed char)frame[8]);
 				input_report_abs(pen_input, ABS_Z, rotation);
 				input_report_abs(pen_input, ABS_WHEEL,
 						 get_unaligned_le16(&frame[11]));
@@ -46,7 +46,7 @@
 #define AXI_DAC_REG_CNTRL_1		0x0044
 #define   AXI_DAC_SYNC			BIT(0)
 #define AXI_DAC_REG_CNTRL_2		0x0048
-#define	  ADI_DAC_R1_MODE		BIT(4)
+#define	  ADI_DAC_R1_MODE		BIT(5)
 #define AXI_DAC_DRP_STATUS		0x0074
 #define   AXI_DAC_DRP_LOCKED		BIT(17)
 /* DAC Channel controls */
@@ -167,7 +167,7 @@ static int iio_gts_gain_cmp(const void *a, const void *b)

 static int gain_to_scaletables(struct iio_gts *gts, int **gains, int **scales)
 {
-	int ret, i, j, new_idx, time_idx;
+	int i, j, new_idx, time_idx, ret = 0;
 	int *all_gains;
 	size_t gain_bytes;

@@ -334,11 +334,12 @@ static int cs40l50_add(struct input_dev *dev, struct ff_effect *effect,
 	work_data.custom_len = effect->u.periodic.custom_len;
 	work_data.vib = vib;
 	work_data.effect = effect;
-	INIT_WORK(&work_data.work, cs40l50_add_worker);
+	INIT_WORK_ONSTACK(&work_data.work, cs40l50_add_worker);

 	/* Push to the workqueue to serialize with playbacks */
 	queue_work(vib->vib_wq, &work_data.work);
 	flush_work(&work_data.work);
+	destroy_work_on_stack(&work_data.work);

 	kfree(work_data.custom_data);

@@ -467,11 +468,12 @@ static int cs40l50_erase(struct input_dev *dev, int effect_id)
 	work_data.vib = vib;
 	work_data.effect = &dev->ff->effects[effect_id];

-	INIT_WORK(&work_data.work, cs40l50_erase_worker);
+	INIT_WORK_ONSTACK(&work_data.work, cs40l50_erase_worker);

 	/* Push to workqueue to serialize with playbacks */
 	queue_work(vib->vib_wq, &work_data.work);
 	flush_work(&work_data.work);
+	destroy_work_on_stack(&work_data.work);

 	return work_data.error;
 }
@@ -192,7 +192,6 @@ static void mvebu_sei_domain_free(struct irq_domain *domain, unsigned int virq,
 }

 static const struct irq_domain_ops mvebu_sei_domain_ops = {
-	.select	= msi_lib_irq_domain_select,
 	.alloc	= mvebu_sei_domain_alloc,
 	.free	= mvebu_sei_domain_free,
 };
@@ -306,6 +305,7 @@ static void mvebu_sei_cp_domain_free(struct irq_domain *domain,
 }

 static const struct irq_domain_ops mvebu_sei_cp_domain_ops = {
+	.select	= msi_lib_irq_domain_select,
 	.alloc	= mvebu_sei_cp_domain_alloc,
 	.free	= mvebu_sei_cp_domain_free,
 };
@@ -15,6 +15,7 @@
 #include <linux/slab.h>
 #include <linux/kfifo.h>
 #include <linux/err.h>
+#include <linux/io.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
@@ -1405,12 +1405,13 @@ static int stdi2dv_timings(struct v4l2_subdev *sd,
 	if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0,
 			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
 			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, timings))
+			false, adv76xx_get_dv_timings_cap(sd, -1), timings))
 		return 0;
 	if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs,
 			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
 			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, state->aspect_ratio, timings))
+			false, state->aspect_ratio,
+			adv76xx_get_dv_timings_cap(sd, -1), timings))
 		return 0;

 	v4l2_dbg(2, debug, sd,
@@ -1431,14 +1431,15 @@ static int stdi2dv_timings(struct v4l2_subdev *sd,
 	}

 	if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0,
-			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
-			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, timings))
+			    (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
+			    (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
+			    false, adv7842_get_dv_timings_cap(sd), timings))
 		return 0;
 	if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs,
-			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
-			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, state->aspect_ratio, timings))
+			    (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
+			    (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
+			    false, state->aspect_ratio,
+			    adv7842_get_dv_timings_cap(sd), timings))
 		return 0;

 	v4l2_dbg(2, debug, sd,
@@ -346,12 +346,16 @@ irqreturn_t ipu6_buttress_isr(int irq, void *isp_ptr)
 	u32 disable_irqs = 0;
 	u32 irq_status;
 	u32 i, count = 0;
+	int active;

-	pm_runtime_get_noresume(&isp->pdev->dev);
+	active = pm_runtime_get_if_active(&isp->pdev->dev);
+	if (!active)
+		return IRQ_NONE;

 	irq_status = readl(isp->base + reg_irq_sts);
-	if (!irq_status) {
-		pm_runtime_put_noidle(&isp->pdev->dev);
+	if (irq_status == 0 || WARN_ON_ONCE(irq_status == 0xffffffffu)) {
+		if (active > 0)
+			pm_runtime_put_noidle(&isp->pdev->dev);
 		return IRQ_NONE;
 	}

@@ -427,7 +431,8 @@ irqreturn_t ipu6_buttress_isr(int irq, void *isp_ptr)
 		writel(BUTTRESS_IRQS & ~disable_irqs,
 		       isp->base + BUTTRESS_REG_ISR_ENABLE);

-	pm_runtime_put(&isp->pdev->dev);
+	if (active > 0)
+		pm_runtime_put(&isp->pdev->dev);

 	return ret;
 }
@@ -752,6 +752,9 @@ static void ipu6_pci_reset_done(struct pci_dev *pdev)
 */
 static int ipu6_suspend(struct device *dev)
 {
+	struct pci_dev *pdev = to_pci_dev(dev);
+
+	synchronize_irq(pdev->irq);
 	return 0;
 }

@@ -466,11 +466,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload,
 			   jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000);
 		return -ETIMEDOUT;
 	}
+	spin_lock_irqsave(&fmdev->resp_skb_lock, flags);
 	if (!fmdev->resp_skb) {
+		spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags);
 		fmerr("Response SKB is missing\n");
 		return -EFAULT;
 	}
-	spin_lock_irqsave(&fmdev->resp_skb_lock, flags);
 	skb = fmdev->resp_skb;
 	fmdev->resp_skb = NULL;
 	spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags);
@@ -1459,12 +1459,19 @@ static bool valid_cvt_gtf_timings(struct v4l2_dv_timings *timings)
 	h_freq = (u32)bt->pixelclock / total_h_pixel;

 	if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_CVT)) {
+		struct v4l2_dv_timings cvt = {};
+
 		if (v4l2_detect_cvt(total_v_lines, h_freq, bt->vsync, bt->width,
-				    bt->polarities, bt->interlaced, timings))
+				    bt->polarities, bt->interlaced,
+				    &vivid_dv_timings_cap, &cvt) &&
+		    cvt.bt.width == bt->width && cvt.bt.height == bt->height) {
+			*timings = cvt;
 			return true;
+		}
 	}

 	if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_GTF)) {
+		struct v4l2_dv_timings gtf = {};
 		struct v4l2_fract aspect_ratio;

 		find_aspect_ratio(bt->width, bt->height,
@@ -1472,8 +1479,12 @@ static bool valid_cvt_gtf_timings(struct v4l2_dv_timings *timings)
 				  &aspect_ratio.denominator);
 		if (v4l2_detect_gtf(total_v_lines, h_freq, bt->vsync,
 				    bt->polarities, bt->interlaced,
-				    aspect_ratio, timings))
+				    aspect_ratio, &vivid_dv_timings_cap,
+				    &gtf) &&
+		    gtf.bt.width == bt->width && gtf.bt.height == bt->height) {
+			*timings = gtf;
 			return true;
+		}
 	}
 	return false;
 }
@@ -481,25 +481,28 @@ EXPORT_SYMBOL_GPL(v4l2_calc_timeperframe);
 * @polarities - the horizontal and vertical polarities (same as struct
 *		v4l2_bt_timings polarities).
 * @interlaced - if this flag is true, it indicates interlaced format
- * @fmt - the resulting timings.
+ * @cap - the v4l2_dv_timings_cap capabilities.
+ * @timings - the resulting timings.
 *
 * This function will attempt to detect if the given values correspond to a
 * valid CVT format. If so, then it will return true, and fmt will be filled
 * in with the found CVT timings.
 */
-bool v4l2_detect_cvt(unsigned frame_height,
-		     unsigned hfreq,
-		     unsigned vsync,
-		     unsigned active_width,
+bool v4l2_detect_cvt(unsigned int frame_height,
+		     unsigned int hfreq,
+		     unsigned int vsync,
+		     unsigned int active_width,
 		     u32 polarities,
 		     bool interlaced,
-		     struct v4l2_dv_timings *fmt)
+		     const struct v4l2_dv_timings_cap *cap,
+		     struct v4l2_dv_timings *timings)
 {
-	int  v_fp, v_bp, h_fp, h_bp, hsync;
-	int  frame_width, image_height, image_width;
+	struct v4l2_dv_timings t = {};
+	int v_fp, v_bp, h_fp, h_bp, hsync;
+	int frame_width, image_height, image_width;
 	bool reduced_blanking;
 	bool rb_v2 = false;
-	unsigned pix_clk;
+	unsigned int pix_clk;

 	if (vsync < 4 || vsync > 8)
 		return false;
@@ -625,36 +628,39 @@ bool v4l2_detect_cvt(unsigned frame_height,
 		h_fp = h_blank - hsync - h_bp;
 	}

-	fmt->type = V4L2_DV_BT_656_1120;
-	fmt->bt.polarities = polarities;
-	fmt->bt.width = image_width;
-	fmt->bt.height = image_height;
-	fmt->bt.hfrontporch = h_fp;
-	fmt->bt.vfrontporch = v_fp;
-	fmt->bt.hsync = hsync;
-	fmt->bt.vsync = vsync;
-	fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync;
+	t.type = V4L2_DV_BT_656_1120;
+	t.bt.polarities = polarities;
+	t.bt.width = image_width;
+	t.bt.height = image_height;
+	t.bt.hfrontporch = h_fp;
+	t.bt.vfrontporch = v_fp;
+	t.bt.hsync = hsync;
+	t.bt.vsync = vsync;
+	t.bt.hbackporch = frame_width - image_width - h_fp - hsync;

 	if (!interlaced) {
-		fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync;
-		fmt->bt.interlaced = V4L2_DV_PROGRESSIVE;
+		t.bt.vbackporch = frame_height - image_height - v_fp - vsync;
+		t.bt.interlaced = V4L2_DV_PROGRESSIVE;
 	} else {
-		fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp -
+		t.bt.vbackporch = (frame_height - image_height - 2 * v_fp -
 				      2 * vsync) / 2;
-		fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
-					2 * vsync - fmt->bt.vbackporch;
-		fmt->bt.il_vfrontporch = v_fp;
-		fmt->bt.il_vsync = vsync;
-		fmt->bt.flags |= V4L2_DV_FL_HALF_LINE;
-		fmt->bt.interlaced = V4L2_DV_INTERLACED;
+		t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
+					2 * vsync - t.bt.vbackporch;
+		t.bt.il_vfrontporch = v_fp;
+		t.bt.il_vsync = vsync;
+		t.bt.flags |= V4L2_DV_FL_HALF_LINE;
+		t.bt.interlaced = V4L2_DV_INTERLACED;
 	}

-	fmt->bt.pixelclock = pix_clk;
-	fmt->bt.standards = V4L2_DV_BT_STD_CVT;
+	t.bt.pixelclock = pix_clk;
+	t.bt.standards = V4L2_DV_BT_STD_CVT;

 	if (reduced_blanking)
-		fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;
+		t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;

+	if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL))
+		return false;
+	*timings = t;
 	return true;
 }
 EXPORT_SYMBOL_GPL(v4l2_detect_cvt);
@@ -699,22 +705,25 @@ EXPORT_SYMBOL_GPL(v4l2_detect_cvt);
 *		image height, so it has to be passed explicitly. Usually
 *		the native screen aspect ratio is used for this. If it
 *		is not filled in correctly, then 16:9 will be assumed.
- * @fmt - the resulting timings.
+ * @cap - the v4l2_dv_timings_cap capabilities.
+ * @timings - the resulting timings.
 *
 * This function will attempt to detect if the given values correspond to a
 * valid GTF format. If so, then it will return true, and fmt will be filled
 * in with the found GTF timings.
 */
-bool v4l2_detect_gtf(unsigned frame_height,
-		unsigned hfreq,
-		unsigned vsync,
-		u32 polarities,
-		bool interlaced,
-		struct v4l2_fract aspect,
-		struct v4l2_dv_timings *fmt)
+bool v4l2_detect_gtf(unsigned int frame_height,
+		     unsigned int hfreq,
+		     unsigned int vsync,
+		     u32 polarities,
+		     bool interlaced,
+		     struct v4l2_fract aspect,
+		     const struct v4l2_dv_timings_cap *cap,
+		     struct v4l2_dv_timings *timings)
 {
+	struct v4l2_dv_timings t = {};
 	int pix_clk;
-	int  v_fp, v_bp, h_fp, hsync;
+	int v_fp, v_bp, h_fp, hsync;
 	int frame_width, image_height, image_width;
 	bool default_gtf;
 	int h_blank;
@@ -783,36 +792,39 @@ bool v4l2_detect_gtf(unsigned frame_height,

 	h_fp = h_blank / 2 - hsync;

-	fmt->type = V4L2_DV_BT_656_1120;
-	fmt->bt.polarities = polarities;
-	fmt->bt.width = image_width;
-	fmt->bt.height = image_height;
-	fmt->bt.hfrontporch = h_fp;
-	fmt->bt.vfrontporch = v_fp;
-	fmt->bt.hsync = hsync;
-	fmt->bt.vsync = vsync;
-	fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync;
+	t.type = V4L2_DV_BT_656_1120;
+	t.bt.polarities = polarities;
+	t.bt.width = image_width;
+	t.bt.height = image_height;
+	t.bt.hfrontporch = h_fp;
+	t.bt.vfrontporch = v_fp;
+	t.bt.hsync = hsync;
+	t.bt.vsync = vsync;
+	t.bt.hbackporch = frame_width - image_width - h_fp - hsync;

 	if (!interlaced) {
-		fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync;
-		fmt->bt.interlaced = V4L2_DV_PROGRESSIVE;
+		t.bt.vbackporch = frame_height - image_height - v_fp - vsync;
+		t.bt.interlaced = V4L2_DV_PROGRESSIVE;
 	} else {
-		fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp -
+		t.bt.vbackporch = (frame_height - image_height - 2 * v_fp -
 				      2 * vsync) / 2;
-		fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
-					2 * vsync - fmt->bt.vbackporch;
-		fmt->bt.il_vfrontporch = v_fp;
-		fmt->bt.il_vsync = vsync;
-		fmt->bt.flags |= V4L2_DV_FL_HALF_LINE;
-		fmt->bt.interlaced = V4L2_DV_INTERLACED;
+		t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
+					2 * vsync - t.bt.vbackporch;
+		t.bt.il_vfrontporch = v_fp;
+		t.bt.il_vsync = vsync;
+		t.bt.flags |= V4L2_DV_FL_HALF_LINE;
+		t.bt.interlaced = V4L2_DV_INTERLACED;
 	}

-	fmt->bt.pixelclock = pix_clk;
-	fmt->bt.standards = V4L2_DV_BT_STD_GTF;
+	t.bt.pixelclock = pix_clk;
+	t.bt.standards = V4L2_DV_BT_STD_GTF;

 	if (!default_gtf)
-		fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;
+		t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;

+	if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL))
+		return false;
+	*timings = t;
 	return true;
 }
 EXPORT_SYMBOL_GPL(v4l2_detect_gtf);
@@ -445,7 +445,7 @@ static void lkdtm_FAM_BOUNDS(void)

 	pr_err("FAIL: survived access of invalid flexible array member index!\n");

-	if (!__has_attribute(__counted_by__))
+	if (!IS_ENABLED(CONFIG_CC_HAS_COUNTED_BY))
 		pr_warn("This is expected since this %s was built with a compiler that does not support __counted_by\n",
 			lkdtm_kernel_info);
 	else if (IS_ENABLED(CONFIG_UBSAN_BOUNDS))
@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor,
 		op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto);

 	if (op->dummy.nbytes)
-		op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+		op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto);

 	if (op->data.nbytes)
 		op->data.buswidth = spi_nor_get_protocol_data_nbits(proto);
@@ -1447,7 +1447,7 @@ out_ech:
 	return err;
 }

-static struct ubi_attach_info *alloc_ai(void)
+static struct ubi_attach_info *alloc_ai(const char *slab_name)
 {
 	struct ubi_attach_info *ai;

@@ -1461,7 +1461,7 @@ static struct ubi_attach_info *alloc_ai(void)
 	INIT_LIST_HEAD(&ai->alien);
 	INIT_LIST_HEAD(&ai->fastmap);
 	ai->volumes = RB_ROOT;
-	ai->aeb_slab_cache = kmem_cache_create("ubi_aeb_slab_cache",
+	ai->aeb_slab_cache = kmem_cache_create(slab_name,
 					       sizeof(struct ubi_ainf_peb),
 					       0, 0, NULL);
 	if (!ai->aeb_slab_cache) {
@@ -1491,7 +1491,7 @@ static int scan_fast(struct ubi_device *ubi, struct ubi_attach_info **ai)

 	err = -ENOMEM;

-	scan_ai = alloc_ai();
+	scan_ai = alloc_ai("ubi_aeb_slab_cache_fastmap");
 	if (!scan_ai)
 		goto out;

@@ -1557,7 +1557,7 @@ int ubi_attach(struct ubi_device *ubi, int force_scan)
 	int err;
 	struct ubi_attach_info *ai;

-	ai = alloc_ai();
+	ai = alloc_ai("ubi_aeb_slab_cache");
 	if (!ai)
 		return -ENOMEM;

@@ -1575,7 +1575,7 @@ int ubi_attach(struct ubi_device *ubi, int force_scan)
 		if (err > 0 || mtd_is_eccerr(err)) {
 			if (err != UBI_NO_FASTMAP) {
 				destroy_ai(ai);
-				ai = alloc_ai();
+				ai = alloc_ai("ubi_aeb_slab_cache");
 				if (!ai)
 					return -ENOMEM;

@@ -1614,7 +1614,7 @@ int ubi_attach(struct ubi_device *ubi, int force_scan)
 	if (ubi->fm && ubi_dbg_chk_fastmap(ubi)) {
 		struct ubi_attach_info *scan_ai;

-		scan_ai = alloc_ai();
+		scan_ai = alloc_ai("ubi_aeb_slab_cache_dbg_chk_fastmap");
 		if (!scan_ai) {
 			err = -ENOMEM;
 			goto out_wl;
@@ -346,14 +346,27 @@ out:
 * WL sub-system.
 *
 * @ubi: UBI device description object
+ * @need_fill: whether to fill wear-leveling pool when no PEBs are found
 */
-static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi)
+static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi,
+					    bool need_fill)
 {
 	struct ubi_fm_pool *pool = &ubi->fm_wl_pool;
 	int pnum;

-	if (pool->used == pool->size)
+	if (pool->used == pool->size) {
+		if (need_fill && !ubi->fm_work_scheduled) {
+			/*
+			 * We cannot update the fastmap here because this
+			 * function is called in atomic context.
+			 * Let's fail here and refill/update it as soon as
+			 * possible.
+			 */
+			ubi->fm_work_scheduled = 1;
+			schedule_work(&ubi->fm_work);
+		}
 		return NULL;
+	}

 	pnum = pool->pebs[pool->used];
 	return ubi->lookuptbl[pnum];
@@ -375,7 +388,7 @@ static bool need_wear_leveling(struct ubi_device *ubi)
 	if (!ubi->used.rb_node)
 		return false;

-	e = next_peb_for_wl(ubi);
+	e = next_peb_for_wl(ubi, false);
 	if (!e) {
 		if (!ubi->free.rb_node)
 			return false;
@@ -143,8 +143,10 @@ static struct fwnode_handle *find_volume_fwnode(struct ubi_volume *vol)
 		    vol->vol_id != volid)
 			continue;

+		fwnode_handle_put(fw_vols);
 		return fw_vol;
 	}
+	fwnode_handle_put(fw_vols);

 	return NULL;
 }
@@ -683,7 +683,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
 	ubi_assert(!ubi->move_to_put);

 #ifdef CONFIG_MTD_UBI_FASTMAP
-	if (!next_peb_for_wl(ubi) ||
+	if (!next_peb_for_wl(ubi, true) ||
 #else
 	if (!ubi->free.rb_node ||
 #endif
@@ -846,7 +846,14 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
 			goto out_not_moved;
 		}
 		if (err == MOVE_RETRY) {
-			scrubbing = 1;
+			/*
+			 * For source PEB:
+			 * 1. The scrubbing is set for scrub type PEB, it will
+			 *    be put back into ubi->scrub list.
+			 * 2. Non-scrub type PEB will be put back into ubi->used
+			 *    list.
+			 */
+			keep = 1;
 			dst_leb_clean = 1;
 			goto out_not_moved;
 		}
@@ -5,7 +5,8 @@
 static void update_fastmap_work_fn(struct work_struct *wrk);
 static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root);
 static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi);
-static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi);
+static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi,
+					    bool need_fill);
 static bool need_wear_leveling(struct ubi_device *ubi);
 static void ubi_fastmap_close(struct ubi_device *ubi);
 static inline void ubi_fastmap_init(struct ubi_device *ubi, int *count)
@@ -1248,10 +1248,10 @@ gve_adminq_configure_flow_rule(struct gve_priv *priv,
 			sizeof(struct gve_adminq_configure_flow_rule),
 			flow_rule_cmd);

-	if (err) {
+	if (err == -ETIME) {
 		dev_err(&priv->pdev->dev, "Timeout to configure the flow rule, trigger reset");
 		gve_reset(priv, true);
-	} else {
+	} else if (!err) {
 		priv->flow_rules_cache.rules_cache_synced = false;
 	}

@@ -5299,7 +5299,7 @@ static int i40e_set_priv_flags(struct net_device *dev, u32 flags)
 	}

 flags_complete:
-	bitmap_xor(changed_flags, pf->flags, orig_flags, I40E_PF_FLAGS_NBITS);
+	bitmap_xor(changed_flags, new_flags, orig_flags, I40E_PF_FLAGS_NBITS);

 	if (test_bit(I40E_FLAG_FW_LLDP_DIS, changed_flags))
 		reset_needed = I40E_PF_RESET_AND_REBUILD_FLAG;
@@ -1247,6 +1247,7 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
 	}

 	kfree(dp->spt_info);
+	dp->spt_info = NULL;
 }

 static void ath12k_dp_reoq_lut_cleanup(struct ath12k_base *ab)
@@ -1282,8 +1283,10 @@ void ath12k_dp_free(struct ath12k_base *ab)

 	ath12k_dp_rx_reo_cmd_list_cleanup(ab);

-	for (i = 0; i < ab->hw_params->max_tx_ring; i++)
+	for (i = 0; i < ab->hw_params->max_tx_ring; i++) {
 		kfree(dp->tx_ring[i].tx_status);
+		dp->tx_ring[i].tx_status = NULL;
+	}

 	ath12k_dp_rx_free(ab);
 	/* Deinit any SOC level resource */
@@ -110,9 +110,8 @@ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
 		}
 		strreplace(board_type, '/', '-');
 		settings->board_type = board_type;
-
-		of_node_put(root);
 	}
+	of_node_put(root);

 	if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
 		return;
@@ -162,10 +162,19 @@ void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value)
 void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+	u16 max_attempts = 10000;
 	u32 value32;
 	u8 readbyte;
 	u16 retry;

+	/*
+	 * In case of USB devices, transfer speeds are limited, hence
+	 * efuse I/O reads could be (way) slower. So, decrease (a lot)
+	 * the read attempts in case of failures.
+	 */
+	if (rtlpriv->rtlhal.interface == INTF_USB)
+		max_attempts = 10;
+
 	rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL] + 1,
 		       (_offset & 0xff));
 	readbyte = rtl_read_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL] + 2);
@@ -178,7 +187,7 @@ void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)

 	retry = 0;
 	value32 = rtl_read_dword(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL]);
-	while (!(((value32 >> 24) & 0xff) & 0x80) && (retry < 10000)) {
+	while (!(((value32 >> 24) & 0xff) & 0x80) && (retry < max_attempts)) {
 		value32 = rtl_read_dword(rtlpriv,
 					 rtlpriv->cfg->maps[EFUSE_CTRL]);
 		retry++;
@@ -4591,6 +4591,11 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set);

 void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
 {
+	/*
+	 * As we're about to destroy the queue and free tagset
+	 * we can not have keep-alive work running.
+	 */
+	nvme_stop_keep_alive(ctrl);
 	blk_mq_destroy_queue(ctrl->admin_q);
 	blk_put_queue(ctrl->admin_q);
 	if (ctrl->ops->flags & NVME_F_FABRICS) {
@@ -165,7 +165,8 @@ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl)
 	int srcu_idx;

 	srcu_idx = srcu_read_lock(&ctrl->srcu);
-	list_for_each_entry_rcu(ns, &ctrl->namespaces, list) {
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		if (!ns->head->disk)
 			continue;
 		kblockd_schedule_work(&ns->head->requeue_work);
@@ -209,7 +210,8 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
 	int srcu_idx;

 	srcu_idx = srcu_read_lock(&ctrl->srcu);
-	list_for_each_entry_rcu(ns, &ctrl->namespaces, list) {
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		nvme_mpath_clear_current_path(ns);
 		kblockd_schedule_work(&ns->head->requeue_work);
 	}
@@ -224,7 +226,8 @@ void nvme_mpath_revalidate_paths(struct nvme_ns *ns)
 	int srcu_idx;

 	srcu_idx = srcu_read_lock(&head->srcu);
-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (capacity != get_capacity(ns->disk))
 			clear_bit(NVME_NS_READY, &ns->flags);
 	}
@@ -257,7 +260,8 @@ static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node)
 	int found_distance = INT_MAX, fallback_distance = INT_MAX, distance;
 	struct nvme_ns *found = NULL, *fallback = NULL, *ns;

-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (nvme_path_is_disabled(ns))
 			continue;

@@ -356,7 +360,8 @@ static struct nvme_ns *nvme_queue_depth_path(struct nvme_ns_head *head)
 	unsigned int min_depth_opt = UINT_MAX, min_depth_nonopt = UINT_MAX;
 	unsigned int depth;

-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (nvme_path_is_disabled(ns))
 			continue;

@@ -424,7 +429,8 @@ static bool nvme_available_path(struct nvme_ns_head *head)
 	if (!test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags))
 		return NULL;

-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (test_bit(NVME_CTRL_FAILFAST_EXPIRED, &ns->ctrl->flags))
 			continue;
 		switch (nvme_ctrl_state(ns->ctrl)) {
@@ -785,7 +791,8 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
 		return 0;

 	srcu_idx = srcu_read_lock(&ctrl->srcu);
-	list_for_each_entry_rcu(ns, &ctrl->namespaces, list) {
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		unsigned nsid;
 again:
 		nsid = le32_to_cpu(desc->nsids[n]);
@@ -79,6 +79,7 @@ static void pci_slot_release(struct kobject *kobj)
 	up_read(&pci_bus_sem);

 	list_del(&slot->list);
+	pci_bus_put(slot->bus);

 	kfree(slot);
 }
@@ -261,7 +262,7 @@ placeholder:
 		goto err;
 	}

-	slot->bus = parent;
+	slot->bus = pci_bus_get(parent);
 	slot->number = slot_nr;

 	slot->kobj.kset = pci_slots_kset;
@@ -269,6 +270,7 @@ placeholder:
 	slot_name = make_slot_name(name);
 	if (!slot_name) {
 		err = -ENOMEM;
+		pci_bus_put(slot->bus);
 		kfree(slot);
 		goto err;
 	}
@@ -2178,8 +2178,6 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
 			continue;

 		xp = arm_cmn_node_to_xp(cmn, dn);
-		dn->portid_bits = xp->portid_bits;
-		dn->deviceid_bits = xp->deviceid_bits;
 		dn->dtc = xp->dtc;
 		dn->dtm = xp->dtm;
 		if (cmn->multi_dtm)
@@ -2420,6 +2418,8 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
 			}

 			arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn);
+			dn->portid_bits = xp->portid_bits;
+			dn->deviceid_bits = xp->deviceid_bits;

 			switch (dn->type) {
 			case CMN_TYPE_DTC:
@@ -431,6 +431,17 @@ static int smmu_pmu_event_init(struct perf_event *event)
 			return -EINVAL;
 	}

+	/*
+	 * Ensure all events are on the same cpu so all events are in the
+	 * same cpu context, to avoid races on pmu_enable etc.
+	 */
+	event->cpu = smmu_pmu->on_cpu;
+
+	hwc->idx = -1;
+
+	if (event->group_leader == event)
+		return 0;
+
 	for_each_sibling_event(sibling, event->group_leader) {
 		if (is_software_event(sibling))
 			continue;
@@ -442,14 +453,6 @@ static int smmu_pmu_event_init(struct perf_event *event)
 			return -EINVAL;
 	}

-	hwc->idx = -1;
-
-	/*
-	 * Ensure all events are on the same cpu so all events are in the
-	 * same cpu context, to avoid races on pmu_enable etc.
-	 */
-	event->cpu = smmu_pmu->on_cpu;
-
 	return 0;
 }

@@ -667,7 +667,7 @@ static void pmic_gpio_config_dbg_show(struct pinctrl_dev *pctldev,
 		"push-pull", "open-drain", "open-source"
 	};
 	static const char *const strengths[] = {
-		"no", "high", "medium", "low"
+		"no", "low", "medium", "high"
 	};

 	pad = pctldev->desc->pins[pin].drv_data;
@@ -409,6 +409,7 @@ static int cros_typec_init_ports(struct cros_typec_data *typec)
 	return 0;

 unregister_ports:
+	fwnode_handle_put(fwnode);
 	cros_unregister_ports(typec);
 	return ret;
 }
@@ -904,13 +904,18 @@ void rtc_timer_do_work(struct work_struct *work)
 	struct timerqueue_node *next;
 	ktime_t now;
 	struct rtc_time tm;
+	int err;

 	struct rtc_device *rtc =
 		container_of(work, struct rtc_device, irqwork);

 	mutex_lock(&rtc->ops_lock);
 again:
-	__rtc_read_time(rtc, &tm);
+	err = __rtc_read_time(rtc, &tm);
+	if (err) {
+		mutex_unlock(&rtc->ops_lock);
+		return;
+	}
 	now = rtc_tm_to_ktime(tm);
 	while ((next = timerqueue_getnext(&rtc->timerqueue))) {
 		if (next->expires > now)
@@ -396,13 +396,6 @@ static int abeoz9z3_temp_read(struct device *dev,
 	if (ret < 0)
 		return ret;

-	if ((val & ABEOZ9_REG_CTRL_STATUS_V1F) ||
-	    (val & ABEOZ9_REG_CTRL_STATUS_V2F)) {
-		dev_err(dev,
-			"thermometer might be disabled due to low voltage\n");
-		return -EINVAL;
-	}
-
 	switch (attr) {
 	case hwmon_temp_input:
 		ret = regmap_read(regmap, ABEOZ9_REG_REG_TEMP, &val);
@@ -39,7 +39,7 @@
 #define ABX8XX_REG_STATUS	0x0f
 #define ABX8XX_STATUS_AF	BIT(2)
 #define ABX8XX_STATUS_BLF	BIT(4)
-#define ABX8XX_STATUS_WDT	BIT(6)
+#define ABX8XX_STATUS_WDT	BIT(5)

 #define ABX8XX_REG_CTRL1	0x10
 #define ABX8XX_CTRL_WRITE	BIT(0)
@@ -111,8 +111,8 @@ static int rzn1_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	tm->tm_hour = bcd2bin(tm->tm_hour);
 	tm->tm_wday = bcd2bin(tm->tm_wday);
 	tm->tm_mday = bcd2bin(tm->tm_mday);
-	tm->tm_mon = bcd2bin(tm->tm_mon);
-	tm->tm_year = bcd2bin(tm->tm_year);
+	tm->tm_mon = bcd2bin(tm->tm_mon) - 1;
+	tm->tm_year = bcd2bin(tm->tm_year) + 100;

 	return 0;
 }
@@ -128,8 +128,8 @@ static int rzn1_rtc_set_time(struct device *dev, struct rtc_time *tm)
 	tm->tm_hour = bin2bcd(tm->tm_hour);
 	tm->tm_wday = bin2bcd(rzn1_rtc_tm_to_wday(tm));
 	tm->tm_mday = bin2bcd(tm->tm_mday);
-	tm->tm_mon = bin2bcd(tm->tm_mon);
-	tm->tm_year = bin2bcd(tm->tm_year);
+	tm->tm_mon = bin2bcd(tm->tm_mon + 1);
+	tm->tm_year = bin2bcd(tm->tm_year - 100);

 	val = readl(rtc->base + RZN1_RTC_CTL2);
 	if (!(val & RZN1_RTC_CTL2_STOPPED)) {
--- a/Show More
+++ b/Show More