[gentoo-commits] proj/linux-patches:5.19 commit in: /

[Mike Pagano]

commit:     036eac410993ee6f8ed2440ba5bf687f2733eda5
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep  8 10:45:14 2022 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep  8 10:45:14 2022 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=036eac41

Linux patch 5.19.8

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README             |    4 +
 1007_linux-5.19.8.patch | 6128 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6132 insertions(+)

diff --git a/0000_README b/0000_README
index e6423950..d9225608 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch:  1006_linux-5.19.7.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.19.7
 
+Patch:  1007_linux-5.19.8.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.19.8
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1007_linux-5.19.8.patch b/1007_linux-5.19.8.patch
new file mode 100644
index 00000000..7bcf0c97
--- /dev/null
+++ b/1007_linux-5.19.8.patch
@@ -0,0 +1,6128 @@
+diff --git a/Makefile b/Makefile
+index 3d88923df694e..e361c6230e9e5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 19
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Superb Owl
+ 
+diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
+index 889951291cc0f..a11a6e14ba89f 100644
+--- a/arch/arm64/kernel/machine_kexec_file.c
++++ b/arch/arm64/kernel/machine_kexec_file.c
+@@ -47,7 +47,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
+ 	u64 i;
+ 	phys_addr_t start, end;
+ 
+-	nr_ranges = 1; /* for exclusion of crashkernel region */
++	nr_ranges = 2; /* for exclusion of crashkernel region */
+ 	for_each_mem_range(i, &start, &end)
+ 		nr_ranges++;
+ 
+diff --git a/arch/powerpc/include/asm/firmware.h b/arch/powerpc/include/asm/firmware.h
+index 8dddd34b8ecf1..fabc82f5e935d 100644
+--- a/arch/powerpc/include/asm/firmware.h
++++ b/arch/powerpc/include/asm/firmware.h
+@@ -82,6 +82,8 @@ enum {
+ 	FW_FEATURE_POWERNV_ALWAYS = 0,
+ 	FW_FEATURE_PS3_POSSIBLE = FW_FEATURE_LPAR | FW_FEATURE_PS3_LV1,
+ 	FW_FEATURE_PS3_ALWAYS = FW_FEATURE_LPAR | FW_FEATURE_PS3_LV1,
++	FW_FEATURE_NATIVE_POSSIBLE = 0,
++	FW_FEATURE_NATIVE_ALWAYS = 0,
+ 	FW_FEATURE_POSSIBLE =
+ #ifdef CONFIG_PPC_PSERIES
+ 		FW_FEATURE_PSERIES_POSSIBLE |
+@@ -91,6 +93,9 @@ enum {
+ #endif
+ #ifdef CONFIG_PPC_PS3
+ 		FW_FEATURE_PS3_POSSIBLE |
++#endif
++#ifdef CONFIG_PPC_HASH_MMU_NATIVE
++		FW_FEATURE_NATIVE_ALWAYS |
+ #endif
+ 		0,
+ 	FW_FEATURE_ALWAYS =
+@@ -102,6 +107,9 @@ enum {
+ #endif
+ #ifdef CONFIG_PPC_PS3
+ 		FW_FEATURE_PS3_ALWAYS &
++#endif
++#ifdef CONFIG_PPC_HASH_MMU_NATIVE
++		FW_FEATURE_NATIVE_ALWAYS &
+ #endif
+ 		FW_FEATURE_POSSIBLE,
+ 
+diff --git a/arch/powerpc/kernel/rtas_entry.S b/arch/powerpc/kernel/rtas_entry.S
+index 9a434d42e660a..6ce95ddadbcdb 100644
+--- a/arch/powerpc/kernel/rtas_entry.S
++++ b/arch/powerpc/kernel/rtas_entry.S
+@@ -109,8 +109,12 @@ __enter_rtas:
+ 	 * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S]
+ 	 * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if
+ 	 * MSR[S] is set, it will remain when entering RTAS.
++	 * If we're in HV mode, RTAS must also run in HV mode, so extract MSR_HV
++	 * from the saved MSR value and insert into the value RTAS will use.
+ 	 */
++	extrdi	r0, r6, 1, 63 - MSR_HV_LG
+ 	LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI)
++	insrdi	r6, r0, 1, 63 - MSR_HV_LG
+ 
+ 	li      r0,0
+ 	mtmsrd  r0,1                    /* disable RI before using SRR0/1 */
+diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
+index cb3358886203e..6c1db3b6de2dc 100644
+--- a/arch/powerpc/kernel/systbl.S
++++ b/arch/powerpc/kernel/systbl.S
+@@ -18,6 +18,7 @@
+ 	.p2align	3
+ #define __SYSCALL(nr, entry)	.8byte entry
+ #else
++	.p2align	2
+ #define __SYSCALL(nr, entry)	.long entry
+ #endif
+ 
+diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
+index 82cae08976bcd..92074a6c49d43 100644
+--- a/arch/powerpc/platforms/pseries/papr_scm.c
++++ b/arch/powerpc/platforms/pseries/papr_scm.c
+@@ -124,9 +124,6 @@ struct papr_scm_priv {
+ 
+ 	/* The bits which needs to be overridden */
+ 	u64 health_bitmap_inject_mask;
+-
+-	/* array to have event_code and stat_id mappings */
+-	u8 *nvdimm_events_map;
+ };
+ 
+ static int papr_scm_pmem_flush(struct nd_region *nd_region,
+@@ -350,6 +347,25 @@ static ssize_t drc_pmem_query_stats(struct papr_scm_priv *p,
+ #ifdef CONFIG_PERF_EVENTS
+ #define to_nvdimm_pmu(_pmu)	container_of(_pmu, struct nvdimm_pmu, pmu)
+ 
++static const char * const nvdimm_events_map[] = {
++	[1] = "CtlResCt",
++	[2] = "CtlResTm",
++	[3] = "PonSecs ",
++	[4] = "MemLife ",
++	[5] = "CritRscU",
++	[6] = "HostLCnt",
++	[7] = "HostSCnt",
++	[8] = "HostSDur",
++	[9] = "HostLDur",
++	[10] = "MedRCnt ",
++	[11] = "MedWCnt ",
++	[12] = "MedRDur ",
++	[13] = "MedWDur ",
++	[14] = "CchRHCnt",
++	[15] = "CchWHCnt",
++	[16] = "FastWCnt",
++};
++
+ static int papr_scm_pmu_get_value(struct perf_event *event, struct device *dev, u64 *count)
+ {
+ 	struct papr_scm_perf_stat *stat;
+@@ -357,11 +373,15 @@ static int papr_scm_pmu_get_value(struct perf_event *event, struct device *dev,
+ 	struct papr_scm_priv *p = (struct papr_scm_priv *)dev->driver_data;
+ 	int rc, size;
+ 
++	/* Invalid eventcode */
++	if (event->attr.config == 0 || event->attr.config >= ARRAY_SIZE(nvdimm_events_map))
++		return -EINVAL;
++
+ 	/* Allocate request buffer enough to hold single performance stat */
+ 	size = sizeof(struct papr_scm_perf_stats) +
+ 		sizeof(struct papr_scm_perf_stat);
+ 
+-	if (!p || !p->nvdimm_events_map)
++	if (!p)
+ 		return -EINVAL;
+ 
+ 	stats = kzalloc(size, GFP_KERNEL);
+@@ -370,7 +390,7 @@ static int papr_scm_pmu_get_value(struct perf_event *event, struct device *dev,
+ 
+ 	stat = &stats->scm_statistic[0];
+ 	memcpy(&stat->stat_id,
+-	       &p->nvdimm_events_map[event->attr.config * sizeof(stat->stat_id)],
++	       nvdimm_events_map[event->attr.config],
+ 		sizeof(stat->stat_id));
+ 	stat->stat_val = 0;
+ 
+@@ -458,56 +478,6 @@ static void papr_scm_pmu_del(struct perf_event *event, int flags)
+ 	papr_scm_pmu_read(event);
+ }
+ 
+-static int papr_scm_pmu_check_events(struct papr_scm_priv *p, struct nvdimm_pmu *nd_pmu)
+-{
+-	struct papr_scm_perf_stat *stat;
+-	struct papr_scm_perf_stats *stats;
+-	u32 available_events;
+-	int index, rc = 0;
+-
+-	if (!p->stat_buffer_len)
+-		return -ENOENT;
+-
+-	available_events = (p->stat_buffer_len  - sizeof(struct papr_scm_perf_stats))
+-			/ sizeof(struct papr_scm_perf_stat);
+-	if (available_events == 0)
+-		return -EOPNOTSUPP;
+-
+-	/* Allocate the buffer for phyp where stats are written */
+-	stats = kzalloc(p->stat_buffer_len, GFP_KERNEL);
+-	if (!stats) {
+-		rc = -ENOMEM;
+-		return rc;
+-	}
+-
+-	/* Called to get list of events supported */
+-	rc = drc_pmem_query_stats(p, stats, 0);
+-	if (rc)
+-		goto out;
+-
+-	/*
+-	 * Allocate memory and populate nvdimm_event_map.
+-	 * Allocate an extra element for NULL entry
+-	 */
+-	p->nvdimm_events_map = kcalloc(available_events + 1,
+-				       sizeof(stat->stat_id),
+-				       GFP_KERNEL);
+-	if (!p->nvdimm_events_map) {
+-		rc = -ENOMEM;
+-		goto out;
+-	}
+-
+-	/* Copy all stat_ids to event map */
+-	for (index = 0, stat = stats->scm_statistic;
+-	     index < available_events; index++, ++stat) {
+-		memcpy(&p->nvdimm_events_map[index * sizeof(stat->stat_id)],
+-		       &stat->stat_id, sizeof(stat->stat_id));
+-	}
+-out:
+-	kfree(stats);
+-	return rc;
+-}
+-
+ static void papr_scm_pmu_register(struct papr_scm_priv *p)
+ {
+ 	struct nvdimm_pmu *nd_pmu;
+@@ -519,9 +489,10 @@ static void papr_scm_pmu_register(struct papr_scm_priv *p)
+ 		goto pmu_err_print;
+ 	}
+ 
+-	rc = papr_scm_pmu_check_events(p, nd_pmu);
+-	if (rc)
++	if (!p->stat_buffer_len) {
++		rc = -ENOENT;
+ 		goto pmu_check_events_err;
++	}
+ 
+ 	nd_pmu->pmu.task_ctx_nr = perf_invalid_context;
+ 	nd_pmu->pmu.name = nvdimm_name(p->nvdimm);
+@@ -539,7 +510,7 @@ static void papr_scm_pmu_register(struct papr_scm_priv *p)
+ 
+ 	rc = register_nvdimm_pmu(nd_pmu, p->pdev);
+ 	if (rc)
+-		goto pmu_register_err;
++		goto pmu_check_events_err;
+ 
+ 	/*
+ 	 * Set archdata.priv value to nvdimm_pmu structure, to handle the
+@@ -548,8 +519,6 @@ static void papr_scm_pmu_register(struct papr_scm_priv *p)
+ 	p->pdev->archdata.priv = nd_pmu;
+ 	return;
+ 
+-pmu_register_err:
+-	kfree(p->nvdimm_events_map);
+ pmu_check_events_err:
+ 	kfree(nd_pmu);
+ pmu_err_print:
+@@ -1560,7 +1529,6 @@ static int papr_scm_remove(struct platform_device *pdev)
+ 		unregister_nvdimm_pmu(pdev->archdata.priv);
+ 
+ 	pdev->archdata.priv = NULL;
+-	kfree(p->nvdimm_events_map);
+ 	kfree(p->bus_desc.provider_name);
+ 	kfree(p);
+ 
+diff --git a/arch/riscv/include/asm/kvm_vcpu_sbi.h b/arch/riscv/include/asm/kvm_vcpu_sbi.h
+index 83d6d4d2b1dff..26a446a34057b 100644
+--- a/arch/riscv/include/asm/kvm_vcpu_sbi.h
++++ b/arch/riscv/include/asm/kvm_vcpu_sbi.h
+@@ -33,4 +33,16 @@ void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
+ 				     u32 type, u64 flags);
+ const struct kvm_vcpu_sbi_extension *kvm_vcpu_sbi_find_ext(unsigned long extid);
+ 
++#ifdef CONFIG_RISCV_SBI_V01
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_v01;
++#endif
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_base;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_time;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_ipi;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_rfence;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_srst;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_hsm;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_experimental;
++extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_vendor;
++
+ #endif /* __RISCV_KVM_VCPU_SBI_H__ */
+diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c
+index d45e7da3f0d32..f96991d230bfc 100644
+--- a/arch/riscv/kvm/vcpu_sbi.c
++++ b/arch/riscv/kvm/vcpu_sbi.c
+@@ -32,23 +32,13 @@ static int kvm_linux_err_map_sbi(int err)
+ 	};
+ }
+ 
+-#ifdef CONFIG_RISCV_SBI_V01
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_v01;
+-#else
++#ifndef CONFIG_RISCV_SBI_V01
+ static const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_v01 = {
+ 	.extid_start = -1UL,
+ 	.extid_end = -1UL,
+ 	.handler = NULL,
+ };
+ #endif
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_base;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_time;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_ipi;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_rfence;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_srst;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_hsm;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_experimental;
+-extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_vendor;
+ 
+ static const struct kvm_vcpu_sbi_extension *sbi_ext[] = {
+ 	&vcpu_sbi_ext_v01,
+diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c
+index 5e49e4b4a4ccc..86c56616e5dea 100644
+--- a/arch/riscv/mm/pageattr.c
++++ b/arch/riscv/mm/pageattr.c
+@@ -118,10 +118,10 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask,
+ 	if (!numpages)
+ 		return 0;
+ 
+-	mmap_read_lock(&init_mm);
++	mmap_write_lock(&init_mm);
+ 	ret =  walk_page_range_novma(&init_mm, start, end, &pageattr_ops, NULL,
+ 				     &masks);
+-	mmap_read_unlock(&init_mm);
++	mmap_write_unlock(&init_mm);
+ 
+ 	flush_tlb_kernel_range(start, end);
+ 
+diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
+index f22beda9e6d5c..ccdbccfde148c 100644
+--- a/arch/s390/include/asm/hugetlb.h
++++ b/arch/s390/include/asm/hugetlb.h
+@@ -28,9 +28,11 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline int prepare_hugepage_range(struct file *file,
+ 			unsigned long addr, unsigned long len)
+ {
+-	if (len & ~HPAGE_MASK)
++	struct hstate *h = hstate_file(file);
++
++	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (addr & ~HPAGE_MASK)
++	if (addr & ~huge_page_mask(h))
+ 		return -EINVAL;
+ 	return 0;
+ }
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 2e526f11b91e2..5ea3830af0ccf 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -131,6 +131,7 @@ SECTIONS
+ 	/*
+ 	 * Table with the patch locations to undo expolines
+ 	*/
++	. = ALIGN(4);
+ 	.nospec_call_table : {
+ 		__nospec_call_start = . ;
+ 		*(.s390_indirect*)
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index 0aaea87a14597..b09a50e0af29d 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -835,8 +835,7 @@ static bool msr_write_intercepted(struct vcpu_vmx *vmx, u32 msr)
+ 	if (!(exec_controls_get(vmx) & CPU_BASED_USE_MSR_BITMAPS))
+ 		return true;
+ 
+-	return vmx_test_msr_bitmap_write(vmx->loaded_vmcs->msr_bitmap,
+-					 MSR_IA32_SPEC_CTRL);
++	return vmx_test_msr_bitmap_write(vmx->loaded_vmcs->msr_bitmap, msr);
+ }
+ 
+ unsigned int __vmx_vcpu_run_flags(struct vcpu_vmx *vmx)
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index bc411d19dac08..55de0d1981e52 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1570,12 +1570,32 @@ static const u32 msr_based_features_all[] = {
+ static u32 msr_based_features[ARRAY_SIZE(msr_based_features_all)];
+ static unsigned int num_msr_based_features;
+ 
++/*
++ * Some IA32_ARCH_CAPABILITIES bits have dependencies on MSRs that KVM
++ * does not yet virtualize. These include:
++ *   10 - MISC_PACKAGE_CTRLS
++ *   11 - ENERGY_FILTERING_CTL
++ *   12 - DOITM
++ *   18 - FB_CLEAR_CTRL
++ *   21 - XAPIC_DISABLE_STATUS
++ *   23 - OVERCLOCKING_STATUS
++ */
++
++#define KVM_SUPPORTED_ARCH_CAP \
++	(ARCH_CAP_RDCL_NO | ARCH_CAP_IBRS_ALL | ARCH_CAP_RSBA | \
++	 ARCH_CAP_SKIP_VMENTRY_L1DFLUSH | ARCH_CAP_SSB_NO | ARCH_CAP_MDS_NO | \
++	 ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \
++	 ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \
++	 ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO)
++
+ static u64 kvm_get_arch_capabilities(void)
+ {
+ 	u64 data = 0;
+ 
+-	if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES))
++	if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) {
+ 		rdmsrl(MSR_IA32_ARCH_CAPABILITIES, data);
++		data &= KVM_SUPPORTED_ARCH_CAP;
++	}
+ 
+ 	/*
+ 	 * If nx_huge_pages is enabled, KVM's shadow paging will ensure that
+@@ -1623,9 +1643,6 @@ static u64 kvm_get_arch_capabilities(void)
+ 		 */
+ 	}
+ 
+-	/* Guests don't need to know "Fill buffer clear control" exists */
+-	data &= ~ARCH_CAP_FB_CLEAR_CTRL;
+-
+ 	return data;
+ }
+ 
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 54ac94fed0151..8bac11d8e618a 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1385,6 +1385,18 @@ static int binder_inc_ref_for_node(struct binder_proc *proc,
+ 	}
+ 	ret = binder_inc_ref_olocked(ref, strong, target_list);
+ 	*rdata = ref->data;
++	if (ret && ref == new_ref) {
++		/*
++		 * Cleanup the failed reference here as the target
++		 * could now be dead and have already released its
++		 * references by now. Calling on the new reference
++		 * with strong=0 and a tmp_refs will not decrement
++		 * the node. The new_ref gets kfree'd below.
++		 */
++		binder_cleanup_ref_olocked(new_ref);
++		ref = NULL;
++	}
++
+ 	binder_proc_unlock(proc);
+ 	if (new_ref && ref != new_ref)
+ 		/*
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 5d437c0c842cb..53797453a6ee8 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -322,7 +322,6 @@ static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
+ 	 */
+ 	if (vma) {
+ 		vm_start = vma->vm_start;
+-		alloc->vma_vm_mm = vma->vm_mm;
+ 		mmap_assert_write_locked(alloc->vma_vm_mm);
+ 	} else {
+ 		mmap_assert_locked(alloc->vma_vm_mm);
+@@ -795,7 +794,6 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
+ 	binder_insert_free_buffer(alloc, buffer);
+ 	alloc->free_async_space = alloc->buffer_size / 2;
+ 	binder_alloc_set_vma(alloc, vma);
+-	mmgrab(alloc->vma_vm_mm);
+ 
+ 	return 0;
+ 
+@@ -1091,6 +1089,8 @@ static struct shrinker binder_shrinker = {
+ void binder_alloc_init(struct binder_alloc *alloc)
+ {
+ 	alloc->pid = current->group_leader->pid;
++	alloc->vma_vm_mm = current->mm;
++	mmgrab(alloc->vma_vm_mm);
+ 	mutex_init(&alloc->mutex);
+ 	INIT_LIST_HEAD(&alloc->buffers);
+ }
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index b766968a873ce..2ccbde111c352 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -897,6 +897,11 @@ static int __device_attach_driver(struct device_driver *drv, void *_data)
+ 		dev_dbg(dev, "Device match requests probe deferral\n");
+ 		dev->can_match = true;
+ 		driver_deferred_probe_add(dev);
++		/*
++		 * Device can't match with a driver right now, so don't attempt
++		 * to match or bind with other drivers on the bus.
++		 */
++		return ret;
+ 	} else if (ret < 0) {
+ 		dev_dbg(dev, "Bus failed to match device: %d\n", ret);
+ 		return ret;
+@@ -1136,6 +1141,11 @@ static int __driver_attach(struct device *dev, void *data)
+ 		dev_dbg(dev, "Device match requests probe deferral\n");
+ 		dev->can_match = true;
+ 		driver_deferred_probe_add(dev);
++		/*
++		 * Driver could not match with device, but may match with
++		 * another device on the bus.
++		 */
++		return 0;
+ 	} else if (ret < 0) {
+ 		dev_dbg(dev, "Bus failed to match device: %d\n", ret);
+ 		return ret;
+diff --git a/drivers/base/firmware_loader/sysfs.c b/drivers/base/firmware_loader/sysfs.c
+index 5b0b85b70b6f2..28b9cbb8a6dd3 100644
+--- a/drivers/base/firmware_loader/sysfs.c
++++ b/drivers/base/firmware_loader/sysfs.c
+@@ -93,10 +93,9 @@ static void fw_dev_release(struct device *dev)
+ {
+ 	struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
+ 
+-	if (fw_sysfs->fw_upload_priv) {
+-		free_fw_priv(fw_sysfs->fw_priv);
+-		kfree(fw_sysfs->fw_upload_priv);
+-	}
++	if (fw_sysfs->fw_upload_priv)
++		fw_upload_free(fw_sysfs);
++
+ 	kfree(fw_sysfs);
+ }
+ 
+diff --git a/drivers/base/firmware_loader/sysfs.h b/drivers/base/firmware_loader/sysfs.h
+index 5d8ff1675c794..df1d5add698f1 100644
+--- a/drivers/base/firmware_loader/sysfs.h
++++ b/drivers/base/firmware_loader/sysfs.h
+@@ -106,12 +106,17 @@ extern struct device_attribute dev_attr_cancel;
+ extern struct device_attribute dev_attr_remaining_size;
+ 
+ int fw_upload_start(struct fw_sysfs *fw_sysfs);
++void fw_upload_free(struct fw_sysfs *fw_sysfs);
+ umode_t fw_upload_is_visible(struct kobject *kobj, struct attribute *attr, int n);
+ #else
+ static inline int fw_upload_start(struct fw_sysfs *fw_sysfs)
+ {
+ 	return 0;
+ }
++
++static inline void fw_upload_free(struct fw_sysfs *fw_sysfs)
++{
++}
+ #endif
+ 
+ #endif /* __FIRMWARE_SYSFS_H */
+diff --git a/drivers/base/firmware_loader/sysfs_upload.c b/drivers/base/firmware_loader/sysfs_upload.c
+index 87044d52322aa..a0af8f5f13d88 100644
+--- a/drivers/base/firmware_loader/sysfs_upload.c
++++ b/drivers/base/firmware_loader/sysfs_upload.c
+@@ -264,6 +264,15 @@ int fw_upload_start(struct fw_sysfs *fw_sysfs)
+ 	return 0;
+ }
+ 
++void fw_upload_free(struct fw_sysfs *fw_sysfs)
++{
++	struct fw_upload_priv *fw_upload_priv = fw_sysfs->fw_upload_priv;
++
++	free_fw_priv(fw_sysfs->fw_priv);
++	kfree(fw_upload_priv->fw_upload);
++	kfree(fw_upload_priv);
++}
++
+ /**
+  * firmware_upload_register() - register for the firmware upload sysfs API
+  * @module: kernel module of this device
+@@ -377,6 +386,7 @@ void firmware_upload_unregister(struct fw_upload *fw_upload)
+ {
+ 	struct fw_sysfs *fw_sysfs = fw_upload->priv;
+ 	struct fw_upload_priv *fw_upload_priv = fw_sysfs->fw_upload_priv;
++	struct module *module = fw_upload_priv->module;
+ 
+ 	mutex_lock(&fw_upload_priv->lock);
+ 	if (fw_upload_priv->progress == FW_UPLOAD_PROG_IDLE) {
+@@ -392,6 +402,6 @@ void firmware_upload_unregister(struct fw_upload *fw_upload)
+ 
+ unregister:
+ 	device_unregister(&fw_sysfs->dev);
+-	module_put(fw_upload_priv->module);
++	module_put(module);
+ }
+ EXPORT_SYMBOL_GPL(firmware_upload_unregister);
+diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
+index bda5c815e4415..a28473470e662 100644
+--- a/drivers/block/xen-blkback/common.h
++++ b/drivers/block/xen-blkback/common.h
+@@ -226,6 +226,9 @@ struct xen_vbd {
+ 	sector_t		size;
+ 	unsigned int		flush_support:1;
+ 	unsigned int		discard_secure:1;
++	/* Connect-time cached feature_persistent parameter value */
++	unsigned int		feature_gnt_persistent_parm:1;
++	/* Persistent grants feature negotiation result */
+ 	unsigned int		feature_gnt_persistent:1;
+ 	unsigned int		overflow_max_grants:1;
+ };
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index ee7ad2fb432d1..c0227dfa46887 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -907,7 +907,7 @@ again:
+ 	xen_blkbk_barrier(xbt, be, be->blkif->vbd.flush_support);
+ 
+ 	err = xenbus_printf(xbt, dev->nodename, "feature-persistent", "%u",
+-			be->blkif->vbd.feature_gnt_persistent);
++			be->blkif->vbd.feature_gnt_persistent_parm);
+ 	if (err) {
+ 		xenbus_dev_fatal(dev, err, "writing %s/feature-persistent",
+ 				 dev->nodename);
+@@ -1085,7 +1085,9 @@ static int connect_ring(struct backend_info *be)
+ 		return -ENOSYS;
+ 	}
+ 
+-	blkif->vbd.feature_gnt_persistent = feature_persistent &&
++	blkif->vbd.feature_gnt_persistent_parm = feature_persistent;
++	blkif->vbd.feature_gnt_persistent =
++		blkif->vbd.feature_gnt_persistent_parm &&
+ 		xenbus_read_unsigned(dev->otherend, "feature-persistent", 0);
+ 
+ 	blkif->vbd.overflow_max_grants = 0;
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 4e763701b3720..1f85750f981e5 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -213,6 +213,9 @@ struct blkfront_info
+ 	unsigned int feature_fua:1;
+ 	unsigned int feature_discard:1;
+ 	unsigned int feature_secdiscard:1;
++	/* Connect-time cached feature_persistent parameter */
++	unsigned int feature_persistent_parm:1;
++	/* Persistent grants feature negotiation result */
+ 	unsigned int feature_persistent:1;
+ 	unsigned int bounce:1;
+ 	unsigned int discard_granularity;
+@@ -1756,6 +1759,12 @@ abort_transaction:
+ 	return err;
+ }
+ 
++/* Enable the persistent grants feature. */
++static bool feature_persistent = true;
++module_param(feature_persistent, bool, 0644);
++MODULE_PARM_DESC(feature_persistent,
++		"Enables the persistent grants feature");
++
+ /* Common code used when first setting up, and when resuming. */
+ static int talk_to_blkback(struct xenbus_device *dev,
+ 			   struct blkfront_info *info)
+@@ -1847,8 +1856,9 @@ again:
+ 		message = "writing protocol";
+ 		goto abort_transaction;
+ 	}
++	info->feature_persistent_parm = feature_persistent;
+ 	err = xenbus_printf(xbt, dev->nodename, "feature-persistent", "%u",
+-			info->feature_persistent);
++			info->feature_persistent_parm);
+ 	if (err)
+ 		dev_warn(&dev->dev,
+ 			 "writing persistent grants feature to xenbus");
+@@ -1916,12 +1926,6 @@ static int negotiate_mq(struct blkfront_info *info)
+ 	return 0;
+ }
+ 
+-/* Enable the persistent grants feature. */
+-static bool feature_persistent = true;
+-module_param(feature_persistent, bool, 0644);
+-MODULE_PARM_DESC(feature_persistent,
+-		"Enables the persistent grants feature");
+-
+ /*
+  * Entry point to this code when a new device is created.  Allocate the basic
+  * structures and the ring buffer for communication with the backend, and
+@@ -2281,7 +2285,7 @@ static void blkfront_gather_backend_features(struct blkfront_info *info)
+ 	if (xenbus_read_unsigned(info->xbdev->otherend, "feature-discard", 0))
+ 		blkfront_setup_discard(info);
+ 
+-	if (feature_persistent)
++	if (info->feature_persistent_parm)
+ 		info->feature_persistent =
+ 			!!xenbus_read_unsigned(info->xbdev->otherend,
+ 					       "feature-persistent", 0);
+diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c
+index 73518009a0f20..4df921d1e21ca 100644
+--- a/drivers/clk/bcm/clk-raspberrypi.c
++++ b/drivers/clk/bcm/clk-raspberrypi.c
+@@ -203,7 +203,7 @@ static unsigned long raspberrypi_fw_get_rate(struct clk_hw *hw,
+ 	ret = raspberrypi_clock_property(rpi->firmware, data,
+ 					 RPI_FIRMWARE_GET_CLOCK_RATE, &val);
+ 	if (ret)
+-		return ret;
++		return 0;
+ 
+ 	return val;
+ }
+@@ -220,7 +220,7 @@ static int raspberrypi_fw_set_rate(struct clk_hw *hw, unsigned long rate,
+ 	ret = raspberrypi_clock_property(rpi->firmware, data,
+ 					 RPI_FIRMWARE_SET_CLOCK_RATE, &_rate);
+ 	if (ret)
+-		dev_err_ratelimited(rpi->dev, "Failed to change %s frequency: %d",
++		dev_err_ratelimited(rpi->dev, "Failed to change %s frequency: %d\n",
+ 				    clk_hw_get_name(hw), ret);
+ 
+ 	return ret;
+@@ -288,7 +288,7 @@ static struct clk_hw *raspberrypi_clk_register(struct raspberrypi_clk *rpi,
+ 					 RPI_FIRMWARE_GET_MIN_CLOCK_RATE,
+ 					 &min_rate);
+ 	if (ret) {
+-		dev_err(rpi->dev, "Failed to get clock %d min freq: %d",
++		dev_err(rpi->dev, "Failed to get clock %d min freq: %d\n",
+ 			id, ret);
+ 		return ERR_PTR(ret);
+ 	}
+@@ -344,8 +344,13 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi,
+ 	struct rpi_firmware_get_clocks_response *clks;
+ 	int ret;
+ 
++	/*
++	 * The firmware doesn't guarantee that the last element of
++	 * RPI_FIRMWARE_GET_CLOCKS is zeroed. So allocate an additional
++	 * zero element as sentinel.
++	 */
+ 	clks = devm_kcalloc(rpi->dev,
+-			    RPI_FIRMWARE_NUM_CLK_ID, sizeof(*clks),
++			    RPI_FIRMWARE_NUM_CLK_ID + 1, sizeof(*clks),
+ 			    GFP_KERNEL);
+ 	if (!clks)
+ 		return -ENOMEM;
+@@ -360,7 +365,7 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi,
+ 		struct raspberrypi_clk_variant *variant;
+ 
+ 		if (clks->id > RPI_FIRMWARE_NUM_CLK_ID) {
+-			dev_err(rpi->dev, "Unknown clock id: %u", clks->id);
++			dev_err(rpi->dev, "Unknown clock id: %u\n", clks->id);
+ 			return -EINVAL;
+ 		}
+ 
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index f00d4c1158d72..f246d66f8261f 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -840,10 +840,9 @@ static void clk_core_unprepare(struct clk_core *core)
+ 	if (core->ops->unprepare)
+ 		core->ops->unprepare(core->hw);
+ 
+-	clk_pm_runtime_put(core);
+-
+ 	trace_clk_unprepare_complete(core);
+ 	clk_core_unprepare(core->parent);
++	clk_pm_runtime_put(core);
+ }
+ 
+ static void clk_core_unprepare_lock(struct clk_core *core)
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 3463579220b51..121d8610beb15 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -143,6 +143,7 @@ static struct device_node *ti_find_clock_provider(struct device_node *from,
+ 			continue;
+ 
+ 		if (!strncmp(n, tmp, strlen(tmp))) {
++			of_node_get(np);
+ 			found = true;
+ 			break;
+ 		}
+diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
+index 205acb2c744de..e3885c90a3acb 100644
+--- a/drivers/dma-buf/dma-resv.c
++++ b/drivers/dma-buf/dma-resv.c
+@@ -295,7 +295,8 @@ void dma_resv_add_fence(struct dma_resv *obj, struct dma_fence *fence,
+ 		enum dma_resv_usage old_usage;
+ 
+ 		dma_resv_list_entry(fobj, i, obj, &old, &old_usage);
+-		if ((old->context == fence->context && old_usage >= usage) ||
++		if ((old->context == fence->context && old_usage >= usage &&
++		     dma_fence_is_later(fence, old)) ||
+ 		    dma_fence_is_signaled(old)) {
+ 			dma_resv_list_set(fobj, i, fence, usage);
+ 			dma_fence_put(old);
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index ecd7d169470b0..2925f4d8cef36 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -1175,7 +1175,9 @@ static int pca953x_suspend(struct device *dev)
+ {
+ 	struct pca953x_chip *chip = dev_get_drvdata(dev);
+ 
++	mutex_lock(&chip->i2c_lock);
+ 	regcache_cache_only(chip->regmap, true);
++	mutex_unlock(&chip->i2c_lock);
+ 
+ 	if (atomic_read(&chip->wakeup_path))
+ 		device_set_wakeup_path(dev);
+@@ -1198,13 +1200,17 @@ static int pca953x_resume(struct device *dev)
+ 		}
+ 	}
+ 
++	mutex_lock(&chip->i2c_lock);
+ 	regcache_cache_only(chip->regmap, false);
+ 	regcache_mark_dirty(chip->regmap);
+ 	ret = pca953x_regcache_sync(dev);
+-	if (ret)
++	if (ret) {
++		mutex_unlock(&chip->i2c_lock);
+ 		return ret;
++	}
+ 
+ 	ret = regcache_sync(chip->regmap);
++	mutex_unlock(&chip->i2c_lock);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to restore register map: %d\n", ret);
+ 		return ret;
+diff --git a/drivers/gpio/gpio-realtek-otto.c b/drivers/gpio/gpio-realtek-otto.c
+index 63dcf42f7c206..d6418f89d3f63 100644
+--- a/drivers/gpio/gpio-realtek-otto.c
++++ b/drivers/gpio/gpio-realtek-otto.c
+@@ -46,10 +46,20 @@
+  * @lock: Lock for accessing the IRQ registers and values
+  * @intr_mask: Mask for interrupts lines
+  * @intr_type: Interrupt type selection
++ * @bank_read: Read a bank setting as a single 32-bit value
++ * @bank_write: Write a bank setting as a single 32-bit value
++ * @imr_line_pos: Bit shift of an IRQ line's IMR value.
++ *
++ * The DIR, DATA, and ISR registers consist of four 8-bit port values, packed
++ * into a single 32-bit register. Use @bank_read (@bank_write) to get (assign)
++ * a value from (to) these registers. The IMR register consists of four 16-bit
++ * port values, packed into two 32-bit registers. Use @imr_line_pos to get the
++ * bit shift of the 2-bit field for a line's IMR settings. Shifts larger than
++ * 32 overflow into the second register.
+  *
+  * Because the interrupt mask register (IMR) combines the function of IRQ type
+  * selection and masking, two extra values are stored. @intr_mask is used to
+- * mask/unmask the interrupts for a GPIO port, and @intr_type is used to store
++ * mask/unmask the interrupts for a GPIO line, and @intr_type is used to store
+  * the selected interrupt types. The logical AND of these values is written to
+  * IMR on changes.
+  */
+@@ -59,10 +69,11 @@ struct realtek_gpio_ctrl {
+ 	void __iomem *cpumask_base;
+ 	struct cpumask cpu_irq_maskable;
+ 	raw_spinlock_t lock;
+-	u16 intr_mask[REALTEK_GPIO_PORTS_PER_BANK];
+-	u16 intr_type[REALTEK_GPIO_PORTS_PER_BANK];
+-	unsigned int (*port_offset_u8)(unsigned int port);
+-	unsigned int (*port_offset_u16)(unsigned int port);
++	u8 intr_mask[REALTEK_GPIO_MAX];
++	u8 intr_type[REALTEK_GPIO_MAX];
++	u32 (*bank_read)(void __iomem *reg);
++	void (*bank_write)(void __iomem *reg, u32 value);
++	unsigned int (*line_imr_pos)(unsigned int line);
+ };
+ 
+ /* Expand with more flags as devices with other quirks are added */
+@@ -101,14 +112,22 @@ static struct realtek_gpio_ctrl *irq_data_to_ctrl(struct irq_data *data)
+  * port. The two interrupt mask registers store two bits per GPIO, so use u16
+  * values.
+  */
+-static unsigned int realtek_gpio_port_offset_u8(unsigned int port)
++static u32 realtek_gpio_bank_read_swapped(void __iomem *reg)
+ {
+-	return port;
++	return ioread32be(reg);
+ }
+ 
+-static unsigned int realtek_gpio_port_offset_u16(unsigned int port)
++static void realtek_gpio_bank_write_swapped(void __iomem *reg, u32 value)
+ {
+-	return 2 * port;
++	iowrite32be(value, reg);
++}
++
++static unsigned int realtek_gpio_line_imr_pos_swapped(unsigned int line)
++{
++	unsigned int port_pin = line % 8;
++	unsigned int port = line / 8;
++
++	return 2 * (8 * (port ^ 1) + port_pin);
+ }
+ 
+ /*
+@@ -119,66 +138,67 @@ static unsigned int realtek_gpio_port_offset_u16(unsigned int port)
+  * per GPIO, so use u16 values. The first register contains ports 1 and 0, the
+  * second ports 3 and 2.
+  */
+-static unsigned int realtek_gpio_port_offset_u8_rev(unsigned int port)
++static u32 realtek_gpio_bank_read(void __iomem *reg)
+ {
+-	return 3 - port;
++	return ioread32(reg);
+ }
+ 
+-static unsigned int realtek_gpio_port_offset_u16_rev(unsigned int port)
++static void realtek_gpio_bank_write(void __iomem *reg, u32 value)
+ {
+-	return 2 * (port ^ 1);
++	iowrite32(value, reg);
+ }
+ 
+-static void realtek_gpio_write_imr(struct realtek_gpio_ctrl *ctrl,
+-	unsigned int port, u16 irq_type, u16 irq_mask)
++static unsigned int realtek_gpio_line_imr_pos(unsigned int line)
+ {
+-	iowrite16(irq_type & irq_mask,
+-		ctrl->base + REALTEK_GPIO_REG_IMR + ctrl->port_offset_u16(port));
++	return 2 * line;
+ }
+ 
+-static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl,
+-	unsigned int port, u8 mask)
++static void realtek_gpio_clear_isr(struct realtek_gpio_ctrl *ctrl, u32 mask)
+ {
+-	iowrite8(mask, ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port));
++	ctrl->bank_write(ctrl->base + REALTEK_GPIO_REG_ISR, mask);
+ }
+ 
+-static u8 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl, unsigned int port)
++static u32 realtek_gpio_read_isr(struct realtek_gpio_ctrl *ctrl)
+ {
+-	return ioread8(ctrl->base + REALTEK_GPIO_REG_ISR + ctrl->port_offset_u8(port));
++	return ctrl->bank_read(ctrl->base + REALTEK_GPIO_REG_ISR);
+ }
+ 
+-/* Set the rising and falling edge mask bits for a GPIO port pin */
+-static u16 realtek_gpio_imr_bits(unsigned int pin, u16 value)
++/* Set the rising and falling edge mask bits for a GPIO pin */
++static void realtek_gpio_update_line_imr(struct realtek_gpio_ctrl *ctrl, unsigned int line)
+ {
+-	return (value & REALTEK_GPIO_IMR_LINE_MASK) << 2 * pin;
++	void __iomem *reg = ctrl->base + REALTEK_GPIO_REG_IMR;
++	unsigned int line_shift = ctrl->line_imr_pos(line);
++	unsigned int shift = line_shift % 32;
++	u32 irq_type = ctrl->intr_type[line];
++	u32 irq_mask = ctrl->intr_mask[line];
++	u32 reg_val;
++
++	reg += 4 * (line_shift / 32);
++	reg_val = ioread32(reg);
++	reg_val &= ~(REALTEK_GPIO_IMR_LINE_MASK << shift);
++	reg_val |= (irq_type & irq_mask & REALTEK_GPIO_IMR_LINE_MASK) << shift;
++	iowrite32(reg_val, reg);
+ }
+ 
+ static void realtek_gpio_irq_ack(struct irq_data *data)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	irq_hw_number_t line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 
+-	realtek_gpio_clear_isr(ctrl, port, BIT(port_pin));
++	realtek_gpio_clear_isr(ctrl, BIT(line));
+ }
+ 
+ static void realtek_gpio_irq_unmask(struct irq_data *data)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	unsigned long flags;
+-	u16 m;
+ 
+ 	gpiochip_enable_irq(&ctrl->gc, line);
+ 
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+-	m = ctrl->intr_mask[port];
+-	m |= realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK);
+-	ctrl->intr_mask[port] = m;
+-	realtek_gpio_write_imr(ctrl, port, ctrl->intr_type[port], m);
++	ctrl->intr_mask[line] = REALTEK_GPIO_IMR_LINE_MASK;
++	realtek_gpio_update_line_imr(ctrl, line);
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+ }
+ 
+@@ -186,16 +206,11 @@ static void realtek_gpio_irq_mask(struct irq_data *data)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	unsigned long flags;
+-	u16 m;
+ 
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+-	m = ctrl->intr_mask[port];
+-	m &= ~realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK);
+-	ctrl->intr_mask[port] = m;
+-	realtek_gpio_write_imr(ctrl, port, ctrl->intr_type[port], m);
++	ctrl->intr_mask[line] = 0;
++	realtek_gpio_update_line_imr(ctrl, line);
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+ 
+ 	gpiochip_disable_irq(&ctrl->gc, line);
+@@ -205,10 +220,8 @@ static int realtek_gpio_irq_set_type(struct irq_data *data, unsigned int flow_ty
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	unsigned long flags;
+-	u16 type, t;
++	u8 type;
+ 
+ 	switch (flow_type & IRQ_TYPE_SENSE_MASK) {
+ 	case IRQ_TYPE_EDGE_FALLING:
+@@ -227,11 +240,8 @@ static int realtek_gpio_irq_set_type(struct irq_data *data, unsigned int flow_ty
+ 	irq_set_handler_locked(data, handle_edge_irq);
+ 
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+-	t = ctrl->intr_type[port];
+-	t &= ~realtek_gpio_imr_bits(port_pin, REALTEK_GPIO_IMR_LINE_MASK);
+-	t |= realtek_gpio_imr_bits(port_pin, type);
+-	ctrl->intr_type[port] = t;
+-	realtek_gpio_write_imr(ctrl, port, t, ctrl->intr_mask[port]);
++	ctrl->intr_type[line] = type;
++	realtek_gpio_update_line_imr(ctrl, line);
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+ 
+ 	return 0;
+@@ -242,28 +252,21 @@ static void realtek_gpio_irq_handler(struct irq_desc *desc)
+ 	struct gpio_chip *gc = irq_desc_get_handler_data(desc);
+ 	struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc);
+ 	struct irq_chip *irq_chip = irq_desc_get_chip(desc);
+-	unsigned int lines_done;
+-	unsigned int port_pin_count;
+ 	unsigned long status;
+ 	int offset;
+ 
+ 	chained_irq_enter(irq_chip, desc);
+ 
+-	for (lines_done = 0; lines_done < gc->ngpio; lines_done += 8) {
+-		status = realtek_gpio_read_isr(ctrl, lines_done / 8);
+-		port_pin_count = min(gc->ngpio - lines_done, 8U);
+-		for_each_set_bit(offset, &status, port_pin_count)
+-			generic_handle_domain_irq(gc->irq.domain, offset + lines_done);
+-	}
++	status = realtek_gpio_read_isr(ctrl);
++	for_each_set_bit(offset, &status, gc->ngpio)
++		generic_handle_domain_irq(gc->irq.domain, offset);
+ 
+ 	chained_irq_exit(irq_chip, desc);
+ }
+ 
+-static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl,
+-	unsigned int port, int cpu)
++static inline void __iomem *realtek_gpio_irq_cpu_mask(struct realtek_gpio_ctrl *ctrl, int cpu)
+ {
+-	return ctrl->cpumask_base + ctrl->port_offset_u8(port) +
+-		REALTEK_GPIO_PORTS_PER_BANK * cpu;
++	return ctrl->cpumask_base + REALTEK_GPIO_PORTS_PER_BANK * cpu;
+ }
+ 
+ static int realtek_gpio_irq_set_affinity(struct irq_data *data,
+@@ -271,12 +274,10 @@ static int realtek_gpio_irq_set_affinity(struct irq_data *data,
+ {
+ 	struct realtek_gpio_ctrl *ctrl = irq_data_to_ctrl(data);
+ 	unsigned int line = irqd_to_hwirq(data);
+-	unsigned int port = line / 8;
+-	unsigned int port_pin = line % 8;
+ 	void __iomem *irq_cpu_mask;
+ 	unsigned long flags;
+ 	int cpu;
+-	u8 v;
++	u32 v;
+ 
+ 	if (!ctrl->cpumask_base)
+ 		return -ENXIO;
+@@ -284,15 +285,15 @@ static int realtek_gpio_irq_set_affinity(struct irq_data *data,
+ 	raw_spin_lock_irqsave(&ctrl->lock, flags);
+ 
+ 	for_each_cpu(cpu, &ctrl->cpu_irq_maskable) {
+-		irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, port, cpu);
+-		v = ioread8(irq_cpu_mask);
++		irq_cpu_mask = realtek_gpio_irq_cpu_mask(ctrl, cpu);
++		v = ctrl->bank_read(irq_cpu_mask);
+ 
+ 		if (cpumask_test_cpu(cpu, dest))
+-			v |= BIT(port_pin);
++			v |= BIT(line);
+ 		else
+-			v &= ~BIT(port_pin);
++			v &= ~BIT(line);
+ 
+-		iowrite8(v, irq_cpu_mask);
++		ctrl->bank_write(irq_cpu_mask, v);
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&ctrl->lock, flags);
+@@ -305,16 +306,17 @@ static int realtek_gpio_irq_set_affinity(struct irq_data *data,
+ static int realtek_gpio_irq_init(struct gpio_chip *gc)
+ {
+ 	struct realtek_gpio_ctrl *ctrl = gpiochip_get_data(gc);
+-	unsigned int port;
++	u32 mask_all = GENMASK(gc->ngpio - 1, 0);
++	unsigned int line;
+ 	int cpu;
+ 
+-	for (port = 0; (port * 8) < gc->ngpio; port++) {
+-		realtek_gpio_write_imr(ctrl, port, 0, 0);
+-		realtek_gpio_clear_isr(ctrl, port, GENMASK(7, 0));
++	for (line = 0; line < gc->ngpio; line++)
++		realtek_gpio_update_line_imr(ctrl, line);
+ 
+-		for_each_cpu(cpu, &ctrl->cpu_irq_maskable)
+-			iowrite8(GENMASK(7, 0), realtek_gpio_irq_cpu_mask(ctrl, port, cpu));
+-	}
++	realtek_gpio_clear_isr(ctrl, mask_all);
++
++	for_each_cpu(cpu, &ctrl->cpu_irq_maskable)
++		ctrl->bank_write(realtek_gpio_irq_cpu_mask(ctrl, cpu), mask_all);
+ 
+ 	return 0;
+ }
+@@ -387,12 +389,14 @@ static int realtek_gpio_probe(struct platform_device *pdev)
+ 
+ 	if (dev_flags & GPIO_PORTS_REVERSED) {
+ 		bgpio_flags = 0;
+-		ctrl->port_offset_u8 = realtek_gpio_port_offset_u8_rev;
+-		ctrl->port_offset_u16 = realtek_gpio_port_offset_u16_rev;
++		ctrl->bank_read = realtek_gpio_bank_read;
++		ctrl->bank_write = realtek_gpio_bank_write;
++		ctrl->line_imr_pos = realtek_gpio_line_imr_pos;
+ 	} else {
+ 		bgpio_flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER;
+-		ctrl->port_offset_u8 = realtek_gpio_port_offset_u8;
+-		ctrl->port_offset_u16 = realtek_gpio_port_offset_u16;
++		ctrl->bank_read = realtek_gpio_bank_read_swapped;
++		ctrl->bank_write = realtek_gpio_bank_write_swapped;
++		ctrl->line_imr_pos = realtek_gpio_line_imr_pos_swapped;
+ 	}
+ 
+ 	err = bgpio_init(&ctrl->gc, dev, 4,
+diff --git a/drivers/gpu/drm/i915/display/intel_backlight.c b/drivers/gpu/drm/i915/display/intel_backlight.c
+index c8e1fc53a881f..3e200a2e4ba29 100644
+--- a/drivers/gpu/drm/i915/display/intel_backlight.c
++++ b/drivers/gpu/drm/i915/display/intel_backlight.c
+@@ -15,6 +15,7 @@
+ #include "intel_dsi_dcs_backlight.h"
+ #include "intel_panel.h"
+ #include "intel_pci_config.h"
++#include "intel_pps.h"
+ 
+ /**
+  * scale - scale values from one range to another
+@@ -970,26 +971,24 @@ int intel_backlight_device_register(struct intel_connector *connector)
+ 	if (!name)
+ 		return -ENOMEM;
+ 
+-	bd = backlight_device_register(name, connector->base.kdev, connector,
+-				       &intel_backlight_device_ops, &props);
+-
+-	/*
+-	 * Using the same name independent of the drm device or connector
+-	 * prevents registration of multiple backlight devices in the
+-	 * driver. However, we need to use the default name for backward
+-	 * compatibility. Use unique names for subsequent backlight devices as a
+-	 * fallback when the default name already exists.
+-	 */
+-	if (IS_ERR(bd) && PTR_ERR(bd) == -EEXIST) {
++	bd = backlight_device_get_by_name(name);
++	if (bd) {
++		put_device(&bd->dev);
++		/*
++		 * Using the same name independent of the drm device or connector
++		 * prevents registration of multiple backlight devices in the
++		 * driver. However, we need to use the default name for backward
++		 * compatibility. Use unique names for subsequent backlight devices as a
++		 * fallback when the default name already exists.
++		 */
+ 		kfree(name);
+ 		name = kasprintf(GFP_KERNEL, "card%d-%s-backlight",
+ 				 i915->drm.primary->index, connector->base.name);
+ 		if (!name)
+ 			return -ENOMEM;
+-
+-		bd = backlight_device_register(name, connector->base.kdev, connector,
+-					       &intel_backlight_device_ops, &props);
+ 	}
++	bd = backlight_device_register(name, connector->base.kdev, connector,
++				       &intel_backlight_device_ops, &props);
+ 
+ 	if (IS_ERR(bd)) {
+ 		drm_err(&i915->drm,
+@@ -1771,9 +1770,13 @@ void intel_backlight_init_funcs(struct intel_panel *panel)
+ 		panel->backlight.pwm_funcs = &i9xx_pwm_funcs;
+ 	}
+ 
+-	if (connector->base.connector_type == DRM_MODE_CONNECTOR_eDP &&
+-	    intel_dp_aux_init_backlight_funcs(connector) == 0)
+-		return;
++	if (connector->base.connector_type == DRM_MODE_CONNECTOR_eDP) {
++		if (intel_dp_aux_init_backlight_funcs(connector) == 0)
++			return;
++
++		if (!(dev_priv->quirks & QUIRK_NO_PPS_BACKLIGHT_POWER_HOOK))
++			connector->panel.backlight.power = intel_pps_backlight_power;
++	}
+ 
+ 	/* We're using a standard PWM backlight interface */
+ 	panel->backlight.funcs = &pwm_bl_funcs;
+diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
+index 37bd7b17f3d0b..f2fad199e2e0b 100644
+--- a/drivers/gpu/drm/i915/display/intel_bw.c
++++ b/drivers/gpu/drm/i915/display/intel_bw.c
+@@ -404,15 +404,17 @@ static int tgl_get_bw_info(struct drm_i915_private *dev_priv, const struct intel
+ 		int clpchgroup;
+ 		int j;
+ 
+-		if (i < num_groups - 1)
+-			bi_next = &dev_priv->max_bw[i + 1];
+-
+ 		clpchgroup = (sa->deburst * qi.deinterleave / num_channels) << i;
+ 
+-		if (i < num_groups - 1 && clpchgroup < clperchgroup)
+-			bi_next->num_planes = (ipqdepth - clpchgroup) / clpchgroup + 1;
+-		else
+-			bi_next->num_planes = 0;
++		if (i < num_groups - 1) {
++			bi_next = &dev_priv->max_bw[i + 1];
++
++			if (clpchgroup < clperchgroup)
++				bi_next->num_planes = (ipqdepth - clpchgroup) /
++						       clpchgroup + 1;
++			else
++				bi_next->num_planes = 0;
++		}
+ 
+ 		bi->num_qgv_points = qi.num_points;
+ 		bi->num_psf_gv_points = qi.num_psf_points;
+diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
+index ff67899522cf7..41aaa6c98114f 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -5248,8 +5248,6 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
+ 
+ 	intel_panel_init(intel_connector);
+ 
+-	if (!(dev_priv->quirks & QUIRK_NO_PPS_BACKLIGHT_POWER_HOOK))
+-		intel_connector->panel.backlight.power = intel_pps_backlight_power;
+ 	intel_backlight_setup(intel_connector, pipe);
+ 
+ 	intel_edp_add_properties(intel_dp);
+diff --git a/drivers/gpu/drm/i915/display/intel_quirks.c b/drivers/gpu/drm/i915/display/intel_quirks.c
+index c8488f5ebd044..e415cd7c0b84b 100644
+--- a/drivers/gpu/drm/i915/display/intel_quirks.c
++++ b/drivers/gpu/drm/i915/display/intel_quirks.c
+@@ -191,6 +191,9 @@ static struct intel_quirk intel_quirks[] = {
+ 	/* ASRock ITX*/
+ 	{ 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
+ 	{ 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
++	/* ECS Liva Q2 */
++	{ 0x3185, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time },
++	{ 0x3184, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time },
+ };
+ 
+ void intel_init_quirks(struct drm_i915_private *i915)
+diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c
+index 2b10b96b17b5b..933648cc90ff9 100644
+--- a/drivers/gpu/drm/i915/gt/intel_migrate.c
++++ b/drivers/gpu/drm/i915/gt/intel_migrate.c
+@@ -638,9 +638,9 @@ static int emit_copy(struct i915_request *rq,
+ 	return 0;
+ }
+ 
+-static int scatter_list_length(struct scatterlist *sg)
++static u64 scatter_list_length(struct scatterlist *sg)
+ {
+-	int len = 0;
++	u64 len = 0;
+ 
+ 	while (sg && sg_dma_len(sg)) {
+ 		len += sg_dma_len(sg);
+@@ -650,28 +650,26 @@ static int scatter_list_length(struct scatterlist *sg)
+ 	return len;
+ }
+ 
+-static void
++static int
+ calculate_chunk_sz(struct drm_i915_private *i915, bool src_is_lmem,
+-		   int *src_sz, u32 bytes_to_cpy, u32 ccs_bytes_to_cpy)
++		   u64 bytes_to_cpy, u64 ccs_bytes_to_cpy)
+ {
+-	if (ccs_bytes_to_cpy) {
+-		if (!src_is_lmem)
+-			/*
+-			 * When CHUNK_SZ is passed all the pages upto CHUNK_SZ
+-			 * will be taken for the blt. in Flat-ccs supported
+-			 * platform Smem obj will have more pages than required
+-			 * for main meory hence limit it to the required size
+-			 * for main memory
+-			 */
+-			*src_sz = min_t(int, bytes_to_cpy, CHUNK_SZ);
+-	} else { /* ccs handling is not required */
+-		*src_sz = CHUNK_SZ;
+-	}
++	if (ccs_bytes_to_cpy && !src_is_lmem)
++		/*
++		 * When CHUNK_SZ is passed all the pages upto CHUNK_SZ
++		 * will be taken for the blt. in Flat-ccs supported
++		 * platform Smem obj will have more pages than required
++		 * for main meory hence limit it to the required size
++		 * for main memory
++		 */
++		return min_t(u64, bytes_to_cpy, CHUNK_SZ);
++	else
++		return CHUNK_SZ;
+ }
+ 
+-static void get_ccs_sg_sgt(struct sgt_dma *it, u32 bytes_to_cpy)
++static void get_ccs_sg_sgt(struct sgt_dma *it, u64 bytes_to_cpy)
+ {
+-	u32 len;
++	u64 len;
+ 
+ 	do {
+ 		GEM_BUG_ON(!it->sg || !sg_dma_len(it->sg));
+@@ -702,12 +700,12 @@ intel_context_migrate_copy(struct intel_context *ce,
+ {
+ 	struct sgt_dma it_src = sg_sgt(src), it_dst = sg_sgt(dst), it_ccs;
+ 	struct drm_i915_private *i915 = ce->engine->i915;
+-	u32 ccs_bytes_to_cpy = 0, bytes_to_cpy;
++	u64 ccs_bytes_to_cpy = 0, bytes_to_cpy;
+ 	enum i915_cache_level ccs_cache_level;
+ 	u32 src_offset, dst_offset;
+ 	u8 src_access, dst_access;
+ 	struct i915_request *rq;
+-	int src_sz, dst_sz;
++	u64 src_sz, dst_sz;
+ 	bool ccs_is_src, overwrite_ccs;
+ 	int err;
+ 
+@@ -790,8 +788,8 @@ intel_context_migrate_copy(struct intel_context *ce,
+ 		if (err)
+ 			goto out_rq;
+ 
+-		calculate_chunk_sz(i915, src_is_lmem, &src_sz,
+-				   bytes_to_cpy, ccs_bytes_to_cpy);
++		src_sz = calculate_chunk_sz(i915, src_is_lmem,
++					    bytes_to_cpy, ccs_bytes_to_cpy);
+ 
+ 		len = emit_pte(rq, &it_src, src_cache_level, src_is_lmem,
+ 			       src_offset, src_sz);
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index 2d9f5f1c79d3a..26a051ef119df 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -4010,6 +4010,13 @@ static inline void guc_init_lrc_mapping(struct intel_guc *guc)
+ 	/* make sure all descriptors are clean... */
+ 	xa_destroy(&guc->context_lookup);
+ 
++	/*
++	 * A reset might have occurred while we had a pending stalled request,
++	 * so make sure we clean that up.
++	 */
++	guc->stalled_request = NULL;
++	guc->submission_stall_reason = STALL_NONE;
++
+ 	/*
+ 	 * Some contexts might have been pinned before we enabled GuC
+ 	 * submission, so we need to add them to the GuC bookeeping.
+diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
+index beea5895e4992..73e74a6a76037 100644
+--- a/drivers/gpu/drm/i915/gvt/handlers.c
++++ b/drivers/gpu/drm/i915/gvt/handlers.c
+@@ -905,7 +905,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu,
+ 	else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX)
+ 		index = FDI_RX_IMR_TO_PIPE(offset);
+ 	else {
+-		gvt_vgpu_err("Unsupport registers %x\n", offset);
++		gvt_vgpu_err("Unsupported registers %x\n", offset);
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/i915/intel_gvt_mmio_table.c b/drivers/gpu/drm/i915/intel_gvt_mmio_table.c
+index 72dac1718f3e7..6163aeaee9b98 100644
+--- a/drivers/gpu/drm/i915/intel_gvt_mmio_table.c
++++ b/drivers/gpu/drm/i915/intel_gvt_mmio_table.c
+@@ -1074,7 +1074,8 @@ static int iterate_skl_plus_mmio(struct intel_gvt_mmio_table_iter *iter)
+ 	MMIO_D(GEN8_HDC_CHICKEN1);
+ 	MMIO_D(GEN9_WM_CHICKEN3);
+ 
+-	if (IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv))
++	if (IS_KABYLAKE(dev_priv) ||
++	    IS_COFFEELAKE(dev_priv) || IS_COMETLAKE(dev_priv))
+ 		MMIO_D(GAMT_CHKN_BIT_REG);
+ 	if (!IS_BROXTON(dev_priv))
+ 		MMIO_D(GEN9_CTX_PREEMPT_REG);
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 5735915facc51..7d5803f2343a9 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -6560,7 +6560,10 @@ void skl_wm_get_hw_state(struct drm_i915_private *dev_priv)
+ 		enum plane_id plane_id;
+ 		u8 slices;
+ 
+-		skl_pipe_wm_get_hw_state(crtc, &crtc_state->wm.skl.optimal);
++		memset(&crtc_state->wm.skl.optimal, 0,
++		       sizeof(crtc_state->wm.skl.optimal));
++		if (crtc_state->hw.active)
++			skl_pipe_wm_get_hw_state(crtc, &crtc_state->wm.skl.optimal);
+ 		crtc_state->wm.skl.raw = crtc_state->wm.skl.optimal;
+ 
+ 		memset(&dbuf_state->ddb[pipe], 0, sizeof(dbuf_state->ddb[pipe]));
+@@ -6571,6 +6574,9 @@ void skl_wm_get_hw_state(struct drm_i915_private *dev_priv)
+ 			struct skl_ddb_entry *ddb_y =
+ 				&crtc_state->wm.skl.plane_ddb_y[plane_id];
+ 
++			if (!crtc_state->hw.active)
++				continue;
++
+ 			skl_ddb_get_hw_plane_state(dev_priv, crtc->pipe,
+ 						   plane_id, ddb, ddb_y);
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 9b4df3084366b..d98c7f7da7c08 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -1998,6 +1998,12 @@ void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc)
+ 
+ 	intf_cfg.stream_sel = 0; /* Don't care value for video mode */
+ 	intf_cfg.mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
++
++	if (phys_enc->hw_intf)
++		intf_cfg.intf = phys_enc->hw_intf->idx;
++	if (phys_enc->hw_wb)
++		intf_cfg.wb = phys_enc->hw_wb->idx;
++
+ 	if (phys_enc->hw_pp->merge_3d)
+ 		intf_cfg.merge_3d = phys_enc->hw_pp->merge_3d->idx;
+ 
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 703249384e7c7..45aa06a31a9fd 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1214,7 +1214,7 @@ static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
+ 	if (ret)
+ 		return ret;
+ 
+-	dp_ctrl_train_pattern_set(ctrl, pattern | DP_RECOVERED_CLOCK_OUT_EN);
++	dp_ctrl_train_pattern_set(ctrl, pattern);
+ 
+ 	for (tries = 0; tries <= maximum_retries; tries++) {
+ 		drm_dp_link_train_channel_eq_delay(ctrl->aux, ctrl->panel->dpcd);
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+index 2c23324a2296b..72c018e26f47f 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+@@ -109,7 +109,7 @@ static const char * const dsi_8996_bus_clk_names[] = {
+ static const struct msm_dsi_config msm8996_dsi_cfg = {
+ 	.io_offset = DSI_6G_REG_SHIFT,
+ 	.reg_cfg = {
+-		.num = 2,
++		.num = 3,
+ 		.regs = {
+ 			{"vdda", 18160, 1 },	/* 1.25 V */
+ 			{"vcca", 17000, 32 },	/* 0.925 V */
+@@ -148,7 +148,7 @@ static const char * const dsi_sdm660_bus_clk_names[] = {
+ static const struct msm_dsi_config sdm660_dsi_cfg = {
+ 	.io_offset = DSI_6G_REG_SHIFT,
+ 	.reg_cfg = {
+-		.num = 2,
++		.num = 1,
+ 		.regs = {
+ 			{"vdda", 12560, 4 },	/* 1.2 V */
+ 		},
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+index a39de3bdc7faf..56dfa2d24be1f 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+@@ -347,7 +347,7 @@ int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+ 	} else {
+ 		timing->shared_timings.clk_pre =
+ 			linear_inter(tmax, tmin, pcnt2, 0, false);
+-			timing->shared_timings.clk_pre_inc_by_2 = 0;
++		timing->shared_timings.clk_pre_inc_by_2 = 0;
+ 	}
+ 
+ 	timing->ta_go = 3;
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 14ab9a627d8b0..7c0314d6566af 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -424,6 +424,8 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+ 		}
+ 	}
+ 
++	drm_helper_move_panel_connectors_to_head(ddev);
++
+ 	ddev->mode_config.funcs = &mode_config_funcs;
+ 	ddev->mode_config.helper_private = &mode_config_helper_funcs;
+ 
+diff --git a/drivers/gpu/drm/msm/msm_gpu_devfreq.c b/drivers/gpu/drm/msm/msm_gpu_devfreq.c
+index ea94bc18e72eb..89cc93eb67557 100644
+--- a/drivers/gpu/drm/msm/msm_gpu_devfreq.c
++++ b/drivers/gpu/drm/msm/msm_gpu_devfreq.c
+@@ -213,6 +213,8 @@ void msm_devfreq_init(struct msm_gpu *gpu)
+ 
+ 	if (IS_ERR(df->devfreq)) {
+ 		DRM_DEV_ERROR(&gpu->pdev->dev, "Couldn't initialize GPU devfreq\n");
++		dev_pm_qos_remove_request(&df->idle_freq);
++		dev_pm_qos_remove_request(&df->boost_freq);
+ 		df->devfreq = NULL;
+ 		return;
+ 	}
+diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
+index befe989ca7b94..fbf3f5a4ecb67 100644
+--- a/drivers/hwmon/gpio-fan.c
++++ b/drivers/hwmon/gpio-fan.c
+@@ -391,6 +391,9 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ 	if (!fan_data)
+ 		return -EINVAL;
+ 
++	if (state >= fan_data->num_speed)
++		return -EINVAL;
++
+ 	set_fan_speed(fan_data, state);
+ 	return 0;
+ }
+diff --git a/drivers/iio/adc/ad7292.c b/drivers/iio/adc/ad7292.c
+index 92c68d467c505..a2f9fda25ff34 100644
+--- a/drivers/iio/adc/ad7292.c
++++ b/drivers/iio/adc/ad7292.c
+@@ -287,10 +287,8 @@ static int ad7292_probe(struct spi_device *spi)
+ 
+ 		ret = devm_add_action_or_reset(&spi->dev,
+ 					       ad7292_regulator_disable, st);
+-		if (ret) {
+-			regulator_disable(st->reg);
++		if (ret)
+ 			return ret;
+-		}
+ 
+ 		ret = regulator_get_voltage(st->reg);
+ 		if (ret < 0)
+diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
+index 1cb4590fe4125..890af7dca62de 100644
+--- a/drivers/iio/adc/mcp3911.c
++++ b/drivers/iio/adc/mcp3911.c
+@@ -40,8 +40,8 @@
+ #define MCP3911_CHANNEL(x)		(MCP3911_REG_CHANNEL0 + x * 3)
+ #define MCP3911_OFFCAL(x)		(MCP3911_REG_OFFCAL_CH0 + x * 6)
+ 
+-/* Internal voltage reference in uV */
+-#define MCP3911_INT_VREF_UV		1200000
++/* Internal voltage reference in mV */
++#define MCP3911_INT_VREF_MV		1200
+ 
+ #define MCP3911_REG_READ(reg, id)	((((reg) << 1) | ((id) << 5) | (1 << 0)) & 0xff)
+ #define MCP3911_REG_WRITE(reg, id)	((((reg) << 1) | ((id) << 5) | (0 << 0)) & 0xff)
+@@ -113,6 +113,8 @@ static int mcp3911_read_raw(struct iio_dev *indio_dev,
+ 		if (ret)
+ 			goto out;
+ 
++		*val = sign_extend32(*val, 23);
++
+ 		ret = IIO_VAL_INT;
+ 		break;
+ 
+@@ -137,11 +139,18 @@ static int mcp3911_read_raw(struct iio_dev *indio_dev,
+ 
+ 			*val = ret / 1000;
+ 		} else {
+-			*val = MCP3911_INT_VREF_UV;
++			*val = MCP3911_INT_VREF_MV;
+ 		}
+ 
+-		*val2 = 24;
+-		ret = IIO_VAL_FRACTIONAL_LOG2;
++		/*
++		 * For 24bit Conversion
++		 * Raw = ((Voltage)/(Vref) * 2^23 * Gain * 1.5
++		 * Voltage = Raw * (Vref)/(2^23 * Gain * 1.5)
++		 */
++
++		/* val2 = (2^23 * 1.5) */
++		*val2 = 12582912;
++		ret = IIO_VAL_FRACTIONAL;
+ 		break;
+ 	}
+ 
+@@ -208,7 +217,14 @@ static int mcp3911_config(struct mcp3911 *adc)
+ 	u32 configreg;
+ 	int ret;
+ 
+-	device_property_read_u32(dev, "device-addr", &adc->dev_addr);
++	ret = device_property_read_u32(dev, "microchip,device-addr", &adc->dev_addr);
++
++	/*
++	 * Fallback to "device-addr" due to historical mismatch between
++	 * dt-bindings and implementation
++	 */
++	if (ret)
++		device_property_read_u32(dev, "device-addr", &adc->dev_addr);
+ 	if (adc->dev_addr > 3) {
+ 		dev_err(&adc->spi->dev,
+ 			"invalid device address (%i). Must be in range 0-3.\n",
+diff --git a/drivers/iio/light/cm3605.c b/drivers/iio/light/cm3605.c
+index 50d34a98839c0..a68b95a79d482 100644
+--- a/drivers/iio/light/cm3605.c
++++ b/drivers/iio/light/cm3605.c
+@@ -226,8 +226,10 @@ static int cm3605_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (irq < 0)
+-		return dev_err_probe(dev, irq, "failed to get irq\n");
++	if (irq < 0) {
++		ret = dev_err_probe(dev, irq, "failed to get irq\n");
++		goto out_disable_aset;
++	}
+ 
+ 	ret = devm_request_threaded_irq(dev, irq, cm3605_prox_irq,
+ 					NULL, 0, "cm3605", indio_dev);
+diff --git a/drivers/input/joystick/iforce/iforce-serio.c b/drivers/input/joystick/iforce/iforce-serio.c
+index f95a81b9fac72..2380546d79782 100644
+--- a/drivers/input/joystick/iforce/iforce-serio.c
++++ b/drivers/input/joystick/iforce/iforce-serio.c
+@@ -39,7 +39,7 @@ static void iforce_serio_xmit(struct iforce *iforce)
+ 
+ again:
+ 	if (iforce->xmit.head == iforce->xmit.tail) {
+-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
++		iforce_clear_xmit_and_wake(iforce);
+ 		spin_unlock_irqrestore(&iforce->xmit_lock, flags);
+ 		return;
+ 	}
+@@ -64,7 +64,7 @@ again:
+ 	if (test_and_clear_bit(IFORCE_XMIT_AGAIN, iforce->xmit_flags))
+ 		goto again;
+ 
+-	clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
++	iforce_clear_xmit_and_wake(iforce);
+ 
+ 	spin_unlock_irqrestore(&iforce->xmit_lock, flags);
+ }
+@@ -169,7 +169,7 @@ static irqreturn_t iforce_serio_irq(struct serio *serio,
+ 			iforce_serio->cmd_response_len = iforce_serio->len;
+ 
+ 			/* Signal that command is done */
+-			wake_up(&iforce->wait);
++			wake_up_all(&iforce->wait);
+ 		} else if (likely(iforce->type)) {
+ 			iforce_process_packet(iforce, iforce_serio->id,
+ 					      iforce_serio->data_in,
+diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
+index ea58805c480fa..cba92bd590a8d 100644
+--- a/drivers/input/joystick/iforce/iforce-usb.c
++++ b/drivers/input/joystick/iforce/iforce-usb.c
+@@ -30,7 +30,7 @@ static void __iforce_usb_xmit(struct iforce *iforce)
+ 	spin_lock_irqsave(&iforce->xmit_lock, flags);
+ 
+ 	if (iforce->xmit.head == iforce->xmit.tail) {
+-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
++		iforce_clear_xmit_and_wake(iforce);
+ 		spin_unlock_irqrestore(&iforce->xmit_lock, flags);
+ 		return;
+ 	}
+@@ -58,9 +58,9 @@ static void __iforce_usb_xmit(struct iforce *iforce)
+ 	XMIT_INC(iforce->xmit.tail, n);
+ 
+ 	if ( (n=usb_submit_urb(iforce_usb->out, GFP_ATOMIC)) ) {
+-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
+ 		dev_warn(&iforce_usb->intf->dev,
+ 			 "usb_submit_urb failed %d\n", n);
++		iforce_clear_xmit_and_wake(iforce);
+ 	}
+ 
+ 	/* The IFORCE_XMIT_RUNNING bit is not cleared here. That's intended.
+@@ -175,15 +175,15 @@ static void iforce_usb_out(struct urb *urb)
+ 	struct iforce *iforce = &iforce_usb->iforce;
+ 
+ 	if (urb->status) {
+-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
+ 		dev_dbg(&iforce_usb->intf->dev, "urb->status %d, exiting\n",
+ 			urb->status);
++		iforce_clear_xmit_and_wake(iforce);
+ 		return;
+ 	}
+ 
+ 	__iforce_usb_xmit(iforce);
+ 
+-	wake_up(&iforce->wait);
++	wake_up_all(&iforce->wait);
+ }
+ 
+ static int iforce_usb_probe(struct usb_interface *intf,
+diff --git a/drivers/input/joystick/iforce/iforce.h b/drivers/input/joystick/iforce/iforce.h
+index 6aa761ebbdf77..9ccb9107ccbef 100644
+--- a/drivers/input/joystick/iforce/iforce.h
++++ b/drivers/input/joystick/iforce/iforce.h
+@@ -119,6 +119,12 @@ static inline int iforce_get_id_packet(struct iforce *iforce, u8 id,
+ 					 response_data, response_len);
+ }
+ 
++static inline void iforce_clear_xmit_and_wake(struct iforce *iforce)
++{
++	clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
++	wake_up_all(&iforce->wait);
++}
++
+ /* Public functions */
+ /* iforce-main.c */
+ int iforce_init_device(struct device *parent, u16 bustype,
+diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-pwrkey.c
+index 3fb64dbda1a21..76873aa005b41 100644
+--- a/drivers/input/misc/rk805-pwrkey.c
++++ b/drivers/input/misc/rk805-pwrkey.c
+@@ -98,6 +98,7 @@ static struct platform_driver rk805_pwrkey_driver = {
+ };
+ module_platform_driver(rk805_pwrkey_driver);
+ 
++MODULE_ALIAS("platform:rk805-pwrkey");
+ MODULE_AUTHOR("Joseph Chen <chenjh@××××××××××.com>");
+ MODULE_DESCRIPTION("RK805 PMIC Power Key driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index 0834d5f866fd8..39d2b03e26317 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -1416,42 +1416,37 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ {
+ 	int ret;
+ 	struct device *dev = ir->dev;
+-	char *data;
+-
+-	data = kzalloc(USB_CTRL_MSG_SZ, GFP_KERNEL);
+-	if (!data) {
+-		dev_err(dev, "%s: memory allocation failed!", __func__);
+-		return;
+-	}
++	char data[USB_CTRL_MSG_SZ];
+ 
+ 	/*
+ 	 * This is a strange one. Windows issues a set address to the device
+ 	 * on the receive control pipe and expect a certain value pair back
+ 	 */
+-	ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+-			      USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0,
+-			      data, USB_CTRL_MSG_SZ, 3000);
++	ret = usb_control_msg_recv(ir->usbdev, 0, USB_REQ_SET_ADDRESS,
++				   USB_DIR_IN | USB_TYPE_VENDOR,
++				   0, 0, data, USB_CTRL_MSG_SZ, 3000,
++				   GFP_KERNEL);
+ 	dev_dbg(dev, "set address - ret = %d", ret);
+ 	dev_dbg(dev, "set address - data[0] = %d, data[1] = %d",
+ 						data[0], data[1]);
+ 
+ 	/* set feature: bit rate 38400 bps */
+-	ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+-			      USB_REQ_SET_FEATURE, USB_TYPE_VENDOR,
+-			      0xc04e, 0x0000, NULL, 0, 3000);
++	ret = usb_control_msg_send(ir->usbdev, 0,
++				   USB_REQ_SET_FEATURE, USB_TYPE_VENDOR,
++				   0xc04e, 0x0000, NULL, 0, 3000, GFP_KERNEL);
+ 
+ 	dev_dbg(dev, "set feature - ret = %d", ret);
+ 
+ 	/* bRequest 4: set char length to 8 bits */
+-	ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+-			      4, USB_TYPE_VENDOR,
+-			      0x0808, 0x0000, NULL, 0, 3000);
++	ret = usb_control_msg_send(ir->usbdev, 0,
++				   4, USB_TYPE_VENDOR,
++				   0x0808, 0x0000, NULL, 0, 3000, GFP_KERNEL);
+ 	dev_dbg(dev, "set char length - retB = %d", ret);
+ 
+ 	/* bRequest 2: set handshaking to use DTR/DSR */
+-	ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+-			      2, USB_TYPE_VENDOR,
+-			      0x0000, 0x0100, NULL, 0, 3000);
++	ret = usb_control_msg_send(ir->usbdev, 0,
++				   2, USB_TYPE_VENDOR,
++				   0x0000, 0x0100, NULL, 0, 3000, GFP_KERNEL);
+ 	dev_dbg(dev, "set handshake  - retC = %d", ret);
+ 
+ 	/* device resume */
+@@ -1459,8 +1454,6 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ 
+ 	/* get hw/sw revision? */
+ 	mce_command_out(ir, GET_REVISION, sizeof(GET_REVISION));
+-
+-	kfree(data);
+ }
+ 
+ static void mceusb_gen2_init(struct mceusb_dev *ir)
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 93ebd174d8487..6e312ac856686 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -1943,7 +1943,12 @@ static int fastrpc_cb_probe(struct platform_device *pdev)
+ 	of_property_read_u32(dev->of_node, "qcom,nsessions", &sessions);
+ 
+ 	spin_lock_irqsave(&cctx->lock, flags);
+-	sess = &cctx->session[cctx->sesscount];
++	if (cctx->sesscount >= FASTRPC_MAX_SESSIONS) {
++		dev_err(&pdev->dev, "too many sessions\n");
++		spin_unlock_irqrestore(&cctx->lock, flags);
++		return -ENOSPC;
++	}
++	sess = &cctx->session[cctx->sesscount++];
+ 	sess->used = false;
+ 	sess->valid = true;
+ 	sess->dev = dev;
+@@ -1956,13 +1961,12 @@ static int fastrpc_cb_probe(struct platform_device *pdev)
+ 		struct fastrpc_session_ctx *dup_sess;
+ 
+ 		for (i = 1; i < sessions; i++) {
+-			if (cctx->sesscount++ >= FASTRPC_MAX_SESSIONS)
++			if (cctx->sesscount >= FASTRPC_MAX_SESSIONS)
+ 				break;
+-			dup_sess = &cctx->session[cctx->sesscount];
++			dup_sess = &cctx->session[cctx->sesscount++];
+ 			memcpy(dup_sess, sess, sizeof(*dup_sess));
+ 		}
+ 	}
+-	cctx->sesscount++;
+ 	spin_unlock_irqrestore(&cctx->lock, flags);
+ 	rc = dma_set_mask(dev, DMA_BIT_MASK(32));
+ 	if (rc) {
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index c5f1df6ce4c0a..5e4e2d2182d91 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -949,15 +949,16 @@ int mmc_sd_setup_card(struct mmc_host *host, struct mmc_card *card,
+ 
+ 		/* Erase init depends on CSD and SSR */
+ 		mmc_init_erase(card);
+-
+-		/*
+-		 * Fetch switch information from card.
+-		 */
+-		err = mmc_read_switch(card);
+-		if (err)
+-			return err;
+ 	}
+ 
++	/*
++	 * Fetch switch information from card. Note, sd3_bus_mode can change if
++	 * voltage switch outcome changes, so do this always.
++	 */
++	err = mmc_read_switch(card);
++	if (err)
++		return err;
++
+ 	/*
+ 	 * For SPI, enable CRC as appropriate.
+ 	 * This CRC enable is located AFTER the reading of the
+@@ -1480,26 +1481,15 @@ retry:
+ 	if (!v18_fixup_failed && !mmc_host_is_spi(host) && mmc_host_uhs(host) &&
+ 	    mmc_sd_card_using_v18(card) &&
+ 	    host->ios.signal_voltage != MMC_SIGNAL_VOLTAGE_180) {
+-		/*
+-		 * Re-read switch information in case it has changed since
+-		 * oldcard was initialized.
+-		 */
+-		if (oldcard) {
+-			err = mmc_read_switch(card);
+-			if (err)
+-				goto free_card;
+-		}
+-		if (mmc_sd_card_using_v18(card)) {
+-			if (mmc_host_set_uhs_voltage(host) ||
+-			    mmc_sd_init_uhs_card(card)) {
+-				v18_fixup_failed = true;
+-				mmc_power_cycle(host, ocr);
+-				if (!oldcard)
+-					mmc_remove_card(card);
+-				goto retry;
+-			}
+-			goto done;
++		if (mmc_host_set_uhs_voltage(host) ||
++		    mmc_sd_init_uhs_card(card)) {
++			v18_fixup_failed = true;
++			mmc_power_cycle(host, ocr);
++			if (!oldcard)
++				mmc_remove_card(card);
++			goto retry;
+ 		}
++		goto cont;
+ 	}
+ 
+ 	/* Initialization sequence for UHS-I cards */
+@@ -1534,7 +1524,7 @@ retry:
+ 			mmc_set_bus_width(host, MMC_BUS_WIDTH_4);
+ 		}
+ 	}
+-
++cont:
+ 	if (!oldcard) {
+ 		/* Read/parse the extension registers. */
+ 		err = sd_read_ext_regs(card);
+@@ -1566,7 +1556,7 @@ retry:
+ 		err = -EINVAL;
+ 		goto free_card;
+ 	}
+-done:
++
+ 	host->card = card;
+ 	return 0;
+ 
+diff --git a/drivers/net/dsa/xrs700x/xrs700x.c b/drivers/net/dsa/xrs700x/xrs700x.c
+index 3887ed33c5fe2..fa622639d6401 100644
+--- a/drivers/net/dsa/xrs700x/xrs700x.c
++++ b/drivers/net/dsa/xrs700x/xrs700x.c
+@@ -109,6 +109,7 @@ static void xrs700x_read_port_counters(struct xrs700x *priv, int port)
+ {
+ 	struct xrs700x_port *p = &priv->ports[port];
+ 	struct rtnl_link_stats64 stats;
++	unsigned long flags;
+ 	int i;
+ 
+ 	memset(&stats, 0, sizeof(stats));
+@@ -138,9 +139,9 @@ static void xrs700x_read_port_counters(struct xrs700x *priv, int port)
+ 	 */
+ 	stats.rx_packets += stats.multicast;
+ 
+-	u64_stats_update_begin(&p->syncp);
++	flags = u64_stats_update_begin_irqsave(&p->syncp);
+ 	p->stats64 = stats;
+-	u64_stats_update_end(&p->syncp);
++	u64_stats_update_end_irqrestore(&p->syncp, flags);
+ 
+ 	mutex_unlock(&p->mib_mutex);
+ }
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 9e6de2f968fa3..6dae768671e3d 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -1919,7 +1919,7 @@ static void gmac_get_stats64(struct net_device *netdev,
+ 
+ 	/* Racing with RX NAPI */
+ 	do {
+-		start = u64_stats_fetch_begin(&port->rx_stats_syncp);
++		start = u64_stats_fetch_begin_irq(&port->rx_stats_syncp);
+ 
+ 		stats->rx_packets = port->stats.rx_packets;
+ 		stats->rx_bytes = port->stats.rx_bytes;
+@@ -1931,11 +1931,11 @@ static void gmac_get_stats64(struct net_device *netdev,
+ 		stats->rx_crc_errors = port->stats.rx_crc_errors;
+ 		stats->rx_frame_errors = port->stats.rx_frame_errors;
+ 
+-	} while (u64_stats_fetch_retry(&port->rx_stats_syncp, start));
++	} while (u64_stats_fetch_retry_irq(&port->rx_stats_syncp, start));
+ 
+ 	/* Racing with MIB and TX completion interrupts */
+ 	do {
+-		start = u64_stats_fetch_begin(&port->ir_stats_syncp);
++		start = u64_stats_fetch_begin_irq(&port->ir_stats_syncp);
+ 
+ 		stats->tx_errors = port->stats.tx_errors;
+ 		stats->tx_packets = port->stats.tx_packets;
+@@ -1945,15 +1945,15 @@ static void gmac_get_stats64(struct net_device *netdev,
+ 		stats->rx_missed_errors = port->stats.rx_missed_errors;
+ 		stats->rx_fifo_errors = port->stats.rx_fifo_errors;
+ 
+-	} while (u64_stats_fetch_retry(&port->ir_stats_syncp, start));
++	} while (u64_stats_fetch_retry_irq(&port->ir_stats_syncp, start));
+ 
+ 	/* Racing with hard_start_xmit */
+ 	do {
+-		start = u64_stats_fetch_begin(&port->tx_stats_syncp);
++		start = u64_stats_fetch_begin_irq(&port->tx_stats_syncp);
+ 
+ 		stats->tx_dropped = port->stats.tx_dropped;
+ 
+-	} while (u64_stats_fetch_retry(&port->tx_stats_syncp, start));
++	} while (u64_stats_fetch_retry_irq(&port->tx_stats_syncp, start));
+ 
+ 	stats->rx_dropped += stats->rx_missed_errors;
+ }
+@@ -2031,18 +2031,18 @@ static void gmac_get_ethtool_stats(struct net_device *netdev,
+ 	/* Racing with MIB interrupt */
+ 	do {
+ 		p = values;
+-		start = u64_stats_fetch_begin(&port->ir_stats_syncp);
++		start = u64_stats_fetch_begin_irq(&port->ir_stats_syncp);
+ 
+ 		for (i = 0; i < RX_STATS_NUM; i++)
+ 			*p++ = port->hw_stats[i];
+ 
+-	} while (u64_stats_fetch_retry(&port->ir_stats_syncp, start));
++	} while (u64_stats_fetch_retry_irq(&port->ir_stats_syncp, start));
+ 	values = p;
+ 
+ 	/* Racing with RX NAPI */
+ 	do {
+ 		p = values;
+-		start = u64_stats_fetch_begin(&port->rx_stats_syncp);
++		start = u64_stats_fetch_begin_irq(&port->rx_stats_syncp);
+ 
+ 		for (i = 0; i < RX_STATUS_NUM; i++)
+ 			*p++ = port->rx_stats[i];
+@@ -2050,13 +2050,13 @@ static void gmac_get_ethtool_stats(struct net_device *netdev,
+ 			*p++ = port->rx_csum_stats[i];
+ 		*p++ = port->rx_napi_exits;
+ 
+-	} while (u64_stats_fetch_retry(&port->rx_stats_syncp, start));
++	} while (u64_stats_fetch_retry_irq(&port->rx_stats_syncp, start));
+ 	values = p;
+ 
+ 	/* Racing with TX start_xmit */
+ 	do {
+ 		p = values;
+-		start = u64_stats_fetch_begin(&port->tx_stats_syncp);
++		start = u64_stats_fetch_begin_irq(&port->tx_stats_syncp);
+ 
+ 		for (i = 0; i < TX_MAX_FRAGS; i++) {
+ 			*values++ = port->tx_frag_stats[i];
+@@ -2065,7 +2065,7 @@ static void gmac_get_ethtool_stats(struct net_device *netdev,
+ 		*values++ = port->tx_frags_linearized;
+ 		*values++ = port->tx_hw_csummed;
+ 
+-	} while (u64_stats_fetch_retry(&port->tx_stats_syncp, start));
++	} while (u64_stats_fetch_retry_irq(&port->tx_stats_syncp, start));
+ }
+ 
+ static int gmac_get_ksettings(struct net_device *netdev,
+diff --git a/drivers/net/ethernet/fungible/funeth/funeth_txrx.h b/drivers/net/ethernet/fungible/funeth/funeth_txrx.h
+index 8708e2895946d..6b125ed04bbad 100644
+--- a/drivers/net/ethernet/fungible/funeth/funeth_txrx.h
++++ b/drivers/net/ethernet/fungible/funeth/funeth_txrx.h
+@@ -205,9 +205,9 @@ struct funeth_rxq {
+ 
+ #define FUN_QSTAT_READ(q, seq, stats_copy) \
+ 	do { \
+-		seq = u64_stats_fetch_begin(&(q)->syncp); \
++		seq = u64_stats_fetch_begin_irq(&(q)->syncp); \
+ 		stats_copy = (q)->stats; \
+-	} while (u64_stats_fetch_retry(&(q)->syncp, (seq)))
++	} while (u64_stats_fetch_retry_irq(&(q)->syncp, (seq)))
+ 
+ #define FUN_INT_NAME_LEN (IFNAMSIZ + 16)
+ 
+diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c
+index 50b384910c839..7b9a2d9d96243 100644
+--- a/drivers/net/ethernet/google/gve/gve_ethtool.c
++++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
+@@ -177,14 +177,14 @@ gve_get_ethtool_stats(struct net_device *netdev,
+ 				struct gve_rx_ring *rx = &priv->rx[ring];
+ 
+ 				start =
+-				  u64_stats_fetch_begin(&priv->rx[ring].statss);
++				  u64_stats_fetch_begin_irq(&priv->rx[ring].statss);
+ 				tmp_rx_pkts = rx->rpackets;
+ 				tmp_rx_bytes = rx->rbytes;
+ 				tmp_rx_skb_alloc_fail = rx->rx_skb_alloc_fail;
+ 				tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail;
+ 				tmp_rx_desc_err_dropped_pkt =
+ 					rx->rx_desc_err_dropped_pkt;
+-			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,
++			} while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss,
+ 						       start));
+ 			rx_pkts += tmp_rx_pkts;
+ 			rx_bytes += tmp_rx_bytes;
+@@ -198,10 +198,10 @@ gve_get_ethtool_stats(struct net_device *netdev,
+ 		if (priv->tx) {
+ 			do {
+ 				start =
+-				  u64_stats_fetch_begin(&priv->tx[ring].statss);
++				  u64_stats_fetch_begin_irq(&priv->tx[ring].statss);
+ 				tmp_tx_pkts = priv->tx[ring].pkt_done;
+ 				tmp_tx_bytes = priv->tx[ring].bytes_done;
+-			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,
++			} while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss,
+ 						       start));
+ 			tx_pkts += tmp_tx_pkts;
+ 			tx_bytes += tmp_tx_bytes;
+@@ -259,13 +259,13 @@ gve_get_ethtool_stats(struct net_device *netdev,
+ 			data[i++] = rx->fill_cnt - rx->cnt;
+ 			do {
+ 				start =
+-				  u64_stats_fetch_begin(&priv->rx[ring].statss);
++				  u64_stats_fetch_begin_irq(&priv->rx[ring].statss);
+ 				tmp_rx_bytes = rx->rbytes;
+ 				tmp_rx_skb_alloc_fail = rx->rx_skb_alloc_fail;
+ 				tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail;
+ 				tmp_rx_desc_err_dropped_pkt =
+ 					rx->rx_desc_err_dropped_pkt;
+-			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,
++			} while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss,
+ 						       start));
+ 			data[i++] = tmp_rx_bytes;
+ 			data[i++] = rx->rx_cont_packet_cnt;
+@@ -331,9 +331,9 @@ gve_get_ethtool_stats(struct net_device *netdev,
+ 			}
+ 			do {
+ 				start =
+-				  u64_stats_fetch_begin(&priv->tx[ring].statss);
++				  u64_stats_fetch_begin_irq(&priv->tx[ring].statss);
+ 				tmp_tx_bytes = tx->bytes_done;
+-			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,
++			} while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss,
+ 						       start));
+ 			data[i++] = tmp_tx_bytes;
+ 			data[i++] = tx->wake_queue;
+diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
+index 6cafee55efc32..044db3ebb071c 100644
+--- a/drivers/net/ethernet/google/gve/gve_main.c
++++ b/drivers/net/ethernet/google/gve/gve_main.c
+@@ -51,10 +51,10 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
+ 		for (ring = 0; ring < priv->rx_cfg.num_queues; ring++) {
+ 			do {
+ 				start =
+-				  u64_stats_fetch_begin(&priv->rx[ring].statss);
++				  u64_stats_fetch_begin_irq(&priv->rx[ring].statss);
+ 				packets = priv->rx[ring].rpackets;
+ 				bytes = priv->rx[ring].rbytes;
+-			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,
++			} while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss,
+ 						       start));
+ 			s->rx_packets += packets;
+ 			s->rx_bytes += bytes;
+@@ -64,10 +64,10 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
+ 		for (ring = 0; ring < priv->tx_cfg.num_queues; ring++) {
+ 			do {
+ 				start =
+-				  u64_stats_fetch_begin(&priv->tx[ring].statss);
++				  u64_stats_fetch_begin_irq(&priv->tx[ring].statss);
+ 				packets = priv->tx[ring].pkt_done;
+ 				bytes = priv->tx[ring].bytes_done;
+-			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,
++			} while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss,
+ 						       start));
+ 			s->tx_packets += packets;
+ 			s->tx_bytes += bytes;
+@@ -1274,9 +1274,9 @@ void gve_handle_report_stats(struct gve_priv *priv)
+ 			}
+ 
+ 			do {
+-				start = u64_stats_fetch_begin(&priv->tx[idx].statss);
++				start = u64_stats_fetch_begin_irq(&priv->tx[idx].statss);
+ 				tx_bytes = priv->tx[idx].bytes_done;
+-			} while (u64_stats_fetch_retry(&priv->tx[idx].statss, start));
++			} while (u64_stats_fetch_retry_irq(&priv->tx[idx].statss, start));
+ 			stats[stats_idx++] = (struct stats) {
+ 				.stat_name = cpu_to_be32(TX_WAKE_CNT),
+ 				.value = cpu_to_be64(priv->tx[idx].wake_queue),
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+index a866bea651103..e5828a658caf4 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+@@ -74,14 +74,14 @@ void hinic_rxq_get_stats(struct hinic_rxq *rxq, struct hinic_rxq_stats *stats)
+ 	unsigned int start;
+ 
+ 	do {
+-		start = u64_stats_fetch_begin(&rxq_stats->syncp);
++		start = u64_stats_fetch_begin_irq(&rxq_stats->syncp);
+ 		stats->pkts = rxq_stats->pkts;
+ 		stats->bytes = rxq_stats->bytes;
+ 		stats->errors = rxq_stats->csum_errors +
+ 				rxq_stats->other_errors;
+ 		stats->csum_errors = rxq_stats->csum_errors;
+ 		stats->other_errors = rxq_stats->other_errors;
+-	} while (u64_stats_fetch_retry(&rxq_stats->syncp, start));
++	} while (u64_stats_fetch_retry_irq(&rxq_stats->syncp, start));
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
+index 5051cdff2384b..3b6c7b5857376 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
+@@ -99,14 +99,14 @@ void hinic_txq_get_stats(struct hinic_txq *txq, struct hinic_txq_stats *stats)
+ 	unsigned int start;
+ 
+ 	do {
+-		start = u64_stats_fetch_begin(&txq_stats->syncp);
++		start = u64_stats_fetch_begin_irq(&txq_stats->syncp);
+ 		stats->pkts    = txq_stats->pkts;
+ 		stats->bytes   = txq_stats->bytes;
+ 		stats->tx_busy = txq_stats->tx_busy;
+ 		stats->tx_wake = txq_stats->tx_wake;
+ 		stats->tx_dropped = txq_stats->tx_dropped;
+ 		stats->big_frags_pkts = txq_stats->big_frags_pkts;
+-	} while (u64_stats_fetch_retry(&txq_stats->syncp, start));
++	} while (u64_stats_fetch_retry_irq(&txq_stats->syncp, start));
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
+index 5fdf9b7179f55..5a1027b072155 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
+@@ -75,6 +75,7 @@ struct mlxbf_gige {
+ 	struct net_device *netdev;
+ 	struct platform_device *pdev;
+ 	void __iomem *mdio_io;
++	void __iomem *clk_io;
+ 	struct mii_bus *mdiobus;
+ 	spinlock_t lock;      /* for packet processing indices */
+ 	u16 rx_q_entries;
+@@ -137,7 +138,8 @@ enum mlxbf_gige_res {
+ 	MLXBF_GIGE_RES_MDIO9,
+ 	MLXBF_GIGE_RES_GPIO0,
+ 	MLXBF_GIGE_RES_LLU,
+-	MLXBF_GIGE_RES_PLU
++	MLXBF_GIGE_RES_PLU,
++	MLXBF_GIGE_RES_CLK
+ };
+ 
+ /* Version of register data returned by mlxbf_gige_get_regs() */
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c
+index 2e6c1b7af0964..85155cd9405c5 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c
+@@ -22,10 +22,23 @@
+ #include <linux/property.h>
+ 
+ #include "mlxbf_gige.h"
++#include "mlxbf_gige_regs.h"
+ 
+ #define MLXBF_GIGE_MDIO_GW_OFFSET	0x0
+ #define MLXBF_GIGE_MDIO_CFG_OFFSET	0x4
+ 
++#define MLXBF_GIGE_MDIO_FREQ_REFERENCE 156250000ULL
++#define MLXBF_GIGE_MDIO_COREPLL_CONST  16384ULL
++#define MLXBF_GIGE_MDC_CLK_NS          400
++#define MLXBF_GIGE_MDIO_PLL_I1CLK_REG1 0x4
++#define MLXBF_GIGE_MDIO_PLL_I1CLK_REG2 0x8
++#define MLXBF_GIGE_MDIO_CORE_F_SHIFT   0
++#define MLXBF_GIGE_MDIO_CORE_F_MASK    GENMASK(25, 0)
++#define MLXBF_GIGE_MDIO_CORE_R_SHIFT   26
++#define MLXBF_GIGE_MDIO_CORE_R_MASK    GENMASK(31, 26)
++#define MLXBF_GIGE_MDIO_CORE_OD_SHIFT  0
++#define MLXBF_GIGE_MDIO_CORE_OD_MASK   GENMASK(3, 0)
++
+ /* Support clause 22 */
+ #define MLXBF_GIGE_MDIO_CL22_ST1	0x1
+ #define MLXBF_GIGE_MDIO_CL22_WRITE	0x1
+@@ -50,27 +63,76 @@
+ #define MLXBF_GIGE_MDIO_CFG_MDIO_IN_SAMP_MASK		GENMASK(23, 16)
+ #define MLXBF_GIGE_MDIO_CFG_MDIO_OUT_SAMP_MASK		GENMASK(31, 24)
+ 
++#define MLXBF_GIGE_MDIO_CFG_VAL (FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_MODE_MASK, 1) | \
++				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO3_3_MASK, 1) | \
++				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_FULL_DRIVE_MASK, 1) | \
++				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_IN_SAMP_MASK, 6) | \
++				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_OUT_SAMP_MASK, 13))
++
++#define MLXBF_GIGE_BF2_COREPLL_ADDR 0x02800c30
++#define MLXBF_GIGE_BF2_COREPLL_SIZE 0x0000000c
++
++static struct resource corepll_params[] = {
++	[MLXBF_GIGE_VERSION_BF2] = {
++		.start = MLXBF_GIGE_BF2_COREPLL_ADDR,
++		.end = MLXBF_GIGE_BF2_COREPLL_ADDR + MLXBF_GIGE_BF2_COREPLL_SIZE - 1,
++		.name = "COREPLL_RES"
++	},
++};
++
++/* Returns core clock i1clk in Hz */
++static u64 calculate_i1clk(struct mlxbf_gige *priv)
++{
++	u8 core_od, core_r;
++	u64 freq_output;
++	u32 reg1, reg2;
++	u32 core_f;
++
++	reg1 = readl(priv->clk_io + MLXBF_GIGE_MDIO_PLL_I1CLK_REG1);
++	reg2 = readl(priv->clk_io + MLXBF_GIGE_MDIO_PLL_I1CLK_REG2);
++
++	core_f = (reg1 & MLXBF_GIGE_MDIO_CORE_F_MASK) >>
++		MLXBF_GIGE_MDIO_CORE_F_SHIFT;
++	core_r = (reg1 & MLXBF_GIGE_MDIO_CORE_R_MASK) >>
++		MLXBF_GIGE_MDIO_CORE_R_SHIFT;
++	core_od = (reg2 & MLXBF_GIGE_MDIO_CORE_OD_MASK) >>
++		MLXBF_GIGE_MDIO_CORE_OD_SHIFT;
++
++	/* Compute PLL output frequency as follow:
++	 *
++	 *                                     CORE_F / 16384
++	 * freq_output = freq_reference * ----------------------------
++	 *                              (CORE_R + 1) * (CORE_OD + 1)
++	 */
++	freq_output = div_u64((MLXBF_GIGE_MDIO_FREQ_REFERENCE * core_f),
++			      MLXBF_GIGE_MDIO_COREPLL_CONST);
++	freq_output = div_u64(freq_output, (core_r + 1) * (core_od + 1));
++
++	return freq_output;
++}
++
+ /* Formula for encoding the MDIO period. The encoded value is
+  * passed to the MDIO config register.
+  *
+- * mdc_clk = 2*(val + 1)*i1clk
++ * mdc_clk = 2*(val + 1)*(core clock in sec)
+  *
+- * 400 ns = 2*(val + 1)*(((1/430)*1000) ns)
++ * i1clk is in Hz:
++ * 400 ns = 2*(val + 1)*(1/i1clk)
+  *
+- * val = (((400 * 430 / 1000) / 2) - 1)
++ * val = (((400/10^9) / (1/i1clk) / 2) - 1)
++ * val = (400/2 * i1clk)/10^9 - 1
+  */
+-#define MLXBF_GIGE_I1CLK_MHZ		430
+-#define MLXBF_GIGE_MDC_CLK_NS		400
++static u8 mdio_period_map(struct mlxbf_gige *priv)
++{
++	u8 mdio_period;
++	u64 i1clk;
+ 
+-#define MLXBF_GIGE_MDIO_PERIOD	(((MLXBF_GIGE_MDC_CLK_NS * MLXBF_GIGE_I1CLK_MHZ / 1000) / 2) - 1)
++	i1clk = calculate_i1clk(priv);
+ 
+-#define MLXBF_GIGE_MDIO_CFG_VAL (FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_MODE_MASK, 1) | \
+-				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO3_3_MASK, 1) | \
+-				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_FULL_DRIVE_MASK, 1) | \
+-				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDC_PERIOD_MASK, \
+-					    MLXBF_GIGE_MDIO_PERIOD) | \
+-				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_IN_SAMP_MASK, 6) | \
+-				 FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDIO_OUT_SAMP_MASK, 13))
++	mdio_period = div_u64((MLXBF_GIGE_MDC_CLK_NS >> 1) * i1clk, 1000000000) - 1;
++
++	return mdio_period;
++}
+ 
+ static u32 mlxbf_gige_mdio_create_cmd(u16 data, int phy_add,
+ 				      int phy_reg, u32 opcode)
+@@ -124,9 +186,9 @@ static int mlxbf_gige_mdio_write(struct mii_bus *bus, int phy_add,
+ 				 int phy_reg, u16 val)
+ {
+ 	struct mlxbf_gige *priv = bus->priv;
++	u32 temp;
+ 	u32 cmd;
+ 	int ret;
+-	u32 temp;
+ 
+ 	if (phy_reg & MII_ADDR_C45)
+ 		return -EOPNOTSUPP;
+@@ -144,18 +206,44 @@ static int mlxbf_gige_mdio_write(struct mii_bus *bus, int phy_add,
+ 	return ret;
+ }
+ 
++static void mlxbf_gige_mdio_cfg(struct mlxbf_gige *priv)
++{
++	u8 mdio_period;
++	u32 val;
++
++	mdio_period = mdio_period_map(priv);
++
++	val = MLXBF_GIGE_MDIO_CFG_VAL;
++	val |= FIELD_PREP(MLXBF_GIGE_MDIO_CFG_MDC_PERIOD_MASK, mdio_period);
++	writel(val, priv->mdio_io + MLXBF_GIGE_MDIO_CFG_OFFSET);
++}
++
+ int mlxbf_gige_mdio_probe(struct platform_device *pdev, struct mlxbf_gige *priv)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct resource *res;
+ 	int ret;
+ 
+ 	priv->mdio_io = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MDIO9);
+ 	if (IS_ERR(priv->mdio_io))
+ 		return PTR_ERR(priv->mdio_io);
+ 
+-	/* Configure mdio parameters */
+-	writel(MLXBF_GIGE_MDIO_CFG_VAL,
+-	       priv->mdio_io + MLXBF_GIGE_MDIO_CFG_OFFSET);
++	/* clk resource shared with other drivers so cannot use
++	 * devm_platform_ioremap_resource
++	 */
++	res = platform_get_resource(pdev, IORESOURCE_MEM, MLXBF_GIGE_RES_CLK);
++	if (!res) {
++		/* For backward compatibility with older ACPI tables, also keep
++		 * CLK resource internal to the driver.
++		 */
++		res = &corepll_params[MLXBF_GIGE_VERSION_BF2];
++	}
++
++	priv->clk_io = devm_ioremap(dev, res->start, resource_size(res));
++	if (IS_ERR(priv->clk_io))
++		return PTR_ERR(priv->clk_io);
++
++	mlxbf_gige_mdio_cfg(priv);
+ 
+ 	priv->mdiobus = devm_mdiobus_alloc(dev);
+ 	if (!priv->mdiobus) {
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h
+index 5fb33c9294bf9..7be3a793984d5 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h
+@@ -8,6 +8,8 @@
+ #ifndef __MLXBF_GIGE_REGS_H__
+ #define __MLXBF_GIGE_REGS_H__
+ 
++#define MLXBF_GIGE_VERSION                            0x0000
++#define MLXBF_GIGE_VERSION_BF2                        0x0
+ #define MLXBF_GIGE_STATUS                             0x0010
+ #define MLXBF_GIGE_STATUS_READY                       BIT(0)
+ #define MLXBF_GIGE_INT_STATUS                         0x0028
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
+index fe663b0ab7086..68d87e61bdc05 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
+@@ -423,7 +423,8 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev,
+ 
+ 	parms = mlxsw_sp_ipip_netdev_parms4(to_dev);
+ 	ip_tunnel_init_flow(&fl4, parms.iph.protocol, *daddrp, *saddrp,
+-			    0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0);
++			    0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0,
++			    0);
+ 
+ 	rt = ip_route_output_key(tun->net, &fl4);
+ 	if (IS_ERR(rt))
+diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+index 6dea7f8c14814..51f8a08163777 100644
+--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+@@ -425,7 +425,8 @@ static struct sk_buff *lan966x_fdma_rx_get_frame(struct lan966x_rx *rx)
+ 	lan966x_ifh_get_src_port(skb->data, &src_port);
+ 	lan966x_ifh_get_timestamp(skb->data, &timestamp);
+ 
+-	WARN_ON(src_port >= lan966x->num_phys_ports);
++	if (WARN_ON(src_port >= lan966x->num_phys_ports))
++		goto free_skb;
+ 
+ 	skb->dev = lan966x->ports[src_port]->dev;
+ 	skb_pull(skb, IFH_LEN * sizeof(u32));
+@@ -449,6 +450,8 @@ static struct sk_buff *lan966x_fdma_rx_get_frame(struct lan966x_rx *rx)
+ 
+ 	return skb;
+ 
++free_skb:
++	kfree_skb(skb);
+ unmap_page:
+ 	dma_unmap_page(lan966x->dev, (dma_addr_t)db->dataptr,
+ 		       FDMA_DCB_STATUS_BLOCKL(db->status),
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c b/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
+index 304f84aadc36b..21844beba72df 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
+@@ -113,6 +113,8 @@ static void sparx5_xtr_grp(struct sparx5 *sparx5, u8 grp, bool byte_swap)
+ 			/* This assumes STATUS_WORD_POS == 1, Status
+ 			 * just after last data
+ 			 */
++			if (!byte_swap)
++				val = ntohl((__force __be32)val);
+ 			byte_cnt -= (4 - XTR_VALID_BYTES(val));
+ 			eof_flag = true;
+ 			break;
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c b/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c
+index 3206ba83b1aaa..de2ef5bf8c694 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c
+@@ -127,10 +127,11 @@ static int nfp_policer_validate(const struct flow_action *action,
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
++	if (act->police.notexceed.act_id != FLOW_ACTION_CONTINUE &&
++	    act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
+ 	    act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
+ 		NL_SET_ERR_MSG_MOD(extack,
+-				   "Offload not supported when conform action is not pipe or ok");
++				   "Offload not supported when conform action is not continue, pipe or ok");
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index 4e56a99087fab..32d46f07ea851 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -1629,21 +1629,21 @@ static void nfp_net_stat64(struct net_device *netdev,
+ 		unsigned int start;
+ 
+ 		do {
+-			start = u64_stats_fetch_begin(&r_vec->rx_sync);
++			start = u64_stats_fetch_begin_irq(&r_vec->rx_sync);
+ 			data[0] = r_vec->rx_pkts;
+ 			data[1] = r_vec->rx_bytes;
+ 			data[2] = r_vec->rx_drops;
+-		} while (u64_stats_fetch_retry(&r_vec->rx_sync, start));
++		} while (u64_stats_fetch_retry_irq(&r_vec->rx_sync, start));
+ 		stats->rx_packets += data[0];
+ 		stats->rx_bytes += data[1];
+ 		stats->rx_dropped += data[2];
+ 
+ 		do {
+-			start = u64_stats_fetch_begin(&r_vec->tx_sync);
++			start = u64_stats_fetch_begin_irq(&r_vec->tx_sync);
+ 			data[0] = r_vec->tx_pkts;
+ 			data[1] = r_vec->tx_bytes;
+ 			data[2] = r_vec->tx_errors;
+-		} while (u64_stats_fetch_retry(&r_vec->tx_sync, start));
++		} while (u64_stats_fetch_retry_irq(&r_vec->tx_sync, start));
+ 		stats->tx_packets += data[0];
+ 		stats->tx_bytes += data[1];
+ 		stats->tx_errors += data[2];
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index e6ee45afd80c7..2d7d30ec54301 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -494,7 +494,7 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data)
+ 		unsigned int start;
+ 
+ 		do {
+-			start = u64_stats_fetch_begin(&nn->r_vecs[i].rx_sync);
++			start = u64_stats_fetch_begin_irq(&nn->r_vecs[i].rx_sync);
+ 			data[0] = nn->r_vecs[i].rx_pkts;
+ 			tmp[0] = nn->r_vecs[i].hw_csum_rx_ok;
+ 			tmp[1] = nn->r_vecs[i].hw_csum_rx_inner_ok;
+@@ -502,10 +502,10 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data)
+ 			tmp[3] = nn->r_vecs[i].hw_csum_rx_error;
+ 			tmp[4] = nn->r_vecs[i].rx_replace_buf_alloc_fail;
+ 			tmp[5] = nn->r_vecs[i].hw_tls_rx;
+-		} while (u64_stats_fetch_retry(&nn->r_vecs[i].rx_sync, start));
++		} while (u64_stats_fetch_retry_irq(&nn->r_vecs[i].rx_sync, start));
+ 
+ 		do {
+-			start = u64_stats_fetch_begin(&nn->r_vecs[i].tx_sync);
++			start = u64_stats_fetch_begin_irq(&nn->r_vecs[i].tx_sync);
+ 			data[1] = nn->r_vecs[i].tx_pkts;
+ 			data[2] = nn->r_vecs[i].tx_busy;
+ 			tmp[6] = nn->r_vecs[i].hw_csum_tx;
+@@ -515,7 +515,7 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data)
+ 			tmp[10] = nn->r_vecs[i].hw_tls_tx;
+ 			tmp[11] = nn->r_vecs[i].tls_tx_fallback;
+ 			tmp[12] = nn->r_vecs[i].tls_tx_no_fallback;
+-		} while (u64_stats_fetch_retry(&nn->r_vecs[i].tx_sync, start));
++		} while (u64_stats_fetch_retry_irq(&nn->r_vecs[i].tx_sync, start));
+ 
+ 		data += NN_RVEC_PER_Q_STATS;
+ 
+diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
+index bc70c6abd6a5b..58cf7cc54f408 100644
+--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
++++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
+@@ -1273,7 +1273,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *ofdpa_port,
+ 	bool removing;
+ 	int err = 0;
+ 
+-	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
++	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+ 	if (!entry)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 3bf20211cceb4..3829c2805b16c 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1037,6 +1037,8 @@ static int smsc911x_mii_probe(struct net_device *dev)
+ 		return ret;
+ 	}
+ 
++	/* Indicate that the MAC is responsible for managing PHY PM */
++	phydev->mac_managed_pm = true;
+ 	phy_attached_info(phydev);
+ 
+ 	phy_set_max_speed(phydev, SPEED_100);
+@@ -2587,6 +2589,8 @@ static int smsc911x_suspend(struct device *dev)
+ 	if (netif_running(ndev)) {
+ 		netif_stop_queue(ndev);
+ 		netif_device_detach(ndev);
++		if (!device_may_wakeup(dev))
++			phy_stop(ndev->phydev);
+ 	}
+ 
+ 	/* enable wake on LAN, energy detection and the external PME
+@@ -2628,6 +2632,8 @@ static int smsc911x_resume(struct device *dev)
+ 	if (netif_running(ndev)) {
+ 		netif_device_attach(ndev);
+ 		netif_start_queue(ndev);
++		if (!device_may_wakeup(dev))
++			phy_start(ndev->phydev);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index 6afdf1622944e..5cf218c674a5a 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -1310,10 +1310,11 @@ static void adf7242_remove(struct spi_device *spi)
+ 
+ 	debugfs_remove_recursive(lp->debugfs_root);
+ 
++	ieee802154_unregister_hw(lp->hw);
++
+ 	cancel_delayed_work_sync(&lp->work);
+ 	destroy_workqueue(lp->wqueue);
+ 
+-	ieee802154_unregister_hw(lp->hw);
+ 	mutex_destroy(&lp->bmux);
+ 	ieee802154_free_hw(lp->hw);
+ }
+diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
+index e470e3398abc2..9a1a5b2036240 100644
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -67,10 +67,10 @@ nsim_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+ 	unsigned int start;
+ 
+ 	do {
+-		start = u64_stats_fetch_begin(&ns->syncp);
++		start = u64_stats_fetch_begin_irq(&ns->syncp);
+ 		stats->tx_bytes = ns->tx_bytes;
+ 		stats->tx_packets = ns->tx_packets;
+-	} while (u64_stats_fetch_retry(&ns->syncp, start));
++	} while (u64_stats_fetch_retry_irq(&ns->syncp, start));
+ }
+ 
+ static int
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 22139901f01c7..34483a4bd688a 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -2838,12 +2838,18 @@ static int lan8814_config_init(struct phy_device *phydev)
+ 	return 0;
+ }
+ 
++/* It is expected that there will not be any 'lan8814_take_coma_mode'
++ * function called in suspend. Because the GPIO line can be shared, so if one of
++ * the phys goes back in coma mode, then all the other PHYs will go, which is
++ * wrong.
++ */
+ static int lan8814_release_coma_mode(struct phy_device *phydev)
+ {
+ 	struct gpio_desc *gpiod;
+ 
+ 	gpiod = devm_gpiod_get_optional(&phydev->mdio.dev, "coma-mode",
+-					GPIOD_OUT_HIGH_OPEN_DRAIN);
++					GPIOD_OUT_HIGH_OPEN_DRAIN |
++					GPIOD_FLAGS_BIT_NONEXCLUSIVE);
+ 	if (IS_ERR(gpiod))
+ 		return PTR_ERR(gpiod);
+ 
+diff --git a/drivers/peci/controller/peci-aspeed.c b/drivers/peci/controller/peci-aspeed.c
+index 1925ddc13f002..731c5d8f75c66 100644
+--- a/drivers/peci/controller/peci-aspeed.c
++++ b/drivers/peci/controller/peci-aspeed.c
+@@ -523,7 +523,7 @@ static int aspeed_peci_probe(struct platform_device *pdev)
+ 		return PTR_ERR(priv->base);
+ 
+ 	priv->irq = platform_get_irq(pdev, 0);
+-	if (!priv->irq)
++	if (priv->irq < 0)
+ 		return priv->irq;
+ 
+ 	ret = devm_request_irq(&pdev->dev, priv->irq, aspeed_peci_irq_handler,
+diff --git a/drivers/platform/mellanox/mlxreg-lc.c b/drivers/platform/mellanox/mlxreg-lc.c
+index 55834ccb4ac7c..e578c7bc060bb 100644
+--- a/drivers/platform/mellanox/mlxreg-lc.c
++++ b/drivers/platform/mellanox/mlxreg-lc.c
+@@ -460,8 +460,6 @@ static int mlxreg_lc_power_on_off(struct mlxreg_lc *mlxreg_lc, u8 action)
+ 	u32 regval;
+ 	int err;
+ 
+-	mutex_lock(&mlxreg_lc->lock);
+-
+ 	err = regmap_read(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_pwr, &regval);
+ 	if (err)
+ 		goto regmap_read_fail;
+@@ -474,7 +472,6 @@ static int mlxreg_lc_power_on_off(struct mlxreg_lc *mlxreg_lc, u8 action)
+ 	err = regmap_write(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_pwr, regval);
+ 
+ regmap_read_fail:
+-	mutex_unlock(&mlxreg_lc->lock);
+ 	return err;
+ }
+ 
+@@ -491,8 +488,6 @@ static int mlxreg_lc_enable_disable(struct mlxreg_lc *mlxreg_lc, bool action)
+ 	 * line card which is already has been enabled. Disabling does not affect the disabled line
+ 	 * card.
+ 	 */
+-	mutex_lock(&mlxreg_lc->lock);
+-
+ 	err = regmap_read(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_ena, &regval);
+ 	if (err)
+ 		goto regmap_read_fail;
+@@ -505,7 +500,6 @@ static int mlxreg_lc_enable_disable(struct mlxreg_lc *mlxreg_lc, bool action)
+ 	err = regmap_write(mlxreg_lc->par_regmap, mlxreg_lc->data->reg_ena, regval);
+ 
+ regmap_read_fail:
+-	mutex_unlock(&mlxreg_lc->lock);
+ 	return err;
+ }
+ 
+@@ -537,6 +531,15 @@ mlxreg_lc_sn4800_c16_config_init(struct mlxreg_lc *mlxreg_lc, void *regmap,
+ 
+ static void
+ mlxreg_lc_state_update(struct mlxreg_lc *mlxreg_lc, enum mlxreg_lc_state state, u8 action)
++{
++	if (action)
++		mlxreg_lc->state |= state;
++	else
++		mlxreg_lc->state &= ~state;
++}
++
++static void
++mlxreg_lc_state_update_locked(struct mlxreg_lc *mlxreg_lc, enum mlxreg_lc_state state, u8 action)
+ {
+ 	mutex_lock(&mlxreg_lc->lock);
+ 
+@@ -560,8 +563,11 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind,
+ 	dev_info(mlxreg_lc->dev, "linecard#%d state %d event kind %d action %d\n",
+ 		 mlxreg_lc->data->slot, mlxreg_lc->state, kind, action);
+ 
+-	if (!(mlxreg_lc->state & MLXREG_LC_INITIALIZED))
++	mutex_lock(&mlxreg_lc->lock);
++	if (!(mlxreg_lc->state & MLXREG_LC_INITIALIZED)) {
++		mutex_unlock(&mlxreg_lc->lock);
+ 		return 0;
++	}
+ 
+ 	switch (kind) {
+ 	case MLXREG_HOTPLUG_LC_SYNCED:
+@@ -574,7 +580,7 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind,
+ 		if (!(mlxreg_lc->state & MLXREG_LC_POWERED) && action) {
+ 			err = mlxreg_lc_power_on_off(mlxreg_lc, 1);
+ 			if (err)
+-				return err;
++				goto mlxreg_lc_power_on_off_fail;
+ 		}
+ 		/* In case line card is configured - enable it. */
+ 		if (mlxreg_lc->state & MLXREG_LC_CONFIGURED && action)
+@@ -588,12 +594,13 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind,
+ 				/* In case line card is configured - enable it. */
+ 				if (mlxreg_lc->state & MLXREG_LC_CONFIGURED)
+ 					err = mlxreg_lc_enable_disable(mlxreg_lc, 1);
++				mutex_unlock(&mlxreg_lc->lock);
+ 				return err;
+ 			}
+ 			err = mlxreg_lc_create_static_devices(mlxreg_lc, mlxreg_lc->main_devs,
+ 							      mlxreg_lc->main_devs_num);
+ 			if (err)
+-				return err;
++				goto mlxreg_lc_create_static_devices_fail;
+ 
+ 			/* In case line card is already in ready state - enable it. */
+ 			if (mlxreg_lc->state & MLXREG_LC_CONFIGURED)
+@@ -620,6 +627,10 @@ static int mlxreg_lc_event_handler(void *handle, enum mlxreg_hotplug_kind kind,
+ 		break;
+ 	}
+ 
++mlxreg_lc_power_on_off_fail:
++mlxreg_lc_create_static_devices_fail:
++	mutex_unlock(&mlxreg_lc->lock);
++
+ 	return err;
+ }
+ 
+@@ -665,7 +676,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent,
+ 		if (err)
+ 			goto mlxreg_lc_create_static_devices_failed;
+ 
+-		mlxreg_lc_state_update(mlxreg_lc, MLXREG_LC_POWERED, 1);
++		mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_POWERED, 1);
+ 	}
+ 
+ 	/* Verify if line card is synchronized. */
+@@ -676,7 +687,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent,
+ 	/* Power on line card if necessary. */
+ 	if (regval & mlxreg_lc->data->mask) {
+ 		mlxreg_lc->state |= MLXREG_LC_SYNCED;
+-		mlxreg_lc_state_update(mlxreg_lc, MLXREG_LC_SYNCED, 1);
++		mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_SYNCED, 1);
+ 		if (mlxreg_lc->state & ~MLXREG_LC_POWERED) {
+ 			err = mlxreg_lc_power_on_off(mlxreg_lc, 1);
+ 			if (err)
+@@ -684,7 +695,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent,
+ 		}
+ 	}
+ 
+-	mlxreg_lc_state_update(mlxreg_lc, MLXREG_LC_INITIALIZED, 1);
++	mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_INITIALIZED, 1);
+ 
+ 	return 0;
+ 
+@@ -863,7 +874,6 @@ static int mlxreg_lc_probe(struct platform_device *pdev)
+ 	if (err) {
+ 		dev_err(&pdev->dev, "Failed to sync regmap for client %s at bus %d at addr 0x%02x\n",
+ 			data->hpdev.brdinfo->type, data->hpdev.nr, data->hpdev.brdinfo->addr);
+-		err = PTR_ERR(regmap);
+ 		goto regcache_sync_fail;
+ 	}
+ 
+@@ -905,6 +915,8 @@ static int mlxreg_lc_remove(struct platform_device *pdev)
+ 	struct mlxreg_core_data *data = dev_get_platdata(&pdev->dev);
+ 	struct mlxreg_lc *mlxreg_lc = platform_get_drvdata(pdev);
+ 
++	mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_INITIALIZED, 0);
++
+ 	/*
+ 	 * Probing and removing are invoked by hotplug events raised upon line card insertion and
+ 	 * removing. If probing procedure fails all data is cleared. However, hotplug event still
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 154317e9910d2..5c757c7f64dee 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -232,7 +232,7 @@ static void pmc_power_off(void)
+ 	pm1_cnt_port = acpi_base_addr + PM1_CNT;
+ 
+ 	pm1_cnt_value = inl(pm1_cnt_port);
+-	pm1_cnt_value &= SLEEP_TYPE_MASK;
++	pm1_cnt_value &= ~SLEEP_TYPE_MASK;
+ 	pm1_cnt_value |= SLEEP_TYPE_S5;
+ 	pm1_cnt_value |= SLEEP_ENABLE;
+ 
+diff --git a/drivers/platform/x86/x86-android-tablets.c b/drivers/platform/x86/x86-android-tablets.c
+index 4803759774358..4acd6fa8d43b8 100644
+--- a/drivers/platform/x86/x86-android-tablets.c
++++ b/drivers/platform/x86/x86-android-tablets.c
+@@ -663,9 +663,23 @@ static const struct x86_i2c_client_info chuwi_hi8_i2c_clients[] __initconst = {
+ 	},
+ };
+ 
++static int __init chuwi_hi8_init(void)
++{
++	/*
++	 * Avoid the acpi_unregister_gsi() call in x86_acpi_irq_helper_get()
++	 * breaking the touchscreen + logging various errors when the Windows
++	 * BIOS is used.
++	 */
++	if (acpi_dev_present("MSSL0001", NULL, 1))
++		return -ENODEV;
++
++	return 0;
++}
++
+ static const struct x86_dev_info chuwi_hi8_info __initconst = {
+ 	.i2c_client_info = chuwi_hi8_i2c_clients,
+ 	.i2c_client_count = ARRAY_SIZE(chuwi_hi8_i2c_clients),
++	.init = chuwi_hi8_init,
+ };
+ 
+ #define CZC_EC_EXTRA_PORT	0x68
+diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
+index b5ec7726592c8..71d2931cb885c 100644
+--- a/drivers/soundwire/qcom.c
++++ b/drivers/soundwire/qcom.c
+@@ -167,7 +167,7 @@ struct qcom_swrm_ctrl {
+ 	u8 wcmd_id;
+ 	struct qcom_swrm_port_config pconfig[QCOM_SDW_MAX_PORTS];
+ 	struct sdw_stream_runtime *sruntime[SWRM_MAX_DAIS];
+-	enum sdw_slave_status status[SDW_MAX_DEVICES];
++	enum sdw_slave_status status[SDW_MAX_DEVICES + 1];
+ 	int (*reg_read)(struct qcom_swrm_ctrl *ctrl, int reg, u32 *val);
+ 	int (*reg_write)(struct qcom_swrm_ctrl *ctrl, int reg, int val);
+ 	u32 slave_status;
+@@ -411,7 +411,7 @@ static int qcom_swrm_get_alert_slave_dev_num(struct qcom_swrm_ctrl *ctrl)
+ 
+ 	ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val);
+ 
+-	for (dev_num = 0; dev_num < SDW_MAX_DEVICES; dev_num++) {
++	for (dev_num = 0; dev_num <= SDW_MAX_DEVICES; dev_num++) {
+ 		status = (val >> (dev_num * SWRM_MCP_SLV_STATUS_SZ));
+ 
+ 		if ((status & SWRM_MCP_SLV_STATUS_MASK) == SDW_SLAVE_ALERT) {
+@@ -431,7 +431,7 @@ static void qcom_swrm_get_device_status(struct qcom_swrm_ctrl *ctrl)
+ 	ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val);
+ 	ctrl->slave_status = val;
+ 
+-	for (i = 0; i < SDW_MAX_DEVICES; i++) {
++	for (i = 0; i <= SDW_MAX_DEVICES; i++) {
+ 		u32 s;
+ 
+ 		s = (val >> (i * 2));
+diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c
+index cac9553666e6d..aa100b5141e1e 100644
+--- a/drivers/staging/r8188eu/os_dep/os_intfs.c
++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
+@@ -18,6 +18,7 @@ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek Wireless Lan Driver");
+ MODULE_AUTHOR("Realtek Semiconductor Corp.");
+ MODULE_VERSION(DRIVERVERSION);
++MODULE_FIRMWARE("rtlwifi/rtl8188eufw.bin");
+ 
+ #define CONFIG_BR_EXT_BRNAME "br0"
+ #define RTW_NOTCH_FILTER 0 /* 0:Disable, 1:Enable, */
+diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c
+index 68869c5daeff8..e5dc977d2fa21 100644
+--- a/drivers/staging/r8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/r8188eu/os_dep/usb_intf.c
+@@ -28,6 +28,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
+ 	/*=== Realtek demoboard ===*/
+ 	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8179)}, /* 8188EUS */
+ 	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
++	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill USB-N150 Nano */
+ 	/*=== Customer ID ===*/
+ 	/****** 8188EUS ********/
+ 	{USB_DEVICE(0x07B8, 0x8179)}, /* Abocom - Abocom */
+diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
+index 2326aae6709e2..bb7db96ed8219 100644
+--- a/drivers/staging/rtl8712/rtl8712_cmd.c
++++ b/drivers/staging/rtl8712/rtl8712_cmd.c
+@@ -117,34 +117,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
+ 	kfree(pdrvcmd->pbuf);
+ }
+ 
+-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+-{
+-	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj	*pcmd);
+-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
+-
+-	/*  invoke cmd->callback function */
+-	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+-	if (!pcmd_callback)
+-		r8712_free_cmd_obj(pcmd);
+-	else
+-		pcmd_callback(padapter, pcmd);
+-	return H2C_SUCCESS;
+-}
+-
+-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+-{
+-	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj	*pcmd);
+-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
+-
+-	/*  invoke cmd->callback function */
+-	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+-	if (!pcmd_callback)
+-		r8712_free_cmd_obj(pcmd);
+-	else
+-		pcmd_callback(padapter, pcmd);
+-	return H2C_SUCCESS;
+-}
+-
+ static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
+ {
+ 	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
+@@ -213,14 +185,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
+ 	pcmd_r = NULL;
+ 
+ 	switch (pcmd->cmdcode) {
+-	case GEN_CMD_CODE(_Read_MACREG):
+-		read_macreg_hdl(padapter, (u8 *)pcmd);
+-		pcmd_r = pcmd;
+-		break;
+-	case GEN_CMD_CODE(_Write_MACREG):
+-		write_macreg_hdl(padapter, (u8 *)pcmd);
+-		pcmd_r = pcmd;
+-		break;
+ 	case GEN_CMD_CODE(_Read_BBREG):
+ 		read_bbreg_hdl(padapter, (u8 *)pcmd);
+ 		break;
+diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
+index e92c658dba1c6..3f7827d72c480 100644
+--- a/drivers/thunderbolt/ctl.c
++++ b/drivers/thunderbolt/ctl.c
+@@ -407,7 +407,7 @@ static void tb_ctl_rx_submit(struct ctl_pkg *pkg)
+ 
+ static int tb_async_error(const struct ctl_pkg *pkg)
+ {
+-	const struct cfg_error_pkg *error = (const struct cfg_error_pkg *)pkg;
++	const struct cfg_error_pkg *error = pkg->buffer;
+ 
+ 	if (pkg->frame.eof != TB_CFG_PKG_ERROR)
+ 		return false;
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 561e1d77240e2..64f0aec7e70ae 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -3781,14 +3781,18 @@ int tb_switch_pcie_l1_enable(struct tb_switch *sw)
+  */
+ int tb_switch_xhci_connect(struct tb_switch *sw)
+ {
+-	bool usb_port1, usb_port3, xhci_port1, xhci_port3;
+ 	struct tb_port *port1, *port3;
+ 	int ret;
+ 
++	if (sw->generation != 3)
++		return 0;
++
+ 	port1 = &sw->ports[1];
+ 	port3 = &sw->ports[3];
+ 
+ 	if (tb_switch_is_alpine_ridge(sw)) {
++		bool usb_port1, usb_port3, xhci_port1, xhci_port3;
++
+ 		usb_port1 = tb_lc_is_usb_plugged(port1);
+ 		usb_port3 = tb_lc_is_usb_plugged(port3);
+ 		xhci_port1 = tb_lc_is_xhci_connected(port1);
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index caa5c14ed57f0..01c112e2e2142 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -248,7 +248,7 @@ struct gsm_mux {
+ 	bool constipated;		/* Asked by remote to shut up */
+ 	bool has_devices;		/* Devices were registered */
+ 
+-	spinlock_t tx_lock;
++	struct mutex tx_mutex;
+ 	unsigned int tx_bytes;		/* TX data outstanding */
+ #define TX_THRESH_HI		8192
+ #define TX_THRESH_LO		2048
+@@ -256,7 +256,7 @@ struct gsm_mux {
+ 	struct list_head tx_data_list;	/* Pending data packets */
+ 
+ 	/* Control messages */
+-	struct timer_list kick_timer;	/* Kick TX queuing on timeout */
++	struct delayed_work kick_timeout;	/* Kick TX queuing on timeout */
+ 	struct timer_list t2_timer;	/* Retransmit timer for commands */
+ 	int cretries;			/* Command retry counter */
+ 	struct gsm_control *pending_cmd;/* Our current pending command */
+@@ -680,7 +680,6 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control)
+ 	struct gsm_msg *msg;
+ 	u8 *dp;
+ 	int ocr;
+-	unsigned long flags;
+ 
+ 	msg = gsm_data_alloc(gsm, addr, 0, control);
+ 	if (!msg)
+@@ -702,10 +701,10 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control)
+ 
+ 	gsm_print_packet("Q->", addr, cr, control, NULL, 0);
+ 
+-	spin_lock_irqsave(&gsm->tx_lock, flags);
++	mutex_lock(&gsm->tx_mutex);
+ 	list_add_tail(&msg->list, &gsm->tx_ctrl_list);
+ 	gsm->tx_bytes += msg->len;
+-	spin_unlock_irqrestore(&gsm->tx_lock, flags);
++	mutex_unlock(&gsm->tx_mutex);
+ 	gsmld_write_trigger(gsm);
+ 
+ 	return 0;
+@@ -730,7 +729,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+ 	spin_unlock_irqrestore(&dlci->lock, flags);
+ 
+ 	/* Clear data packets in MUX write queue */
+-	spin_lock_irqsave(&gsm->tx_lock, flags);
++	mutex_lock(&gsm->tx_mutex);
+ 	list_for_each_entry_safe(msg, nmsg, &gsm->tx_data_list, list) {
+ 		if (msg->addr != addr)
+ 			continue;
+@@ -738,7 +737,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+ 		list_del(&msg->list);
+ 		kfree(msg);
+ 	}
+-	spin_unlock_irqrestore(&gsm->tx_lock, flags);
++	mutex_unlock(&gsm->tx_mutex);
+ }
+ 
+ /**
+@@ -1009,7 +1008,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+ 	gsm->tx_bytes += msg->len;
+ 
+ 	gsmld_write_trigger(gsm);
+-	mod_timer(&gsm->kick_timer, jiffies + 10 * gsm->t1 * HZ / 100);
++	schedule_delayed_work(&gsm->kick_timeout, 10 * gsm->t1 * HZ / 100);
+ }
+ 
+ /**
+@@ -1024,10 +1023,9 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+ 
+ static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+ {
+-	unsigned long flags;
+-	spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
++	mutex_lock(&dlci->gsm->tx_mutex);
+ 	__gsm_data_queue(dlci, msg);
+-	spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags);
++	mutex_unlock(&dlci->gsm->tx_mutex);
+ }
+ 
+ /**
+@@ -1039,7 +1037,7 @@ static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+  *	is data. Keep to the MRU of the mux. This path handles the usual tty
+  *	interface which is a byte stream with optional modem data.
+  *
+- *	Caller must hold the tx_lock of the mux.
++ *	Caller must hold the tx_mutex of the mux.
+  */
+ 
+ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+@@ -1099,7 +1097,7 @@ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+  *	is data. Keep to the MRU of the mux. This path handles framed data
+  *	queued as skbuffs to the DLCI.
+  *
+- *	Caller must hold the tx_lock of the mux.
++ *	Caller must hold the tx_mutex of the mux.
+  */
+ 
+ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
+@@ -1115,7 +1113,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
+ 	if (dlci->adaption == 4)
+ 		overhead = 1;
+ 
+-	/* dlci->skb is locked by tx_lock */
++	/* dlci->skb is locked by tx_mutex */
+ 	if (dlci->skb == NULL) {
+ 		dlci->skb = skb_dequeue_tail(&dlci->skb_list);
+ 		if (dlci->skb == NULL)
+@@ -1169,7 +1167,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
+  *	Push an empty frame in to the transmit queue to update the modem status
+  *	bits and to transmit an optional break.
+  *
+- *	Caller must hold the tx_lock of the mux.
++ *	Caller must hold the tx_mutex of the mux.
+  */
+ 
+ static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci,
+@@ -1283,13 +1281,12 @@ static int gsm_dlci_data_sweep(struct gsm_mux *gsm)
+ 
+ static void gsm_dlci_data_kick(struct gsm_dlci *dlci)
+ {
+-	unsigned long flags;
+ 	int sweep;
+ 
+ 	if (dlci->constipated)
+ 		return;
+ 
+-	spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
++	mutex_lock(&dlci->gsm->tx_mutex);
+ 	/* If we have nothing running then we need to fire up */
+ 	sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO);
+ 	if (dlci->gsm->tx_bytes == 0) {
+@@ -1300,7 +1297,7 @@ static void gsm_dlci_data_kick(struct gsm_dlci *dlci)
+ 	}
+ 	if (sweep)
+ 		gsm_dlci_data_sweep(dlci->gsm);
+-	spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags);
++	mutex_unlock(&dlci->gsm->tx_mutex);
+ }
+ 
+ /*
+@@ -1984,24 +1981,23 @@ static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len)
+ }
+ 
+ /**
+- *	gsm_kick_timer	-	transmit if possible
+- *	@t: timer contained in our gsm object
++ *	gsm_kick_timeout	-	transmit if possible
++ *	@work: work contained in our gsm object
+  *
+  *	Transmit data from DLCIs if the queue is empty. We can't rely on
+  *	a tty wakeup except when we filled the pipe so we need to fire off
+  *	new data ourselves in other cases.
+  */
+-static void gsm_kick_timer(struct timer_list *t)
++static void gsm_kick_timeout(struct work_struct *work)
+ {
+-	struct gsm_mux *gsm = from_timer(gsm, t, kick_timer);
+-	unsigned long flags;
++	struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work);
+ 	int sent = 0;
+ 
+-	spin_lock_irqsave(&gsm->tx_lock, flags);
++	mutex_lock(&gsm->tx_mutex);
+ 	/* If we have nothing running then we need to fire up */
+ 	if (gsm->tx_bytes < TX_THRESH_LO)
+ 		sent = gsm_dlci_data_sweep(gsm);
+-	spin_unlock_irqrestore(&gsm->tx_lock, flags);
++	mutex_unlock(&gsm->tx_mutex);
+ 
+ 	if (sent && debug & 4)
+ 		pr_info("%s TX queue stalled\n", __func__);
+@@ -2458,7 +2454,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
+ 	}
+ 
+ 	/* Finish outstanding timers, making sure they are done */
+-	del_timer_sync(&gsm->kick_timer);
++	cancel_delayed_work_sync(&gsm->kick_timeout);
+ 	del_timer_sync(&gsm->t2_timer);
+ 
+ 	/* Finish writing to ldisc */
+@@ -2501,13 +2497,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
+ 	if (dlci == NULL)
+ 		return -ENOMEM;
+ 
+-	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
+-	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+-	INIT_WORK(&gsm->tx_work, gsmld_write_task);
+-	init_waitqueue_head(&gsm->event);
+-	spin_lock_init(&gsm->control_lock);
+-	spin_lock_init(&gsm->tx_lock);
+-
+ 	if (gsm->encoding == 0)
+ 		gsm->receive = gsm0_receive;
+ 	else
+@@ -2538,6 +2527,7 @@ static void gsm_free_mux(struct gsm_mux *gsm)
+ 			break;
+ 		}
+ 	}
++	mutex_destroy(&gsm->tx_mutex);
+ 	mutex_destroy(&gsm->mutex);
+ 	kfree(gsm->txframe);
+ 	kfree(gsm->buf);
+@@ -2609,9 +2599,15 @@ static struct gsm_mux *gsm_alloc_mux(void)
+ 	}
+ 	spin_lock_init(&gsm->lock);
+ 	mutex_init(&gsm->mutex);
++	mutex_init(&gsm->tx_mutex);
+ 	kref_init(&gsm->ref);
+ 	INIT_LIST_HEAD(&gsm->tx_ctrl_list);
+ 	INIT_LIST_HEAD(&gsm->tx_data_list);
++	INIT_DELAYED_WORK(&gsm->kick_timeout, gsm_kick_timeout);
++	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
++	INIT_WORK(&gsm->tx_work, gsmld_write_task);
++	init_waitqueue_head(&gsm->event);
++	spin_lock_init(&gsm->control_lock);
+ 
+ 	gsm->t1 = T1;
+ 	gsm->t2 = T2;
+@@ -2636,6 +2632,7 @@ static struct gsm_mux *gsm_alloc_mux(void)
+ 	}
+ 	spin_unlock(&gsm_mux_lock);
+ 	if (i == MAX_MUX) {
++		mutex_destroy(&gsm->tx_mutex);
+ 		mutex_destroy(&gsm->mutex);
+ 		kfree(gsm->txframe);
+ 		kfree(gsm->buf);
+@@ -2791,17 +2788,16 @@ static void gsmld_write_trigger(struct gsm_mux *gsm)
+ static void gsmld_write_task(struct work_struct *work)
+ {
+ 	struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work);
+-	unsigned long flags;
+ 	int i, ret;
+ 
+ 	/* All outstanding control channel and control messages and one data
+ 	 * frame is sent.
+ 	 */
+ 	ret = -ENODEV;
+-	spin_lock_irqsave(&gsm->tx_lock, flags);
++	mutex_lock(&gsm->tx_mutex);
+ 	if (gsm->tty)
+ 		ret = gsm_data_kick(gsm);
+-	spin_unlock_irqrestore(&gsm->tx_lock, flags);
++	mutex_unlock(&gsm->tx_mutex);
+ 
+ 	if (ret >= 0)
+ 		for (i = 0; i < NUM_DLCI; i++)
+@@ -2858,7 +2854,8 @@ static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+ 			flags = *fp++;
+ 		switch (flags) {
+ 		case TTY_NORMAL:
+-			gsm->receive(gsm, *cp);
++			if (gsm->receive)
++				gsm->receive(gsm, *cp);
+ 			break;
+ 		case TTY_OVERRUN:
+ 		case TTY_BREAK:
+@@ -2946,10 +2943,6 @@ static int gsmld_open(struct tty_struct *tty)
+ 
+ 	gsmld_attach_gsm(tty, gsm);
+ 
+-	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
+-	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+-	INIT_WORK(&gsm->tx_work, gsmld_write_task);
+-
+ 	return 0;
+ }
+ 
+@@ -3012,7 +3005,6 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file,
+ 			   const unsigned char *buf, size_t nr)
+ {
+ 	struct gsm_mux *gsm = tty->disc_data;
+-	unsigned long flags;
+ 	int space;
+ 	int ret;
+ 
+@@ -3020,13 +3012,13 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file,
+ 		return -ENODEV;
+ 
+ 	ret = -ENOBUFS;
+-	spin_lock_irqsave(&gsm->tx_lock, flags);
++	mutex_lock(&gsm->tx_mutex);
+ 	space = tty_write_room(tty);
+ 	if (space >= nr)
+ 		ret = tty->ops->write(tty, buf, nr);
+ 	else
+ 		set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+-	spin_unlock_irqrestore(&gsm->tx_lock, flags);
++	mutex_unlock(&gsm->tx_mutex);
+ 
+ 	return ret;
+ }
+@@ -3323,14 +3315,13 @@ static struct tty_ldisc_ops tty_ldisc_packet = {
+ static void gsm_modem_upd_via_data(struct gsm_dlci *dlci, u8 brk)
+ {
+ 	struct gsm_mux *gsm = dlci->gsm;
+-	unsigned long flags;
+ 
+ 	if (dlci->state != DLCI_OPEN || dlci->adaption != 2)
+ 		return;
+ 
+-	spin_lock_irqsave(&gsm->tx_lock, flags);
++	mutex_lock(&gsm->tx_mutex);
+ 	gsm_dlci_modem_output(gsm, dlci, brk);
+-	spin_unlock_irqrestore(&gsm->tx_lock, flags);
++	mutex_unlock(&gsm->tx_mutex);
+ }
+ 
+ /**
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index dd1c7e4bd1c95..400a1686a6b26 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -296,9 +296,6 @@ static int atmel_config_rs485(struct uart_port *port,
+ 
+ 	mode = atmel_uart_readl(port, ATMEL_US_MR);
+ 
+-	/* Resetting serial mode to RS232 (0x0) */
+-	mode &= ~ATMEL_US_USMODE;
+-
+ 	if (rs485conf->flags & SER_RS485_ENABLED) {
+ 		dev_dbg(port->dev, "Setting UART to RS485\n");
+ 		if (rs485conf->flags & SER_RS485_RX_DURING_TX)
+@@ -308,6 +305,7 @@ static int atmel_config_rs485(struct uart_port *port,
+ 
+ 		atmel_uart_writel(port, ATMEL_US_TTGR,
+ 				  rs485conf->delay_rts_after_send);
++		mode &= ~ATMEL_US_USMODE;
+ 		mode |= ATMEL_US_USMODE_RS485;
+ 	} else {
+ 		dev_dbg(port->dev, "Setting UART to RS232\n");
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 561d6d0b7c945..2945c1b890880 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1381,9 +1381,9 @@ static int lpuart_config_rs485(struct uart_port *port,
+ 		 * Note: UART is assumed to be active high.
+ 		 */
+ 		if (rs485->flags & SER_RS485_RTS_ON_SEND)
+-			modem &= ~UARTMODEM_TXRTSPOL;
+-		else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
+ 			modem |= UARTMODEM_TXRTSPOL;
++		else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
++			modem &= ~UARTMODEM_TXRTSPOL;
+ 	}
+ 
+ 	writeb(modem, sport->port.membase + UARTMODEM);
+@@ -2182,6 +2182,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	uart_update_timeout(port, termios->c_cflag, baud);
+ 
+ 	/* wait transmit engin complete */
++	lpuart32_write(&sport->port, 0, UARTMODIR);
+ 	lpuart32_wait_bit_set(&sport->port, UARTSTAT, UARTSTAT_TC);
+ 
+ 	/* disable transmit and receive */
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 6eaf8eb846619..b8f5bc19416d9 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4662,9 +4662,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
+ 	console_lock();
+ 	if (vc->vc_mode != KD_TEXT)
+ 		rc = -EINVAL;
+-	else if (vc->vc_sw->con_font_set)
++	else if (vc->vc_sw->con_font_set) {
++		if (vc_is_sel(vc))
++			clear_selection();
+ 		rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
+-	else
++	} else
+ 		rc = -ENOSYS;
+ 	console_unlock();
+ 	kfree(font.data);
+@@ -4691,9 +4693,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
+ 		console_unlock();
+ 		return -EINVAL;
+ 	}
+-	if (vc->vc_sw->con_font_default)
++	if (vc->vc_sw->con_font_default) {
++		if (vc_is_sel(vc))
++			clear_selection();
+ 		rc = vc->vc_sw->con_font_default(vc, &font, s);
+-	else
++	} else
+ 		rc = -ENOSYS;
+ 	console_unlock();
+ 	if (!rc) {
+diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
+index d21b69997e750..5adcb349718c3 100644
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -1530,7 +1530,8 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev,
+ 						TRB_LEN(le32_to_cpu(trb->length));
+ 
+ 				if (priv_req->num_of_trb > 1 &&
+-					le32_to_cpu(trb->control) & TRB_SMM)
++					le32_to_cpu(trb->control) & TRB_SMM &&
++					le32_to_cpu(trb->control) & TRB_CHAIN)
+ 					transfer_end = true;
+ 
+ 				cdns3_ep_inc_deq(priv_ep);
+@@ -1690,6 +1691,7 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep)
+ 				ep_cfg &= ~EP_CFG_ENABLE;
+ 				writel(ep_cfg, &priv_dev->regs->ep_cfg);
+ 				priv_ep->flags &= ~EP_QUIRK_ISO_OUT_EN;
++				priv_ep->flags |= EP_UPDATE_EP_TRBADDR;
+ 			}
+ 			cdns3_transfer_completed(priv_dev, priv_ep);
+ 		} else if (!(priv_ep->flags & EP_STALLED) &&
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 9b9aea24d58c4..f3c6aad277895 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1810,6 +1810,9 @@ static const struct usb_device_id acm_ids[] = {
+ 	{ USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
+ 	.driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
+ 	},
++	{ USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */
++	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
++	},
+ 	{ USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
+ 	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ 	},
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 68e9121c18788..dfef85a18eb55 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -6048,6 +6048,11 @@ re_enumerate:
+  * the reset is over (using their post_reset method).
+  *
+  * Return: The same as for usb_reset_and_verify_device().
++ * However, if a reset is already in progress (for instance, if a
++ * driver doesn't have pre_ or post_reset() callbacks, and while
++ * being unbound or re-bound during the ongoing reset its disconnect()
++ * or probe() routine tries to perform a second, nested reset), the
++ * routine returns -EINPROGRESS.
+  *
+  * Note:
+  * The caller must own the device lock.  For example, it's safe to use
+@@ -6081,6 +6086,10 @@ int usb_reset_device(struct usb_device *udev)
+ 		return -EISDIR;
+ 	}
+ 
++	if (udev->reset_in_progress)
++		return -EINPROGRESS;
++	udev->reset_in_progress = 1;
++
+ 	port_dev = hub->ports[udev->portnum - 1];
+ 
+ 	/*
+@@ -6145,6 +6154,7 @@ int usb_reset_device(struct usb_device *udev)
+ 
+ 	usb_autosuspend_device(udev);
+ 	memalloc_noio_restore(noio_flag);
++	udev->reset_in_progress = 0;
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(usb_reset_device);
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index c8ba87df7abef..fd0ccf6f3ec5a 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -154,9 +154,9 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg)
+ 	} else if (hsotg->plat && hsotg->plat->phy_init) {
+ 		ret = hsotg->plat->phy_init(pdev, hsotg->plat->phy_type);
+ 	} else {
+-		ret = phy_power_on(hsotg->phy);
++		ret = phy_init(hsotg->phy);
+ 		if (ret == 0)
+-			ret = phy_init(hsotg->phy);
++			ret = phy_power_on(hsotg->phy);
+ 	}
+ 
+ 	return ret;
+@@ -188,9 +188,9 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
+ 	} else if (hsotg->plat && hsotg->plat->phy_exit) {
+ 		ret = hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type);
+ 	} else {
+-		ret = phy_exit(hsotg->phy);
++		ret = phy_power_off(hsotg->phy);
+ 		if (ret == 0)
+-			ret = phy_power_off(hsotg->phy);
++			ret = phy_exit(hsotg->phy);
+ 	}
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index ba2fa91be1d64..1db9f51f98aef 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -833,15 +833,16 @@ static void dwc3_core_exit(struct dwc3 *dwc)
+ {
+ 	dwc3_event_buffers_cleanup(dwc);
+ 
++	usb_phy_set_suspend(dwc->usb2_phy, 1);
++	usb_phy_set_suspend(dwc->usb3_phy, 1);
++	phy_power_off(dwc->usb2_generic_phy);
++	phy_power_off(dwc->usb3_generic_phy);
++
+ 	usb_phy_shutdown(dwc->usb2_phy);
+ 	usb_phy_shutdown(dwc->usb3_phy);
+ 	phy_exit(dwc->usb2_generic_phy);
+ 	phy_exit(dwc->usb3_generic_phy);
+ 
+-	usb_phy_set_suspend(dwc->usb2_phy, 1);
+-	usb_phy_set_suspend(dwc->usb3_phy, 1);
+-	phy_power_off(dwc->usb2_generic_phy);
+-	phy_power_off(dwc->usb3_generic_phy);
+ 	dwc3_clk_disable(dwc);
+ 	reset_control_assert(dwc->reset);
+ }
+@@ -1844,16 +1845,16 @@ err5:
+ 	dwc3_debugfs_exit(dwc);
+ 	dwc3_event_buffers_cleanup(dwc);
+ 
+-	usb_phy_shutdown(dwc->usb2_phy);
+-	usb_phy_shutdown(dwc->usb3_phy);
+-	phy_exit(dwc->usb2_generic_phy);
+-	phy_exit(dwc->usb3_generic_phy);
+-
+ 	usb_phy_set_suspend(dwc->usb2_phy, 1);
+ 	usb_phy_set_suspend(dwc->usb3_phy, 1);
+ 	phy_power_off(dwc->usb2_generic_phy);
+ 	phy_power_off(dwc->usb3_generic_phy);
+ 
++	usb_phy_shutdown(dwc->usb2_phy);
++	usb_phy_shutdown(dwc->usb3_phy);
++	phy_exit(dwc->usb2_generic_phy);
++	phy_exit(dwc->usb3_generic_phy);
++
+ 	dwc3_ulpi_exit(dwc);
+ 
+ err4:
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 6b018048fe2e1..4ee4ca09873af 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -44,6 +44,7 @@
+ #define PCI_DEVICE_ID_INTEL_ADLP		0x51ee
+ #define PCI_DEVICE_ID_INTEL_ADLM		0x54ee
+ #define PCI_DEVICE_ID_INTEL_ADLS		0x7ae1
++#define PCI_DEVICE_ID_INTEL_RPL			0x460e
+ #define PCI_DEVICE_ID_INTEL_RPLS		0x7a61
+ #define PCI_DEVICE_ID_INTEL_MTLP		0x7ec1
+ #define PCI_DEVICE_ID_INTEL_MTL			0x7e7e
+@@ -456,6 +457,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS),
+ 	  (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+ 
++	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPL),
++	  (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS),
+ 	  (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+ 
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 52d5a7c81362a..886fab0008a75 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2538,9 +2538,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ 
+ 	is_on = !!is_on;
+ 
+-	if (dwc->pullups_connected == is_on)
+-		return 0;
+-
+ 	dwc->softconnect = is_on;
+ 
+ 	/*
+@@ -2565,6 +2562,11 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ 		return 0;
+ 	}
+ 
++	if (dwc->pullups_connected == is_on) {
++		pm_runtime_put(dwc->dev);
++		return 0;
++	}
++
+ 	if (!is_on) {
+ 		ret = dwc3_gadget_soft_disconnect(dwc);
+ 	} else {
+diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
+index f56c30cf151e4..06b3d988fbf32 100644
+--- a/drivers/usb/dwc3/host.c
++++ b/drivers/usb/dwc3/host.c
+@@ -11,8 +11,13 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ 
++#include "../host/xhci-plat.h"
+ #include "core.h"
+ 
++static const struct xhci_plat_priv dwc3_xhci_plat_priv = {
++	.quirks = XHCI_SKIP_PHY_INIT,
++};
++
+ static void dwc3_host_fill_xhci_irq_res(struct dwc3 *dwc,
+ 					int irq, char *name)
+ {
+@@ -92,6 +97,11 @@ int dwc3_host_init(struct dwc3 *dwc)
+ 		goto err;
+ 	}
+ 
++	ret = platform_device_add_data(xhci, &dwc3_xhci_plat_priv,
++					sizeof(dwc3_xhci_plat_priv));
++	if (ret)
++		goto err;
++
+ 	memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props));
+ 
+ 	if (dwc->usb3_lpm_capable)
+diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
+index 1905a8d8e0c9f..08726e4c68a56 100644
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -291,6 +291,12 @@ static struct usb_endpoint_descriptor ss_ep_int_desc = {
+ 	.bInterval = 4,
+ };
+ 
++static struct usb_ss_ep_comp_descriptor ss_ep_int_desc_comp = {
++	.bLength = sizeof(ss_ep_int_desc_comp),
++	.bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
++	.wBytesPerInterval = cpu_to_le16(6),
++};
++
+ /* Audio Streaming OUT Interface - Alt0 */
+ static struct usb_interface_descriptor std_as_out_if0_desc = {
+ 	.bLength = sizeof std_as_out_if0_desc,
+@@ -604,7 +610,8 @@ static struct usb_descriptor_header *ss_audio_desc[] = {
+ 	(struct usb_descriptor_header *)&in_feature_unit_desc,
+ 	(struct usb_descriptor_header *)&io_out_ot_desc,
+ 
+-  (struct usb_descriptor_header *)&ss_ep_int_desc,
++	(struct usb_descriptor_header *)&ss_ep_int_desc,
++	(struct usb_descriptor_header *)&ss_ep_int_desc_comp,
+ 
+ 	(struct usb_descriptor_header *)&std_as_out_if0_desc,
+ 	(struct usb_descriptor_header *)&std_as_out_if1_desc,
+@@ -800,6 +807,7 @@ static void setup_headers(struct f_uac2_opts *opts,
+ 	struct usb_ss_ep_comp_descriptor *epout_desc_comp = NULL;
+ 	struct usb_ss_ep_comp_descriptor *epin_desc_comp = NULL;
+ 	struct usb_ss_ep_comp_descriptor *epin_fback_desc_comp = NULL;
++	struct usb_ss_ep_comp_descriptor *ep_int_desc_comp = NULL;
+ 	struct usb_endpoint_descriptor *epout_desc;
+ 	struct usb_endpoint_descriptor *epin_desc;
+ 	struct usb_endpoint_descriptor *epin_fback_desc;
+@@ -827,6 +835,7 @@ static void setup_headers(struct f_uac2_opts *opts,
+ 		epin_fback_desc = &ss_epin_fback_desc;
+ 		epin_fback_desc_comp = &ss_epin_fback_desc_comp;
+ 		ep_int_desc = &ss_ep_int_desc;
++		ep_int_desc_comp = &ss_ep_int_desc_comp;
+ 	}
+ 
+ 	i = 0;
+@@ -855,8 +864,11 @@ static void setup_headers(struct f_uac2_opts *opts,
+ 	if (EPOUT_EN(opts))
+ 		headers[i++] = USBDHDR(&io_out_ot_desc);
+ 
+-	if (FUOUT_EN(opts) || FUIN_EN(opts))
++	if (FUOUT_EN(opts) || FUIN_EN(opts)) {
+ 		headers[i++] = USBDHDR(ep_int_desc);
++		if (ep_int_desc_comp)
++			headers[i++] = USBDHDR(ep_int_desc_comp);
++	}
+ 
+ 	if (EPOUT_EN(opts)) {
+ 		headers[i++] = USBDHDR(&std_as_out_if0_desc);
+diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c
+index b859a158a4140..e122050eebaf1 100644
+--- a/drivers/usb/gadget/function/storage_common.c
++++ b/drivers/usb/gadget/function/storage_common.c
+@@ -294,8 +294,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub);
+ void store_cdrom_address(u8 *dest, int msf, u32 addr)
+ {
+ 	if (msf) {
+-		/* Convert to Minutes-Seconds-Frames */
+-		addr >>= 2;		/* Convert to 2048-byte frames */
++		/*
++		 * Convert to Minutes-Seconds-Frames.
++		 * Sector size is already set to 2048 bytes.
++		 */
+ 		addr += 2*75;		/* Lead-in occupies 2 seconds */
+ 		dest[3] = addr % 75;	/* Frames */
+ 		addr /= 75;
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index cafcf260394cd..c63c0c2cf649d 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -736,7 +736,10 @@ int usb_gadget_disconnect(struct usb_gadget *gadget)
+ 	ret = gadget->ops->pullup(gadget, 0);
+ 	if (!ret) {
+ 		gadget->connected = 0;
+-		gadget->udc->driver->disconnect(gadget);
++		mutex_lock(&udc_lock);
++		if (gadget->udc->driver)
++			gadget->udc->driver->disconnect(gadget);
++		mutex_unlock(&udc_lock);
+ 	}
+ 
+ out:
+@@ -1489,7 +1492,6 @@ static int gadget_bind_driver(struct device *dev)
+ 
+ 	usb_gadget_udc_set_speed(udc, driver->max_speed);
+ 
+-	mutex_lock(&udc_lock);
+ 	ret = driver->bind(udc->gadget, driver);
+ 	if (ret)
+ 		goto err_bind;
+@@ -1499,7 +1501,6 @@ static int gadget_bind_driver(struct device *dev)
+ 		goto err_start;
+ 	usb_gadget_enable_async_callbacks(udc);
+ 	usb_udc_connect_control(udc);
+-	mutex_unlock(&udc_lock);
+ 
+ 	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
+ 	return 0;
+@@ -1512,6 +1513,7 @@ static int gadget_bind_driver(struct device *dev)
+ 		dev_err(&udc->dev, "failed to start %s: %d\n",
+ 			driver->function, ret);
+ 
++	mutex_lock(&udc_lock);
+ 	udc->driver = NULL;
+ 	driver->is_bound = false;
+ 	mutex_unlock(&udc_lock);
+@@ -1529,7 +1531,6 @@ static void gadget_unbind_driver(struct device *dev)
+ 
+ 	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
+ 
+-	mutex_lock(&udc_lock);
+ 	usb_gadget_disconnect(gadget);
+ 	usb_gadget_disable_async_callbacks(udc);
+ 	if (gadget->irq)
+@@ -1537,6 +1538,7 @@ static void gadget_unbind_driver(struct device *dev)
+ 	udc->driver->unbind(gadget);
+ 	usb_gadget_udc_stop(udc);
+ 
++	mutex_lock(&udc_lock);
+ 	driver->is_bound = false;
+ 	udc->driver = NULL;
+ 	mutex_unlock(&udc_lock);
+@@ -1612,7 +1614,7 @@ static ssize_t soft_connect_store(struct device *dev,
+ 	struct usb_udc		*udc = container_of(dev, struct usb_udc, dev);
+ 	ssize_t			ret;
+ 
+-	mutex_lock(&udc_lock);
++	device_lock(&udc->gadget->dev);
+ 	if (!udc->driver) {
+ 		dev_err(dev, "soft-connect without a gadget driver\n");
+ 		ret = -EOPNOTSUPP;
+@@ -1633,7 +1635,7 @@ static ssize_t soft_connect_store(struct device *dev,
+ 
+ 	ret = n;
+ out:
+-	mutex_unlock(&udc_lock);
++	device_unlock(&udc->gadget->dev);
+ 	return ret;
+ }
+ static DEVICE_ATTR_WO(soft_connect);
+@@ -1652,11 +1654,15 @@ static ssize_t function_show(struct device *dev, struct device_attribute *attr,
+ 			     char *buf)
+ {
+ 	struct usb_udc		*udc = container_of(dev, struct usb_udc, dev);
+-	struct usb_gadget_driver *drv = udc->driver;
++	struct usb_gadget_driver *drv;
++	int			rc = 0;
+ 
+-	if (!drv || !drv->function)
+-		return 0;
+-	return scnprintf(buf, PAGE_SIZE, "%s\n", drv->function);
++	mutex_lock(&udc_lock);
++	drv = udc->driver;
++	if (drv && drv->function)
++		rc = scnprintf(buf, PAGE_SIZE, "%s\n", drv->function);
++	mutex_unlock(&udc_lock);
++	return rc;
+ }
+ static DEVICE_ATTR_RO(function);
+ 
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 0fdc014c94011..4619d5e89d5be 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -652,7 +652,7 @@ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd)
+  * It will release and re-aquire the lock while calling ACPI
+  * method.
+  */
+-void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd,
++static void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd,
+ 				u16 index, bool on, unsigned long *flags)
+ 	__must_hold(&xhci->lock)
+ {
+@@ -1648,6 +1648,17 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ 
+ 	status = bus_state->resuming_ports;
+ 
++	/*
++	 * SS devices are only visible to roothub after link training completes.
++	 * Keep polling roothubs for a grace period after xHC start
++	 */
++	if (xhci->run_graceperiod) {
++		if (time_before(jiffies, xhci->run_graceperiod))
++			status = 1;
++		else
++			xhci->run_graceperiod = 0;
++	}
++
+ 	mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
+ 
+ 	/* For each port, did anything change?  If so, set that bit in buf. */
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index 06a6b19acaae6..579899eb24c15 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -425,7 +425,6 @@ static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset)
+ 
+ static int check_sch_tt(struct mu3h_sch_ep_info *sch_ep, u32 offset)
+ {
+-	u32 extra_cs_count;
+ 	u32 start_ss, last_ss;
+ 	u32 start_cs, last_cs;
+ 
+@@ -461,18 +460,12 @@ static int check_sch_tt(struct mu3h_sch_ep_info *sch_ep, u32 offset)
+ 		if (last_cs > 7)
+ 			return -ESCH_CS_OVERFLOW;
+ 
+-		if (sch_ep->ep_type == ISOC_IN_EP)
+-			extra_cs_count = (last_cs == 7) ? 1 : 2;
+-		else /*  ep_type : INTR IN / INTR OUT */
+-			extra_cs_count = 1;
+-
+-		cs_count += extra_cs_count;
+ 		if (cs_count > 7)
+ 			cs_count = 7; /* HW limit */
+ 
+ 		sch_ep->cs_count = cs_count;
+-		/* one for ss, the other for idle */
+-		sch_ep->num_budget_microframes = cs_count + 2;
++		/* ss, idle are ignored */
++		sch_ep->num_budget_microframes = cs_count;
+ 
+ 		/*
+ 		 * if interval=1, maxp >752, num_budge_micoframe is larger
+@@ -771,8 +764,8 @@ int xhci_mtk_drop_ep(struct usb_hcd *hcd, struct usb_device *udev,
+ 	if (ret)
+ 		return ret;
+ 
+-	if (ep->hcpriv)
+-		drop_ep_quirk(hcd, udev, ep);
++	/* needn't check @ep->hcpriv, xhci_endpoint_disable set it NULL */
++	drop_ep_quirk(hcd, udev, ep);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 044855818cb11..a8641b6536eea 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -398,12 +398,17 @@ static int xhci_plat_remove(struct platform_device *dev)
+ 	pm_runtime_get_sync(&dev->dev);
+ 	xhci->xhc_state |= XHCI_STATE_REMOVING;
+ 
+-	usb_remove_hcd(shared_hcd);
+-	xhci->shared_hcd = NULL;
++	if (shared_hcd) {
++		usb_remove_hcd(shared_hcd);
++		xhci->shared_hcd = NULL;
++	}
++
+ 	usb_phy_shutdown(hcd->usb_phy);
+ 
+ 	usb_remove_hcd(hcd);
+-	usb_put_hcd(shared_hcd);
++
++	if (shared_hcd)
++		usb_put_hcd(shared_hcd);
+ 
+ 	clk_disable_unprepare(clk);
+ 	clk_disable_unprepare(reg_clk);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 65858f6074377..38649284ff889 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -151,9 +151,11 @@ int xhci_start(struct xhci_hcd *xhci)
+ 		xhci_err(xhci, "Host took too long to start, "
+ 				"waited %u microseconds.\n",
+ 				XHCI_MAX_HALT_USEC);
+-	if (!ret)
++	if (!ret) {
+ 		/* clear state flags. Including dying, halted or removing */
+ 		xhci->xhc_state = 0;
++		xhci->run_graceperiod = jiffies + msecs_to_jiffies(500);
++	}
+ 
+ 	return ret;
+ }
+@@ -791,8 +793,6 @@ static void xhci_stop(struct usb_hcd *hcd)
+ void xhci_shutdown(struct usb_hcd *hcd)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+-	unsigned long flags;
+-	int i;
+ 
+ 	if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+ 		usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev));
+@@ -808,21 +808,12 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ 		del_timer_sync(&xhci->shared_hcd->rh_timer);
+ 	}
+ 
+-	spin_lock_irqsave(&xhci->lock, flags);
++	spin_lock_irq(&xhci->lock);
+ 	xhci_halt(xhci);
+-
+-	/* Power off USB2 ports*/
+-	for (i = 0; i < xhci->usb2_rhub.num_ports; i++)
+-		xhci_set_port_power(xhci, xhci->main_hcd, i, false, &flags);
+-
+-	/* Power off USB3 ports*/
+-	for (i = 0; i < xhci->usb3_rhub.num_ports; i++)
+-		xhci_set_port_power(xhci, xhci->shared_hcd, i, false, &flags);
+-
+ 	/* Workaround for spurious wakeups at shutdown with HSW */
+ 	if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+ 		xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+-	spin_unlock_irqrestore(&xhci->lock, flags);
++	spin_unlock_irq(&xhci->lock);
+ 
+ 	xhci_cleanup_msix(xhci);
+ 
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 1960b47acfb28..7caa0db5e826d 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1826,7 +1826,7 @@ struct xhci_hcd {
+ 
+ 	/* Host controller watchdog timer structures */
+ 	unsigned int		xhc_state;
+-
++	unsigned long		run_graceperiod;
+ 	u32			command;
+ 	struct s3_save		s3;
+ /* Host controller is dying - not responding to commands. "I'm not dead yet!"
+@@ -2196,8 +2196,6 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
+ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
+ int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
+ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd);
+-void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, u16 index,
+-			 bool on, unsigned long *flags);
+ 
+ void xhci_hc_died(struct xhci_hcd *xhci);
+ 
+diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
+index 4d61df6a9b5c8..70693cae83efb 100644
+--- a/drivers/usb/musb/Kconfig
++++ b/drivers/usb/musb/Kconfig
+@@ -86,7 +86,7 @@ config USB_MUSB_TUSB6010
+ 	tristate "TUSB6010"
+ 	depends on HAS_IOMEM
+ 	depends on ARCH_OMAP2PLUS || COMPILE_TEST
+-	depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
++	depends on NOP_USB_XCEIV!=m || USB_MUSB_HDRC=m
+ 
+ config USB_MUSB_OMAP2PLUS
+ 	tristate "OMAP2430 and onwards"
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 2798fca712612..af01a462cc43c 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -97,7 +97,10 @@ struct ch341_private {
+ 	u8 mcr;
+ 	u8 msr;
+ 	u8 lcr;
++
+ 	unsigned long quirks;
++	u8 version;
++
+ 	unsigned long break_end;
+ };
+ 
+@@ -250,8 +253,12 @@ static int ch341_set_baudrate_lcr(struct usb_device *dev,
+ 	/*
+ 	 * CH341A buffers data until a full endpoint-size packet (32 bytes)
+ 	 * has been received unless bit 7 is set.
++	 *
++	 * At least one device with version 0x27 appears to have this bit
++	 * inverted.
+ 	 */
+-	val |= BIT(7);
++	if (priv->version > 0x27)
++		val |= BIT(7);
+ 
+ 	r = ch341_control_out(dev, CH341_REQ_WRITE_REG,
+ 			      CH341_REG_DIVISOR << 8 | CH341_REG_PRESCALER,
+@@ -265,6 +272,9 @@ static int ch341_set_baudrate_lcr(struct usb_device *dev,
+ 	 * (stop bits, parity and word length). Version 0x30 and above use
+ 	 * CH341_REG_LCR only and CH341_REG_LCR2 is always set to zero.
+ 	 */
++	if (priv->version < 0x30)
++		return 0;
++
+ 	r = ch341_control_out(dev, CH341_REQ_WRITE_REG,
+ 			      CH341_REG_LCR2 << 8 | CH341_REG_LCR, lcr);
+ 	if (r)
+@@ -308,7 +318,9 @@ static int ch341_configure(struct usb_device *dev, struct ch341_private *priv)
+ 	r = ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size);
+ 	if (r)
+ 		return r;
+-	dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]);
++
++	priv->version = buffer[0];
++	dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version);
+ 
+ 	r = ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0);
+ 	if (r < 0)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index c374620a486f0..a34957c4b64c0 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -130,6 +130,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */
+ 	{ USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
+ 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
++	{ USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */
+ 	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+ 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+ 	{ USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index d5a3986dfee75..52d59be920342 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1045,6 +1045,8 @@ static const struct usb_device_id id_table_combined[] = {
+ 	/* IDS GmbH devices */
+ 	{ USB_DEVICE(IDS_VID, IDS_SI31A_PID) },
+ 	{ USB_DEVICE(IDS_VID, IDS_CM31A_PID) },
++	/* Omron devices */
++	{ USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) },
+ 	/* U-Blox devices */
+ 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+ 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 4e92c165c86bf..31c8ccabbbb78 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -661,6 +661,12 @@
+ #define INFINEON_TRIBOARD_TC1798_PID	0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+ #define INFINEON_TRIBOARD_TC2X7_PID	0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
+ 
++/*
++ * Omron corporation (https://www.omron.com)
++ */
++ #define OMRON_VID			0x0590
++ #define OMRON_CS1W_CIF31_PID		0x00b2
++
+ /*
+  * Acton Research Corp.
+  */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index de59fa919540a..a5e8374a8d710 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -253,6 +253,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_BG96			0x0296
+ #define QUECTEL_PRODUCT_EP06			0x0306
+ #define QUECTEL_PRODUCT_EM05G			0x030a
++#define QUECTEL_PRODUCT_EM060K			0x030b
+ #define QUECTEL_PRODUCT_EM12			0x0512
+ #define QUECTEL_PRODUCT_RM500Q			0x0800
+ #define QUECTEL_PRODUCT_EC200S_CN		0x6002
+@@ -438,6 +439,8 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_MV31_2_RMNET		0x00b9
+ #define CINTERION_PRODUCT_MV32_WA		0x00f1
+ #define CINTERION_PRODUCT_MV32_WB		0x00f2
++#define CINTERION_PRODUCT_MV32_WA_RMNET		0x00f3
++#define CINTERION_PRODUCT_MV32_WB_RMNET		0x00f4
+ 
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID			0x0b3c
+@@ -573,6 +576,10 @@ static void option_instat_callback(struct urb *urb);
+ #define WETELECOM_PRODUCT_6802			0x6802
+ #define WETELECOM_PRODUCT_WMD300		0x6803
+ 
++/* OPPO products */
++#define OPPO_VENDOR_ID				0x22d9
++#define OPPO_PRODUCT_R11			0x276c
++
+ 
+ /* Device flags */
+ 
+@@ -1138,6 +1145,9 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
+ 	  .driver_info = RSVD(6) | ZLP },
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+ 	  .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+@@ -1993,8 +2003,12 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = RSVD(0)},
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
+ 	  .driver_info = RSVD(3)},
++	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff),
++	  .driver_info = RSVD(0) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
+ 	  .driver_info = RSVD(3)},
++	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff),
++	  .driver_info = RSVD(0) },
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+ 	  .driver_info = RSVD(4) },
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+@@ -2155,6 +2169,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
++	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 1a05e3dcfec8a..4993227ab2930 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2294,6 +2294,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+ 
++/* Reported by Witold Lipieta <witold.lipieta@×××××××××.com> */
++UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100,
++		"NXP Semiconductors",
++		"PN7462AU",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_IGNORE_RESIDUE ),
++
+ /* Supplied with some Castlewood ORB removable drives */
+ UNUSUAL_DEV(  0x2027, 0xa001, 0x0000, 0x9999,
+ 		"Double-H Technology",
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index c1d8c23baa399..de66a2949e33b 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -99,8 +99,8 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con)
+ 	case DP_STATUS_CON_UFP_D:
+ 	case DP_STATUS_CON_BOTH: /* NOTE: First acting as DP source */
+ 		conf |= DP_CONF_UFP_U_AS_UFP_D;
+-		pin_assign = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo) &
+-			     DP_CAP_UFP_D_PIN_ASSIGN(dp->port->vdo);
++		pin_assign = DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo) &
++				 DP_CAP_PIN_ASSIGN_DFP_D(dp->port->vdo);
+ 		break;
+ 	default:
+ 		break;
+diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c
+index 47b733f78fb0d..a8e273fe204ab 100644
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -571,9 +571,11 @@ err_unregister_switch:
+ 
+ static int is_memory(struct acpi_resource *res, void *data)
+ {
+-	struct resource r;
++	struct resource_win win = {};
++	struct resource *r = &win.res;
+ 
+-	return !acpi_dev_resource_memory(res, &r);
++	return !(acpi_dev_resource_memory(res, r) ||
++		 acpi_dev_resource_address_space(res, &win));
+ }
+ 
+ /* IOM ACPI IDs and IOM_PORT_STATUS_OFFSET */
+@@ -583,6 +585,9 @@ static const struct acpi_device_id iom_acpi_ids[] = {
+ 
+ 	/* AlderLake */
+ 	{ "INTC1079", 0x160, },
++
++	/* Meteor Lake */
++	{ "INTC107A", 0x160, },
+ 	{}
+ };
+ 
+diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
+index 3bc2f4ebd1feb..984a13a9efc22 100644
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -6191,6 +6191,13 @@ static int tcpm_psy_set_prop(struct power_supply *psy,
+ 	struct tcpm_port *port = power_supply_get_drvdata(psy);
+ 	int ret;
+ 
++	/*
++	 * All the properties below are related to USB PD. The check needs to be
++	 * property specific when a non-pd related property is added.
++	 */
++	if (!port->pd_supported)
++		return -EOPNOTSUPP;
++
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_ONLINE:
+ 		ret = tcpm_psy_set_online(port, val);
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 1aea46493b852..7f2624f427241 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1200,32 +1200,6 @@ out_unlock:
+ 	return ret;
+ }
+ 
+-static void ucsi_unregister_connectors(struct ucsi *ucsi)
+-{
+-	struct ucsi_connector *con;
+-	int i;
+-
+-	if (!ucsi->connector)
+-		return;
+-
+-	for (i = 0; i < ucsi->cap.num_connectors; i++) {
+-		con = &ucsi->connector[i];
+-
+-		if (!con->wq)
+-			break;
+-
+-		cancel_work_sync(&con->work);
+-		ucsi_unregister_partner(con);
+-		ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
+-		ucsi_unregister_port_psy(con);
+-		destroy_workqueue(con->wq);
+-		typec_unregister_port(con->port);
+-	}
+-
+-	kfree(ucsi->connector);
+-	ucsi->connector = NULL;
+-}
+-
+ /**
+  * ucsi_init - Initialize UCSI interface
+  * @ucsi: UCSI to be initialized
+@@ -1234,6 +1208,7 @@ static void ucsi_unregister_connectors(struct ucsi *ucsi)
+  */
+ static int ucsi_init(struct ucsi *ucsi)
+ {
++	struct ucsi_connector *con;
+ 	u64 command;
+ 	int ret;
+ 	int i;
+@@ -1264,7 +1239,7 @@ static int ucsi_init(struct ucsi *ucsi)
+ 	}
+ 
+ 	/* Allocate the connectors. Released in ucsi_unregister() */
+-	ucsi->connector = kcalloc(ucsi->cap.num_connectors,
++	ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1,
+ 				  sizeof(*ucsi->connector), GFP_KERNEL);
+ 	if (!ucsi->connector) {
+ 		ret = -ENOMEM;
+@@ -1288,7 +1263,15 @@ static int ucsi_init(struct ucsi *ucsi)
+ 	return 0;
+ 
+ err_unregister:
+-	ucsi_unregister_connectors(ucsi);
++	for (con = ucsi->connector; con->port; con++) {
++		ucsi_unregister_partner(con);
++		ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
++		ucsi_unregister_port_psy(con);
++		if (con->wq)
++			destroy_workqueue(con->wq);
++		typec_unregister_port(con->port);
++		con->port = NULL;
++	}
+ 
+ err_reset:
+ 	memset(&ucsi->cap, 0, sizeof(ucsi->cap));
+@@ -1402,6 +1385,7 @@ EXPORT_SYMBOL_GPL(ucsi_register);
+ void ucsi_unregister(struct ucsi *ucsi)
+ {
+ 	u64 cmd = UCSI_SET_NOTIFICATION_ENABLE;
++	int i;
+ 
+ 	/* Make sure that we are not in the middle of driver initialization */
+ 	cancel_delayed_work_sync(&ucsi->work);
+@@ -1409,7 +1393,18 @@ void ucsi_unregister(struct ucsi *ucsi)
+ 	/* Disable notifications */
+ 	ucsi->ops->async_write(ucsi, UCSI_CONTROL, &cmd, sizeof(cmd));
+ 
+-	ucsi_unregister_connectors(ucsi);
++	for (i = 0; i < ucsi->cap.num_connectors; i++) {
++		cancel_work_sync(&ucsi->connector[i].work);
++		ucsi_unregister_partner(&ucsi->connector[i]);
++		ucsi_unregister_altmodes(&ucsi->connector[i],
++					 UCSI_RECIPIENT_CON);
++		ucsi_unregister_port_psy(&ucsi->connector[i]);
++		if (ucsi->connector[i].wq)
++			destroy_workqueue(ucsi->connector[i].wq);
++		typec_unregister_port(ucsi->connector[i].port);
++	}
++
++	kfree(ucsi->connector);
+ }
+ EXPORT_SYMBOL_GPL(ucsi_unregister);
+ 
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 738029de3c672..e1ec725c2819d 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -1047,6 +1047,9 @@ int gnttab_dma_alloc_pages(struct gnttab_dma_alloc_args *args)
+ 	size_t size;
+ 	int i, ret;
+ 
++	if (args->nr_pages < 0 || args->nr_pages > (INT_MAX >> PAGE_SHIFT))
++		return -ENOMEM;
++
+ 	size = args->nr_pages << PAGE_SHIFT;
+ 	if (args->coherent)
+ 		args->vaddr = dma_alloc_coherent(args->dev, size,
+diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
+index 6cba2c6de2f96..2ad58c4652084 100644
+--- a/fs/cachefiles/internal.h
++++ b/fs/cachefiles/internal.h
+@@ -111,6 +111,7 @@ struct cachefiles_cache {
+ 	char				*tag;		/* cache binding tag */
+ 	refcount_t			unbind_pincount;/* refcount to do daemon unbind */
+ 	struct xarray			reqs;		/* xarray of pending on-demand requests */
++	unsigned long			req_id_next;
+ 	struct xarray			ondemand_ids;	/* xarray for ondemand_id allocation */
+ 	u32				ondemand_id_next;
+ };
+diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c
+index 1fee702d55293..0254ed39f68ce 100644
+--- a/fs/cachefiles/ondemand.c
++++ b/fs/cachefiles/ondemand.c
+@@ -158,9 +158,13 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args)
+ 
+ 	/* fail OPEN request if daemon reports an error */
+ 	if (size < 0) {
+-		if (!IS_ERR_VALUE(size))
+-			size = -EINVAL;
+-		req->error = size;
++		if (!IS_ERR_VALUE(size)) {
++			req->error = -EINVAL;
++			ret = -EINVAL;
++		} else {
++			req->error = size;
++			ret = 0;
++		}
+ 		goto out;
+ 	}
+ 
+@@ -238,14 +242,19 @@ ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache,
+ 	unsigned long id = 0;
+ 	size_t n;
+ 	int ret = 0;
+-	XA_STATE(xas, &cache->reqs, 0);
++	XA_STATE(xas, &cache->reqs, cache->req_id_next);
+ 
+ 	/*
+-	 * Search for a request that has not ever been processed, to prevent
+-	 * requests from being processed repeatedly.
++	 * Cyclically search for a request that has not ever been processed,
++	 * to prevent requests from being processed repeatedly, and make
++	 * request distribution fair.
+ 	 */
+ 	xa_lock(&cache->reqs);
+ 	req = xas_find_marked(&xas, UINT_MAX, CACHEFILES_REQ_NEW);
++	if (!req && cache->req_id_next > 0) {
++		xas_set(&xas, 0);
++		req = xas_find_marked(&xas, cache->req_id_next - 1, CACHEFILES_REQ_NEW);
++	}
+ 	if (!req) {
+ 		xa_unlock(&cache->reqs);
+ 		return 0;
+@@ -260,6 +269,7 @@ ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache,
+ 	}
+ 
+ 	xas_clear_mark(&xas, CACHEFILES_REQ_NEW);
++	cache->req_id_next = xas.xa_index + 1;
+ 	xa_unlock(&cache->reqs);
+ 
+ 	id = xas.xa_index;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index c7614ade875b5..ba58d7fd54f9e 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -964,16 +964,17 @@ SMB2_negotiate(const unsigned int xid,
+ 	} else if (rc != 0)
+ 		goto neg_exit;
+ 
++	rc = -EIO;
+ 	if (strcmp(server->vals->version_string,
+ 		   SMB3ANY_VERSION_STRING) == 0) {
+ 		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
+ 			cifs_server_dbg(VFS,
+ 				"SMB2 dialect returned but not requested\n");
+-			return -EIO;
++			goto neg_exit;
+ 		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
+ 			cifs_server_dbg(VFS,
+ 				"SMB2.1 dialect returned but not requested\n");
+-			return -EIO;
++			goto neg_exit;
+ 		} else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
+ 			/* ops set to 3.0 by default for default so update */
+ 			server->ops = &smb311_operations;
+@@ -984,7 +985,7 @@ SMB2_negotiate(const unsigned int xid,
+ 		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
+ 			cifs_server_dbg(VFS,
+ 				"SMB2 dialect returned but not requested\n");
+-			return -EIO;
++			goto neg_exit;
+ 		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
+ 			/* ops set to 3.0 by default for default so update */
+ 			server->ops = &smb21_operations;
+@@ -998,7 +999,7 @@ SMB2_negotiate(const unsigned int xid,
+ 		/* if requested single dialect ensure returned dialect matched */
+ 		cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n",
+ 				le16_to_cpu(rsp->DialectRevision));
+-		return -EIO;
++		goto neg_exit;
+ 	}
+ 
+ 	cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
+@@ -1016,9 +1017,10 @@ SMB2_negotiate(const unsigned int xid,
+ 	else {
+ 		cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n",
+ 				le16_to_cpu(rsp->DialectRevision));
+-		rc = -EIO;
+ 		goto neg_exit;
+ 	}
++
++	rc = 0;
+ 	server->dialect = le16_to_cpu(rsp->DialectRevision);
+ 
+ 	/*
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 7424cf234ae03..ed352c00330cd 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -398,6 +398,9 @@ enum bpf_type_flag {
+ 	/* DYNPTR points to a ringbuf record. */
+ 	DYNPTR_TYPE_RINGBUF	= BIT(9 + BPF_BASE_TYPE_BITS),
+ 
++	/* Size is known at compile time. */
++	MEM_FIXED_SIZE		= BIT(10 + BPF_BASE_TYPE_BITS),
++
+ 	__BPF_TYPE_FLAG_MAX,
+ 	__BPF_TYPE_LAST_FLAG	= __BPF_TYPE_FLAG_MAX - 1,
+ };
+@@ -461,6 +464,8 @@ enum bpf_arg_type {
+ 	 * all bytes or clear them in error case.
+ 	 */
+ 	ARG_PTR_TO_UNINIT_MEM		= MEM_UNINIT | ARG_PTR_TO_MEM,
++	/* Pointer to valid memory of size known at compile time. */
++	ARG_PTR_TO_FIXED_SIZE_MEM	= MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
+ 
+ 	/* This must be the last entry. Its purpose is to ensure the enum is
+ 	 * wide enough to hold the higher bits reserved for bpf_type_flag.
+@@ -526,6 +531,14 @@ struct bpf_func_proto {
+ 			u32 *arg5_btf_id;
+ 		};
+ 		u32 *arg_btf_id[5];
++		struct {
++			size_t arg1_size;
++			size_t arg2_size;
++			size_t arg3_size;
++			size_t arg4_size;
++			size_t arg5_size;
++		};
++		size_t arg_size[5];
+ 	};
+ 	int *ret_btf_id; /* return value btf_id */
+ 	bool (*allowed)(const struct bpf_prog *prog);
+diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/platform_data/x86/pmc_atom.h
+index 6807839c718bd..ea01dd80153b3 100644
+--- a/include/linux/platform_data/x86/pmc_atom.h
++++ b/include/linux/platform_data/x86/pmc_atom.h
+@@ -7,6 +7,8 @@
+ #ifndef PMC_ATOM_H
+ #define PMC_ATOM_H
+ 
++#include <linux/bits.h>
++
+ /* ValleyView Power Control Unit PCI Device ID */
+ #define	PCI_DEVICE_ID_VLV_PMC	0x0F1C
+ /* CherryTrail Power Control Unit PCI Device ID */
+@@ -139,9 +141,9 @@
+ #define	ACPI_MMIO_REG_LEN	0x100
+ 
+ #define	PM1_CNT			0x4
+-#define	SLEEP_TYPE_MASK		0xFFFFECFF
++#define	SLEEP_TYPE_MASK		GENMASK(12, 10)
+ #define	SLEEP_TYPE_S5		0x1C00
+-#define	SLEEP_ENABLE		0x2000
++#define	SLEEP_ENABLE		BIT(13)
+ 
+ extern int pmc_atom_read(int offset, u32 *value);
+ 
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 60bee864d8977..1a664ab2ebc66 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -575,6 +575,7 @@ struct usb3_lpm_parameters {
+  * @devaddr: device address, XHCI: assigned by HW, others: same as devnum
+  * @can_submit: URBs may be submitted
+  * @persist_enabled:  USB_PERSIST enabled for this device
++ * @reset_in_progress: the device is being reset
+  * @have_langid: whether string_langid is valid
+  * @authorized: policy has said we can use it;
+  *	(user space) policy determines if we authorize this device to be
+@@ -661,6 +662,7 @@ struct usb_device {
+ 
+ 	unsigned can_submit:1;
+ 	unsigned persist_enabled:1;
++	unsigned reset_in_progress:1;
+ 	unsigned have_langid:1;
+ 	unsigned authorized:1;
+ 	unsigned authenticated:1;
+diff --git a/include/linux/usb/typec_dp.h b/include/linux/usb/typec_dp.h
+index cfb916cccd316..8d09c2f0a9b80 100644
+--- a/include/linux/usb/typec_dp.h
++++ b/include/linux/usb/typec_dp.h
+@@ -73,6 +73,11 @@ enum {
+ #define DP_CAP_USB			BIT(7)
+ #define DP_CAP_DFP_D_PIN_ASSIGN(_cap_)	(((_cap_) & GENMASK(15, 8)) >> 8)
+ #define DP_CAP_UFP_D_PIN_ASSIGN(_cap_)	(((_cap_) & GENMASK(23, 16)) >> 16)
++/* Get pin assignment taking plug & receptacle into consideration */
++#define DP_CAP_PIN_ASSIGN_UFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \
++			DP_CAP_UFP_D_PIN_ASSIGN(_cap_) : DP_CAP_DFP_D_PIN_ASSIGN(_cap_))
++#define DP_CAP_PIN_ASSIGN_DFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \
++			DP_CAP_DFP_D_PIN_ASSIGN(_cap_) : DP_CAP_UFP_D_PIN_ASSIGN(_cap_))
+ 
+ /* DisplayPort Status Update VDO bits */
+ #define DP_STATUS_CONNECTION(_status_)	((_status_) & 3)
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 20f60d9da7418..cf1f22c01ed3d 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -246,7 +246,8 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4,
+ 				       __be32 daddr, __be32 saddr,
+ 				       __be32 key, __u8 tos,
+ 				       struct net *net, int oif,
+-				       __u32 mark, __u32 tun_inner_hash)
++				       __u32 mark, __u32 tun_inner_hash,
++				       __u8 flow_flags)
+ {
+ 	memset(fl4, 0, sizeof(*fl4));
+ 
+@@ -263,6 +264,7 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4,
+ 	fl4->fl4_gre_key = key;
+ 	fl4->flowi4_mark = mark;
+ 	fl4->flowi4_multipath_hash = tun_inner_hash;
++	fl4->flowi4_flags = flow_flags;
+ }
+ 
+ int ip_tunnel_init(struct net_device *dev);
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index 7a394f7c205c4..34dfa45ef4f3b 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -762,8 +762,10 @@ static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *prog,
+ 				pos++;
+ 			}
+ 		}
++
++		/* no link or prog match, skip the cgroup of this layer */
++		continue;
+ found:
+-		BUG_ON(!cg);
+ 		progs = rcu_dereference_protected(
+ 				desc->bpf.effective[atype],
+ 				lockdep_is_held(&cgroup_mutex));
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index fb6bd57228a84..cf44ff50b1f23 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -1005,7 +1005,7 @@ pure_initcall(bpf_jit_charge_init);
+ 
+ int bpf_jit_charge_modmem(u32 size)
+ {
+-	if (atomic_long_add_return(size, &bpf_jit_current) > bpf_jit_limit) {
++	if (atomic_long_add_return(size, &bpf_jit_current) > READ_ONCE(bpf_jit_limit)) {
+ 		if (!bpf_capable()) {
+ 			atomic_long_sub(size, &bpf_jit_current);
+ 			return -EPERM;
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 82e83cfb4114a..dd0fc2a86ce17 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -5153,7 +5153,7 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+ {
+ 	switch (func_id) {
+ 	case BPF_FUNC_sys_bpf:
+-		return &bpf_sys_bpf_proto;
++		return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
+ 	case BPF_FUNC_btf_find_by_name_kind:
+ 		return &bpf_btf_find_by_name_kind_proto;
+ 	case BPF_FUNC_sys_close:
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 0e45d405f151c..339147061127a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5533,17 +5533,6 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type)
+ 	       type == ARG_CONST_SIZE_OR_ZERO;
+ }
+ 
+-static bool arg_type_is_alloc_size(enum bpf_arg_type type)
+-{
+-	return type == ARG_CONST_ALLOC_SIZE_OR_ZERO;
+-}
+-
+-static bool arg_type_is_int_ptr(enum bpf_arg_type type)
+-{
+-	return type == ARG_PTR_TO_INT ||
+-	       type == ARG_PTR_TO_LONG;
+-}
+-
+ static bool arg_type_is_release(enum bpf_arg_type type)
+ {
+ 	return type & OBJ_RELEASE;
+@@ -5847,6 +5836,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
+ 	struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
+ 	enum bpf_arg_type arg_type = fn->arg_type[arg];
+ 	enum bpf_reg_type type = reg->type;
++	u32 *arg_btf_id = NULL;
+ 	int err = 0;
+ 
+ 	if (arg_type == ARG_DONTCARE)
+@@ -5883,7 +5873,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
+ 		 */
+ 		goto skip_type_check;
+ 
+-	err = check_reg_type(env, regno, arg_type, fn->arg_btf_id[arg], meta);
++	/* arg_btf_id and arg_size are in a union. */
++	if (base_type(arg_type) == ARG_PTR_TO_BTF_ID)
++		arg_btf_id = fn->arg_btf_id[arg];
++
++	err = check_reg_type(env, regno, arg_type, arg_btf_id, meta);
+ 	if (err)
+ 		return err;
+ 
+@@ -5924,7 +5918,8 @@ skip_type_check:
+ 		meta->ref_obj_id = reg->ref_obj_id;
+ 	}
+ 
+-	if (arg_type == ARG_CONST_MAP_PTR) {
++	switch (base_type(arg_type)) {
++	case ARG_CONST_MAP_PTR:
+ 		/* bpf_map_xxx(map_ptr) call: remember that map_ptr */
+ 		if (meta->map_ptr) {
+ 			/* Use map_uid (which is unique id of inner map) to reject:
+@@ -5949,7 +5944,8 @@ skip_type_check:
+ 		}
+ 		meta->map_ptr = reg->map_ptr;
+ 		meta->map_uid = reg->map_uid;
+-	} else if (arg_type == ARG_PTR_TO_MAP_KEY) {
++		break;
++	case ARG_PTR_TO_MAP_KEY:
+ 		/* bpf_map_xxx(..., map_ptr, ..., key) call:
+ 		 * check that [key, key + map->key_size) are within
+ 		 * stack limits and initialized
+@@ -5966,7 +5962,8 @@ skip_type_check:
+ 		err = check_helper_mem_access(env, regno,
+ 					      meta->map_ptr->key_size, false,
+ 					      NULL);
+-	} else if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE) {
++		break;
++	case ARG_PTR_TO_MAP_VALUE:
+ 		if (type_may_be_null(arg_type) && register_is_null(reg))
+ 			return 0;
+ 
+@@ -5982,14 +5979,16 @@ skip_type_check:
+ 		err = check_helper_mem_access(env, regno,
+ 					      meta->map_ptr->value_size, false,
+ 					      meta);
+-	} else if (arg_type == ARG_PTR_TO_PERCPU_BTF_ID) {
++		break;
++	case ARG_PTR_TO_PERCPU_BTF_ID:
+ 		if (!reg->btf_id) {
+ 			verbose(env, "Helper has invalid btf_id in R%d\n", regno);
+ 			return -EACCES;
+ 		}
+ 		meta->ret_btf = reg->btf;
+ 		meta->ret_btf_id = reg->btf_id;
+-	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
++		break;
++	case ARG_PTR_TO_SPIN_LOCK:
+ 		if (meta->func_id == BPF_FUNC_spin_lock) {
+ 			if (process_spin_lock(env, regno, true))
+ 				return -EACCES;
+@@ -6000,21 +5999,32 @@ skip_type_check:
+ 			verbose(env, "verifier internal error\n");
+ 			return -EFAULT;
+ 		}
+-	} else if (arg_type == ARG_PTR_TO_TIMER) {
++		break;
++	case ARG_PTR_TO_TIMER:
+ 		if (process_timer_func(env, regno, meta))
+ 			return -EACCES;
+-	} else if (arg_type == ARG_PTR_TO_FUNC) {
++		break;
++	case ARG_PTR_TO_FUNC:
+ 		meta->subprogno = reg->subprogno;
+-	} else if (base_type(arg_type) == ARG_PTR_TO_MEM) {
++		break;
++	case ARG_PTR_TO_MEM:
+ 		/* The access to this pointer is only checked when we hit the
+ 		 * next is_mem_size argument below.
+ 		 */
+ 		meta->raw_mode = arg_type & MEM_UNINIT;
+-	} else if (arg_type_is_mem_size(arg_type)) {
+-		bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);
+-
+-		err = check_mem_size_reg(env, reg, regno, zero_size_allowed, meta);
+-	} else if (arg_type_is_dynptr(arg_type)) {
++		if (arg_type & MEM_FIXED_SIZE) {
++			err = check_helper_mem_access(env, regno,
++						      fn->arg_size[arg], false,
++						      meta);
++		}
++		break;
++	case ARG_CONST_SIZE:
++		err = check_mem_size_reg(env, reg, regno, false, meta);
++		break;
++	case ARG_CONST_SIZE_OR_ZERO:
++		err = check_mem_size_reg(env, reg, regno, true, meta);
++		break;
++	case ARG_PTR_TO_DYNPTR:
+ 		if (arg_type & MEM_UNINIT) {
+ 			if (!is_dynptr_reg_valid_uninit(env, reg)) {
+ 				verbose(env, "Dynptr has to be an uninitialized dynptr\n");
+@@ -6048,21 +6058,31 @@ skip_type_check:
+ 				err_extra, arg + 1);
+ 			return -EINVAL;
+ 		}
+-	} else if (arg_type_is_alloc_size(arg_type)) {
++		break;
++	case ARG_CONST_ALLOC_SIZE_OR_ZERO:
+ 		if (!tnum_is_const(reg->var_off)) {
+ 			verbose(env, "R%d is not a known constant'\n",
+ 				regno);
+ 			return -EACCES;
+ 		}
+ 		meta->mem_size = reg->var_off.value;
+-	} else if (arg_type_is_int_ptr(arg_type)) {
++		err = mark_chain_precision(env, regno);
++		if (err)
++			return err;
++		break;
++	case ARG_PTR_TO_INT:
++	case ARG_PTR_TO_LONG:
++	{
+ 		int size = int_ptr_type_to_size(arg_type);
+ 
+ 		err = check_helper_mem_access(env, regno, size, false, meta);
+ 		if (err)
+ 			return err;
+ 		err = check_ptr_alignment(env, reg, 0, size, true);
+-	} else if (arg_type == ARG_PTR_TO_CONST_STR) {
++		break;
++	}
++	case ARG_PTR_TO_CONST_STR:
++	{
+ 		struct bpf_map *map = reg->map_ptr;
+ 		int map_off;
+ 		u64 map_addr;
+@@ -6101,9 +6121,12 @@ skip_type_check:
+ 			verbose(env, "string is not zero-terminated\n");
+ 			return -EINVAL;
+ 		}
+-	} else if (arg_type == ARG_PTR_TO_KPTR) {
++		break;
++	}
++	case ARG_PTR_TO_KPTR:
+ 		if (process_kptr_func(env, regno, meta))
+ 			return -EACCES;
++		break;
+ 	}
+ 
+ 	return err;
+@@ -6400,11 +6423,19 @@ static bool check_raw_mode_ok(const struct bpf_func_proto *fn)
+ 	return count <= 1;
+ }
+ 
+-static bool check_args_pair_invalid(enum bpf_arg_type arg_curr,
+-				    enum bpf_arg_type arg_next)
++static bool check_args_pair_invalid(const struct bpf_func_proto *fn, int arg)
+ {
+-	return (base_type(arg_curr) == ARG_PTR_TO_MEM) !=
+-		arg_type_is_mem_size(arg_next);
++	bool is_fixed = fn->arg_type[arg] & MEM_FIXED_SIZE;
++	bool has_size = fn->arg_size[arg] != 0;
++	bool is_next_size = false;
++
++	if (arg + 1 < ARRAY_SIZE(fn->arg_type))
++		is_next_size = arg_type_is_mem_size(fn->arg_type[arg + 1]);
++
++	if (base_type(fn->arg_type[arg]) != ARG_PTR_TO_MEM)
++		return is_next_size;
++
++	return has_size == is_next_size || is_next_size == is_fixed;
+ }
+ 
+ static bool check_arg_pair_ok(const struct bpf_func_proto *fn)
+@@ -6415,11 +6446,11 @@ static bool check_arg_pair_ok(const struct bpf_func_proto *fn)
+ 	 * helper function specification.
+ 	 */
+ 	if (arg_type_is_mem_size(fn->arg1_type) ||
+-	    base_type(fn->arg5_type) == ARG_PTR_TO_MEM ||
+-	    check_args_pair_invalid(fn->arg1_type, fn->arg2_type) ||
+-	    check_args_pair_invalid(fn->arg2_type, fn->arg3_type) ||
+-	    check_args_pair_invalid(fn->arg3_type, fn->arg4_type) ||
+-	    check_args_pair_invalid(fn->arg4_type, fn->arg5_type))
++	    check_args_pair_invalid(fn, 0) ||
++	    check_args_pair_invalid(fn, 1) ||
++	    check_args_pair_invalid(fn, 2) ||
++	    check_args_pair_invalid(fn, 3) ||
++	    check_args_pair_invalid(fn, 4))
+ 		return false;
+ 
+ 	return true;
+@@ -6460,7 +6491,10 @@ static bool check_btf_id_ok(const struct bpf_func_proto *fn)
+ 		if (base_type(fn->arg_type[i]) == ARG_PTR_TO_BTF_ID && !fn->arg_btf_id[i])
+ 			return false;
+ 
+-		if (base_type(fn->arg_type[i]) != ARG_PTR_TO_BTF_ID && fn->arg_btf_id[i])
++		if (base_type(fn->arg_type[i]) != ARG_PTR_TO_BTF_ID && fn->arg_btf_id[i] &&
++		    /* arg_btf_id and arg_size are in a union. */
++		    (base_type(fn->arg_type[i]) != ARG_PTR_TO_MEM ||
++		     !(fn->arg_type[i] & MEM_FIXED_SIZE)))
+ 			return false;
+ 	}
+ 
+diff --git a/mm/pagewalk.c b/mm/pagewalk.c
+index 9b3db11a4d1db..fa7a3d21a7518 100644
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -110,7 +110,7 @@ static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
+ 	do {
+ again:
+ 		next = pmd_addr_end(addr, end);
+-		if (pmd_none(*pmd) || (!walk->vma && !walk->no_vma)) {
++		if (pmd_none(*pmd)) {
+ 			if (ops->pte_hole)
+ 				err = ops->pte_hole(addr, next, depth, walk);
+ 			if (err)
+@@ -171,7 +171,7 @@ static int walk_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end,
+ 	do {
+  again:
+ 		next = pud_addr_end(addr, end);
+-		if (pud_none(*pud) || (!walk->vma && !walk->no_vma)) {
++		if (pud_none(*pud)) {
+ 			if (ops->pte_hole)
+ 				err = ops->pte_hole(addr, next, depth, walk);
+ 			if (err)
+@@ -366,19 +366,19 @@ static int __walk_page_range(unsigned long start, unsigned long end,
+ 	struct vm_area_struct *vma = walk->vma;
+ 	const struct mm_walk_ops *ops = walk->ops;
+ 
+-	if (vma && ops->pre_vma) {
++	if (ops->pre_vma) {
+ 		err = ops->pre_vma(start, end, walk);
+ 		if (err)
+ 			return err;
+ 	}
+ 
+-	if (vma && is_vm_hugetlb_page(vma)) {
++	if (is_vm_hugetlb_page(vma)) {
+ 		if (ops->hugetlb_entry)
+ 			err = walk_hugetlb_range(start, end, walk);
+ 	} else
+ 		err = walk_pgd_range(start, end, walk);
+ 
+-	if (vma && ops->post_vma)
++	if (ops->post_vma)
+ 		ops->post_vma(walk);
+ 
+ 	return err;
+@@ -450,9 +450,13 @@ int walk_page_range(struct mm_struct *mm, unsigned long start,
+ 		if (!vma) { /* after the last vma */
+ 			walk.vma = NULL;
+ 			next = end;
++			if (ops->pte_hole)
++				err = ops->pte_hole(start, next, -1, &walk);
+ 		} else if (start < vma->vm_start) { /* outside vma */
+ 			walk.vma = NULL;
+ 			next = min(end, vma->vm_start);
++			if (ops->pte_hole)
++				err = ops->pte_hole(start, next, -1, &walk);
+ 		} else { /* inside vma */
+ 			walk.vma = vma;
+ 			next = min(end, vma->vm_end);
+@@ -470,9 +474,8 @@ int walk_page_range(struct mm_struct *mm, unsigned long start,
+ 			}
+ 			if (err < 0)
+ 				break;
+-		}
+-		if (walk.vma || walk.ops->pte_hole)
+ 			err = __walk_page_range(start, next, &walk);
++		}
+ 		if (err)
+ 			break;
+ 	} while (start = next, start < end);
+@@ -501,9 +504,9 @@ int walk_page_range_novma(struct mm_struct *mm, unsigned long start,
+ 	if (start >= end || !walk.mm)
+ 		return -EINVAL;
+ 
+-	mmap_assert_locked(walk.mm);
++	mmap_assert_write_locked(walk.mm);
+ 
+-	return __walk_page_range(start, end, &walk);
++	return walk_pgd_range(start, end, &walk);
+ }
+ 
+ int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops,
+diff --git a/mm/ptdump.c b/mm/ptdump.c
+index eea3d28d173c2..8adab455a68b3 100644
+--- a/mm/ptdump.c
++++ b/mm/ptdump.c
+@@ -152,13 +152,13 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd)
+ {
+ 	const struct ptdump_range *range = st->range;
+ 
+-	mmap_read_lock(mm);
++	mmap_write_lock(mm);
+ 	while (range->start != range->end) {
+ 		walk_page_range_novma(mm, range->start, range->end,
+ 				      &ptdump_ops, pgd, st);
+ 		range++;
+ 	}
+-	mmap_read_unlock(mm);
++	mmap_write_unlock(mm);
+ 
+ 	/* Flush out the last page */
+ 	st->note_page(st, 0, -1, 0);
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 77c3adf40e504..dbd4b6f9b0e79 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -420,6 +420,28 @@ kmem_cache_create(const char *name, unsigned int size, unsigned int align,
+ }
+ EXPORT_SYMBOL(kmem_cache_create);
+ 
++#ifdef SLAB_SUPPORTS_SYSFS
++/*
++ * For a given kmem_cache, kmem_cache_destroy() should only be called
++ * once or there will be a use-after-free problem. The actual deletion
++ * and release of the kobject does not need slab_mutex or cpu_hotplug_lock
++ * protection. So they are now done without holding those locks.
++ *
++ * Note that there will be a slight delay in the deletion of sysfs files
++ * if kmem_cache_release() is called indrectly from a work function.
++ */
++static void kmem_cache_release(struct kmem_cache *s)
++{
++	sysfs_slab_unlink(s);
++	sysfs_slab_release(s);
++}
++#else
++static void kmem_cache_release(struct kmem_cache *s)
++{
++	slab_kmem_cache_release(s);
++}
++#endif
++
+ static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work)
+ {
+ 	LIST_HEAD(to_destroy);
+@@ -446,11 +468,7 @@ static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work)
+ 	list_for_each_entry_safe(s, s2, &to_destroy, list) {
+ 		debugfs_slab_release(s);
+ 		kfence_shutdown_cache(s);
+-#ifdef SLAB_SUPPORTS_SYSFS
+-		sysfs_slab_release(s);
+-#else
+-		slab_kmem_cache_release(s);
+-#endif
++		kmem_cache_release(s);
+ 	}
+ }
+ 
+@@ -465,20 +483,11 @@ static int shutdown_cache(struct kmem_cache *s)
+ 	list_del(&s->list);
+ 
+ 	if (s->flags & SLAB_TYPESAFE_BY_RCU) {
+-#ifdef SLAB_SUPPORTS_SYSFS
+-		sysfs_slab_unlink(s);
+-#endif
+ 		list_add_tail(&s->list, &slab_caches_to_rcu_destroy);
+ 		schedule_work(&slab_caches_to_rcu_destroy_work);
+ 	} else {
+ 		kfence_shutdown_cache(s);
+ 		debugfs_slab_release(s);
+-#ifdef SLAB_SUPPORTS_SYSFS
+-		sysfs_slab_unlink(s);
+-		sysfs_slab_release(s);
+-#else
+-		slab_kmem_cache_release(s);
+-#endif
+ 	}
+ 
+ 	return 0;
+@@ -493,14 +502,16 @@ void slab_kmem_cache_release(struct kmem_cache *s)
+ 
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
++	int refcnt;
++
+ 	if (unlikely(!s) || !kasan_check_byte(s))
+ 		return;
+ 
+ 	cpus_read_lock();
+ 	mutex_lock(&slab_mutex);
+ 
+-	s->refcount--;
+-	if (s->refcount)
++	refcnt = --s->refcount;
++	if (refcnt)
+ 		goto out_unlock;
+ 
+ 	WARN(shutdown_cache(s),
+@@ -509,6 +520,8 @@ void kmem_cache_destroy(struct kmem_cache *s)
+ out_unlock:
+ 	mutex_unlock(&slab_mutex);
+ 	cpus_read_unlock();
++	if (!refcnt && !(s->flags & SLAB_TYPESAFE_BY_RCU))
++		kmem_cache_release(s);
+ }
+ EXPORT_SYMBOL(kmem_cache_destroy);
+ 
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 7cb956d3abb26..2c320a8fe70d7 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3998,6 +3998,17 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
+ 		}
+ 	}
+ 
++	if (i == ARRAY_SIZE(hci_cc_table)) {
++		/* Unknown opcode, assume byte 0 contains the status, so
++		 * that e.g. __hci_cmd_sync() properly returns errors
++		 * for vendor specific commands send by HCI drivers.
++		 * If a vendor doesn't actually follow this convention we may
++		 * need to introduce a vendor CC table in order to properly set
++		 * the status.
++		 */
++		*status = skb->data[0];
++	}
++
+ 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
+ 
+ 	hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
+@@ -5557,7 +5568,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
+ 	 */
+ 	hci_dev_clear_flag(hdev, HCI_LE_ADV);
+ 
+-	conn = hci_lookup_le_connect(hdev);
++	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
+ 	if (!conn) {
+ 		/* In case of error status and there is no connection pending
+ 		 * just unlock as there is nothing to cleanup.
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index b5e7d4b8ab24a..3b4cee67bbd60 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4452,9 +4452,11 @@ static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
+ 		/* Cleanup hci_conn object if it cannot be cancelled as it
+ 		 * likelly means the controller and host stack are out of sync.
+ 		 */
+-		if (err)
++		if (err) {
++			hci_dev_lock(hdev);
+ 			hci_conn_failed(conn, err);
+-
++			hci_dev_unlock(hdev);
++		}
+ 		return err;
+ 	case BT_CONNECT2:
+ 		return hci_reject_conn_sync(hdev, conn, reason);
+@@ -4967,17 +4969,21 @@ int hci_suspend_sync(struct hci_dev *hdev)
+ 	/* Prevent disconnects from causing scanning to be re-enabled */
+ 	hci_pause_scan_sync(hdev);
+ 
+-	/* Soft disconnect everything (power off) */
+-	err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF);
+-	if (err) {
+-		/* Set state to BT_RUNNING so resume doesn't notify */
+-		hdev->suspend_state = BT_RUNNING;
+-		hci_resume_sync(hdev);
+-		return err;
+-	}
++	if (hci_conn_count(hdev)) {
++		/* Soft disconnect everything (power off) */
++		err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF);
++		if (err) {
++			/* Set state to BT_RUNNING so resume doesn't notify */
++			hdev->suspend_state = BT_RUNNING;
++			hci_resume_sync(hdev);
++			return err;
++		}
+ 
+-	/* Update event mask so only the allowed event can wakeup the host */
+-	hci_set_event_mask_sync(hdev);
++		/* Update event mask so only the allowed event can wakeup the
++		 * host.
++		 */
++		hci_set_event_mask_sync(hdev);
++	}
+ 
+ 	/* Only configure accept list if disconnect succeeded and wake
+ 	 * isn't being prevented.
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 84209e661171e..69ac686c7cae3 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -462,7 +462,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
+ 
+ 			if (copied == len)
+ 				break;
+-		} while (!sg_is_last(sge));
++		} while ((i != msg_rx->sg.end) && !sg_is_last(sge));
+ 
+ 		if (unlikely(peek)) {
+ 			msg_rx = sk_psock_next_msg(psock, msg_rx);
+@@ -472,7 +472,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
+ 		}
+ 
+ 		msg_rx->sg.start = i;
+-		if (!sge->length && sg_is_last(sge)) {
++		if (!sge->length && (i == msg_rx->sg.end || sg_is_last(sge))) {
+ 			msg_rx = sk_psock_dequeue_msg(psock);
+ 			kfree_sk_msg(msg_rx);
+ 		}
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index f361d3d56be27..943edf4ad4db0 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -389,7 +389,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
+ 	dev_match = dev_match || (res.type == RTN_LOCAL &&
+ 				  dev == net->loopback_dev);
+ 	if (dev_match) {
+-		ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST;
++		ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_LINK;
+ 		return ret;
+ 	}
+ 	if (no_addr)
+@@ -401,7 +401,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
+ 	ret = 0;
+ 	if (fib_lookup(net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE) == 0) {
+ 		if (res.type == RTN_UNICAST)
+-			ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST;
++			ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_LINK;
+ 	}
+ 	return ret;
+ 
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 5c58e21f724e9..f866d6282b2b3 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -609,7 +609,7 @@ static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ 	ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src,
+ 			    tunnel_id_to_key32(key->tun_id),
+ 			    key->tos & ~INET_ECN_MASK, dev_net(dev), 0,
+-			    skb->mark, skb_get_hash(skb));
++			    skb->mark, skb_get_hash(skb), key->flow_flags);
+ 	rt = ip_route_output_key(dev_net(dev), &fl4);
+ 	if (IS_ERR(rt))
+ 		return PTR_ERR(rt);
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 94017a8c39945..1ad8809fc2e3b 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -295,7 +295,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
+ 		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
+ 				    iph->saddr, tunnel->parms.o_key,
+ 				    RT_TOS(iph->tos), dev_net(dev),
+-				    tunnel->parms.link, tunnel->fwmark, 0);
++				    tunnel->parms.link, tunnel->fwmark, 0, 0);
+ 		rt = ip_route_output_key(tunnel->net, &fl4);
+ 
+ 		if (!IS_ERR(rt)) {
+@@ -570,7 +570,8 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	}
+ 	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
+ 			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
+-			    dev_net(dev), 0, skb->mark, skb_get_hash(skb));
++			    dev_net(dev), 0, skb->mark, skb_get_hash(skb),
++			    key->flow_flags);
+ 	if (tunnel->encap.type != TUNNEL_ENCAP_NONE)
+ 		goto tx_error;
+ 
+@@ -728,7 +729,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr,
+ 			    tunnel->parms.o_key, RT_TOS(tos),
+ 			    dev_net(dev), tunnel->parms.link,
+-			    tunnel->fwmark, skb_get_hash(skb));
++			    tunnel->fwmark, skb_get_hash(skb), 0);
+ 
+ 	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
+ 		goto tx_error;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index b1637990d5708..e5435156e545d 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3630,11 +3630,11 @@ static void tcp_send_challenge_ack(struct sock *sk)
+ 
+ 	/* Then check host-wide RFC 5961 rate limit. */
+ 	now = jiffies / HZ;
+-	if (now != challenge_timestamp) {
++	if (now != READ_ONCE(challenge_timestamp)) {
+ 		u32 ack_limit = READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit);
+ 		u32 half = (ack_limit + 1) >> 1;
+ 
+-		challenge_timestamp = now;
++		WRITE_ONCE(challenge_timestamp, now);
+ 		WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit));
+ 	}
+ 	count = READ_ONCE(challenge_count);
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index 71899e5a5a111..1215c863e1c41 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ 	psock->sk = csk;
+ 	psock->bpf_prog = prog;
+ 
+-	err = strp_init(&psock->strp, csk, &cb);
+-	if (err) {
+-		kmem_cache_free(kcm_psockp, psock);
+-		goto out;
+-	}
+-
+ 	write_lock_bh(&csk->sk_callback_lock);
+ 
+ 	/* Check if sk_user_data is already by KCM or someone else.
+@@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ 	 */
+ 	if (csk->sk_user_data) {
+ 		write_unlock_bh(&csk->sk_callback_lock);
+-		strp_stop(&psock->strp);
+-		strp_done(&psock->strp);
+ 		kmem_cache_free(kcm_psockp, psock);
+ 		err = -EALREADY;
+ 		goto out;
+ 	}
+ 
++	err = strp_init(&psock->strp, csk, &cb);
++	if (err) {
++		write_unlock_bh(&csk->sk_callback_lock);
++		kmem_cache_free(kcm_psockp, psock);
++		goto out;
++	}
++
+ 	psock->save_data_ready = csk->sk_data_ready;
+ 	psock->save_write_space = csk->sk_write_space;
+ 	psock->save_state_change = csk->sk_state_change;
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 8ff547ff351ed..4e4c9df637354 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -534,6 +534,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
+ 
+ 	sdata_assert_lock(sdata);
+ 
++	/* When not connected/joined, sending CSA doesn't make sense. */
++	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
++		return -ENOLINK;
++
+ 	/* update cfg80211 bss information with the new channel */
+ 	if (!is_zero_ether_addr(ifibss->bssid)) {
+ 		cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index b698756887eb5..e692a2487eb5d 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -465,16 +465,19 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+ 	scan_req = rcu_dereference_protected(local->scan_req,
+ 					     lockdep_is_held(&local->mtx));
+ 
+-	if (scan_req != local->int_scan_req) {
+-		local->scan_info.aborted = aborted;
+-		cfg80211_scan_done(scan_req, &local->scan_info);
+-	}
+ 	RCU_INIT_POINTER(local->scan_req, NULL);
+ 	RCU_INIT_POINTER(local->scan_sdata, NULL);
+ 
+ 	local->scanning = 0;
+ 	local->scan_chandef.chan = NULL;
+ 
++	synchronize_rcu();
++
++	if (scan_req != local->int_scan_req) {
++		local->scan_info.aborted = aborted;
++		cfg80211_scan_done(scan_req, &local->scan_info);
++	}
++
+ 	/* Set power back to normal operating levels. */
+ 	ieee80211_hw_config(local, 0);
+ 
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index c0b2ce70e101c..fef9ad44d82ec 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2221,9 +2221,9 @@ static inline u64 sta_get_tidstats_msdu(struct ieee80211_sta_rx_stats *rxstats,
+ 	u64 value;
+ 
+ 	do {
+-		start = u64_stats_fetch_begin(&rxstats->syncp);
++		start = u64_stats_fetch_begin_irq(&rxstats->syncp);
+ 		value = rxstats->msdu[tid];
+-	} while (u64_stats_fetch_retry(&rxstats->syncp, start));
++	} while (u64_stats_fetch_retry_irq(&rxstats->syncp, start));
+ 
+ 	return value;
+ }
+@@ -2289,9 +2289,9 @@ static inline u64 sta_get_stats_bytes(struct ieee80211_sta_rx_stats *rxstats)
+ 	u64 value;
+ 
+ 	do {
+-		start = u64_stats_fetch_begin(&rxstats->syncp);
++		start = u64_stats_fetch_begin_irq(&rxstats->syncp);
+ 		value = rxstats->bytes;
+-	} while (u64_stats_fetch_retry(&rxstats->syncp, start));
++	} while (u64_stats_fetch_retry_irq(&rxstats->syncp, start));
+ 
+ 	return value;
+ }
+diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
+index b8ce84618a55b..c439125ef2b91 100644
+--- a/net/mac802154/rx.c
++++ b/net/mac802154/rx.c
+@@ -44,7 +44,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
+ 
+ 	switch (mac_cb(skb)->dest.mode) {
+ 	case IEEE802154_ADDR_NONE:
+-		if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
++		if (hdr->source.mode != IEEE802154_ADDR_NONE)
+ 			/* FIXME: check if we are PAN coordinator */
+ 			skb->pkt_type = PACKET_OTHERHOST;
+ 		else
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index 35b5f806fdda1..b52afe316dc41 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -1079,9 +1079,9 @@ static void mpls_get_stats(struct mpls_dev *mdev,
+ 
+ 		p = per_cpu_ptr(mdev->stats, i);
+ 		do {
+-			start = u64_stats_fetch_begin(&p->syncp);
++			start = u64_stats_fetch_begin_irq(&p->syncp);
+ 			local = p->stats;
+-		} while (u64_stats_fetch_retry(&p->syncp, start));
++		} while (u64_stats_fetch_retry_irq(&p->syncp, start));
+ 
+ 		stats->rx_packets	+= local.rx_packets;
+ 		stats->rx_bytes		+= local.rx_bytes;
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 7e8a39a356271..6c9d153afbeee 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -1802,7 +1802,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ 				ovs_dp_reset_user_features(skb, info);
+ 		}
+ 
+-		goto err_unlock_and_destroy_meters;
++		goto err_destroy_portids;
+ 	}
+ 
+ 	err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid,
+@@ -1817,6 +1817,8 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ 	ovs_notify(&dp_datapath_genl_family, reply, info);
+ 	return 0;
+ 
++err_destroy_portids:
++	kfree(rcu_dereference_raw(dp->upcall_portids));
+ err_unlock_and_destroy_meters:
+ 	ovs_unlock();
+ 	ovs_meters_exit(dp);
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index a64c3c1541118..b3596d4bd14a2 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1125,6 +1125,21 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+ }
+ EXPORT_SYMBOL(dev_graft_qdisc);
+ 
++static void shutdown_scheduler_queue(struct net_device *dev,
++				     struct netdev_queue *dev_queue,
++				     void *_qdisc_default)
++{
++	struct Qdisc *qdisc = dev_queue->qdisc_sleeping;
++	struct Qdisc *qdisc_default = _qdisc_default;
++
++	if (qdisc) {
++		rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
++		dev_queue->qdisc_sleeping = qdisc_default;
++
++		qdisc_put(qdisc);
++	}
++}
++
+ static void attach_one_default_qdisc(struct net_device *dev,
+ 				     struct netdev_queue *dev_queue,
+ 				     void *_unused)
+@@ -1172,6 +1187,7 @@ static void attach_default_qdiscs(struct net_device *dev)
+ 	if (qdisc == &noop_qdisc) {
+ 		netdev_warn(dev, "default qdisc (%s) fail, fallback to %s\n",
+ 			    default_qdisc_ops->id, noqueue_qdisc_ops.id);
++		netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
+ 		dev->priv_flags |= IFF_NO_QUEUE;
+ 		netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL);
+ 		qdisc = txq->qdisc_sleeping;
+@@ -1450,21 +1466,6 @@ void dev_init_scheduler(struct net_device *dev)
+ 	timer_setup(&dev->watchdog_timer, dev_watchdog, 0);
+ }
+ 
+-static void shutdown_scheduler_queue(struct net_device *dev,
+-				     struct netdev_queue *dev_queue,
+-				     void *_qdisc_default)
+-{
+-	struct Qdisc *qdisc = dev_queue->qdisc_sleeping;
+-	struct Qdisc *qdisc_default = _qdisc_default;
+-
+-	if (qdisc) {
+-		rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
+-		dev_queue->qdisc_sleeping = qdisc_default;
+-
+-		qdisc_put(qdisc);
+-	}
+-}
+-
+ void dev_shutdown(struct net_device *dev)
+ {
+ 	netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
+diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
+index 72102277449e1..36079fdde2cb5 100644
+--- a/net/sched/sch_tbf.c
++++ b/net/sched/sch_tbf.c
+@@ -356,6 +356,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
+ 	struct nlattr *tb[TCA_TBF_MAX + 1];
+ 	struct tc_tbf_qopt *qopt;
+ 	struct Qdisc *child = NULL;
++	struct Qdisc *old = NULL;
+ 	struct psched_ratecfg rate;
+ 	struct psched_ratecfg peak;
+ 	u64 max_size;
+@@ -447,7 +448,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
+ 	sch_tree_lock(sch);
+ 	if (child) {
+ 		qdisc_tree_flush_backlog(q->qdisc);
+-		qdisc_put(q->qdisc);
++		old = q->qdisc;
+ 		q->qdisc = child;
+ 	}
+ 	q->limit = qopt->limit;
+@@ -467,6 +468,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
+ 	memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg));
+ 
+ 	sch_tree_unlock(sch);
++	qdisc_put(old);
+ 	err = 0;
+ 
+ 	tbf_offload_change(sch);
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 433bb5a7df31e..a51d5ed2ad764 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1812,7 +1812,6 @@ static void smc_listen_out_connected(struct smc_sock *new_smc)
+ {
+ 	struct sock *newsmcsk = &new_smc->sk;
+ 
+-	sk_refcnt_debug_inc(newsmcsk);
+ 	if (newsmcsk->sk_state == SMC_INIT)
+ 		newsmcsk->sk_state = SMC_ACTIVE;
+ 
+diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
+index aab43469a2f04..0878b162890af 100644
+--- a/net/wireless/debugfs.c
++++ b/net/wireless/debugfs.c
+@@ -65,9 +65,10 @@ static ssize_t ht40allow_map_read(struct file *file,
+ {
+ 	struct wiphy *wiphy = file->private_data;
+ 	char *buf;
+-	unsigned int offset = 0, buf_size = PAGE_SIZE, i, r;
++	unsigned int offset = 0, buf_size = PAGE_SIZE, i;
+ 	enum nl80211_band band;
+ 	struct ieee80211_supported_band *sband;
++	ssize_t r;
+ 
+ 	buf = kzalloc(buf_size, GFP_KERNEL);
+ 	if (!buf)
+diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
+index f70112176b7c1..a71a8c6edf553 100644
+--- a/net/xdp/xsk_buff_pool.c
++++ b/net/xdp/xsk_buff_pool.c
+@@ -379,6 +379,16 @@ static void xp_check_dma_contiguity(struct xsk_dma_map *dma_map)
+ 
+ static int xp_init_dma_info(struct xsk_buff_pool *pool, struct xsk_dma_map *dma_map)
+ {
++	if (!pool->unaligned) {
++		u32 i;
++
++		for (i = 0; i < pool->heads_cnt; i++) {
++			struct xdp_buff_xsk *xskb = &pool->heads[i];
++
++			xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr);
++		}
++	}
++
+ 	pool->dma_pages = kvcalloc(dma_map->dma_pages_cnt, sizeof(*pool->dma_pages), GFP_KERNEL);
+ 	if (!pool->dma_pages)
+ 		return -ENOMEM;
+@@ -428,12 +438,6 @@ int xp_dma_map(struct xsk_buff_pool *pool, struct device *dev,
+ 
+ 	if (pool->unaligned)
+ 		xp_check_dma_contiguity(dma_map);
+-	else
+-		for (i = 0; i < pool->heads_cnt; i++) {
+-			struct xdp_buff_xsk *xskb = &pool->heads[i];
+-
+-			xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr);
+-		}
+ 
+ 	err = xp_init_dma_info(pool, dma_map);
+ 	if (err) {
+diff --git a/security/landlock/fs.c b/security/landlock/fs.c
+index ec5a6247cd3e7..a9dbd99d9ee76 100644
+--- a/security/landlock/fs.c
++++ b/security/landlock/fs.c
+@@ -149,6 +149,16 @@ retry:
+ 	LANDLOCK_ACCESS_FS_READ_FILE)
+ /* clang-format on */
+ 
++/*
++ * All access rights that are denied by default whether they are handled or not
++ * by a ruleset/layer.  This must be ORed with all ruleset->fs_access_masks[]
++ * entries when we need to get the absolute handled access masks.
++ */
++/* clang-format off */
++#define ACCESS_INITIALLY_DENIED ( \
++	LANDLOCK_ACCESS_FS_REFER)
++/* clang-format on */
++
+ /*
+  * @path: Should have been checked by get_path_from_fd().
+  */
+@@ -167,7 +177,9 @@ int landlock_append_fs_rule(struct landlock_ruleset *const ruleset,
+ 		return -EINVAL;
+ 
+ 	/* Transforms relative access rights to absolute ones. */
+-	access_rights |= LANDLOCK_MASK_ACCESS_FS & ~ruleset->fs_access_masks[0];
++	access_rights |=
++		LANDLOCK_MASK_ACCESS_FS &
++		~(ruleset->fs_access_masks[0] | ACCESS_INITIALLY_DENIED);
+ 	object = get_inode_object(d_backing_inode(path->dentry));
+ 	if (IS_ERR(object))
+ 		return PTR_ERR(object);
+@@ -277,23 +289,12 @@ static inline bool is_nouser_or_private(const struct dentry *dentry)
+ static inline access_mask_t
+ get_handled_accesses(const struct landlock_ruleset *const domain)
+ {
+-	access_mask_t access_dom = 0;
+-	unsigned long access_bit;
+-
+-	for (access_bit = 0; access_bit < LANDLOCK_NUM_ACCESS_FS;
+-	     access_bit++) {
+-		size_t layer_level;
++	access_mask_t access_dom = ACCESS_INITIALLY_DENIED;
++	size_t layer_level;
+ 
+-		for (layer_level = 0; layer_level < domain->num_layers;
+-		     layer_level++) {
+-			if (domain->fs_access_masks[layer_level] &
+-			    BIT_ULL(access_bit)) {
+-				access_dom |= BIT_ULL(access_bit);
+-				break;
+-			}
+-		}
+-	}
+-	return access_dom;
++	for (layer_level = 0; layer_level < domain->num_layers; layer_level++)
++		access_dom |= domain->fs_access_masks[layer_level];
++	return access_dom & LANDLOCK_MASK_ACCESS_FS;
+ }
+ 
+ static inline access_mask_t
+@@ -316,8 +317,13 @@ init_layer_masks(const struct landlock_ruleset *const domain,
+ 
+ 		for_each_set_bit(access_bit, &access_req,
+ 				 ARRAY_SIZE(*layer_masks)) {
+-			if (domain->fs_access_masks[layer_level] &
+-			    BIT_ULL(access_bit)) {
++			/*
++			 * Artificially handles all initially denied by default
++			 * access rights.
++			 */
++			if (BIT_ULL(access_bit) &
++			    (domain->fs_access_masks[layer_level] |
++			     ACCESS_INITIALLY_DENIED)) {
+ 				(*layer_masks)[access_bit] |=
+ 					BIT_ULL(layer_level);
+ 				handled_accesses |= BIT_ULL(access_bit);
+@@ -857,10 +863,6 @@ static int current_check_refer_path(struct dentry *const old_dentry,
+ 					      NULL, NULL);
+ 	}
+ 
+-	/* Backward compatibility: no reparenting support. */
+-	if (!(get_handled_accesses(dom) & LANDLOCK_ACCESS_FS_REFER))
+-		return -EXDEV;
+-
+ 	access_request_parent1 |= LANDLOCK_ACCESS_FS_REFER;
+ 	access_request_parent2 |= LANDLOCK_ACCESS_FS_REFER;
+ 
+diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
+index 8cfdaee779050..55b3c49ba61de 100644
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -20,6 +20,13 @@
+ 
+ static const struct snd_malloc_ops *snd_dma_get_ops(struct snd_dma_buffer *dmab);
+ 
++#ifdef CONFIG_SND_DMA_SGBUF
++static void *do_alloc_fallback_pages(struct device *dev, size_t size,
++				     dma_addr_t *addr, bool wc);
++static void do_free_fallback_pages(void *p, size_t size, bool wc);
++static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size);
++#endif
++
+ /* a cast to gfp flag from the dev pointer; for CONTINUOUS and VMALLOC types */
+ static inline gfp_t snd_mem_get_gfp_flags(const struct snd_dma_buffer *dmab,
+ 					  gfp_t default_gfp)
+@@ -269,16 +276,21 @@ EXPORT_SYMBOL(snd_sgbuf_get_chunk_size);
+ /*
+  * Continuous pages allocator
+  */
+-static void *snd_dma_continuous_alloc(struct snd_dma_buffer *dmab, size_t size)
++static void *do_alloc_pages(size_t size, dma_addr_t *addr, gfp_t gfp)
+ {
+-	gfp_t gfp = snd_mem_get_gfp_flags(dmab, GFP_KERNEL);
+ 	void *p = alloc_pages_exact(size, gfp);
+ 
+ 	if (p)
+-		dmab->addr = page_to_phys(virt_to_page(p));
++		*addr = page_to_phys(virt_to_page(p));
+ 	return p;
+ }
+ 
++static void *snd_dma_continuous_alloc(struct snd_dma_buffer *dmab, size_t size)
++{
++	return do_alloc_pages(size, &dmab->addr,
++			      snd_mem_get_gfp_flags(dmab, GFP_KERNEL));
++}
++
+ static void snd_dma_continuous_free(struct snd_dma_buffer *dmab)
+ {
+ 	free_pages_exact(dmab->area, dmab->bytes);
+@@ -455,6 +467,25 @@ static const struct snd_malloc_ops snd_dma_dev_ops = {
+ /*
+  * Write-combined pages
+  */
++/* x86-specific allocations */
++#ifdef CONFIG_SND_DMA_SGBUF
++static void *snd_dma_wc_alloc(struct snd_dma_buffer *dmab, size_t size)
++{
++	return do_alloc_fallback_pages(dmab->dev.dev, size, &dmab->addr, true);
++}
++
++static void snd_dma_wc_free(struct snd_dma_buffer *dmab)
++{
++	do_free_fallback_pages(dmab->area, dmab->bytes, true);
++}
++
++static int snd_dma_wc_mmap(struct snd_dma_buffer *dmab,
++			   struct vm_area_struct *area)
++{
++	area->vm_page_prot = pgprot_writecombine(area->vm_page_prot);
++	return snd_dma_continuous_mmap(dmab, area);
++}
++#else
+ static void *snd_dma_wc_alloc(struct snd_dma_buffer *dmab, size_t size)
+ {
+ 	return dma_alloc_wc(dmab->dev.dev, size, &dmab->addr, DEFAULT_GFP);
+@@ -471,6 +502,7 @@ static int snd_dma_wc_mmap(struct snd_dma_buffer *dmab,
+ 	return dma_mmap_wc(dmab->dev.dev, area,
+ 			   dmab->area, dmab->addr, dmab->bytes);
+ }
++#endif /* CONFIG_SND_DMA_SGBUF */
+ 
+ static const struct snd_malloc_ops snd_dma_wc_ops = {
+ 	.alloc = snd_dma_wc_alloc,
+@@ -478,10 +510,6 @@ static const struct snd_malloc_ops snd_dma_wc_ops = {
+ 	.mmap = snd_dma_wc_mmap,
+ };
+ 
+-#ifdef CONFIG_SND_DMA_SGBUF
+-static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size);
+-#endif
+-
+ /*
+  * Non-contiguous pages allocator
+  */
+@@ -661,6 +689,37 @@ static const struct snd_malloc_ops snd_dma_sg_wc_ops = {
+ 	.get_chunk_size = snd_dma_noncontig_get_chunk_size,
+ };
+ 
++/* manual page allocations with wc setup */
++static void *do_alloc_fallback_pages(struct device *dev, size_t size,
++				     dma_addr_t *addr, bool wc)
++{
++	gfp_t gfp = GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN;
++	void *p;
++
++ again:
++	p = do_alloc_pages(size, addr, gfp);
++	if (!p || (*addr + size - 1) & ~dev->coherent_dma_mask) {
++		if (IS_ENABLED(CONFIG_ZONE_DMA32) && !(gfp & GFP_DMA32)) {
++			gfp |= GFP_DMA32;
++			goto again;
++		}
++		if (IS_ENABLED(CONFIG_ZONE_DMA) && !(gfp & GFP_DMA)) {
++			gfp = (gfp & ~GFP_DMA32) | GFP_DMA;
++			goto again;
++		}
++	}
++	if (p && wc)
++		set_memory_wc((unsigned long)(p), size >> PAGE_SHIFT);
++	return p;
++}
++
++static void do_free_fallback_pages(void *p, size_t size, bool wc)
++{
++	if (wc)
++		set_memory_wb((unsigned long)(p), size >> PAGE_SHIFT);
++	free_pages_exact(p, size);
++}
++
+ /* Fallback SG-buffer allocations for x86 */
+ struct snd_dma_sg_fallback {
+ 	size_t count;
+@@ -671,14 +730,11 @@ struct snd_dma_sg_fallback {
+ static void __snd_dma_sg_fallback_free(struct snd_dma_buffer *dmab,
+ 				       struct snd_dma_sg_fallback *sgbuf)
+ {
++	bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK;
+ 	size_t i;
+ 
+-	if (sgbuf->count && dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK)
+-		set_pages_array_wb(sgbuf->pages, sgbuf->count);
+ 	for (i = 0; i < sgbuf->count && sgbuf->pages[i]; i++)
+-		dma_free_coherent(dmab->dev.dev, PAGE_SIZE,
+-				  page_address(sgbuf->pages[i]),
+-				  sgbuf->addrs[i]);
++		do_free_fallback_pages(page_address(sgbuf->pages[i]), PAGE_SIZE, wc);
+ 	kvfree(sgbuf->pages);
+ 	kvfree(sgbuf->addrs);
+ 	kfree(sgbuf);
+@@ -690,6 +746,7 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
+ 	struct page **pages;
+ 	size_t i, count;
+ 	void *p;
++	bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK;
+ 
+ 	sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL);
+ 	if (!sgbuf)
+@@ -704,15 +761,13 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
+ 		goto error;
+ 
+ 	for (i = 0; i < count; sgbuf->count++, i++) {
+-		p = dma_alloc_coherent(dmab->dev.dev, PAGE_SIZE,
+-				       &sgbuf->addrs[i], DEFAULT_GFP);
++		p = do_alloc_fallback_pages(dmab->dev.dev, PAGE_SIZE,
++					    &sgbuf->addrs[i], wc);
+ 		if (!p)
+ 			goto error;
+ 		sgbuf->pages[i] = virt_to_page(p);
+ 	}
+ 
+-	if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK)
+-		set_pages_array_wc(pages, count);
+ 	p = vmap(pages, count, VM_MAP, PAGE_KERNEL);
+ 	if (!p)
+ 		goto error;
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index 1e3bf086f8671..07efb38f58ac1 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -270,7 +270,9 @@ snd_seq_oss_midi_clear_all(void)
+ void
+ snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp)
+ {
++	spin_lock_irq(&register_lock);
+ 	dp->max_mididev = max_midi_devs;
++	spin_unlock_irq(&register_lock);
+ }
+ 
+ /*
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 2e9d695d336c9..2d707afa1ef1c 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -121,13 +121,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ 	spin_unlock_irqrestore(&clients_lock, flags);
+ #ifdef CONFIG_MODULES
+ 	if (!in_interrupt()) {
+-		static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS];
+-		static char card_requested[SNDRV_CARDS];
++		static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS);
++		static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
++
+ 		if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) {
+ 			int idx;
+ 			
+-			if (!client_requested[clientid]) {
+-				client_requested[clientid] = 1;
++			if (!test_and_set_bit(clientid, client_requested)) {
+ 				for (idx = 0; idx < 15; idx++) {
+ 					if (seq_client_load[idx] < 0)
+ 						break;
+@@ -142,10 +142,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ 			int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) /
+ 				SNDRV_SEQ_CLIENTS_PER_CARD;
+ 			if (card < snd_ecards_limit) {
+-				if (! card_requested[card]) {
+-					card_requested[card] = 1;
++				if (!test_and_set_bit(card, card_requested))
+ 					snd_request_card(card);
+-				}
+ 				snd_seq_device_load_drivers();
+ 			}
+ 		}
+diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c
+index 9db5ccd9aa2db..13bb0ccfb36c0 100644
+--- a/sound/hda/intel-nhlt.c
++++ b/sound/hda/intel-nhlt.c
+@@ -55,16 +55,22 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt)
+ 
+ 		/* find max number of channels based on format_configuration */
+ 		if (fmt_configs->fmt_count) {
++			struct nhlt_fmt_cfg *fmt_cfg = fmt_configs->fmt_config;
++
+ 			dev_dbg(dev, "found %d format definitions\n",
+ 				fmt_configs->fmt_count);
+ 
+ 			for (i = 0; i < fmt_configs->fmt_count; i++) {
+ 				struct wav_fmt_ext *fmt_ext;
+ 
+-				fmt_ext = &fmt_configs->fmt_config[i].fmt_ext;
++				fmt_ext = &fmt_cfg->fmt_ext;
+ 
+ 				if (fmt_ext->fmt.channels > max_ch)
+ 					max_ch = fmt_ext->fmt.channels;
++
++				/* Move to the next nhlt_fmt_cfg */
++				fmt_cfg = (struct nhlt_fmt_cfg *)(fmt_cfg->config.caps +
++								  fmt_cfg->config.size);
+ 			}
+ 			dev_dbg(dev, "max channels found %d\n", max_ch);
+ 		} else {
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b44b882f8378c..799f6bf266dd0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4689,6 +4689,48 @@ static void alc236_fixup_hp_mute_led_micmute_vref(struct hda_codec *codec,
+ 	alc236_fixup_hp_micmute_led_vref(codec, fix, action);
+ }
+ 
++static inline void alc298_samsung_write_coef_pack(struct hda_codec *codec,
++						  const unsigned short coefs[2])
++{
++	alc_write_coef_idx(codec, 0x23, coefs[0]);
++	alc_write_coef_idx(codec, 0x25, coefs[1]);
++	alc_write_coef_idx(codec, 0x26, 0xb011);
++}
++
++struct alc298_samsung_amp_desc {
++	unsigned char nid;
++	unsigned short init_seq[2][2];
++};
++
++static void alc298_fixup_samsung_amp(struct hda_codec *codec,
++				     const struct hda_fixup *fix, int action)
++{
++	int i, j;
++	static const unsigned short init_seq[][2] = {
++		{ 0x19, 0x00 }, { 0x20, 0xc0 }, { 0x22, 0x44 }, { 0x23, 0x08 },
++		{ 0x24, 0x85 }, { 0x25, 0x41 }, { 0x35, 0x40 }, { 0x36, 0x01 },
++		{ 0x38, 0x81 }, { 0x3a, 0x03 }, { 0x3b, 0x81 }, { 0x40, 0x3e },
++		{ 0x41, 0x07 }, { 0x400, 0x1 }
++	};
++	static const struct alc298_samsung_amp_desc amps[] = {
++		{ 0x3a, { { 0x18, 0x1 }, { 0x26, 0x0 } } },
++		{ 0x39, { { 0x18, 0x2 }, { 0x26, 0x1 } } }
++	};
++
++	if (action != HDA_FIXUP_ACT_INIT)
++		return;
++
++	for (i = 0; i < ARRAY_SIZE(amps); i++) {
++		alc_write_coef_idx(codec, 0x22, amps[i].nid);
++
++		for (j = 0; j < ARRAY_SIZE(amps[i].init_seq); j++)
++			alc298_samsung_write_coef_pack(codec, amps[i].init_seq[j]);
++
++		for (j = 0; j < ARRAY_SIZE(init_seq); j++)
++			alc298_samsung_write_coef_pack(codec, init_seq[j]);
++	}
++}
++
+ #if IS_REACHABLE(CONFIG_INPUT)
+ static void gpio2_mic_hotkey_event(struct hda_codec *codec,
+ 				   struct hda_jack_callback *event)
+@@ -7000,6 +7042,7 @@ enum {
+ 	ALC236_FIXUP_HP_GPIO_LED,
+ 	ALC236_FIXUP_HP_MUTE_LED,
+ 	ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
++	ALC298_FIXUP_SAMSUNG_AMP,
+ 	ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ 	ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ 	ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
+@@ -8365,6 +8408,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc236_fixup_hp_mute_led_micmute_vref,
+ 	},
++	[ALC298_FIXUP_SAMSUNG_AMP] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc298_fixup_samsung_amp,
++		.chained = true,
++		.chain_id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET
++	},
+ 	[ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
+ 		.type = HDA_FIXUP_VERBS,
+ 		.v.verbs = (const struct hda_verb[]) {
+@@ -9307,13 +9356,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x10ec, 0x1254, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
+ 	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+ 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+-	SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+-	SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+-	SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+-	SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
++	SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_AMP),
++	SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_AMP),
++	SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP),
++	SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP),
+ 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+-	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+-	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
++	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP),
++	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP),
+ 	SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+@@ -9679,7 +9728,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
+ 	{.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"},
+ 	{.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
+-	{.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
++	{.id = ALC298_FIXUP_SAMSUNG_AMP, .name = "alc298-samsung-amp"},
+ 	{.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"},
+ 	{.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"},
+ 	{.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"},
+diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
+index 21a2ce8fa739d..45de42a027c54 100644
+--- a/tools/testing/selftests/landlock/fs_test.c
++++ b/tools/testing/selftests/landlock/fs_test.c
+@@ -4,7 +4,7 @@
+  *
+  * Copyright © 2017-2020 Mickaël Salaün <mic@×××××××.net>
+  * Copyright © 2020 ANSSI
+- * Copyright © 2020-2021 Microsoft Corporation
++ * Copyright © 2020-2022 Microsoft Corporation
+  */
+ 
+ #define _GNU_SOURCE
+@@ -371,6 +371,13 @@ TEST_F_FORK(layout1, inval)
+ 	ASSERT_EQ(EINVAL, errno);
+ 	path_beneath.allowed_access &= ~LANDLOCK_ACCESS_FS_EXECUTE;
+ 
++	/* Tests with denied-by-default access right. */
++	path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_REFER;
++	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
++					&path_beneath, 0));
++	ASSERT_EQ(EINVAL, errno);
++	path_beneath.allowed_access &= ~LANDLOCK_ACCESS_FS_REFER;
++
+ 	/* Test with unknown (64-bits) value. */
+ 	path_beneath.allowed_access |= (1ULL << 60);
+ 	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
+@@ -1826,6 +1833,20 @@ TEST_F_FORK(layout1, link)
+ 	ASSERT_EQ(0, link(file1_s1d3, file2_s1d3));
+ }
+ 
++static int test_rename(const char *const oldpath, const char *const newpath)
++{
++	if (rename(oldpath, newpath))
++		return errno;
++	return 0;
++}
++
++static int test_exchange(const char *const oldpath, const char *const newpath)
++{
++	if (renameat2(AT_FDCWD, oldpath, AT_FDCWD, newpath, RENAME_EXCHANGE))
++		return errno;
++	return 0;
++}
++
+ TEST_F_FORK(layout1, rename_file)
+ {
+ 	const struct rule rules[] = {
+@@ -1867,10 +1888,10 @@ TEST_F_FORK(layout1, rename_file)
+ 	 * to a different directory (which allows file removal).
+ 	 */
+ 	ASSERT_EQ(-1, rename(file1_s2d1, file1_s1d3));
+-	ASSERT_EQ(EXDEV, errno);
++	ASSERT_EQ(EACCES, errno);
+ 	ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s2d1, AT_FDCWD, file1_s1d3,
+ 				RENAME_EXCHANGE));
+-	ASSERT_EQ(EXDEV, errno);
++	ASSERT_EQ(EACCES, errno);
+ 	ASSERT_EQ(-1, renameat2(AT_FDCWD, dir_s2d2, AT_FDCWD, file1_s1d3,
+ 				RENAME_EXCHANGE));
+ 	ASSERT_EQ(EXDEV, errno);
+@@ -1894,7 +1915,7 @@ TEST_F_FORK(layout1, rename_file)
+ 	ASSERT_EQ(EXDEV, errno);
+ 	ASSERT_EQ(0, unlink(file1_s1d3));
+ 	ASSERT_EQ(-1, rename(file1_s2d1, file1_s1d3));
+-	ASSERT_EQ(EXDEV, errno);
++	ASSERT_EQ(EACCES, errno);
+ 
+ 	/* Exchanges and renames files with same parent. */
+ 	ASSERT_EQ(0, renameat2(AT_FDCWD, file2_s2d3, AT_FDCWD, file1_s2d3,
+@@ -2014,6 +2035,115 @@ TEST_F_FORK(layout1, reparent_refer)
+ 	ASSERT_EQ(0, rename(dir_s1d3, dir_s2d3));
+ }
+ 
++/* Checks renames beneath dir_s1d1. */
++static void refer_denied_by_default(struct __test_metadata *const _metadata,
++				    const struct rule layer1[],
++				    const int layer1_err,
++				    const struct rule layer2[])
++{
++	int ruleset_fd;
++
++	ASSERT_EQ(0, unlink(file1_s1d2));
++
++	ruleset_fd = create_ruleset(_metadata, layer1[0].access, layer1);
++	ASSERT_LE(0, ruleset_fd);
++	enforce_ruleset(_metadata, ruleset_fd);
++	ASSERT_EQ(0, close(ruleset_fd));
++
++	/*
++	 * If the first layer handles LANDLOCK_ACCESS_FS_REFER (according to
++	 * layer1_err), then it allows some different-parent renames and links.
++	 */
++	ASSERT_EQ(layer1_err, test_rename(file1_s1d1, file1_s1d2));
++	if (layer1_err == 0)
++		ASSERT_EQ(layer1_err, test_rename(file1_s1d2, file1_s1d1));
++	ASSERT_EQ(layer1_err, test_exchange(file2_s1d1, file2_s1d2));
++	ASSERT_EQ(layer1_err, test_exchange(file2_s1d2, file2_s1d1));
++
++	ruleset_fd = create_ruleset(_metadata, layer2[0].access, layer2);
++	ASSERT_LE(0, ruleset_fd);
++	enforce_ruleset(_metadata, ruleset_fd);
++	ASSERT_EQ(0, close(ruleset_fd));
++
++	/*
++	 * Now, either the first or the second layer does not handle
++	 * LANDLOCK_ACCESS_FS_REFER, which means that any different-parent
++	 * renames and links are denied, thus making the layer handling
++	 * LANDLOCK_ACCESS_FS_REFER null and void.
++	 */
++	ASSERT_EQ(EXDEV, test_rename(file1_s1d1, file1_s1d2));
++	ASSERT_EQ(EXDEV, test_exchange(file2_s1d1, file2_s1d2));
++	ASSERT_EQ(EXDEV, test_exchange(file2_s1d2, file2_s1d1));
++}
++
++const struct rule layer_dir_s1d1_refer[] = {
++	{
++		.path = dir_s1d1,
++		.access = LANDLOCK_ACCESS_FS_REFER,
++	},
++	{},
++};
++
++const struct rule layer_dir_s1d1_execute[] = {
++	{
++		/* Matches a parent directory. */
++		.path = dir_s1d1,
++		.access = LANDLOCK_ACCESS_FS_EXECUTE,
++	},
++	{},
++};
++
++const struct rule layer_dir_s2d1_execute[] = {
++	{
++		/* Does not match a parent directory. */
++		.path = dir_s2d1,
++		.access = LANDLOCK_ACCESS_FS_EXECUTE,
++	},
++	{},
++};
++
++/*
++ * Tests precedence over renames: denied by default for different parent
++ * directories, *with* a rule matching a parent directory, but not directly
++ * denying access (with MAKE_REG nor REMOVE).
++ */
++TEST_F_FORK(layout1, refer_denied_by_default1)
++{
++	refer_denied_by_default(_metadata, layer_dir_s1d1_refer, 0,
++				layer_dir_s1d1_execute);
++}
++
++/*
++ * Same test but this time turning around the ABI version order: the first
++ * layer does not handle LANDLOCK_ACCESS_FS_REFER.
++ */
++TEST_F_FORK(layout1, refer_denied_by_default2)
++{
++	refer_denied_by_default(_metadata, layer_dir_s1d1_execute, EXDEV,
++				layer_dir_s1d1_refer);
++}
++
++/*
++ * Tests precedence over renames: denied by default for different parent
++ * directories, *without* a rule matching a parent directory, but not directly
++ * denying access (with MAKE_REG nor REMOVE).
++ */
++TEST_F_FORK(layout1, refer_denied_by_default3)
++{
++	refer_denied_by_default(_metadata, layer_dir_s1d1_refer, 0,
++				layer_dir_s2d1_execute);
++}
++
++/*
++ * Same test but this time turning around the ABI version order: the first
++ * layer does not handle LANDLOCK_ACCESS_FS_REFER.
++ */
++TEST_F_FORK(layout1, refer_denied_by_default4)
++{
++	refer_denied_by_default(_metadata, layer_dir_s2d1_execute, EXDEV,
++				layer_dir_s1d1_refer);
++}
++
+ TEST_F_FORK(layout1, reparent_link)
+ {
+ 	const struct rule layer1[] = {
+@@ -2336,11 +2466,12 @@ TEST_F_FORK(layout1, reparent_exdev_layers_rename1)
+ 	ASSERT_EQ(EXDEV, errno);
+ 
+ 	/*
+-	 * However, moving the file2_s1d3 file below dir_s2d3 is allowed
+-	 * because it cannot inherit MAKE_REG nor MAKE_DIR rights (which are
+-	 * dedicated to directories).
++	 * Moving the file2_s1d3 file below dir_s2d3 is denied because the
++	 * second layer does not handle REFER, which is always denied by
++	 * default.
+ 	 */
+-	ASSERT_EQ(0, rename(file2_s1d3, file1_s2d3));
++	ASSERT_EQ(-1, rename(file2_s1d3, file1_s2d3));
++	ASSERT_EQ(EXDEV, errno);
+ }
+ 
+ TEST_F_FORK(layout1, reparent_exdev_layers_rename2)
+@@ -2373,8 +2504,12 @@ TEST_F_FORK(layout1, reparent_exdev_layers_rename2)
+ 	ASSERT_EQ(EACCES, errno);
+ 	ASSERT_EQ(-1, rename(file1_s1d1, file1_s2d3));
+ 	ASSERT_EQ(EXDEV, errno);
+-	/* Modify layout! */
+-	ASSERT_EQ(0, rename(file2_s1d2, file1_s2d3));
++	/*
++	 * Modifying the layout is now denied because the second layer does not
++	 * handle REFER, which is always denied by default.
++	 */
++	ASSERT_EQ(-1, rename(file2_s1d2, file1_s2d3));
++	ASSERT_EQ(EXDEV, errno);
+ 
+ 	/* Without REFER source, EACCES wins over EXDEV. */
+ 	ASSERT_EQ(-1, rename(dir_s1d1, file1_s2d2));