Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:5.3 commit in: /
Date: Thu, 17 Oct 2019 22:28:13
Message-Id: 1571351271.60bbadab7b2c80a38d304667976d13a10add2526.mpagano@gentoo
1 commit: 60bbadab7b2c80a38d304667976d13a10add2526
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Thu Oct 17 22:27:51 2019 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Thu Oct 17 22:27:51 2019 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=60bbadab
7
8 Linux patch 5.3.7
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1006_linux-5.3.7.patch | 5181 ++++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 5185 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index 2347308..e15ba25 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -67,6 +67,10 @@ Patch: 1005_linux-5.3.6.patch
21 From: http://www.kernel.org
22 Desc: Linux 5.3.6
23
24 +Patch: 1006_linux-5.3.7.patch
25 +From: http://www.kernel.org
26 +Desc: Linux 5.3.7
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1006_linux-5.3.7.patch b/1006_linux-5.3.7.patch
33 new file mode 100644
34 index 0000000..de9efc4
35 --- /dev/null
36 +++ b/1006_linux-5.3.7.patch
37 @@ -0,0 +1,5181 @@
38 +diff --git a/Documentation/usb/rio.rst b/Documentation/usb/rio.rst
39 +deleted file mode 100644
40 +index ea73475471db..000000000000
41 +--- a/Documentation/usb/rio.rst
42 ++++ /dev/null
43 +@@ -1,109 +0,0 @@
44 +-============
45 +-Diamonds Rio
46 +-============
47 +-
48 +-Copyright (C) 1999, 2000 Bruce Tenison
49 +-
50 +-Portions Copyright (C) 1999, 2000 David Nelson
51 +-
52 +-Thanks to David Nelson for guidance and the usage of the scanner.txt
53 +-and scanner.c files to model our driver and this informative file.
54 +-
55 +-Mar. 2, 2000
56 +-
57 +-Changes
58 +-=======
59 +-
60 +-- Initial Revision
61 +-
62 +-
63 +-Overview
64 +-========
65 +-
66 +-This README will address issues regarding how to configure the kernel
67 +-to access a RIO 500 mp3 player.
68 +-Before I explain how to use this to access the Rio500 please be warned:
69 +-
70 +-.. warning::
71 +-
72 +- Please note that this software is still under development. The authors
73 +- are in no way responsible for any damage that may occur, no matter how
74 +- inconsequential.
75 +-
76 +-It seems that the Rio has a problem when sending .mp3 with low batteries.
77 +-I suggest when the batteries are low and you want to transfer stuff that you
78 +-replace it with a fresh one. In my case, what happened is I lost two 16kb
79 +-blocks (they are no longer usable to store information to it). But I don't
80 +-know if that's normal or not; it could simply be a problem with the flash
81 +-memory.
82 +-
83 +-In an extreme case, I left my Rio playing overnight and the batteries wore
84 +-down to nothing and appear to have corrupted the flash memory. My RIO
85 +-needed to be replaced as a result. Diamond tech support is aware of the
86 +-problem. Do NOT allow your batteries to wear down to nothing before
87 +-changing them. It appears RIO 500 firmware does not handle low battery
88 +-power well at all.
89 +-
90 +-On systems with OHCI controllers, the kernel OHCI code appears to have
91 +-power on problems with some chipsets. If you are having problems
92 +-connecting to your RIO 500, try turning it on first and then plugging it
93 +-into the USB cable.
94 +-
95 +-Contact Information
96 +--------------------
97 +-
98 +- The main page for the project is hosted at sourceforge.net in the following
99 +- URL: <http://rio500.sourceforge.net>. You can also go to the project's
100 +- sourceforge home page at: <http://sourceforge.net/projects/rio500/>.
101 +- There is also a mailing list: rio500-users@×××××××××××××××××.net
102 +-
103 +-Authors
104 +--------
105 +-
106 +-Most of the code was written by Cesar Miquel <miquel@××××××.ar>. Keith
107 +-Clayton <kclayton@×××.net> is incharge of the PPC port and making sure
108 +-things work there. Bruce Tenison <btenison@×××××.net> is adding support
109 +-for .fon files and also does testing. The program will mostly sure be
110 +-re-written and Pete Ikusz along with the rest will re-design it. I would
111 +-also like to thank Tri Nguyen <tmn_3022000@×××××××.com> who provided use
112 +-with some important information regarding the communication with the Rio.
113 +-
114 +-Additional Information and userspace tools
115 +-
116 +- http://rio500.sourceforge.net/
117 +-
118 +-
119 +-Requirements
120 +-============
121 +-
122 +-A host with a USB port running a Linux kernel with RIO 500 support enabled.
123 +-
124 +-The driver is a module called rio500, which should be automatically loaded
125 +-as you plug in your device. If that fails you can manually load it with
126 +-
127 +- modprobe rio500
128 +-
129 +-Udev should automatically create a device node as soon as plug in your device.
130 +-If that fails, you can manually add a device for the USB rio500::
131 +-
132 +- mknod /dev/usb/rio500 c 180 64
133 +-
134 +-In that case, set appropriate permissions for /dev/usb/rio500 (don't forget
135 +-about group and world permissions). Both read and write permissions are
136 +-required for proper operation.
137 +-
138 +-That's it. The Rio500 Utils at: http://rio500.sourceforge.net should
139 +-be able to access the rio500.
140 +-
141 +-Limits
142 +-======
143 +-
144 +-You can use only a single rio500 device at a time with your computer.
145 +-
146 +-Bugs
147 +-====
148 +-
149 +-If you encounter any problems feel free to drop me an email.
150 +-
151 +-Bruce Tenison
152 +-btenison@×××××.net
153 +diff --git a/MAINTAINERS b/MAINTAINERS
154 +index a50e97a63bc8..1d235c674be8 100644
155 +--- a/MAINTAINERS
156 ++++ b/MAINTAINERS
157 +@@ -16606,13 +16606,6 @@ W: http://www.linux-usb.org/usbnet
158 + S: Maintained
159 + F: drivers/net/usb/dm9601.c
160 +
161 +-USB DIAMOND RIO500 DRIVER
162 +-M: Cesar Miquel <miquel@××××××.ar>
163 +-L: rio500-users@×××××××××××××××××.net
164 +-W: http://rio500.sourceforge.net
165 +-S: Maintained
166 +-F: drivers/usb/misc/rio500*
167 +-
168 + USB EHCI DRIVER
169 + M: Alan Stern <stern@×××××××××××××××.edu>
170 + L: linux-usb@×××××××××××.org
171 +diff --git a/Makefile b/Makefile
172 +index d7469f0926a6..7a3e659c79ae 100644
173 +--- a/Makefile
174 ++++ b/Makefile
175 +@@ -1,7 +1,7 @@
176 + # SPDX-License-Identifier: GPL-2.0
177 + VERSION = 5
178 + PATCHLEVEL = 3
179 +-SUBLEVEL = 6
180 ++SUBLEVEL = 7
181 + EXTRAVERSION =
182 + NAME = Bobtail Squid
183 +
184 +diff --git a/arch/arm/configs/badge4_defconfig b/arch/arm/configs/badge4_defconfig
185 +index 5ae5b5228467..ef484c4cfd1a 100644
186 +--- a/arch/arm/configs/badge4_defconfig
187 ++++ b/arch/arm/configs/badge4_defconfig
188 +@@ -91,7 +91,6 @@ CONFIG_USB_SERIAL_PL2303=m
189 + CONFIG_USB_SERIAL_CYBERJACK=m
190 + CONFIG_USB_SERIAL_XIRCOM=m
191 + CONFIG_USB_SERIAL_OMNINET=m
192 +-CONFIG_USB_RIO500=m
193 + CONFIG_EXT2_FS=m
194 + CONFIG_EXT3_FS=m
195 + CONFIG_MSDOS_FS=y
196 +diff --git a/arch/arm/configs/corgi_defconfig b/arch/arm/configs/corgi_defconfig
197 +index e4f6442588e7..4fec2ec379ad 100644
198 +--- a/arch/arm/configs/corgi_defconfig
199 ++++ b/arch/arm/configs/corgi_defconfig
200 +@@ -195,7 +195,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
201 + CONFIG_USB_SERIAL_OMNINET=m
202 + CONFIG_USB_EMI62=m
203 + CONFIG_USB_EMI26=m
204 +-CONFIG_USB_RIO500=m
205 + CONFIG_USB_LEGOTOWER=m
206 + CONFIG_USB_LCD=m
207 + CONFIG_USB_CYTHERM=m
208 +diff --git a/arch/arm/configs/pxa_defconfig b/arch/arm/configs/pxa_defconfig
209 +index 787c3f9be414..b817c57f05f1 100644
210 +--- a/arch/arm/configs/pxa_defconfig
211 ++++ b/arch/arm/configs/pxa_defconfig
212 +@@ -581,7 +581,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
213 + CONFIG_USB_SERIAL_OMNINET=m
214 + CONFIG_USB_EMI62=m
215 + CONFIG_USB_EMI26=m
216 +-CONFIG_USB_RIO500=m
217 + CONFIG_USB_LEGOTOWER=m
218 + CONFIG_USB_LCD=m
219 + CONFIG_USB_CYTHERM=m
220 +diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
221 +index 95b5a4ffddea..73ed73a8785a 100644
222 +--- a/arch/arm/configs/s3c2410_defconfig
223 ++++ b/arch/arm/configs/s3c2410_defconfig
224 +@@ -327,7 +327,6 @@ CONFIG_USB_EMI62=m
225 + CONFIG_USB_EMI26=m
226 + CONFIG_USB_ADUTUX=m
227 + CONFIG_USB_SEVSEG=m
228 +-CONFIG_USB_RIO500=m
229 + CONFIG_USB_LEGOTOWER=m
230 + CONFIG_USB_LCD=m
231 + CONFIG_USB_CYPRESS_CY7C63=m
232 +diff --git a/arch/arm/configs/spitz_defconfig b/arch/arm/configs/spitz_defconfig
233 +index 4fb51d665abb..a1cdbfa064c5 100644
234 +--- a/arch/arm/configs/spitz_defconfig
235 ++++ b/arch/arm/configs/spitz_defconfig
236 +@@ -189,7 +189,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
237 + CONFIG_USB_SERIAL_OMNINET=m
238 + CONFIG_USB_EMI62=m
239 + CONFIG_USB_EMI26=m
240 +-CONFIG_USB_RIO500=m
241 + CONFIG_USB_LEGOTOWER=m
242 + CONFIG_USB_LCD=m
243 + CONFIG_USB_CYTHERM=m
244 +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
245 +index f674f28df663..803499360da8 100644
246 +--- a/arch/arm64/kernel/process.c
247 ++++ b/arch/arm64/kernel/process.c
248 +@@ -323,22 +323,27 @@ void arch_release_task_struct(struct task_struct *tsk)
249 + fpsimd_release_task(tsk);
250 + }
251 +
252 +-/*
253 +- * src and dst may temporarily have aliased sve_state after task_struct
254 +- * is copied. We cannot fix this properly here, because src may have
255 +- * live SVE state and dst's thread_info may not exist yet, so tweaking
256 +- * either src's or dst's TIF_SVE is not safe.
257 +- *
258 +- * The unaliasing is done in copy_thread() instead. This works because
259 +- * dst is not schedulable or traceable until both of these functions
260 +- * have been called.
261 +- */
262 + int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
263 + {
264 + if (current->mm)
265 + fpsimd_preserve_current_state();
266 + *dst = *src;
267 +
268 ++ /* We rely on the above assignment to initialize dst's thread_flags: */
269 ++ BUILD_BUG_ON(!IS_ENABLED(CONFIG_THREAD_INFO_IN_TASK));
270 ++
271 ++ /*
272 ++ * Detach src's sve_state (if any) from dst so that it does not
273 ++ * get erroneously used or freed prematurely. dst's sve_state
274 ++ * will be allocated on demand later on if dst uses SVE.
275 ++ * For consistency, also clear TIF_SVE here: this could be done
276 ++ * later in copy_process(), but to avoid tripping up future
277 ++ * maintainers it is best not to leave TIF_SVE and sve_state in
278 ++ * an inconsistent state, even temporarily.
279 ++ */
280 ++ dst->thread.sve_state = NULL;
281 ++ clear_tsk_thread_flag(dst, TIF_SVE);
282 ++
283 + return 0;
284 + }
285 +
286 +@@ -351,13 +356,6 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
287 +
288 + memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
289 +
290 +- /*
291 +- * Unalias p->thread.sve_state (if any) from the parent task
292 +- * and disable discard SVE state for p:
293 +- */
294 +- clear_tsk_thread_flag(p, TIF_SVE);
295 +- p->thread.sve_state = NULL;
296 +-
297 + /*
298 + * In case p was allocated the same task_struct pointer as some
299 + * other recently-exited task, make sure p is disassociated from
300 +diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
301 +index 0825c4a856e3..6106c49f84bc 100644
302 +--- a/arch/arm64/kernel/topology.c
303 ++++ b/arch/arm64/kernel/topology.c
304 +@@ -340,17 +340,28 @@ void remove_cpu_topology(unsigned int cpu)
305 + }
306 +
307 + #ifdef CONFIG_ACPI
308 ++static bool __init acpi_cpu_is_threaded(int cpu)
309 ++{
310 ++ int is_threaded = acpi_pptt_cpu_is_thread(cpu);
311 ++
312 ++ /*
313 ++ * if the PPTT doesn't have thread information, assume a homogeneous
314 ++ * machine and return the current CPU's thread state.
315 ++ */
316 ++ if (is_threaded < 0)
317 ++ is_threaded = read_cpuid_mpidr() & MPIDR_MT_BITMASK;
318 ++
319 ++ return !!is_threaded;
320 ++}
321 ++
322 + /*
323 + * Propagate the topology information of the processor_topology_node tree to the
324 + * cpu_topology array.
325 + */
326 + static int __init parse_acpi_topology(void)
327 + {
328 +- bool is_threaded;
329 + int cpu, topology_id;
330 +
331 +- is_threaded = read_cpuid_mpidr() & MPIDR_MT_BITMASK;
332 +-
333 + for_each_possible_cpu(cpu) {
334 + int i, cache_id;
335 +
336 +@@ -358,7 +369,7 @@ static int __init parse_acpi_topology(void)
337 + if (topology_id < 0)
338 + return topology_id;
339 +
340 +- if (is_threaded) {
341 ++ if (acpi_cpu_is_threaded(cpu)) {
342 + cpu_topology[cpu].thread_id = topology_id;
343 + topology_id = find_acpi_cpu_topology(cpu, 1);
344 + cpu_topology[cpu].core_id = topology_id;
345 +diff --git a/arch/mips/configs/mtx1_defconfig b/arch/mips/configs/mtx1_defconfig
346 +index 16bef819fe98..914af125a7fa 100644
347 +--- a/arch/mips/configs/mtx1_defconfig
348 ++++ b/arch/mips/configs/mtx1_defconfig
349 +@@ -571,7 +571,6 @@ CONFIG_USB_SERIAL_OMNINET=m
350 + CONFIG_USB_EMI62=m
351 + CONFIG_USB_EMI26=m
352 + CONFIG_USB_ADUTUX=m
353 +-CONFIG_USB_RIO500=m
354 + CONFIG_USB_LEGOTOWER=m
355 + CONFIG_USB_LCD=m
356 + CONFIG_USB_CYPRESS_CY7C63=m
357 +diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig
358 +index 0f4b09f8a0ee..d588bc5280f4 100644
359 +--- a/arch/mips/configs/rm200_defconfig
360 ++++ b/arch/mips/configs/rm200_defconfig
361 +@@ -315,7 +315,6 @@ CONFIG_USB_SERIAL_SAFE_PADDED=y
362 + CONFIG_USB_SERIAL_CYBERJACK=m
363 + CONFIG_USB_SERIAL_XIRCOM=m
364 + CONFIG_USB_SERIAL_OMNINET=m
365 +-CONFIG_USB_RIO500=m
366 + CONFIG_USB_LEGOTOWER=m
367 + CONFIG_USB_LCD=m
368 + CONFIG_USB_CYTHERM=m
369 +diff --git a/arch/mips/include/uapi/asm/hwcap.h b/arch/mips/include/uapi/asm/hwcap.h
370 +index a2aba4b059e6..1ade1daa4921 100644
371 +--- a/arch/mips/include/uapi/asm/hwcap.h
372 ++++ b/arch/mips/include/uapi/asm/hwcap.h
373 +@@ -6,5 +6,16 @@
374 + #define HWCAP_MIPS_R6 (1 << 0)
375 + #define HWCAP_MIPS_MSA (1 << 1)
376 + #define HWCAP_MIPS_CRC32 (1 << 2)
377 ++#define HWCAP_MIPS_MIPS16 (1 << 3)
378 ++#define HWCAP_MIPS_MDMX (1 << 4)
379 ++#define HWCAP_MIPS_MIPS3D (1 << 5)
380 ++#define HWCAP_MIPS_SMARTMIPS (1 << 6)
381 ++#define HWCAP_MIPS_DSP (1 << 7)
382 ++#define HWCAP_MIPS_DSP2 (1 << 8)
383 ++#define HWCAP_MIPS_DSP3 (1 << 9)
384 ++#define HWCAP_MIPS_MIPS16E2 (1 << 10)
385 ++#define HWCAP_LOONGSON_MMI (1 << 11)
386 ++#define HWCAP_LOONGSON_EXT (1 << 12)
387 ++#define HWCAP_LOONGSON_EXT2 (1 << 13)
388 +
389 + #endif /* _UAPI_ASM_HWCAP_H */
390 +diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
391 +index e698a20017c1..147dafa4bfc3 100644
392 +--- a/arch/mips/kernel/cpu-probe.c
393 ++++ b/arch/mips/kernel/cpu-probe.c
394 +@@ -2198,6 +2198,39 @@ void cpu_probe(void)
395 + elf_hwcap |= HWCAP_MIPS_MSA;
396 + }
397 +
398 ++ if (cpu_has_mips16)
399 ++ elf_hwcap |= HWCAP_MIPS_MIPS16;
400 ++
401 ++ if (cpu_has_mdmx)
402 ++ elf_hwcap |= HWCAP_MIPS_MDMX;
403 ++
404 ++ if (cpu_has_mips3d)
405 ++ elf_hwcap |= HWCAP_MIPS_MIPS3D;
406 ++
407 ++ if (cpu_has_smartmips)
408 ++ elf_hwcap |= HWCAP_MIPS_SMARTMIPS;
409 ++
410 ++ if (cpu_has_dsp)
411 ++ elf_hwcap |= HWCAP_MIPS_DSP;
412 ++
413 ++ if (cpu_has_dsp2)
414 ++ elf_hwcap |= HWCAP_MIPS_DSP2;
415 ++
416 ++ if (cpu_has_dsp3)
417 ++ elf_hwcap |= HWCAP_MIPS_DSP3;
418 ++
419 ++ if (cpu_has_mips16e2)
420 ++ elf_hwcap |= HWCAP_MIPS_MIPS16E2;
421 ++
422 ++ if (cpu_has_loongson_mmi)
423 ++ elf_hwcap |= HWCAP_LOONGSON_MMI;
424 ++
425 ++ if (cpu_has_loongson_ext)
426 ++ elf_hwcap |= HWCAP_LOONGSON_EXT;
427 ++
428 ++ if (cpu_has_loongson_ext2)
429 ++ elf_hwcap |= HWCAP_LOONGSON_EXT2;
430 ++
431 + if (cpu_has_vz)
432 + cpu_probe_vz(c);
433 +
434 +diff --git a/arch/mips/loongson64/Platform b/arch/mips/loongson64/Platform
435 +index c1a4d4dc4665..9f79908f5063 100644
436 +--- a/arch/mips/loongson64/Platform
437 ++++ b/arch/mips/loongson64/Platform
438 +@@ -66,6 +66,10 @@ else
439 + $(call cc-option,-march=mips64r2,-mips64r2 -U_MIPS_ISA -D_MIPS_ISA=_MIPS_ISA_MIPS64)
440 + endif
441 +
442 ++# Some -march= flags enable MMI instructions, and GCC complains about that
443 ++# support being enabled alongside -msoft-float. Thus explicitly disable MMI.
444 ++cflags-y += $(call cc-option,-mno-loongson-mmi)
445 ++
446 + #
447 + # Loongson Machines' Support
448 + #
449 +diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
450 +index 7221df24cb23..38d005be3cc4 100644
451 +--- a/arch/mips/vdso/Makefile
452 ++++ b/arch/mips/vdso/Makefile
453 +@@ -9,6 +9,7 @@ ccflags-vdso := \
454 + $(filter -mmicromips,$(KBUILD_CFLAGS)) \
455 + $(filter -march=%,$(KBUILD_CFLAGS)) \
456 + $(filter -m%-float,$(KBUILD_CFLAGS)) \
457 ++ $(filter -mno-loongson-%,$(KBUILD_CFLAGS)) \
458 + -D__VDSO__
459 +
460 + ifdef CONFIG_CC_IS_CLANG
461 +diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
462 +index e28f8b723b5c..9d5252c9685c 100644
463 +--- a/arch/x86/include/asm/mwait.h
464 ++++ b/arch/x86/include/asm/mwait.h
465 +@@ -21,7 +21,7 @@
466 + #define MWAIT_ECX_INTERRUPT_BREAK 0x1
467 + #define MWAITX_ECX_TIMER_ENABLE BIT(1)
468 + #define MWAITX_MAX_LOOPS ((u32)-1)
469 +-#define MWAITX_DISABLE_CSTATES 0xf
470 ++#define MWAITX_DISABLE_CSTATES 0xf0
471 +
472 + static inline void __monitor(const void *eax, unsigned long ecx,
473 + unsigned long edx)
474 +diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
475 +index b7375dc6898f..c126571e5e2e 100644
476 +--- a/arch/x86/lib/delay.c
477 ++++ b/arch/x86/lib/delay.c
478 +@@ -113,8 +113,8 @@ static void delay_mwaitx(unsigned long __loops)
479 + __monitorx(raw_cpu_ptr(&cpu_tss_rw), 0, 0);
480 +
481 + /*
482 +- * AMD, like Intel, supports the EAX hint and EAX=0xf
483 +- * means, do not enter any deep C-state and we use it
484 ++ * AMD, like Intel's MWAIT version, supports the EAX hint and
485 ++ * EAX=0xf0 means, do not enter any deep C-state and we use it
486 + * here in delay() to minimize wakeup latency.
487 + */
488 + __mwaitx(MWAITX_DISABLE_CSTATES, delay, MWAITX_ECX_TIMER_ENABLE);
489 +diff --git a/block/blk-rq-qos.c b/block/blk-rq-qos.c
490 +index 3954c0dc1443..de04b89e9157 100644
491 +--- a/block/blk-rq-qos.c
492 ++++ b/block/blk-rq-qos.c
493 +@@ -142,24 +142,27 @@ bool rq_depth_calc_max_depth(struct rq_depth *rqd)
494 + return ret;
495 + }
496 +
497 +-void rq_depth_scale_up(struct rq_depth *rqd)
498 ++/* Returns true on success and false if scaling up wasn't possible */
499 ++bool rq_depth_scale_up(struct rq_depth *rqd)
500 + {
501 + /*
502 + * Hit max in previous round, stop here
503 + */
504 + if (rqd->scaled_max)
505 +- return;
506 ++ return false;
507 +
508 + rqd->scale_step--;
509 +
510 + rqd->scaled_max = rq_depth_calc_max_depth(rqd);
511 ++ return true;
512 + }
513 +
514 + /*
515 + * Scale rwb down. If 'hard_throttle' is set, do it quicker, since we
516 +- * had a latency violation.
517 ++ * had a latency violation. Returns true on success and returns false if
518 ++ * scaling down wasn't possible.
519 + */
520 +-void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
521 ++bool rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
522 + {
523 + /*
524 + * Stop scaling down when we've hit the limit. This also prevents
525 +@@ -167,7 +170,7 @@ void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
526 + * keep up.
527 + */
528 + if (rqd->max_depth == 1)
529 +- return;
530 ++ return false;
531 +
532 + if (rqd->scale_step < 0 && hard_throttle)
533 + rqd->scale_step = 0;
534 +@@ -176,6 +179,7 @@ void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
535 +
536 + rqd->scaled_max = false;
537 + rq_depth_calc_max_depth(rqd);
538 ++ return true;
539 + }
540 +
541 + struct rq_qos_wait_data {
542 +diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h
543 +index 2300e038b9fa..c0f0778d5396 100644
544 +--- a/block/blk-rq-qos.h
545 ++++ b/block/blk-rq-qos.h
546 +@@ -125,8 +125,8 @@ void rq_qos_wait(struct rq_wait *rqw, void *private_data,
547 + acquire_inflight_cb_t *acquire_inflight_cb,
548 + cleanup_cb_t *cleanup_cb);
549 + bool rq_wait_inc_below(struct rq_wait *rq_wait, unsigned int limit);
550 +-void rq_depth_scale_up(struct rq_depth *rqd);
551 +-void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle);
552 ++bool rq_depth_scale_up(struct rq_depth *rqd);
553 ++bool rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle);
554 + bool rq_depth_calc_max_depth(struct rq_depth *rqd);
555 +
556 + void __rq_qos_cleanup(struct rq_qos *rqos, struct bio *bio);
557 +diff --git a/block/blk-wbt.c b/block/blk-wbt.c
558 +index 313f45a37e9d..5a96881e7a52 100644
559 +--- a/block/blk-wbt.c
560 ++++ b/block/blk-wbt.c
561 +@@ -308,7 +308,8 @@ static void calc_wb_limits(struct rq_wb *rwb)
562 +
563 + static void scale_up(struct rq_wb *rwb)
564 + {
565 +- rq_depth_scale_up(&rwb->rq_depth);
566 ++ if (!rq_depth_scale_up(&rwb->rq_depth))
567 ++ return;
568 + calc_wb_limits(rwb);
569 + rwb->unknown_cnt = 0;
570 + rwb_wake_all(rwb);
571 +@@ -317,7 +318,8 @@ static void scale_up(struct rq_wb *rwb)
572 +
573 + static void scale_down(struct rq_wb *rwb, bool hard_throttle)
574 + {
575 +- rq_depth_scale_down(&rwb->rq_depth, hard_throttle);
576 ++ if (!rq_depth_scale_down(&rwb->rq_depth, hard_throttle))
577 ++ return;
578 + calc_wb_limits(rwb);
579 + rwb->unknown_cnt = 0;
580 + rwb_trace_step(rwb, "scale down");
581 +diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
582 +index 1e7ac0bd0d3a..9497298018a9 100644
583 +--- a/drivers/acpi/pptt.c
584 ++++ b/drivers/acpi/pptt.c
585 +@@ -540,6 +540,44 @@ static int find_acpi_cpu_topology_tag(unsigned int cpu, int level, int flag)
586 + return retval;
587 + }
588 +
589 ++/**
590 ++ * check_acpi_cpu_flag() - Determine if CPU node has a flag set
591 ++ * @cpu: Kernel logical CPU number
592 ++ * @rev: The minimum PPTT revision defining the flag
593 ++ * @flag: The flag itself
594 ++ *
595 ++ * Check the node representing a CPU for a given flag.
596 ++ *
597 ++ * Return: -ENOENT if the PPTT doesn't exist, the CPU cannot be found or
598 ++ * the table revision isn't new enough.
599 ++ * 1, any passed flag set
600 ++ * 0, flag unset
601 ++ */
602 ++static int check_acpi_cpu_flag(unsigned int cpu, int rev, u32 flag)
603 ++{
604 ++ struct acpi_table_header *table;
605 ++ acpi_status status;
606 ++ u32 acpi_cpu_id = get_acpi_id_for_cpu(cpu);
607 ++ struct acpi_pptt_processor *cpu_node = NULL;
608 ++ int ret = -ENOENT;
609 ++
610 ++ status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
611 ++ if (ACPI_FAILURE(status)) {
612 ++ acpi_pptt_warn_missing();
613 ++ return ret;
614 ++ }
615 ++
616 ++ if (table->revision >= rev)
617 ++ cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
618 ++
619 ++ if (cpu_node)
620 ++ ret = (cpu_node->flags & flag) != 0;
621 ++
622 ++ acpi_put_table(table);
623 ++
624 ++ return ret;
625 ++}
626 ++
627 + /**
628 + * acpi_find_last_cache_level() - Determines the number of cache levels for a PE
629 + * @cpu: Kernel logical CPU number
630 +@@ -604,6 +642,20 @@ int cache_setup_acpi(unsigned int cpu)
631 + return status;
632 + }
633 +
634 ++/**
635 ++ * acpi_pptt_cpu_is_thread() - Determine if CPU is a thread
636 ++ * @cpu: Kernel logical CPU number
637 ++ *
638 ++ * Return: 1, a thread
639 ++ * 0, not a thread
640 ++ * -ENOENT ,if the PPTT doesn't exist, the CPU cannot be found or
641 ++ * the table revision isn't new enough.
642 ++ */
643 ++int acpi_pptt_cpu_is_thread(unsigned int cpu)
644 ++{
645 ++ return check_acpi_cpu_flag(cpu, 2, ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD);
646 ++}
647 ++
648 + /**
649 + * find_acpi_cpu_topology() - Determine a unique topology value for a given CPU
650 + * @cpu: Kernel logical CPU number
651 +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
652 +index ad3b1f4866b3..8f020827cdd3 100644
653 +--- a/drivers/firmware/efi/efi.c
654 ++++ b/drivers/firmware/efi/efi.c
655 +@@ -282,6 +282,9 @@ static __init int efivar_ssdt_load(void)
656 + void *data;
657 + int ret;
658 +
659 ++ if (!efivar_ssdt[0])
660 ++ return 0;
661 ++
662 + ret = efivar_init(efivar_ssdt_iter, &entries, true, &entries);
663 +
664 + list_for_each_entry_safe(entry, aux, &entries, list) {
665 +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
666 +index 1d3f5ca3eaaf..ebd7977653a8 100644
667 +--- a/drivers/firmware/efi/tpm.c
668 ++++ b/drivers/firmware/efi/tpm.c
669 +@@ -40,7 +40,7 @@ int __init efi_tpm_eventlog_init(void)
670 + {
671 + struct linux_efi_tpm_eventlog *log_tbl;
672 + struct efi_tcg2_final_events_table *final_tbl;
673 +- unsigned int tbl_size;
674 ++ int tbl_size;
675 + int ret = 0;
676 +
677 + if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
678 +@@ -75,16 +75,28 @@ int __init efi_tpm_eventlog_init(void)
679 + goto out;
680 + }
681 +
682 +- tbl_size = tpm2_calc_event_log_size((void *)efi.tpm_final_log
683 +- + sizeof(final_tbl->version)
684 +- + sizeof(final_tbl->nr_events),
685 +- final_tbl->nr_events,
686 +- log_tbl->log);
687 ++ tbl_size = 0;
688 ++ if (final_tbl->nr_events != 0) {
689 ++ void *events = (void *)efi.tpm_final_log
690 ++ + sizeof(final_tbl->version)
691 ++ + sizeof(final_tbl->nr_events);
692 ++
693 ++ tbl_size = tpm2_calc_event_log_size(events,
694 ++ final_tbl->nr_events,
695 ++ log_tbl->log);
696 ++ }
697 ++
698 ++ if (tbl_size < 0) {
699 ++ pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
700 ++ goto out_calc;
701 ++ }
702 ++
703 + memblock_reserve((unsigned long)final_tbl,
704 + tbl_size + sizeof(*final_tbl));
705 +- early_memunmap(final_tbl, sizeof(*final_tbl));
706 + efi_tpm_final_log_size = tbl_size;
707 +
708 ++out_calc:
709 ++ early_memunmap(final_tbl, sizeof(*final_tbl));
710 + out:
711 + early_memunmap(log_tbl, sizeof(*log_tbl));
712 + return ret;
713 +diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
714 +index dda525c0f968..5c6f2a74f104 100644
715 +--- a/drivers/firmware/google/vpd_decode.c
716 ++++ b/drivers/firmware/google/vpd_decode.c
717 +@@ -52,7 +52,7 @@ static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
718 + if (max_len - consumed < *entry_len)
719 + return VPD_FAIL;
720 +
721 +- consumed += decoded_len;
722 ++ consumed += *entry_len;
723 + *_consumed = consumed;
724 + return VPD_OK;
725 + }
726 +diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
727 +index 7b9ac4a12c20..090539f0c5a2 100644
728 +--- a/drivers/gpio/gpio-eic-sprd.c
729 ++++ b/drivers/gpio/gpio-eic-sprd.c
730 +@@ -530,11 +530,12 @@ static void sprd_eic_handle_one_type(struct gpio_chip *chip)
731 + }
732 +
733 + for_each_set_bit(n, &reg, SPRD_EIC_PER_BANK_NR) {
734 +- girq = irq_find_mapping(chip->irq.domain,
735 +- bank * SPRD_EIC_PER_BANK_NR + n);
736 ++ u32 offset = bank * SPRD_EIC_PER_BANK_NR + n;
737 ++
738 ++ girq = irq_find_mapping(chip->irq.domain, offset);
739 +
740 + generic_handle_irq(girq);
741 +- sprd_eic_toggle_trigger(chip, girq, n);
742 ++ sprd_eic_toggle_trigger(chip, girq, offset);
743 + }
744 + }
745 + }
746 +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
747 +index d9074191edef..74a77001b1bd 100644
748 +--- a/drivers/gpio/gpiolib.c
749 ++++ b/drivers/gpio/gpiolib.c
750 +@@ -2775,8 +2775,10 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
751 + if (!ret)
752 + goto set_output_value;
753 + /* Emulate open drain by not actively driving the line high */
754 +- if (value)
755 +- return gpiod_direction_input(desc);
756 ++ if (value) {
757 ++ ret = gpiod_direction_input(desc);
758 ++ goto set_output_flag;
759 ++ }
760 + }
761 + else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags)) {
762 + ret = gpio_set_config(gc, gpio_chip_hwgpio(desc),
763 +@@ -2784,8 +2786,10 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
764 + if (!ret)
765 + goto set_output_value;
766 + /* Emulate open source by not actively driving the line low */
767 +- if (!value)
768 +- return gpiod_direction_input(desc);
769 ++ if (!value) {
770 ++ ret = gpiod_direction_input(desc);
771 ++ goto set_output_flag;
772 ++ }
773 + } else {
774 + gpio_set_config(gc, gpio_chip_hwgpio(desc),
775 + PIN_CONFIG_DRIVE_PUSH_PULL);
776 +@@ -2793,6 +2797,17 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
777 +
778 + set_output_value:
779 + return gpiod_direction_output_raw_commit(desc, value);
780 ++
781 ++set_output_flag:
782 ++ /*
783 ++ * When emulating open-source or open-drain functionalities by not
784 ++ * actively driving the line (setting mode to input) we still need to
785 ++ * set the IS_OUT flag or otherwise we won't be able to set the line
786 ++ * value anymore.
787 ++ */
788 ++ if (ret == 0)
789 ++ set_bit(FLAG_IS_OUT, &desc->flags);
790 ++ return ret;
791 + }
792 + EXPORT_SYMBOL_GPL(gpiod_direction_output);
793 +
794 +@@ -3153,8 +3168,6 @@ static void gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value)
795 +
796 + if (value) {
797 + err = chip->direction_input(chip, offset);
798 +- if (!err)
799 +- clear_bit(FLAG_IS_OUT, &desc->flags);
800 + } else {
801 + err = chip->direction_output(chip, offset, 0);
802 + if (!err)
803 +@@ -3184,8 +3197,6 @@ static void gpio_set_open_source_value_commit(struct gpio_desc *desc, bool value
804 + set_bit(FLAG_IS_OUT, &desc->flags);
805 + } else {
806 + err = chip->direction_input(chip, offset);
807 +- if (!err)
808 +- clear_bit(FLAG_IS_OUT, &desc->flags);
809 + }
810 + trace_gpio_direction(desc_to_gpio(desc), !value, err);
811 + if (err < 0)
812 +@@ -4303,7 +4314,7 @@ struct gpio_desc *gpiod_get_from_of_node(struct device_node *node,
813 + transitory = flags & OF_GPIO_TRANSITORY;
814 +
815 + ret = gpiod_request(desc, label);
816 +- if (ret == -EBUSY && (flags & GPIOD_FLAGS_BIT_NONEXCLUSIVE))
817 ++ if (ret == -EBUSY && (dflags & GPIOD_FLAGS_BIT_NONEXCLUSIVE))
818 + return desc;
819 + if (ret)
820 + return ERR_PTR(ret);
821 +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
822 +index 1e59a78e74bf..9b61fae5aef7 100644
823 +--- a/drivers/gpu/drm/i915/display/intel_display.c
824 ++++ b/drivers/gpu/drm/i915/display/intel_display.c
825 +@@ -3291,7 +3291,20 @@ static int skl_max_plane_width(const struct drm_framebuffer *fb,
826 + switch (fb->modifier) {
827 + case DRM_FORMAT_MOD_LINEAR:
828 + case I915_FORMAT_MOD_X_TILED:
829 +- return 4096;
830 ++ /*
831 ++ * Validated limit is 4k, but has 5k should
832 ++ * work apart from the following features:
833 ++ * - Ytile (already limited to 4k)
834 ++ * - FP16 (already limited to 4k)
835 ++ * - render compression (already limited to 4k)
836 ++ * - KVMR sprite and cursor (don't care)
837 ++ * - horizontal panning (TODO verify this)
838 ++ * - pipe and plane scaling (TODO verify this)
839 ++ */
840 ++ if (cpp == 8)
841 ++ return 4096;
842 ++ else
843 ++ return 5120;
844 + case I915_FORMAT_MOD_Y_TILED_CCS:
845 + case I915_FORMAT_MOD_Yf_TILED_CCS:
846 + /* FIXME AUX plane? */
847 +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
848 +index 39a661927d8e..c201289039fe 100644
849 +--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
850 ++++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
851 +@@ -317,7 +317,11 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf)
852 + msecs_to_jiffies_timeout(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND));
853 + GEM_BUG_ON(!obj->userfault_count);
854 +
855 +- i915_vma_set_ggtt_write(vma);
856 ++ if (write) {
857 ++ GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj));
858 ++ i915_vma_set_ggtt_write(vma);
859 ++ obj->mm.dirty = true;
860 ++ }
861 +
862 + err_fence:
863 + i915_vma_unpin_fence(vma);
864 +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pm.c b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
865 +index 914b5d4112bb..d6e9a10f3589 100644
866 +--- a/drivers/gpu/drm/i915/gem/i915_gem_pm.c
867 ++++ b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
868 +@@ -250,9 +250,6 @@ void i915_gem_resume(struct drm_i915_private *i915)
869 + mutex_lock(&i915->drm.struct_mutex);
870 + intel_uncore_forcewake_get(&i915->uncore, FORCEWAKE_ALL);
871 +
872 +- i915_gem_restore_gtt_mappings(i915);
873 +- i915_gem_restore_fences(i915);
874 +-
875 + if (i915_gem_init_hw(i915))
876 + goto err_wedged;
877 +
878 +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
879 +index 99e8242194c0..8f75882ded3f 100644
880 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
881 ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
882 +@@ -1042,6 +1042,9 @@ static void gen9_whitelist_build(struct i915_wa_list *w)
883 +
884 + /* WaAllowUMDToModifyHDCChicken1:skl,bxt,kbl,glk,cfl */
885 + whitelist_reg(w, GEN8_HDC_CHICKEN1);
886 ++
887 ++ /* WaSendPushConstantsFromMMIO:skl,bxt */
888 ++ whitelist_reg(w, COMMON_SLICE_CHICKEN2);
889 + }
890 +
891 + static void skl_whitelist_build(struct intel_engine_cs *engine)
892 +diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
893 +index bac1ee94f63f..5b895df09ebf 100644
894 +--- a/drivers/gpu/drm/i915/i915_drv.c
895 ++++ b/drivers/gpu/drm/i915/i915_drv.c
896 +@@ -2238,6 +2238,11 @@ static int i915_drm_resume(struct drm_device *dev)
897 + if (ret)
898 + DRM_ERROR("failed to re-enable GGTT\n");
899 +
900 ++ mutex_lock(&dev_priv->drm.struct_mutex);
901 ++ i915_gem_restore_gtt_mappings(dev_priv);
902 ++ i915_gem_restore_fences(dev_priv);
903 ++ mutex_unlock(&dev_priv->drm.struct_mutex);
904 ++
905 + intel_csr_ucode_resume(dev_priv);
906 +
907 + i915_restore_state(dev_priv);
908 +diff --git a/drivers/gpu/drm/i915/selftests/i915_gem.c b/drivers/gpu/drm/i915/selftests/i915_gem.c
909 +index c6a01a6e87f1..76b320914113 100644
910 +--- a/drivers/gpu/drm/i915/selftests/i915_gem.c
911 ++++ b/drivers/gpu/drm/i915/selftests/i915_gem.c
912 +@@ -117,6 +117,12 @@ static void pm_resume(struct drm_i915_private *i915)
913 + with_intel_runtime_pm(&i915->runtime_pm, wakeref) {
914 + intel_gt_sanitize(i915, false);
915 + i915_gem_sanitize(i915);
916 ++
917 ++ mutex_lock(&i915->drm.struct_mutex);
918 ++ i915_gem_restore_gtt_mappings(i915);
919 ++ i915_gem_restore_fences(i915);
920 ++ mutex_unlock(&i915->drm.struct_mutex);
921 ++
922 + i915_gem_resume(i915);
923 + }
924 + }
925 +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
926 +index 8cf6362e64bf..07b5fe0a7e5d 100644
927 +--- a/drivers/gpu/drm/msm/msm_gem.c
928 ++++ b/drivers/gpu/drm/msm/msm_gem.c
929 +@@ -50,7 +50,7 @@ static void sync_for_device(struct msm_gem_object *msm_obj)
930 + {
931 + struct device *dev = msm_obj->base.dev->dev;
932 +
933 +- if (get_dma_ops(dev)) {
934 ++ if (get_dma_ops(dev) && IS_ENABLED(CONFIG_ARM64)) {
935 + dma_sync_sg_for_device(dev, msm_obj->sgt->sgl,
936 + msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
937 + } else {
938 +@@ -63,7 +63,7 @@ static void sync_for_cpu(struct msm_gem_object *msm_obj)
939 + {
940 + struct device *dev = msm_obj->base.dev->dev;
941 +
942 +- if (get_dma_ops(dev)) {
943 ++ if (get_dma_ops(dev) && IS_ENABLED(CONFIG_ARM64)) {
944 + dma_sync_sg_for_cpu(dev, msm_obj->sgt->sgl,
945 + msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
946 + } else {
947 +diff --git a/drivers/iio/accel/adxl372.c b/drivers/iio/accel/adxl372.c
948 +index 055227cb3d43..67b8817995c0 100644
949 +--- a/drivers/iio/accel/adxl372.c
950 ++++ b/drivers/iio/accel/adxl372.c
951 +@@ -474,12 +474,17 @@ static int adxl372_configure_fifo(struct adxl372_state *st)
952 + if (ret < 0)
953 + return ret;
954 +
955 +- fifo_samples = st->watermark & 0xFF;
956 ++ /*
957 ++ * watermark stores the number of sets; we need to write the FIFO
958 ++ * registers with the number of samples
959 ++ */
960 ++ fifo_samples = (st->watermark * st->fifo_set_size);
961 + fifo_ctl = ADXL372_FIFO_CTL_FORMAT_MODE(st->fifo_format) |
962 + ADXL372_FIFO_CTL_MODE_MODE(st->fifo_mode) |
963 +- ADXL372_FIFO_CTL_SAMPLES_MODE(st->watermark);
964 ++ ADXL372_FIFO_CTL_SAMPLES_MODE(fifo_samples);
965 +
966 +- ret = regmap_write(st->regmap, ADXL372_FIFO_SAMPLES, fifo_samples);
967 ++ ret = regmap_write(st->regmap,
968 ++ ADXL372_FIFO_SAMPLES, fifo_samples & 0xFF);
969 + if (ret < 0)
970 + return ret;
971 +
972 +@@ -548,8 +553,7 @@ static irqreturn_t adxl372_trigger_handler(int irq, void *p)
973 + goto err;
974 +
975 + /* Each sample is 2 bytes */
976 +- for (i = 0; i < fifo_entries * sizeof(u16);
977 +- i += st->fifo_set_size * sizeof(u16))
978 ++ for (i = 0; i < fifo_entries; i += st->fifo_set_size)
979 + iio_push_to_buffers(indio_dev, &st->fifo_buf[i]);
980 + }
981 + err:
982 +@@ -571,6 +575,14 @@ static int adxl372_setup(struct adxl372_state *st)
983 + return -ENODEV;
984 + }
985 +
986 ++ /*
987 ++ * Perform a software reset to make sure the device is in a consistent
988 ++ * state after start up.
989 ++ */
990 ++ ret = regmap_write(st->regmap, ADXL372_RESET, ADXL372_RESET_CODE);
991 ++ if (ret < 0)
992 ++ return ret;
993 ++
994 + ret = adxl372_set_op_mode(st, ADXL372_STANDBY);
995 + if (ret < 0)
996 + return ret;
997 +diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
998 +index 5a3ca5904ded..f658012baad8 100644
999 +--- a/drivers/iio/adc/ad799x.c
1000 ++++ b/drivers/iio/adc/ad799x.c
1001 +@@ -810,10 +810,10 @@ static int ad799x_probe(struct i2c_client *client,
1002 +
1003 + ret = ad799x_write_config(st, st->chip_config->default_config);
1004 + if (ret < 0)
1005 +- goto error_disable_reg;
1006 ++ goto error_disable_vref;
1007 + ret = ad799x_read_config(st);
1008 + if (ret < 0)
1009 +- goto error_disable_reg;
1010 ++ goto error_disable_vref;
1011 + st->config = ret;
1012 +
1013 + ret = iio_triggered_buffer_setup(indio_dev, NULL,
1014 +diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
1015 +index 31d51bcc5f2c..85d08e68b34f 100644
1016 +--- a/drivers/iio/adc/axp288_adc.c
1017 ++++ b/drivers/iio/adc/axp288_adc.c
1018 +@@ -7,6 +7,7 @@
1019 + * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1020 + */
1021 +
1022 ++#include <linux/dmi.h>
1023 + #include <linux/module.h>
1024 + #include <linux/kernel.h>
1025 + #include <linux/device.h>
1026 +@@ -25,6 +26,11 @@
1027 + #define AXP288_ADC_EN_MASK 0xF0
1028 + #define AXP288_ADC_TS_ENABLE 0x01
1029 +
1030 ++#define AXP288_ADC_TS_BIAS_MASK GENMASK(5, 4)
1031 ++#define AXP288_ADC_TS_BIAS_20UA (0 << 4)
1032 ++#define AXP288_ADC_TS_BIAS_40UA (1 << 4)
1033 ++#define AXP288_ADC_TS_BIAS_60UA (2 << 4)
1034 ++#define AXP288_ADC_TS_BIAS_80UA (3 << 4)
1035 + #define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
1036 + #define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
1037 + #define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
1038 +@@ -177,10 +183,36 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
1039 + return ret;
1040 + }
1041 +
1042 ++/*
1043 ++ * We rely on the machine's firmware to correctly setup the TS pin bias current
1044 ++ * at boot. This lists systems with broken fw where we need to set it ourselves.
1045 ++ */
1046 ++static const struct dmi_system_id axp288_adc_ts_bias_override[] = {
1047 ++ {
1048 ++ /* Lenovo Ideapad 100S (11 inch) */
1049 ++ .matches = {
1050 ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
1051 ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad 100S-11IBY"),
1052 ++ },
1053 ++ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA,
1054 ++ },
1055 ++ {}
1056 ++};
1057 ++
1058 + static int axp288_adc_initialize(struct axp288_adc_info *info)
1059 + {
1060 ++ const struct dmi_system_id *bias_override;
1061 + int ret, adc_enable_val;
1062 +
1063 ++ bias_override = dmi_first_match(axp288_adc_ts_bias_override);
1064 ++ if (bias_override) {
1065 ++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
1066 ++ AXP288_ADC_TS_BIAS_MASK,
1067 ++ (uintptr_t)bias_override->driver_data);
1068 ++ if (ret)
1069 ++ return ret;
1070 ++ }
1071 ++
1072 + /*
1073 + * Determine if the TS pin is enabled and set the TS current-source
1074 + * accordingly.
1075 +diff --git a/drivers/iio/adc/hx711.c b/drivers/iio/adc/hx711.c
1076 +index 88c7fe15003b..62e6c8badd22 100644
1077 +--- a/drivers/iio/adc/hx711.c
1078 ++++ b/drivers/iio/adc/hx711.c
1079 +@@ -100,14 +100,14 @@ struct hx711_data {
1080 +
1081 + static int hx711_cycle(struct hx711_data *hx711_data)
1082 + {
1083 +- int val;
1084 ++ unsigned long flags;
1085 +
1086 + /*
1087 + * if preempted for more then 60us while PD_SCK is high:
1088 + * hx711 is going in reset
1089 + * ==> measuring is false
1090 + */
1091 +- preempt_disable();
1092 ++ local_irq_save(flags);
1093 + gpiod_set_value(hx711_data->gpiod_pd_sck, 1);
1094 +
1095 + /*
1096 +@@ -117,7 +117,6 @@ static int hx711_cycle(struct hx711_data *hx711_data)
1097 + */
1098 + ndelay(hx711_data->data_ready_delay_ns);
1099 +
1100 +- val = gpiod_get_value(hx711_data->gpiod_dout);
1101 + /*
1102 + * here we are not waiting for 0.2 us as suggested by the datasheet,
1103 + * because the oscilloscope showed in a test scenario
1104 +@@ -125,7 +124,7 @@ static int hx711_cycle(struct hx711_data *hx711_data)
1105 + * and 0.56 us for PD_SCK low on TI Sitara with 800 MHz
1106 + */
1107 + gpiod_set_value(hx711_data->gpiod_pd_sck, 0);
1108 +- preempt_enable();
1109 ++ local_irq_restore(flags);
1110 +
1111 + /*
1112 + * make it a square wave for addressing cases with capacitance on
1113 +@@ -133,7 +132,8 @@ static int hx711_cycle(struct hx711_data *hx711_data)
1114 + */
1115 + ndelay(hx711_data->data_ready_delay_ns);
1116 +
1117 +- return val;
1118 ++ /* sample as late as possible */
1119 ++ return gpiod_get_value(hx711_data->gpiod_dout);
1120 + }
1121 +
1122 + static int hx711_read(struct hx711_data *hx711_data)
1123 +diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c
1124 +index 1f7ce5186dfc..6016a864d6d6 100644
1125 +--- a/drivers/iio/adc/stm32-adc-core.c
1126 ++++ b/drivers/iio/adc/stm32-adc-core.c
1127 +@@ -22,33 +22,6 @@
1128 +
1129 + #include "stm32-adc-core.h"
1130 +
1131 +-/* STM32F4 - common registers for all ADC instances: 1, 2 & 3 */
1132 +-#define STM32F4_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
1133 +-#define STM32F4_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x04)
1134 +-
1135 +-/* STM32F4_ADC_CSR - bit fields */
1136 +-#define STM32F4_EOC3 BIT(17)
1137 +-#define STM32F4_EOC2 BIT(9)
1138 +-#define STM32F4_EOC1 BIT(1)
1139 +-
1140 +-/* STM32F4_ADC_CCR - bit fields */
1141 +-#define STM32F4_ADC_ADCPRE_SHIFT 16
1142 +-#define STM32F4_ADC_ADCPRE_MASK GENMASK(17, 16)
1143 +-
1144 +-/* STM32H7 - common registers for all ADC instances */
1145 +-#define STM32H7_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
1146 +-#define STM32H7_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x08)
1147 +-
1148 +-/* STM32H7_ADC_CSR - bit fields */
1149 +-#define STM32H7_EOC_SLV BIT(18)
1150 +-#define STM32H7_EOC_MST BIT(2)
1151 +-
1152 +-/* STM32H7_ADC_CCR - bit fields */
1153 +-#define STM32H7_PRESC_SHIFT 18
1154 +-#define STM32H7_PRESC_MASK GENMASK(21, 18)
1155 +-#define STM32H7_CKMODE_SHIFT 16
1156 +-#define STM32H7_CKMODE_MASK GENMASK(17, 16)
1157 +-
1158 + #define STM32_ADC_CORE_SLEEP_DELAY_MS 2000
1159 +
1160 + /**
1161 +@@ -58,6 +31,8 @@
1162 + * @eoc1: adc1 end of conversion flag in @csr
1163 + * @eoc2: adc2 end of conversion flag in @csr
1164 + * @eoc3: adc3 end of conversion flag in @csr
1165 ++ * @ier: interrupt enable register offset for each adc
1166 ++ * @eocie_msk: end of conversion interrupt enable mask in @ier
1167 + */
1168 + struct stm32_adc_common_regs {
1169 + u32 csr;
1170 +@@ -65,6 +40,8 @@ struct stm32_adc_common_regs {
1171 + u32 eoc1_msk;
1172 + u32 eoc2_msk;
1173 + u32 eoc3_msk;
1174 ++ u32 ier;
1175 ++ u32 eocie_msk;
1176 + };
1177 +
1178 + struct stm32_adc_priv;
1179 +@@ -278,6 +255,8 @@ static const struct stm32_adc_common_regs stm32f4_adc_common_regs = {
1180 + .eoc1_msk = STM32F4_EOC1,
1181 + .eoc2_msk = STM32F4_EOC2,
1182 + .eoc3_msk = STM32F4_EOC3,
1183 ++ .ier = STM32F4_ADC_CR1,
1184 ++ .eocie_msk = STM32F4_EOCIE,
1185 + };
1186 +
1187 + /* STM32H7 common registers definitions */
1188 +@@ -286,8 +265,24 @@ static const struct stm32_adc_common_regs stm32h7_adc_common_regs = {
1189 + .ccr = STM32H7_ADC_CCR,
1190 + .eoc1_msk = STM32H7_EOC_MST,
1191 + .eoc2_msk = STM32H7_EOC_SLV,
1192 ++ .ier = STM32H7_ADC_IER,
1193 ++ .eocie_msk = STM32H7_EOCIE,
1194 ++};
1195 ++
1196 ++static const unsigned int stm32_adc_offset[STM32_ADC_MAX_ADCS] = {
1197 ++ 0, STM32_ADC_OFFSET, STM32_ADC_OFFSET * 2,
1198 + };
1199 +
1200 ++static unsigned int stm32_adc_eoc_enabled(struct stm32_adc_priv *priv,
1201 ++ unsigned int adc)
1202 ++{
1203 ++ u32 ier, offset = stm32_adc_offset[adc];
1204 ++
1205 ++ ier = readl_relaxed(priv->common.base + offset + priv->cfg->regs->ier);
1206 ++
1207 ++ return ier & priv->cfg->regs->eocie_msk;
1208 ++}
1209 ++
1210 + /* ADC common interrupt for all instances */
1211 + static void stm32_adc_irq_handler(struct irq_desc *desc)
1212 + {
1213 +@@ -298,13 +293,28 @@ static void stm32_adc_irq_handler(struct irq_desc *desc)
1214 + chained_irq_enter(chip, desc);
1215 + status = readl_relaxed(priv->common.base + priv->cfg->regs->csr);
1216 +
1217 +- if (status & priv->cfg->regs->eoc1_msk)
1218 ++ /*
1219 ++ * End of conversion may be handled by using IRQ or DMA. There may be a
1220 ++ * race here when two conversions complete at the same time on several
1221 ++ * ADCs. EOC may be read 'set' for several ADCs, with:
1222 ++ * - an ADC configured to use DMA (EOC triggers the DMA request, and
1223 ++ * is then automatically cleared by DR read in hardware)
1224 ++ * - an ADC configured to use IRQs (EOCIE bit is set. The handler must
1225 ++ * be called in this case)
1226 ++ * So both EOC status bit in CSR and EOCIE control bit must be checked
1227 ++ * before invoking the interrupt handler (e.g. call ISR only for
1228 ++ * IRQ-enabled ADCs).
1229 ++ */
1230 ++ if (status & priv->cfg->regs->eoc1_msk &&
1231 ++ stm32_adc_eoc_enabled(priv, 0))
1232 + generic_handle_irq(irq_find_mapping(priv->domain, 0));
1233 +
1234 +- if (status & priv->cfg->regs->eoc2_msk)
1235 ++ if (status & priv->cfg->regs->eoc2_msk &&
1236 ++ stm32_adc_eoc_enabled(priv, 1))
1237 + generic_handle_irq(irq_find_mapping(priv->domain, 1));
1238 +
1239 +- if (status & priv->cfg->regs->eoc3_msk)
1240 ++ if (status & priv->cfg->regs->eoc3_msk &&
1241 ++ stm32_adc_eoc_enabled(priv, 2))
1242 + generic_handle_irq(irq_find_mapping(priv->domain, 2));
1243 +
1244 + chained_irq_exit(chip, desc);
1245 +diff --git a/drivers/iio/adc/stm32-adc-core.h b/drivers/iio/adc/stm32-adc-core.h
1246 +index 8af507b3f32d..2579d514c2a3 100644
1247 +--- a/drivers/iio/adc/stm32-adc-core.h
1248 ++++ b/drivers/iio/adc/stm32-adc-core.h
1249 +@@ -25,8 +25,145 @@
1250 + * --------------------------------------------------------
1251 + */
1252 + #define STM32_ADC_MAX_ADCS 3
1253 ++#define STM32_ADC_OFFSET 0x100
1254 + #define STM32_ADCX_COMN_OFFSET 0x300
1255 +
1256 ++/* STM32F4 - Registers for each ADC instance */
1257 ++#define STM32F4_ADC_SR 0x00
1258 ++#define STM32F4_ADC_CR1 0x04
1259 ++#define STM32F4_ADC_CR2 0x08
1260 ++#define STM32F4_ADC_SMPR1 0x0C
1261 ++#define STM32F4_ADC_SMPR2 0x10
1262 ++#define STM32F4_ADC_HTR 0x24
1263 ++#define STM32F4_ADC_LTR 0x28
1264 ++#define STM32F4_ADC_SQR1 0x2C
1265 ++#define STM32F4_ADC_SQR2 0x30
1266 ++#define STM32F4_ADC_SQR3 0x34
1267 ++#define STM32F4_ADC_JSQR 0x38
1268 ++#define STM32F4_ADC_JDR1 0x3C
1269 ++#define STM32F4_ADC_JDR2 0x40
1270 ++#define STM32F4_ADC_JDR3 0x44
1271 ++#define STM32F4_ADC_JDR4 0x48
1272 ++#define STM32F4_ADC_DR 0x4C
1273 ++
1274 ++/* STM32F4 - common registers for all ADC instances: 1, 2 & 3 */
1275 ++#define STM32F4_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
1276 ++#define STM32F4_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x04)
1277 ++
1278 ++/* STM32F4_ADC_SR - bit fields */
1279 ++#define STM32F4_STRT BIT(4)
1280 ++#define STM32F4_EOC BIT(1)
1281 ++
1282 ++/* STM32F4_ADC_CR1 - bit fields */
1283 ++#define STM32F4_RES_SHIFT 24
1284 ++#define STM32F4_RES_MASK GENMASK(25, 24)
1285 ++#define STM32F4_SCAN BIT(8)
1286 ++#define STM32F4_EOCIE BIT(5)
1287 ++
1288 ++/* STM32F4_ADC_CR2 - bit fields */
1289 ++#define STM32F4_SWSTART BIT(30)
1290 ++#define STM32F4_EXTEN_SHIFT 28
1291 ++#define STM32F4_EXTEN_MASK GENMASK(29, 28)
1292 ++#define STM32F4_EXTSEL_SHIFT 24
1293 ++#define STM32F4_EXTSEL_MASK GENMASK(27, 24)
1294 ++#define STM32F4_EOCS BIT(10)
1295 ++#define STM32F4_DDS BIT(9)
1296 ++#define STM32F4_DMA BIT(8)
1297 ++#define STM32F4_ADON BIT(0)
1298 ++
1299 ++/* STM32F4_ADC_CSR - bit fields */
1300 ++#define STM32F4_EOC3 BIT(17)
1301 ++#define STM32F4_EOC2 BIT(9)
1302 ++#define STM32F4_EOC1 BIT(1)
1303 ++
1304 ++/* STM32F4_ADC_CCR - bit fields */
1305 ++#define STM32F4_ADC_ADCPRE_SHIFT 16
1306 ++#define STM32F4_ADC_ADCPRE_MASK GENMASK(17, 16)
1307 ++
1308 ++/* STM32H7 - Registers for each ADC instance */
1309 ++#define STM32H7_ADC_ISR 0x00
1310 ++#define STM32H7_ADC_IER 0x04
1311 ++#define STM32H7_ADC_CR 0x08
1312 ++#define STM32H7_ADC_CFGR 0x0C
1313 ++#define STM32H7_ADC_SMPR1 0x14
1314 ++#define STM32H7_ADC_SMPR2 0x18
1315 ++#define STM32H7_ADC_PCSEL 0x1C
1316 ++#define STM32H7_ADC_SQR1 0x30
1317 ++#define STM32H7_ADC_SQR2 0x34
1318 ++#define STM32H7_ADC_SQR3 0x38
1319 ++#define STM32H7_ADC_SQR4 0x3C
1320 ++#define STM32H7_ADC_DR 0x40
1321 ++#define STM32H7_ADC_DIFSEL 0xC0
1322 ++#define STM32H7_ADC_CALFACT 0xC4
1323 ++#define STM32H7_ADC_CALFACT2 0xC8
1324 ++
1325 ++/* STM32H7 - common registers for all ADC instances */
1326 ++#define STM32H7_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
1327 ++#define STM32H7_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x08)
1328 ++
1329 ++/* STM32H7_ADC_ISR - bit fields */
1330 ++#define STM32MP1_VREGREADY BIT(12)
1331 ++#define STM32H7_EOC BIT(2)
1332 ++#define STM32H7_ADRDY BIT(0)
1333 ++
1334 ++/* STM32H7_ADC_IER - bit fields */
1335 ++#define STM32H7_EOCIE STM32H7_EOC
1336 ++
1337 ++/* STM32H7_ADC_CR - bit fields */
1338 ++#define STM32H7_ADCAL BIT(31)
1339 ++#define STM32H7_ADCALDIF BIT(30)
1340 ++#define STM32H7_DEEPPWD BIT(29)
1341 ++#define STM32H7_ADVREGEN BIT(28)
1342 ++#define STM32H7_LINCALRDYW6 BIT(27)
1343 ++#define STM32H7_LINCALRDYW5 BIT(26)
1344 ++#define STM32H7_LINCALRDYW4 BIT(25)
1345 ++#define STM32H7_LINCALRDYW3 BIT(24)
1346 ++#define STM32H7_LINCALRDYW2 BIT(23)
1347 ++#define STM32H7_LINCALRDYW1 BIT(22)
1348 ++#define STM32H7_ADCALLIN BIT(16)
1349 ++#define STM32H7_BOOST BIT(8)
1350 ++#define STM32H7_ADSTP BIT(4)
1351 ++#define STM32H7_ADSTART BIT(2)
1352 ++#define STM32H7_ADDIS BIT(1)
1353 ++#define STM32H7_ADEN BIT(0)
1354 ++
1355 ++/* STM32H7_ADC_CFGR bit fields */
1356 ++#define STM32H7_EXTEN_SHIFT 10
1357 ++#define STM32H7_EXTEN_MASK GENMASK(11, 10)
1358 ++#define STM32H7_EXTSEL_SHIFT 5
1359 ++#define STM32H7_EXTSEL_MASK GENMASK(9, 5)
1360 ++#define STM32H7_RES_SHIFT 2
1361 ++#define STM32H7_RES_MASK GENMASK(4, 2)
1362 ++#define STM32H7_DMNGT_SHIFT 0
1363 ++#define STM32H7_DMNGT_MASK GENMASK(1, 0)
1364 ++
1365 ++enum stm32h7_adc_dmngt {
1366 ++ STM32H7_DMNGT_DR_ONLY, /* Regular data in DR only */
1367 ++ STM32H7_DMNGT_DMA_ONESHOT, /* DMA one shot mode */
1368 ++ STM32H7_DMNGT_DFSDM, /* DFSDM mode */
1369 ++ STM32H7_DMNGT_DMA_CIRC, /* DMA circular mode */
1370 ++};
1371 ++
1372 ++/* STM32H7_ADC_CALFACT - bit fields */
1373 ++#define STM32H7_CALFACT_D_SHIFT 16
1374 ++#define STM32H7_CALFACT_D_MASK GENMASK(26, 16)
1375 ++#define STM32H7_CALFACT_S_SHIFT 0
1376 ++#define STM32H7_CALFACT_S_MASK GENMASK(10, 0)
1377 ++
1378 ++/* STM32H7_ADC_CALFACT2 - bit fields */
1379 ++#define STM32H7_LINCALFACT_SHIFT 0
1380 ++#define STM32H7_LINCALFACT_MASK GENMASK(29, 0)
1381 ++
1382 ++/* STM32H7_ADC_CSR - bit fields */
1383 ++#define STM32H7_EOC_SLV BIT(18)
1384 ++#define STM32H7_EOC_MST BIT(2)
1385 ++
1386 ++/* STM32H7_ADC_CCR - bit fields */
1387 ++#define STM32H7_PRESC_SHIFT 18
1388 ++#define STM32H7_PRESC_MASK GENMASK(21, 18)
1389 ++#define STM32H7_CKMODE_SHIFT 16
1390 ++#define STM32H7_CKMODE_MASK GENMASK(17, 16)
1391 ++
1392 + /**
1393 + * struct stm32_adc_common - stm32 ADC driver common data (for all instances)
1394 + * @base: control registers base cpu addr
1395 +diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
1396 +index 205e1699f954..b22be473cb03 100644
1397 +--- a/drivers/iio/adc/stm32-adc.c
1398 ++++ b/drivers/iio/adc/stm32-adc.c
1399 +@@ -28,115 +28,6 @@
1400 +
1401 + #include "stm32-adc-core.h"
1402 +
1403 +-/* STM32F4 - Registers for each ADC instance */
1404 +-#define STM32F4_ADC_SR 0x00
1405 +-#define STM32F4_ADC_CR1 0x04
1406 +-#define STM32F4_ADC_CR2 0x08
1407 +-#define STM32F4_ADC_SMPR1 0x0C
1408 +-#define STM32F4_ADC_SMPR2 0x10
1409 +-#define STM32F4_ADC_HTR 0x24
1410 +-#define STM32F4_ADC_LTR 0x28
1411 +-#define STM32F4_ADC_SQR1 0x2C
1412 +-#define STM32F4_ADC_SQR2 0x30
1413 +-#define STM32F4_ADC_SQR3 0x34
1414 +-#define STM32F4_ADC_JSQR 0x38
1415 +-#define STM32F4_ADC_JDR1 0x3C
1416 +-#define STM32F4_ADC_JDR2 0x40
1417 +-#define STM32F4_ADC_JDR3 0x44
1418 +-#define STM32F4_ADC_JDR4 0x48
1419 +-#define STM32F4_ADC_DR 0x4C
1420 +-
1421 +-/* STM32F4_ADC_SR - bit fields */
1422 +-#define STM32F4_STRT BIT(4)
1423 +-#define STM32F4_EOC BIT(1)
1424 +-
1425 +-/* STM32F4_ADC_CR1 - bit fields */
1426 +-#define STM32F4_RES_SHIFT 24
1427 +-#define STM32F4_RES_MASK GENMASK(25, 24)
1428 +-#define STM32F4_SCAN BIT(8)
1429 +-#define STM32F4_EOCIE BIT(5)
1430 +-
1431 +-/* STM32F4_ADC_CR2 - bit fields */
1432 +-#define STM32F4_SWSTART BIT(30)
1433 +-#define STM32F4_EXTEN_SHIFT 28
1434 +-#define STM32F4_EXTEN_MASK GENMASK(29, 28)
1435 +-#define STM32F4_EXTSEL_SHIFT 24
1436 +-#define STM32F4_EXTSEL_MASK GENMASK(27, 24)
1437 +-#define STM32F4_EOCS BIT(10)
1438 +-#define STM32F4_DDS BIT(9)
1439 +-#define STM32F4_DMA BIT(8)
1440 +-#define STM32F4_ADON BIT(0)
1441 +-
1442 +-/* STM32H7 - Registers for each ADC instance */
1443 +-#define STM32H7_ADC_ISR 0x00
1444 +-#define STM32H7_ADC_IER 0x04
1445 +-#define STM32H7_ADC_CR 0x08
1446 +-#define STM32H7_ADC_CFGR 0x0C
1447 +-#define STM32H7_ADC_SMPR1 0x14
1448 +-#define STM32H7_ADC_SMPR2 0x18
1449 +-#define STM32H7_ADC_PCSEL 0x1C
1450 +-#define STM32H7_ADC_SQR1 0x30
1451 +-#define STM32H7_ADC_SQR2 0x34
1452 +-#define STM32H7_ADC_SQR3 0x38
1453 +-#define STM32H7_ADC_SQR4 0x3C
1454 +-#define STM32H7_ADC_DR 0x40
1455 +-#define STM32H7_ADC_DIFSEL 0xC0
1456 +-#define STM32H7_ADC_CALFACT 0xC4
1457 +-#define STM32H7_ADC_CALFACT2 0xC8
1458 +-
1459 +-/* STM32H7_ADC_ISR - bit fields */
1460 +-#define STM32MP1_VREGREADY BIT(12)
1461 +-#define STM32H7_EOC BIT(2)
1462 +-#define STM32H7_ADRDY BIT(0)
1463 +-
1464 +-/* STM32H7_ADC_IER - bit fields */
1465 +-#define STM32H7_EOCIE STM32H7_EOC
1466 +-
1467 +-/* STM32H7_ADC_CR - bit fields */
1468 +-#define STM32H7_ADCAL BIT(31)
1469 +-#define STM32H7_ADCALDIF BIT(30)
1470 +-#define STM32H7_DEEPPWD BIT(29)
1471 +-#define STM32H7_ADVREGEN BIT(28)
1472 +-#define STM32H7_LINCALRDYW6 BIT(27)
1473 +-#define STM32H7_LINCALRDYW5 BIT(26)
1474 +-#define STM32H7_LINCALRDYW4 BIT(25)
1475 +-#define STM32H7_LINCALRDYW3 BIT(24)
1476 +-#define STM32H7_LINCALRDYW2 BIT(23)
1477 +-#define STM32H7_LINCALRDYW1 BIT(22)
1478 +-#define STM32H7_ADCALLIN BIT(16)
1479 +-#define STM32H7_BOOST BIT(8)
1480 +-#define STM32H7_ADSTP BIT(4)
1481 +-#define STM32H7_ADSTART BIT(2)
1482 +-#define STM32H7_ADDIS BIT(1)
1483 +-#define STM32H7_ADEN BIT(0)
1484 +-
1485 +-/* STM32H7_ADC_CFGR bit fields */
1486 +-#define STM32H7_EXTEN_SHIFT 10
1487 +-#define STM32H7_EXTEN_MASK GENMASK(11, 10)
1488 +-#define STM32H7_EXTSEL_SHIFT 5
1489 +-#define STM32H7_EXTSEL_MASK GENMASK(9, 5)
1490 +-#define STM32H7_RES_SHIFT 2
1491 +-#define STM32H7_RES_MASK GENMASK(4, 2)
1492 +-#define STM32H7_DMNGT_SHIFT 0
1493 +-#define STM32H7_DMNGT_MASK GENMASK(1, 0)
1494 +-
1495 +-enum stm32h7_adc_dmngt {
1496 +- STM32H7_DMNGT_DR_ONLY, /* Regular data in DR only */
1497 +- STM32H7_DMNGT_DMA_ONESHOT, /* DMA one shot mode */
1498 +- STM32H7_DMNGT_DFSDM, /* DFSDM mode */
1499 +- STM32H7_DMNGT_DMA_CIRC, /* DMA circular mode */
1500 +-};
1501 +-
1502 +-/* STM32H7_ADC_CALFACT - bit fields */
1503 +-#define STM32H7_CALFACT_D_SHIFT 16
1504 +-#define STM32H7_CALFACT_D_MASK GENMASK(26, 16)
1505 +-#define STM32H7_CALFACT_S_SHIFT 0
1506 +-#define STM32H7_CALFACT_S_MASK GENMASK(10, 0)
1507 +-
1508 +-/* STM32H7_ADC_CALFACT2 - bit fields */
1509 +-#define STM32H7_LINCALFACT_SHIFT 0
1510 +-#define STM32H7_LINCALFACT_MASK GENMASK(29, 0)
1511 +-
1512 + /* Number of linear calibration shadow registers / LINCALRDYW control bits */
1513 + #define STM32H7_LINCALFACT_NUM 6
1514 +
1515 +diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c
1516 +index e666879007d2..92004a2563ea 100644
1517 +--- a/drivers/iio/light/opt3001.c
1518 ++++ b/drivers/iio/light/opt3001.c
1519 +@@ -686,6 +686,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
1520 + struct iio_dev *iio = _iio;
1521 + struct opt3001 *opt = iio_priv(iio);
1522 + int ret;
1523 ++ bool wake_result_ready_queue = false;
1524 +
1525 + if (!opt->ok_to_ignore_lock)
1526 + mutex_lock(&opt->lock);
1527 +@@ -720,13 +721,16 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
1528 + }
1529 + opt->result = ret;
1530 + opt->result_ready = true;
1531 +- wake_up(&opt->result_ready_queue);
1532 ++ wake_result_ready_queue = true;
1533 + }
1534 +
1535 + out:
1536 + if (!opt->ok_to_ignore_lock)
1537 + mutex_unlock(&opt->lock);
1538 +
1539 ++ if (wake_result_ready_queue)
1540 ++ wake_up(&opt->result_ready_queue);
1541 ++
1542 + return IRQ_HANDLED;
1543 + }
1544 +
1545 +diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
1546 +index 51421ac32517..16dacea9eadf 100644
1547 +--- a/drivers/iio/light/vcnl4000.c
1548 ++++ b/drivers/iio/light/vcnl4000.c
1549 +@@ -398,19 +398,23 @@ static int vcnl4000_probe(struct i2c_client *client,
1550 + static const struct of_device_id vcnl_4000_of_match[] = {
1551 + {
1552 + .compatible = "vishay,vcnl4000",
1553 +- .data = "VCNL4000",
1554 ++ .data = (void *)VCNL4000,
1555 + },
1556 + {
1557 + .compatible = "vishay,vcnl4010",
1558 +- .data = "VCNL4010",
1559 ++ .data = (void *)VCNL4010,
1560 + },
1561 + {
1562 +- .compatible = "vishay,vcnl4010",
1563 +- .data = "VCNL4020",
1564 ++ .compatible = "vishay,vcnl4020",
1565 ++ .data = (void *)VCNL4010,
1566 ++ },
1567 ++ {
1568 ++ .compatible = "vishay,vcnl4040",
1569 ++ .data = (void *)VCNL4040,
1570 + },
1571 + {
1572 + .compatible = "vishay,vcnl4200",
1573 +- .data = "VCNL4200",
1574 ++ .data = (void *)VCNL4200,
1575 + },
1576 + {},
1577 + };
1578 +diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
1579 +index 1ab423b19f77..6eb6d2717ca5 100644
1580 +--- a/drivers/infiniband/core/security.c
1581 ++++ b/drivers/infiniband/core/security.c
1582 +@@ -426,7 +426,7 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
1583 + int ret;
1584 +
1585 + rdma_for_each_port (dev, i) {
1586 +- is_ib = rdma_protocol_ib(dev, i++);
1587 ++ is_ib = rdma_protocol_ib(dev, i);
1588 + if (is_ib)
1589 + break;
1590 + }
1591 +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
1592 +index 6cac0c88cf39..36cdfbdbd325 100644
1593 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
1594 ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
1595 +@@ -230,8 +230,6 @@ static void pvrdma_free_srq(struct pvrdma_dev *dev, struct pvrdma_srq *srq)
1596 +
1597 + pvrdma_page_dir_cleanup(dev, &srq->pdir);
1598 +
1599 +- kfree(srq);
1600 +-
1601 + atomic_dec(&dev->num_srqs);
1602 + }
1603 +
1604 +diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
1605 +index be8041e3e6b8..b0cfa4c1f8cc 100644
1606 +--- a/drivers/media/usb/stkwebcam/stk-webcam.c
1607 ++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
1608 +@@ -643,8 +643,7 @@ static int v4l_stk_release(struct file *fp)
1609 + dev->owner = NULL;
1610 + }
1611 +
1612 +- if (is_present(dev))
1613 +- usb_autopm_put_interface(dev->interface);
1614 ++ usb_autopm_put_interface(dev->interface);
1615 + mutex_unlock(&dev->lock);
1616 + return v4l2_fh_release(fp);
1617 + }
1618 +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
1619 +index 32e9b1aed2ca..0a2b99e1af45 100644
1620 +--- a/drivers/misc/mei/bus-fixup.c
1621 ++++ b/drivers/misc/mei/bus-fixup.c
1622 +@@ -218,13 +218,21 @@ static void mei_mkhi_fix(struct mei_cl_device *cldev)
1623 + {
1624 + int ret;
1625 +
1626 ++ /* No need to enable the client if nothing is needed from it */
1627 ++ if (!cldev->bus->fw_f_fw_ver_supported &&
1628 ++ !cldev->bus->hbm_f_os_supported)
1629 ++ return;
1630 ++
1631 + ret = mei_cldev_enable(cldev);
1632 + if (ret)
1633 + return;
1634 +
1635 +- ret = mei_fwver(cldev);
1636 +- if (ret < 0)
1637 +- dev_err(&cldev->dev, "FW version command failed %d\n", ret);
1638 ++ if (cldev->bus->fw_f_fw_ver_supported) {
1639 ++ ret = mei_fwver(cldev);
1640 ++ if (ret < 0)
1641 ++ dev_err(&cldev->dev, "FW version command failed %d\n",
1642 ++ ret);
1643 ++ }
1644 +
1645 + if (cldev->bus->hbm_f_os_supported) {
1646 + ret = mei_osver(cldev);
1647 +diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
1648 +index 77f7dff7098d..c09f8bb49495 100644
1649 +--- a/drivers/misc/mei/hw-me-regs.h
1650 ++++ b/drivers/misc/mei/hw-me-regs.h
1651 +@@ -79,6 +79,9 @@
1652 + #define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
1653 + #define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
1654 +
1655 ++#define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */
1656 ++#define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
1657 ++
1658 + #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
1659 +
1660 + #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
1661 +diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
1662 +index abe1b1f4362f..c4f6991d3028 100644
1663 +--- a/drivers/misc/mei/hw-me.c
1664 ++++ b/drivers/misc/mei/hw-me.c
1665 +@@ -1355,6 +1355,8 @@ static bool mei_me_fw_type_sps(struct pci_dev *pdev)
1666 + #define MEI_CFG_FW_SPS \
1667 + .quirk_probe = mei_me_fw_type_sps
1668 +
1669 ++#define MEI_CFG_FW_VER_SUPP \
1670 ++ .fw_ver_supported = 1
1671 +
1672 + #define MEI_CFG_ICH_HFS \
1673 + .fw_status.count = 0
1674 +@@ -1392,31 +1394,41 @@ static const struct mei_cfg mei_me_ich10_cfg = {
1675 + MEI_CFG_ICH10_HFS,
1676 + };
1677 +
1678 +-/* PCH devices */
1679 +-static const struct mei_cfg mei_me_pch_cfg = {
1680 ++/* PCH6 devices */
1681 ++static const struct mei_cfg mei_me_pch6_cfg = {
1682 + MEI_CFG_PCH_HFS,
1683 + };
1684 +
1685 ++/* PCH7 devices */
1686 ++static const struct mei_cfg mei_me_pch7_cfg = {
1687 ++ MEI_CFG_PCH_HFS,
1688 ++ MEI_CFG_FW_VER_SUPP,
1689 ++};
1690 ++
1691 + /* PCH Cougar Point and Patsburg with quirk for Node Manager exclusion */
1692 + static const struct mei_cfg mei_me_pch_cpt_pbg_cfg = {
1693 + MEI_CFG_PCH_HFS,
1694 ++ MEI_CFG_FW_VER_SUPP,
1695 + MEI_CFG_FW_NM,
1696 + };
1697 +
1698 + /* PCH8 Lynx Point and newer devices */
1699 + static const struct mei_cfg mei_me_pch8_cfg = {
1700 + MEI_CFG_PCH8_HFS,
1701 ++ MEI_CFG_FW_VER_SUPP,
1702 + };
1703 +
1704 + /* PCH8 Lynx Point with quirk for SPS Firmware exclusion */
1705 + static const struct mei_cfg mei_me_pch8_sps_cfg = {
1706 + MEI_CFG_PCH8_HFS,
1707 ++ MEI_CFG_FW_VER_SUPP,
1708 + MEI_CFG_FW_SPS,
1709 + };
1710 +
1711 + /* Cannon Lake and newer devices */
1712 + static const struct mei_cfg mei_me_pch12_cfg = {
1713 + MEI_CFG_PCH8_HFS,
1714 ++ MEI_CFG_FW_VER_SUPP,
1715 + MEI_CFG_DMA_128,
1716 + };
1717 +
1718 +@@ -1428,7 +1440,8 @@ static const struct mei_cfg *const mei_cfg_list[] = {
1719 + [MEI_ME_UNDEF_CFG] = NULL,
1720 + [MEI_ME_ICH_CFG] = &mei_me_ich_cfg,
1721 + [MEI_ME_ICH10_CFG] = &mei_me_ich10_cfg,
1722 +- [MEI_ME_PCH_CFG] = &mei_me_pch_cfg,
1723 ++ [MEI_ME_PCH6_CFG] = &mei_me_pch6_cfg,
1724 ++ [MEI_ME_PCH7_CFG] = &mei_me_pch7_cfg,
1725 + [MEI_ME_PCH_CPT_PBG_CFG] = &mei_me_pch_cpt_pbg_cfg,
1726 + [MEI_ME_PCH8_CFG] = &mei_me_pch8_cfg,
1727 + [MEI_ME_PCH8_SPS_CFG] = &mei_me_pch8_sps_cfg,
1728 +@@ -1473,6 +1486,8 @@ struct mei_device *mei_me_dev_init(struct pci_dev *pdev,
1729 + mei_device_init(dev, &pdev->dev, &mei_me_hw_ops);
1730 + hw->cfg = cfg;
1731 +
1732 ++ dev->fw_f_fw_ver_supported = cfg->fw_ver_supported;
1733 ++
1734 + return dev;
1735 + }
1736 +
1737 +diff --git a/drivers/misc/mei/hw-me.h b/drivers/misc/mei/hw-me.h
1738 +index 08c84a0de4a8..1d8794828cbc 100644
1739 +--- a/drivers/misc/mei/hw-me.h
1740 ++++ b/drivers/misc/mei/hw-me.h
1741 +@@ -20,11 +20,13 @@
1742 + * @fw_status: FW status
1743 + * @quirk_probe: device exclusion quirk
1744 + * @dma_size: device DMA buffers size
1745 ++ * @fw_ver_supported: is fw version retrievable from FW
1746 + */
1747 + struct mei_cfg {
1748 + const struct mei_fw_status fw_status;
1749 + bool (*quirk_probe)(struct pci_dev *pdev);
1750 + size_t dma_size[DMA_DSCR_NUM];
1751 ++ u32 fw_ver_supported:1;
1752 + };
1753 +
1754 +
1755 +@@ -62,7 +64,8 @@ struct mei_me_hw {
1756 + * @MEI_ME_UNDEF_CFG: Lower sentinel.
1757 + * @MEI_ME_ICH_CFG: I/O Controller Hub legacy devices.
1758 + * @MEI_ME_ICH10_CFG: I/O Controller Hub platforms Gen10
1759 +- * @MEI_ME_PCH_CFG: Platform Controller Hub platforms (Up to Gen8).
1760 ++ * @MEI_ME_PCH6_CFG: Platform Controller Hub platforms (Gen6).
1761 ++ * @MEI_ME_PCH7_CFG: Platform Controller Hub platforms (Gen7).
1762 + * @MEI_ME_PCH_CPT_PBG_CFG:Platform Controller Hub workstations
1763 + * with quirk for Node Manager exclusion.
1764 + * @MEI_ME_PCH8_CFG: Platform Controller Hub Gen8 and newer
1765 +@@ -77,7 +80,8 @@ enum mei_cfg_idx {
1766 + MEI_ME_UNDEF_CFG,
1767 + MEI_ME_ICH_CFG,
1768 + MEI_ME_ICH10_CFG,
1769 +- MEI_ME_PCH_CFG,
1770 ++ MEI_ME_PCH6_CFG,
1771 ++ MEI_ME_PCH7_CFG,
1772 + MEI_ME_PCH_CPT_PBG_CFG,
1773 + MEI_ME_PCH8_CFG,
1774 + MEI_ME_PCH8_SPS_CFG,
1775 +diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
1776 +index f71a023aed3c..0f2141178299 100644
1777 +--- a/drivers/misc/mei/mei_dev.h
1778 ++++ b/drivers/misc/mei/mei_dev.h
1779 +@@ -426,6 +426,8 @@ struct mei_fw_version {
1780 + *
1781 + * @fw_ver : FW versions
1782 + *
1783 ++ * @fw_f_fw_ver_supported : fw feature: fw version supported
1784 ++ *
1785 + * @me_clients_rwsem: rw lock over me_clients list
1786 + * @me_clients : list of FW clients
1787 + * @me_clients_map : FW clients bit map
1788 +@@ -506,6 +508,8 @@ struct mei_device {
1789 +
1790 + struct mei_fw_version fw_ver[MEI_MAX_FW_VER_BLOCKS];
1791 +
1792 ++ unsigned int fw_f_fw_ver_supported:1;
1793 ++
1794 + struct rw_semaphore me_clients_rwsem;
1795 + struct list_head me_clients;
1796 + DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
1797 +diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
1798 +index 541538eff8b1..3a2eadcd0378 100644
1799 +--- a/drivers/misc/mei/pci-me.c
1800 ++++ b/drivers/misc/mei/pci-me.c
1801 +@@ -61,13 +61,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
1802 + {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_3, MEI_ME_ICH10_CFG)},
1803 + {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_4, MEI_ME_ICH10_CFG)},
1804 +
1805 +- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH_CFG)},
1806 +- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH_CFG)},
1807 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH6_CFG)},
1808 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH6_CFG)},
1809 + {MEI_PCI_DEVICE(MEI_DEV_ID_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)},
1810 + {MEI_PCI_DEVICE(MEI_DEV_ID_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)},
1811 +- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH_CFG)},
1812 +- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH_CFG)},
1813 +- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH_CFG)},
1814 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)},
1815 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)},
1816 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)},
1817 + {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_CFG)},
1818 + {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_CFG)},
1819 + {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)},
1820 +@@ -96,6 +96,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
1821 + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
1822 + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
1823 +
1824 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
1825 ++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
1826 ++
1827 + {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
1828 +
1829 + {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH12_CFG)},
1830 +diff --git a/drivers/mtd/nand/raw/au1550nd.c b/drivers/mtd/nand/raw/au1550nd.c
1831 +index 97a97a9ccc36..e10b76089048 100644
1832 +--- a/drivers/mtd/nand/raw/au1550nd.c
1833 ++++ b/drivers/mtd/nand/raw/au1550nd.c
1834 +@@ -134,16 +134,15 @@ static void au_write_buf16(struct nand_chip *this, const u_char *buf, int len)
1835 +
1836 + /**
1837 + * au_read_buf16 - read chip data into buffer
1838 +- * @mtd: MTD device structure
1839 ++ * @this: NAND chip object
1840 + * @buf: buffer to store date
1841 + * @len: number of bytes to read
1842 + *
1843 + * read function for 16bit buswidth
1844 + */
1845 +-static void au_read_buf16(struct mtd_info *mtd, u_char *buf, int len)
1846 ++static void au_read_buf16(struct nand_chip *this, u_char *buf, int len)
1847 + {
1848 + int i;
1849 +- struct nand_chip *this = mtd_to_nand(mtd);
1850 + u16 *p = (u16 *) buf;
1851 + len >>= 1;
1852 +
1853 +diff --git a/drivers/staging/fbtft/Kconfig b/drivers/staging/fbtft/Kconfig
1854 +index 8ec524a95ec8..4e5d860fd788 100644
1855 +--- a/drivers/staging/fbtft/Kconfig
1856 ++++ b/drivers/staging/fbtft/Kconfig
1857 +@@ -1,7 +1,7 @@
1858 + # SPDX-License-Identifier: GPL-2.0
1859 + menuconfig FB_TFT
1860 + tristate "Support for small TFT LCD display modules"
1861 +- depends on FB && SPI
1862 ++ depends on FB && SPI && OF
1863 + depends on GPIOLIB || COMPILE_TEST
1864 + select FB_SYS_FILLRECT
1865 + select FB_SYS_COPYAREA
1866 +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
1867 +index cf5700a2ea66..a0a67aa517f0 100644
1868 +--- a/drivers/staging/fbtft/fbtft-core.c
1869 ++++ b/drivers/staging/fbtft/fbtft-core.c
1870 +@@ -714,7 +714,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
1871 + if (par->gamma.curves && gamma) {
1872 + if (fbtft_gamma_parse_str(par, par->gamma.curves, gamma,
1873 + strlen(gamma)))
1874 +- goto alloc_fail;
1875 ++ goto release_framebuf;
1876 + }
1877 +
1878 + /* Transmit buffer */
1879 +@@ -731,7 +731,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
1880 + if (txbuflen > 0) {
1881 + txbuf = devm_kzalloc(par->info->device, txbuflen, GFP_KERNEL);
1882 + if (!txbuf)
1883 +- goto alloc_fail;
1884 ++ goto release_framebuf;
1885 + par->txbuf.buf = txbuf;
1886 + par->txbuf.len = txbuflen;
1887 + }
1888 +@@ -753,6 +753,9 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
1889 +
1890 + return info;
1891 +
1892 ++release_framebuf:
1893 ++ framebuffer_release(info);
1894 ++
1895 + alloc_fail:
1896 + vfree(vmem);
1897 +
1898 +diff --git a/drivers/staging/rtl8188eu/hal/hal8188e_rate_adaptive.c b/drivers/staging/rtl8188eu/hal/hal8188e_rate_adaptive.c
1899 +index 9ddd51685063..5792f491b59a 100644
1900 +--- a/drivers/staging/rtl8188eu/hal/hal8188e_rate_adaptive.c
1901 ++++ b/drivers/staging/rtl8188eu/hal/hal8188e_rate_adaptive.c
1902 +@@ -409,7 +409,7 @@ static int odm_ARFBRefresh_8188E(struct odm_dm_struct *dm_odm, struct odm_ra_inf
1903 + pRaInfo->PTModeSS = 3;
1904 + else if (pRaInfo->HighestRate > 0x0b)
1905 + pRaInfo->PTModeSS = 2;
1906 +- else if (pRaInfo->HighestRate > 0x0b)
1907 ++ else if (pRaInfo->HighestRate > 0x03)
1908 + pRaInfo->PTModeSS = 1;
1909 + else
1910 + pRaInfo->PTModeSS = 0;
1911 +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
1912 +index bc1eaa3a0773..826016c3431a 100644
1913 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
1914 ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
1915 +@@ -12,7 +12,7 @@
1916 + static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
1917 + .info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
1918 + SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
1919 +- SNDRV_PCM_INFO_DRAIN_TRIGGER | SNDRV_PCM_INFO_SYNC_APPLPTR),
1920 ++ SNDRV_PCM_INFO_SYNC_APPLPTR),
1921 + .formats = SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
1922 + .rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
1923 + .rate_min = 8000,
1924 +@@ -29,7 +29,7 @@ static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
1925 + static const struct snd_pcm_hardware snd_bcm2835_playback_spdif_hw = {
1926 + .info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
1927 + SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
1928 +- SNDRV_PCM_INFO_DRAIN_TRIGGER | SNDRV_PCM_INFO_SYNC_APPLPTR),
1929 ++ SNDRV_PCM_INFO_SYNC_APPLPTR),
1930 + .formats = SNDRV_PCM_FMTBIT_S16_LE,
1931 + .rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_44100 |
1932 + SNDRV_PCM_RATE_48000,
1933 +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
1934 +index 23fba01107b9..c6f9cf1913d2 100644
1935 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
1936 ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
1937 +@@ -289,6 +289,7 @@ int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream)
1938 + VC_AUDIO_MSG_TYPE_STOP, false);
1939 + }
1940 +
1941 ++/* FIXME: this doesn't seem working as expected for "draining" */
1942 + int bcm2835_audio_drain(struct bcm2835_alsa_stream *alsa_stream)
1943 + {
1944 + struct vc_audio_msg m = {
1945 +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
1946 +index c6bb4aaf9bd0..082302944c37 100644
1947 +--- a/drivers/staging/vt6655/device_main.c
1948 ++++ b/drivers/staging/vt6655/device_main.c
1949 +@@ -1748,8 +1748,10 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
1950 +
1951 + priv->hw->max_signal = 100;
1952 +
1953 +- if (vnt_init(priv))
1954 ++ if (vnt_init(priv)) {
1955 ++ device_free_info(priv);
1956 + return -ENODEV;
1957 ++ }
1958 +
1959 + device_print_info(priv);
1960 + pci_set_drvdata(pcid, priv);
1961 +diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
1962 +index b8b912b5a8b9..06e79c11141d 100644
1963 +--- a/drivers/tty/serial/uartlite.c
1964 ++++ b/drivers/tty/serial/uartlite.c
1965 +@@ -897,7 +897,8 @@ static int __init ulite_init(void)
1966 + static void __exit ulite_exit(void)
1967 + {
1968 + platform_driver_unregister(&ulite_platform_driver);
1969 +- uart_unregister_driver(&ulite_uart_driver);
1970 ++ if (ulite_uart_driver.state)
1971 ++ uart_unregister_driver(&ulite_uart_driver);
1972 + }
1973 +
1974 + module_init(ulite_init);
1975 +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
1976 +index f145946f659b..92df0c4f1c7a 100644
1977 +--- a/drivers/tty/serial/xilinx_uartps.c
1978 ++++ b/drivers/tty/serial/xilinx_uartps.c
1979 +@@ -1550,7 +1550,6 @@ static int cdns_uart_probe(struct platform_device *pdev)
1980 + goto err_out_id;
1981 + }
1982 +
1983 +- uartps_major = cdns_uart_uart_driver->tty_driver->major;
1984 + cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;
1985 +
1986 + /*
1987 +@@ -1680,6 +1679,7 @@ static int cdns_uart_probe(struct platform_device *pdev)
1988 + console_port = NULL;
1989 + #endif
1990 +
1991 ++ uartps_major = cdns_uart_uart_driver->tty_driver->major;
1992 + cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node,
1993 + "cts-override");
1994 + return 0;
1995 +@@ -1741,6 +1741,12 @@ static int cdns_uart_remove(struct platform_device *pdev)
1996 + console_port = NULL;
1997 + #endif
1998 +
1999 ++ /* If this is last instance major number should be initialized */
2000 ++ mutex_lock(&bitmap_lock);
2001 ++ if (bitmap_empty(bitmap, MAX_UART_INSTANCES))
2002 ++ uartps_major = 0;
2003 ++ mutex_unlock(&bitmap_lock);
2004 ++
2005 + uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
2006 + return rc;
2007 + }
2008 +diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
2009 +index 407a7a6198a2..502e9bf1746f 100644
2010 +--- a/drivers/usb/class/usblp.c
2011 ++++ b/drivers/usb/class/usblp.c
2012 +@@ -461,10 +461,12 @@ static int usblp_release(struct inode *inode, struct file *file)
2013 +
2014 + mutex_lock(&usblp_mutex);
2015 + usblp->used = 0;
2016 +- if (usblp->present) {
2017 ++ if (usblp->present)
2018 + usblp_unlink_urbs(usblp);
2019 +- usb_autopm_put_interface(usblp->intf);
2020 +- } else /* finish cleanup from disconnect */
2021 ++
2022 ++ usb_autopm_put_interface(usblp->intf);
2023 ++
2024 ++ if (!usblp->present) /* finish cleanup from disconnect */
2025 + usblp_cleanup(usblp);
2026 + mutex_unlock(&usblp_mutex);
2027 + return 0;
2028 +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
2029 +index 8414fac74493..3d499d93c083 100644
2030 +--- a/drivers/usb/gadget/udc/dummy_hcd.c
2031 ++++ b/drivers/usb/gadget/udc/dummy_hcd.c
2032 +@@ -48,6 +48,7 @@
2033 + #define DRIVER_VERSION "02 May 2005"
2034 +
2035 + #define POWER_BUDGET 500 /* in mA; use 8 for low-power port testing */
2036 ++#define POWER_BUDGET_3 900 /* in mA */
2037 +
2038 + static const char driver_name[] = "dummy_hcd";
2039 + static const char driver_desc[] = "USB Host+Gadget Emulator";
2040 +@@ -2432,7 +2433,7 @@ static int dummy_start_ss(struct dummy_hcd *dum_hcd)
2041 + dum_hcd->rh_state = DUMMY_RH_RUNNING;
2042 + dum_hcd->stream_en_ep = 0;
2043 + INIT_LIST_HEAD(&dum_hcd->urbp_list);
2044 +- dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET;
2045 ++ dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET_3;
2046 + dummy_hcd_to_hcd(dum_hcd)->state = HC_STATE_RUNNING;
2047 + dummy_hcd_to_hcd(dum_hcd)->uses_new_polling = 1;
2048 + #ifdef CONFIG_USB_OTG
2049 +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
2050 +index 9741cdeea9d7..85ceb43e3405 100644
2051 +--- a/drivers/usb/host/xhci-ring.c
2052 ++++ b/drivers/usb/host/xhci-ring.c
2053 +@@ -3202,10 +3202,10 @@ static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
2054 + if (usb_urb_dir_out(urb)) {
2055 + len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
2056 + seg->bounce_buf, new_buff_len, enqd_len);
2057 +- if (len != seg->bounce_len)
2058 ++ if (len != new_buff_len)
2059 + xhci_warn(xhci,
2060 + "WARN Wrong bounce buffer write length: %zu != %d\n",
2061 +- len, seg->bounce_len);
2062 ++ len, new_buff_len);
2063 + seg->bounce_dma = dma_map_single(dev, seg->bounce_buf,
2064 + max_pkt, DMA_TO_DEVICE);
2065 + } else {
2066 +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
2067 +index 03d1e552769b..ee9d2e0fc53a 100644
2068 +--- a/drivers/usb/host/xhci.c
2069 ++++ b/drivers/usb/host/xhci.c
2070 +@@ -1032,7 +1032,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
2071 + writel(command, &xhci->op_regs->command);
2072 + xhci->broken_suspend = 0;
2073 + if (xhci_handshake(&xhci->op_regs->status,
2074 +- STS_SAVE, 0, 10 * 1000)) {
2075 ++ STS_SAVE, 0, 20 * 1000)) {
2076 + /*
2077 + * AMD SNPS xHC 3.0 occasionally does not clear the
2078 + * SSS bit of USBSTS and when driver tries to poll
2079 +@@ -1108,6 +1108,18 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
2080 + hibernated = true;
2081 +
2082 + if (!hibernated) {
2083 ++ /*
2084 ++ * Some controllers might lose power during suspend, so wait
2085 ++ * for controller not ready bit to clear, just as in xHC init.
2086 ++ */
2087 ++ retval = xhci_handshake(&xhci->op_regs->status,
2088 ++ STS_CNR, 0, 10 * 1000 * 1000);
2089 ++ if (retval) {
2090 ++ xhci_warn(xhci, "Controller not ready at resume %d\n",
2091 ++ retval);
2092 ++ spin_unlock_irq(&xhci->lock);
2093 ++ return retval;
2094 ++ }
2095 + /* step 1: restore register */
2096 + xhci_restore_registers(xhci);
2097 + /* step 2: initialize command ring buffer */
2098 +@@ -3083,6 +3095,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
2099 + unsigned int ep_index;
2100 + unsigned long flags;
2101 + u32 ep_flag;
2102 ++ int err;
2103 +
2104 + xhci = hcd_to_xhci(hcd);
2105 + if (!host_ep->hcpriv)
2106 +@@ -3142,7 +3155,17 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
2107 + xhci_free_command(xhci, cfg_cmd);
2108 + goto cleanup;
2109 + }
2110 +- xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id, ep_index, 0);
2111 ++
2112 ++ err = xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id,
2113 ++ ep_index, 0);
2114 ++ if (err < 0) {
2115 ++ spin_unlock_irqrestore(&xhci->lock, flags);
2116 ++ xhci_free_command(xhci, cfg_cmd);
2117 ++ xhci_dbg(xhci, "%s: Failed to queue stop ep command, %d ",
2118 ++ __func__, err);
2119 ++ goto cleanup;
2120 ++ }
2121 ++
2122 + xhci_ring_cmd_db(xhci);
2123 + spin_unlock_irqrestore(&xhci->lock, flags);
2124 +
2125 +@@ -3156,8 +3179,16 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
2126 + ctrl_ctx, ep_flag, ep_flag);
2127 + xhci_endpoint_copy(xhci, cfg_cmd->in_ctx, vdev->out_ctx, ep_index);
2128 +
2129 +- xhci_queue_configure_endpoint(xhci, cfg_cmd, cfg_cmd->in_ctx->dma,
2130 ++ err = xhci_queue_configure_endpoint(xhci, cfg_cmd, cfg_cmd->in_ctx->dma,
2131 + udev->slot_id, false);
2132 ++ if (err < 0) {
2133 ++ spin_unlock_irqrestore(&xhci->lock, flags);
2134 ++ xhci_free_command(xhci, cfg_cmd);
2135 ++ xhci_dbg(xhci, "%s: Failed to queue config ep command, %d ",
2136 ++ __func__, err);
2137 ++ goto cleanup;
2138 ++ }
2139 ++
2140 + xhci_ring_cmd_db(xhci);
2141 + spin_unlock_irqrestore(&xhci->lock, flags);
2142 +
2143 +@@ -4673,12 +4704,12 @@ static int xhci_update_timeout_for_endpoint(struct xhci_hcd *xhci,
2144 + alt_timeout = xhci_call_host_update_timeout_for_endpoint(xhci, udev,
2145 + desc, state, timeout);
2146 +
2147 +- /* If we found we can't enable hub-initiated LPM, or
2148 ++ /* If we found we can't enable hub-initiated LPM, and
2149 + * the U1 or U2 exit latency was too high to allow
2150 +- * device-initiated LPM as well, just stop searching.
2151 ++ * device-initiated LPM as well, then we will disable LPM
2152 ++ * for this device, so stop searching any further.
2153 + */
2154 +- if (alt_timeout == USB3_LPM_DISABLED ||
2155 +- alt_timeout == USB3_LPM_DEVICE_INITIATED) {
2156 ++ if (alt_timeout == USB3_LPM_DISABLED) {
2157 + *timeout = alt_timeout;
2158 + return -E2BIG;
2159 + }
2160 +@@ -4789,10 +4820,12 @@ static u16 xhci_calculate_lpm_timeout(struct usb_hcd *hcd,
2161 + if (intf->dev.driver) {
2162 + driver = to_usb_driver(intf->dev.driver);
2163 + if (driver && driver->disable_hub_initiated_lpm) {
2164 +- dev_dbg(&udev->dev, "Hub-initiated %s disabled "
2165 +- "at request of driver %s\n",
2166 +- state_name, driver->name);
2167 +- return xhci_get_timeout_no_hub_lpm(udev, state);
2168 ++ dev_dbg(&udev->dev, "Hub-initiated %s disabled at request of driver %s\n",
2169 ++ state_name, driver->name);
2170 ++ timeout = xhci_get_timeout_no_hub_lpm(udev,
2171 ++ state);
2172 ++ if (timeout == USB3_LPM_DISABLED)
2173 ++ return timeout;
2174 + }
2175 + }
2176 +
2177 +@@ -5076,11 +5109,18 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
2178 + hcd->has_tt = 1;
2179 + } else {
2180 + /*
2181 +- * Some 3.1 hosts return sbrn 0x30, use xhci supported protocol
2182 +- * minor revision instead of sbrn. Minor revision is a two digit
2183 +- * BCD containing minor and sub-minor numbers, only show minor.
2184 ++ * Early xHCI 1.1 spec did not mention USB 3.1 capable hosts
2185 ++ * should return 0x31 for sbrn, or that the minor revision
2186 ++ * is a two digit BCD containig minor and sub-minor numbers.
2187 ++ * This was later clarified in xHCI 1.2.
2188 ++ *
2189 ++ * Some USB 3.1 capable hosts therefore have sbrn 0x30, and
2190 ++ * minor revision set to 0x1 instead of 0x10.
2191 + */
2192 +- minor_rev = xhci->usb3_rhub.min_rev / 0x10;
2193 ++ if (xhci->usb3_rhub.min_rev == 0x1)
2194 ++ minor_rev = 1;
2195 ++ else
2196 ++ minor_rev = xhci->usb3_rhub.min_rev / 0x10;
2197 +
2198 + switch (minor_rev) {
2199 + case 2:
2200 +@@ -5197,8 +5237,16 @@ static void xhci_clear_tt_buffer_complete(struct usb_hcd *hcd,
2201 + unsigned int ep_index;
2202 + unsigned long flags;
2203 +
2204 ++ /*
2205 ++ * udev might be NULL if tt buffer is cleared during a failed device
2206 ++ * enumeration due to a halted control endpoint. Usb core might
2207 ++ * have allocated a new udev for the next enumeration attempt.
2208 ++ */
2209 ++
2210 + xhci = hcd_to_xhci(hcd);
2211 + udev = (struct usb_device *)ep->hcpriv;
2212 ++ if (!udev)
2213 ++ return;
2214 + slot_id = udev->slot_id;
2215 + ep_index = xhci_get_endpoint_index(&ep->desc);
2216 +
2217 +diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
2218 +index 0a57c2cc8e5a..7a6b122c833f 100644
2219 +--- a/drivers/usb/image/microtek.c
2220 ++++ b/drivers/usb/image/microtek.c
2221 +@@ -716,6 +716,10 @@ static int mts_usb_probe(struct usb_interface *intf,
2222 +
2223 + }
2224 +
2225 ++ if (ep_in_current != &ep_in_set[2]) {
2226 ++ MTS_WARNING("couldn't find two input bulk endpoints. Bailing out.\n");
2227 ++ return -ENODEV;
2228 ++ }
2229 +
2230 + if ( ep_out == -1 ) {
2231 + MTS_WARNING( "couldn't find an output bulk endpoint. Bailing out.\n" );
2232 +diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
2233 +index bdae62b2ffe0..9bce583aada3 100644
2234 +--- a/drivers/usb/misc/Kconfig
2235 ++++ b/drivers/usb/misc/Kconfig
2236 +@@ -47,16 +47,6 @@ config USB_SEVSEG
2237 + To compile this driver as a module, choose M here: the
2238 + module will be called usbsevseg.
2239 +
2240 +-config USB_RIO500
2241 +- tristate "USB Diamond Rio500 support"
2242 +- help
2243 +- Say Y here if you want to connect a USB Rio500 mp3 player to your
2244 +- computer's USB port. Please read <file:Documentation/usb/rio.rst>
2245 +- for more information.
2246 +-
2247 +- To compile this driver as a module, choose M here: the
2248 +- module will be called rio500.
2249 +-
2250 + config USB_LEGOTOWER
2251 + tristate "USB Lego Infrared Tower support"
2252 + help
2253 +diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
2254 +index 109f54f5b9aa..0d416eb624bb 100644
2255 +--- a/drivers/usb/misc/Makefile
2256 ++++ b/drivers/usb/misc/Makefile
2257 +@@ -17,7 +17,6 @@ obj-$(CONFIG_USB_ISIGHTFW) += isight_firmware.o
2258 + obj-$(CONFIG_USB_LCD) += usblcd.o
2259 + obj-$(CONFIG_USB_LD) += ldusb.o
2260 + obj-$(CONFIG_USB_LEGOTOWER) += legousbtower.o
2261 +-obj-$(CONFIG_USB_RIO500) += rio500.o
2262 + obj-$(CONFIG_USB_TEST) += usbtest.o
2263 + obj-$(CONFIG_USB_EHSET_TEST_FIXTURE) += ehset.o
2264 + obj-$(CONFIG_USB_TRANCEVIBRATOR) += trancevibrator.o
2265 +diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
2266 +index 344d523b0502..6f5edb9fc61e 100644
2267 +--- a/drivers/usb/misc/adutux.c
2268 ++++ b/drivers/usb/misc/adutux.c
2269 +@@ -75,6 +75,7 @@ struct adu_device {
2270 + char serial_number[8];
2271 +
2272 + int open_count; /* number of times this port has been opened */
2273 ++ unsigned long disconnected:1;
2274 +
2275 + char *read_buffer_primary;
2276 + int read_buffer_length;
2277 +@@ -116,7 +117,7 @@ static void adu_abort_transfers(struct adu_device *dev)
2278 + {
2279 + unsigned long flags;
2280 +
2281 +- if (dev->udev == NULL)
2282 ++ if (dev->disconnected)
2283 + return;
2284 +
2285 + /* shutdown transfer */
2286 +@@ -148,6 +149,7 @@ static void adu_delete(struct adu_device *dev)
2287 + kfree(dev->read_buffer_secondary);
2288 + kfree(dev->interrupt_in_buffer);
2289 + kfree(dev->interrupt_out_buffer);
2290 ++ usb_put_dev(dev->udev);
2291 + kfree(dev);
2292 + }
2293 +
2294 +@@ -243,7 +245,7 @@ static int adu_open(struct inode *inode, struct file *file)
2295 + }
2296 +
2297 + dev = usb_get_intfdata(interface);
2298 +- if (!dev || !dev->udev) {
2299 ++ if (!dev) {
2300 + retval = -ENODEV;
2301 + goto exit_no_device;
2302 + }
2303 +@@ -326,7 +328,7 @@ static int adu_release(struct inode *inode, struct file *file)
2304 + }
2305 +
2306 + adu_release_internal(dev);
2307 +- if (dev->udev == NULL) {
2308 ++ if (dev->disconnected) {
2309 + /* the device was unplugged before the file was released */
2310 + if (!dev->open_count) /* ... and we're the last user */
2311 + adu_delete(dev);
2312 +@@ -354,7 +356,7 @@ static ssize_t adu_read(struct file *file, __user char *buffer, size_t count,
2313 + return -ERESTARTSYS;
2314 +
2315 + /* verify that the device wasn't unplugged */
2316 +- if (dev->udev == NULL) {
2317 ++ if (dev->disconnected) {
2318 + retval = -ENODEV;
2319 + pr_err("No device or device unplugged %d\n", retval);
2320 + goto exit;
2321 +@@ -518,7 +520,7 @@ static ssize_t adu_write(struct file *file, const __user char *buffer,
2322 + goto exit_nolock;
2323 +
2324 + /* verify that the device wasn't unplugged */
2325 +- if (dev->udev == NULL) {
2326 ++ if (dev->disconnected) {
2327 + retval = -ENODEV;
2328 + pr_err("No device or device unplugged %d\n", retval);
2329 + goto exit;
2330 +@@ -663,7 +665,7 @@ static int adu_probe(struct usb_interface *interface,
2331 +
2332 + mutex_init(&dev->mtx);
2333 + spin_lock_init(&dev->buflock);
2334 +- dev->udev = udev;
2335 ++ dev->udev = usb_get_dev(udev);
2336 + init_waitqueue_head(&dev->read_wait);
2337 + init_waitqueue_head(&dev->write_wait);
2338 +
2339 +@@ -762,14 +764,18 @@ static void adu_disconnect(struct usb_interface *interface)
2340 +
2341 + dev = usb_get_intfdata(interface);
2342 +
2343 +- mutex_lock(&dev->mtx); /* not interruptible */
2344 +- dev->udev = NULL; /* poison */
2345 + usb_deregister_dev(interface, &adu_class);
2346 +- mutex_unlock(&dev->mtx);
2347 ++
2348 ++ usb_poison_urb(dev->interrupt_in_urb);
2349 ++ usb_poison_urb(dev->interrupt_out_urb);
2350 +
2351 + mutex_lock(&adutux_mutex);
2352 + usb_set_intfdata(interface, NULL);
2353 +
2354 ++ mutex_lock(&dev->mtx); /* not interruptible */
2355 ++ dev->disconnected = 1;
2356 ++ mutex_unlock(&dev->mtx);
2357 ++
2358 + /* if the device is not opened, then we clean up right now */
2359 + if (!dev->open_count)
2360 + adu_delete(dev);
2361 +diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
2362 +index cf5828ce927a..34e6cd6f40d3 100644
2363 +--- a/drivers/usb/misc/chaoskey.c
2364 ++++ b/drivers/usb/misc/chaoskey.c
2365 +@@ -98,6 +98,7 @@ static void chaoskey_free(struct chaoskey *dev)
2366 + usb_free_urb(dev->urb);
2367 + kfree(dev->name);
2368 + kfree(dev->buf);
2369 ++ usb_put_intf(dev->interface);
2370 + kfree(dev);
2371 + }
2372 + }
2373 +@@ -145,6 +146,8 @@ static int chaoskey_probe(struct usb_interface *interface,
2374 + if (dev == NULL)
2375 + goto out;
2376 +
2377 ++ dev->interface = usb_get_intf(interface);
2378 ++
2379 + dev->buf = kmalloc(size, GFP_KERNEL);
2380 +
2381 + if (dev->buf == NULL)
2382 +@@ -174,8 +177,6 @@ static int chaoskey_probe(struct usb_interface *interface,
2383 + goto out;
2384 + }
2385 +
2386 +- dev->interface = interface;
2387 +-
2388 + dev->in_ep = in_ep;
2389 +
2390 + if (le16_to_cpu(udev->descriptor.idVendor) != ALEA_VENDOR_ID)
2391 +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
2392 +index f5bed9f29e56..f405fa734bcc 100644
2393 +--- a/drivers/usb/misc/iowarrior.c
2394 ++++ b/drivers/usb/misc/iowarrior.c
2395 +@@ -87,6 +87,7 @@ struct iowarrior {
2396 + char chip_serial[9]; /* the serial number string of the chip connected */
2397 + int report_size; /* number of bytes in a report */
2398 + u16 product_id;
2399 ++ struct usb_anchor submitted;
2400 + };
2401 +
2402 + /*--------------*/
2403 +@@ -243,6 +244,7 @@ static inline void iowarrior_delete(struct iowarrior *dev)
2404 + kfree(dev->int_in_buffer);
2405 + usb_free_urb(dev->int_in_urb);
2406 + kfree(dev->read_queue);
2407 ++ usb_put_intf(dev->interface);
2408 + kfree(dev);
2409 + }
2410 +
2411 +@@ -424,11 +426,13 @@ static ssize_t iowarrior_write(struct file *file,
2412 + retval = -EFAULT;
2413 + goto error;
2414 + }
2415 ++ usb_anchor_urb(int_out_urb, &dev->submitted);
2416 + retval = usb_submit_urb(int_out_urb, GFP_KERNEL);
2417 + if (retval) {
2418 + dev_dbg(&dev->interface->dev,
2419 + "submit error %d for urb nr.%d\n",
2420 + retval, atomic_read(&dev->write_busy));
2421 ++ usb_unanchor_urb(int_out_urb);
2422 + goto error;
2423 + }
2424 + /* submit was ok */
2425 +@@ -764,11 +768,13 @@ static int iowarrior_probe(struct usb_interface *interface,
2426 + init_waitqueue_head(&dev->write_wait);
2427 +
2428 + dev->udev = udev;
2429 +- dev->interface = interface;
2430 ++ dev->interface = usb_get_intf(interface);
2431 +
2432 + iface_desc = interface->cur_altsetting;
2433 + dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
2434 +
2435 ++ init_usb_anchor(&dev->submitted);
2436 ++
2437 + res = usb_find_last_int_in_endpoint(iface_desc, &dev->int_in_endpoint);
2438 + if (res) {
2439 + dev_err(&interface->dev, "no interrupt-in endpoint found\n");
2440 +@@ -866,8 +872,6 @@ static void iowarrior_disconnect(struct usb_interface *interface)
2441 + dev = usb_get_intfdata(interface);
2442 + mutex_lock(&iowarrior_open_disc_lock);
2443 + usb_set_intfdata(interface, NULL);
2444 +- /* prevent device read, write and ioctl */
2445 +- dev->present = 0;
2446 +
2447 + minor = dev->minor;
2448 + mutex_unlock(&iowarrior_open_disc_lock);
2449 +@@ -878,8 +882,7 @@ static void iowarrior_disconnect(struct usb_interface *interface)
2450 + mutex_lock(&dev->mutex);
2451 +
2452 + /* prevent device read, write and ioctl */
2453 +-
2454 +- mutex_unlock(&dev->mutex);
2455 ++ dev->present = 0;
2456 +
2457 + if (dev->opened) {
2458 + /* There is a process that holds a filedescriptor to the device ,
2459 +@@ -887,10 +890,13 @@ static void iowarrior_disconnect(struct usb_interface *interface)
2460 + Deleting the device is postponed until close() was called.
2461 + */
2462 + usb_kill_urb(dev->int_in_urb);
2463 ++ usb_kill_anchored_urbs(&dev->submitted);
2464 + wake_up_interruptible(&dev->read_wait);
2465 + wake_up_interruptible(&dev->write_wait);
2466 ++ mutex_unlock(&dev->mutex);
2467 + } else {
2468 + /* no process is using the device, cleanup now */
2469 ++ mutex_unlock(&dev->mutex);
2470 + iowarrior_delete(dev);
2471 + }
2472 +
2473 +diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
2474 +index 6581774bdfa4..f3108d85e768 100644
2475 +--- a/drivers/usb/misc/ldusb.c
2476 ++++ b/drivers/usb/misc/ldusb.c
2477 +@@ -153,6 +153,7 @@ MODULE_PARM_DESC(min_interrupt_out_interval, "Minimum interrupt out interval in
2478 + struct ld_usb {
2479 + struct mutex mutex; /* locks this structure */
2480 + struct usb_interface *intf; /* save off the usb interface pointer */
2481 ++ unsigned long disconnected:1;
2482 +
2483 + int open_count; /* number of times this port has been opened */
2484 +
2485 +@@ -192,12 +193,10 @@ static void ld_usb_abort_transfers(struct ld_usb *dev)
2486 + /* shutdown transfer */
2487 + if (dev->interrupt_in_running) {
2488 + dev->interrupt_in_running = 0;
2489 +- if (dev->intf)
2490 +- usb_kill_urb(dev->interrupt_in_urb);
2491 ++ usb_kill_urb(dev->interrupt_in_urb);
2492 + }
2493 + if (dev->interrupt_out_busy)
2494 +- if (dev->intf)
2495 +- usb_kill_urb(dev->interrupt_out_urb);
2496 ++ usb_kill_urb(dev->interrupt_out_urb);
2497 + }
2498 +
2499 + /**
2500 +@@ -205,8 +204,6 @@ static void ld_usb_abort_transfers(struct ld_usb *dev)
2501 + */
2502 + static void ld_usb_delete(struct ld_usb *dev)
2503 + {
2504 +- ld_usb_abort_transfers(dev);
2505 +-
2506 + /* free data structures */
2507 + usb_free_urb(dev->interrupt_in_urb);
2508 + usb_free_urb(dev->interrupt_out_urb);
2509 +@@ -263,7 +260,7 @@ static void ld_usb_interrupt_in_callback(struct urb *urb)
2510 +
2511 + resubmit:
2512 + /* resubmit if we're still running */
2513 +- if (dev->interrupt_in_running && !dev->buffer_overflow && dev->intf) {
2514 ++ if (dev->interrupt_in_running && !dev->buffer_overflow) {
2515 + retval = usb_submit_urb(dev->interrupt_in_urb, GFP_ATOMIC);
2516 + if (retval) {
2517 + dev_err(&dev->intf->dev,
2518 +@@ -392,7 +389,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
2519 + retval = -ENODEV;
2520 + goto unlock_exit;
2521 + }
2522 +- if (dev->intf == NULL) {
2523 ++ if (dev->disconnected) {
2524 + /* the device was unplugged before the file was released */
2525 + mutex_unlock(&dev->mutex);
2526 + /* unlock here as ld_usb_delete frees dev */
2527 +@@ -423,7 +420,7 @@ static __poll_t ld_usb_poll(struct file *file, poll_table *wait)
2528 +
2529 + dev = file->private_data;
2530 +
2531 +- if (!dev->intf)
2532 ++ if (dev->disconnected)
2533 + return EPOLLERR | EPOLLHUP;
2534 +
2535 + poll_wait(file, &dev->read_wait, wait);
2536 +@@ -462,7 +459,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
2537 + }
2538 +
2539 + /* verify that the device wasn't unplugged */
2540 +- if (dev->intf == NULL) {
2541 ++ if (dev->disconnected) {
2542 + retval = -ENODEV;
2543 + printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
2544 + goto unlock_exit;
2545 +@@ -542,7 +539,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
2546 + }
2547 +
2548 + /* verify that the device wasn't unplugged */
2549 +- if (dev->intf == NULL) {
2550 ++ if (dev->disconnected) {
2551 + retval = -ENODEV;
2552 + printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
2553 + goto unlock_exit;
2554 +@@ -764,6 +761,9 @@ static void ld_usb_disconnect(struct usb_interface *intf)
2555 + /* give back our minor */
2556 + usb_deregister_dev(intf, &ld_usb_class);
2557 +
2558 ++ usb_poison_urb(dev->interrupt_in_urb);
2559 ++ usb_poison_urb(dev->interrupt_out_urb);
2560 ++
2561 + mutex_lock(&dev->mutex);
2562 +
2563 + /* if the device is not opened, then we clean up right now */
2564 +@@ -771,7 +771,7 @@ static void ld_usb_disconnect(struct usb_interface *intf)
2565 + mutex_unlock(&dev->mutex);
2566 + ld_usb_delete(dev);
2567 + } else {
2568 +- dev->intf = NULL;
2569 ++ dev->disconnected = 1;
2570 + /* wake up pollers */
2571 + wake_up_interruptible_all(&dev->read_wait);
2572 + wake_up_interruptible_all(&dev->write_wait);
2573 +diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
2574 +index 006cf13b2199..9d4c52a7ebe0 100644
2575 +--- a/drivers/usb/misc/legousbtower.c
2576 ++++ b/drivers/usb/misc/legousbtower.c
2577 +@@ -179,7 +179,6 @@ static const struct usb_device_id tower_table[] = {
2578 + };
2579 +
2580 + MODULE_DEVICE_TABLE (usb, tower_table);
2581 +-static DEFINE_MUTEX(open_disc_mutex);
2582 +
2583 + #define LEGO_USB_TOWER_MINOR_BASE 160
2584 +
2585 +@@ -191,6 +190,7 @@ struct lego_usb_tower {
2586 + unsigned char minor; /* the starting minor number for this device */
2587 +
2588 + int open_count; /* number of times this port has been opened */
2589 ++ unsigned long disconnected:1;
2590 +
2591 + char* read_buffer;
2592 + size_t read_buffer_length; /* this much came in */
2593 +@@ -290,14 +290,13 @@ static inline void lego_usb_tower_debug_data(struct device *dev,
2594 + */
2595 + static inline void tower_delete (struct lego_usb_tower *dev)
2596 + {
2597 +- tower_abort_transfers (dev);
2598 +-
2599 + /* free data structures */
2600 + usb_free_urb(dev->interrupt_in_urb);
2601 + usb_free_urb(dev->interrupt_out_urb);
2602 + kfree (dev->read_buffer);
2603 + kfree (dev->interrupt_in_buffer);
2604 + kfree (dev->interrupt_out_buffer);
2605 ++ usb_put_dev(dev->udev);
2606 + kfree (dev);
2607 + }
2608 +
2609 +@@ -332,18 +331,14 @@ static int tower_open (struct inode *inode, struct file *file)
2610 + goto exit;
2611 + }
2612 +
2613 +- mutex_lock(&open_disc_mutex);
2614 + dev = usb_get_intfdata(interface);
2615 +-
2616 + if (!dev) {
2617 +- mutex_unlock(&open_disc_mutex);
2618 + retval = -ENODEV;
2619 + goto exit;
2620 + }
2621 +
2622 + /* lock this device */
2623 + if (mutex_lock_interruptible(&dev->lock)) {
2624 +- mutex_unlock(&open_disc_mutex);
2625 + retval = -ERESTARTSYS;
2626 + goto exit;
2627 + }
2628 +@@ -351,12 +346,9 @@ static int tower_open (struct inode *inode, struct file *file)
2629 +
2630 + /* allow opening only once */
2631 + if (dev->open_count) {
2632 +- mutex_unlock(&open_disc_mutex);
2633 + retval = -EBUSY;
2634 + goto unlock_exit;
2635 + }
2636 +- dev->open_count = 1;
2637 +- mutex_unlock(&open_disc_mutex);
2638 +
2639 + /* reset the tower */
2640 + result = usb_control_msg (dev->udev,
2641 +@@ -396,13 +388,14 @@ static int tower_open (struct inode *inode, struct file *file)
2642 + dev_err(&dev->udev->dev,
2643 + "Couldn't submit interrupt_in_urb %d\n", retval);
2644 + dev->interrupt_in_running = 0;
2645 +- dev->open_count = 0;
2646 + goto unlock_exit;
2647 + }
2648 +
2649 + /* save device in the file's private structure */
2650 + file->private_data = dev;
2651 +
2652 ++ dev->open_count = 1;
2653 ++
2654 + unlock_exit:
2655 + mutex_unlock(&dev->lock);
2656 +
2657 +@@ -423,10 +416,9 @@ static int tower_release (struct inode *inode, struct file *file)
2658 +
2659 + if (dev == NULL) {
2660 + retval = -ENODEV;
2661 +- goto exit_nolock;
2662 ++ goto exit;
2663 + }
2664 +
2665 +- mutex_lock(&open_disc_mutex);
2666 + if (mutex_lock_interruptible(&dev->lock)) {
2667 + retval = -ERESTARTSYS;
2668 + goto exit;
2669 +@@ -438,7 +430,8 @@ static int tower_release (struct inode *inode, struct file *file)
2670 + retval = -ENODEV;
2671 + goto unlock_exit;
2672 + }
2673 +- if (dev->udev == NULL) {
2674 ++
2675 ++ if (dev->disconnected) {
2676 + /* the device was unplugged before the file was released */
2677 +
2678 + /* unlock here as tower_delete frees dev */
2679 +@@ -456,10 +449,7 @@ static int tower_release (struct inode *inode, struct file *file)
2680 +
2681 + unlock_exit:
2682 + mutex_unlock(&dev->lock);
2683 +-
2684 + exit:
2685 +- mutex_unlock(&open_disc_mutex);
2686 +-exit_nolock:
2687 + return retval;
2688 + }
2689 +
2690 +@@ -477,10 +467,9 @@ static void tower_abort_transfers (struct lego_usb_tower *dev)
2691 + if (dev->interrupt_in_running) {
2692 + dev->interrupt_in_running = 0;
2693 + mb();
2694 +- if (dev->udev)
2695 +- usb_kill_urb (dev->interrupt_in_urb);
2696 ++ usb_kill_urb(dev->interrupt_in_urb);
2697 + }
2698 +- if (dev->interrupt_out_busy && dev->udev)
2699 ++ if (dev->interrupt_out_busy)
2700 + usb_kill_urb(dev->interrupt_out_urb);
2701 + }
2702 +
2703 +@@ -516,7 +505,7 @@ static __poll_t tower_poll (struct file *file, poll_table *wait)
2704 +
2705 + dev = file->private_data;
2706 +
2707 +- if (!dev->udev)
2708 ++ if (dev->disconnected)
2709 + return EPOLLERR | EPOLLHUP;
2710 +
2711 + poll_wait(file, &dev->read_wait, wait);
2712 +@@ -563,7 +552,7 @@ static ssize_t tower_read (struct file *file, char __user *buffer, size_t count,
2713 + }
2714 +
2715 + /* verify that the device wasn't unplugged */
2716 +- if (dev->udev == NULL) {
2717 ++ if (dev->disconnected) {
2718 + retval = -ENODEV;
2719 + pr_err("No device or device unplugged %d\n", retval);
2720 + goto unlock_exit;
2721 +@@ -649,7 +638,7 @@ static ssize_t tower_write (struct file *file, const char __user *buffer, size_t
2722 + }
2723 +
2724 + /* verify that the device wasn't unplugged */
2725 +- if (dev->udev == NULL) {
2726 ++ if (dev->disconnected) {
2727 + retval = -ENODEV;
2728 + pr_err("No device or device unplugged %d\n", retval);
2729 + goto unlock_exit;
2730 +@@ -759,7 +748,7 @@ static void tower_interrupt_in_callback (struct urb *urb)
2731 +
2732 + resubmit:
2733 + /* resubmit if we're still running */
2734 +- if (dev->interrupt_in_running && dev->udev) {
2735 ++ if (dev->interrupt_in_running) {
2736 + retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
2737 + if (retval)
2738 + dev_err(&dev->udev->dev,
2739 +@@ -822,8 +811,9 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
2740 +
2741 + mutex_init(&dev->lock);
2742 +
2743 +- dev->udev = udev;
2744 ++ dev->udev = usb_get_dev(udev);
2745 + dev->open_count = 0;
2746 ++ dev->disconnected = 0;
2747 +
2748 + dev->read_buffer = NULL;
2749 + dev->read_buffer_length = 0;
2750 +@@ -891,8 +881,10 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
2751 + get_version_reply,
2752 + sizeof(*get_version_reply),
2753 + 1000);
2754 +- if (result < 0) {
2755 +- dev_err(idev, "LEGO USB Tower get version control request failed\n");
2756 ++ if (result < sizeof(*get_version_reply)) {
2757 ++ if (result >= 0)
2758 ++ result = -EIO;
2759 ++ dev_err(idev, "get version request failed: %d\n", result);
2760 + retval = result;
2761 + goto error;
2762 + }
2763 +@@ -910,7 +902,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
2764 + if (retval) {
2765 + /* something prevented us from registering this driver */
2766 + dev_err(idev, "Not able to get a minor for this device.\n");
2767 +- usb_set_intfdata (interface, NULL);
2768 + goto error;
2769 + }
2770 + dev->minor = interface->minor;
2771 +@@ -942,23 +933,24 @@ static void tower_disconnect (struct usb_interface *interface)
2772 + int minor;
2773 +
2774 + dev = usb_get_intfdata (interface);
2775 +- mutex_lock(&open_disc_mutex);
2776 +- usb_set_intfdata (interface, NULL);
2777 +
2778 + minor = dev->minor;
2779 +
2780 +- /* give back our minor */
2781 ++ /* give back our minor and prevent further open() */
2782 + usb_deregister_dev (interface, &tower_class);
2783 +
2784 ++ /* stop I/O */
2785 ++ usb_poison_urb(dev->interrupt_in_urb);
2786 ++ usb_poison_urb(dev->interrupt_out_urb);
2787 ++
2788 + mutex_lock(&dev->lock);
2789 +- mutex_unlock(&open_disc_mutex);
2790 +
2791 + /* if the device is not opened, then we clean up right now */
2792 + if (!dev->open_count) {
2793 + mutex_unlock(&dev->lock);
2794 + tower_delete (dev);
2795 + } else {
2796 +- dev->udev = NULL;
2797 ++ dev->disconnected = 1;
2798 + /* wake up pollers */
2799 + wake_up_interruptible_all(&dev->read_wait);
2800 + wake_up_interruptible_all(&dev->write_wait);
2801 +diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c
2802 +deleted file mode 100644
2803 +index a32d61a79ab8..000000000000
2804 +--- a/drivers/usb/misc/rio500.c
2805 ++++ /dev/null
2806 +@@ -1,561 +0,0 @@
2807 +-// SPDX-License-Identifier: GPL-2.0+
2808 +-/* -*- linux-c -*- */
2809 +-
2810 +-/*
2811 +- * Driver for USB Rio 500
2812 +- *
2813 +- * Cesar Miquel (miquel@××××××.ar)
2814 +- *
2815 +- * based on hp_scanner.c by David E. Nelson (dnelson@××××.net)
2816 +- *
2817 +- * Based upon mouse.c (Brad Keryan) and printer.c (Michael Gee).
2818 +- *
2819 +- * Changelog:
2820 +- * 30/05/2003 replaced lock/unlock kernel with up/down
2821 +- * Daniele Bellucci bellucda@×××××××.it
2822 +- * */
2823 +-
2824 +-#include <linux/module.h>
2825 +-#include <linux/kernel.h>
2826 +-#include <linux/signal.h>
2827 +-#include <linux/sched/signal.h>
2828 +-#include <linux/mutex.h>
2829 +-#include <linux/errno.h>
2830 +-#include <linux/random.h>
2831 +-#include <linux/poll.h>
2832 +-#include <linux/slab.h>
2833 +-#include <linux/spinlock.h>
2834 +-#include <linux/usb.h>
2835 +-#include <linux/wait.h>
2836 +-
2837 +-#include "rio500_usb.h"
2838 +-
2839 +-#define DRIVER_AUTHOR "Cesar Miquel <miquel@××××××.ar>"
2840 +-#define DRIVER_DESC "USB Rio 500 driver"
2841 +-
2842 +-#define RIO_MINOR 64
2843 +-
2844 +-/* stall/wait timeout for rio */
2845 +-#define NAK_TIMEOUT (HZ)
2846 +-
2847 +-#define IBUF_SIZE 0x1000
2848 +-
2849 +-/* Size of the rio buffer */
2850 +-#define OBUF_SIZE 0x10000
2851 +-
2852 +-struct rio_usb_data {
2853 +- struct usb_device *rio_dev; /* init: probe_rio */
2854 +- unsigned int ifnum; /* Interface number of the USB device */
2855 +- int isopen; /* nz if open */
2856 +- int present; /* Device is present on the bus */
2857 +- char *obuf, *ibuf; /* transfer buffers */
2858 +- char bulk_in_ep, bulk_out_ep; /* Endpoint assignments */
2859 +- wait_queue_head_t wait_q; /* for timeouts */
2860 +- struct mutex lock; /* general race avoidance */
2861 +-};
2862 +-
2863 +-static DEFINE_MUTEX(rio500_mutex);
2864 +-static struct rio_usb_data rio_instance;
2865 +-
2866 +-static int open_rio(struct inode *inode, struct file *file)
2867 +-{
2868 +- struct rio_usb_data *rio = &rio_instance;
2869 +-
2870 +- /* against disconnect() */
2871 +- mutex_lock(&rio500_mutex);
2872 +- mutex_lock(&(rio->lock));
2873 +-
2874 +- if (rio->isopen || !rio->present) {
2875 +- mutex_unlock(&(rio->lock));
2876 +- mutex_unlock(&rio500_mutex);
2877 +- return -EBUSY;
2878 +- }
2879 +- rio->isopen = 1;
2880 +-
2881 +- init_waitqueue_head(&rio->wait_q);
2882 +-
2883 +- mutex_unlock(&(rio->lock));
2884 +-
2885 +- dev_info(&rio->rio_dev->dev, "Rio opened.\n");
2886 +- mutex_unlock(&rio500_mutex);
2887 +-
2888 +- return 0;
2889 +-}
2890 +-
2891 +-static int close_rio(struct inode *inode, struct file *file)
2892 +-{
2893 +- struct rio_usb_data *rio = &rio_instance;
2894 +-
2895 +- /* against disconnect() */
2896 +- mutex_lock(&rio500_mutex);
2897 +- mutex_lock(&(rio->lock));
2898 +-
2899 +- rio->isopen = 0;
2900 +- if (!rio->present) {
2901 +- /* cleanup has been delayed */
2902 +- kfree(rio->ibuf);
2903 +- kfree(rio->obuf);
2904 +- rio->ibuf = NULL;
2905 +- rio->obuf = NULL;
2906 +- } else {
2907 +- dev_info(&rio->rio_dev->dev, "Rio closed.\n");
2908 +- }
2909 +- mutex_unlock(&(rio->lock));
2910 +- mutex_unlock(&rio500_mutex);
2911 +- return 0;
2912 +-}
2913 +-
2914 +-static long ioctl_rio(struct file *file, unsigned int cmd, unsigned long arg)
2915 +-{
2916 +- struct RioCommand rio_cmd;
2917 +- struct rio_usb_data *rio = &rio_instance;
2918 +- void __user *data;
2919 +- unsigned char *buffer;
2920 +- int result, requesttype;
2921 +- int retries;
2922 +- int retval=0;
2923 +-
2924 +- mutex_lock(&(rio->lock));
2925 +- /* Sanity check to make sure rio is connected, powered, etc */
2926 +- if (rio->present == 0 || rio->rio_dev == NULL) {
2927 +- retval = -ENODEV;
2928 +- goto err_out;
2929 +- }
2930 +-
2931 +- switch (cmd) {
2932 +- case RIO_RECV_COMMAND:
2933 +- data = (void __user *) arg;
2934 +- if (data == NULL)
2935 +- break;
2936 +- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) {
2937 +- retval = -EFAULT;
2938 +- goto err_out;
2939 +- }
2940 +- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) {
2941 +- retval = -EINVAL;
2942 +- goto err_out;
2943 +- }
2944 +- buffer = (unsigned char *) __get_free_page(GFP_KERNEL);
2945 +- if (buffer == NULL) {
2946 +- retval = -ENOMEM;
2947 +- goto err_out;
2948 +- }
2949 +- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) {
2950 +- retval = -EFAULT;
2951 +- free_page((unsigned long) buffer);
2952 +- goto err_out;
2953 +- }
2954 +-
2955 +- requesttype = rio_cmd.requesttype | USB_DIR_IN |
2956 +- USB_TYPE_VENDOR | USB_RECIP_DEVICE;
2957 +- dev_dbg(&rio->rio_dev->dev,
2958 +- "sending command:reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n",
2959 +- requesttype, rio_cmd.request, rio_cmd.value,
2960 +- rio_cmd.index, rio_cmd.length);
2961 +- /* Send rio control message */
2962 +- retries = 3;
2963 +- while (retries) {
2964 +- result = usb_control_msg(rio->rio_dev,
2965 +- usb_rcvctrlpipe(rio-> rio_dev, 0),
2966 +- rio_cmd.request,
2967 +- requesttype,
2968 +- rio_cmd.value,
2969 +- rio_cmd.index, buffer,
2970 +- rio_cmd.length,
2971 +- jiffies_to_msecs(rio_cmd.timeout));
2972 +- if (result == -ETIMEDOUT)
2973 +- retries--;
2974 +- else if (result < 0) {
2975 +- dev_err(&rio->rio_dev->dev,
2976 +- "Error executing ioctrl. code = %d\n",
2977 +- result);
2978 +- retries = 0;
2979 +- } else {
2980 +- dev_dbg(&rio->rio_dev->dev,
2981 +- "Executed ioctl. Result = %d (data=%02x)\n",
2982 +- result, buffer[0]);
2983 +- if (copy_to_user(rio_cmd.buffer, buffer,
2984 +- rio_cmd.length)) {
2985 +- free_page((unsigned long) buffer);
2986 +- retval = -EFAULT;
2987 +- goto err_out;
2988 +- }
2989 +- retries = 0;
2990 +- }
2991 +-
2992 +- /* rio_cmd.buffer contains a raw stream of single byte
2993 +- data which has been returned from rio. Data is
2994 +- interpreted at application level. For data that
2995 +- will be cast to data types longer than 1 byte, data
2996 +- will be little_endian and will potentially need to
2997 +- be swapped at the app level */
2998 +-
2999 +- }
3000 +- free_page((unsigned long) buffer);
3001 +- break;
3002 +-
3003 +- case RIO_SEND_COMMAND:
3004 +- data = (void __user *) arg;
3005 +- if (data == NULL)
3006 +- break;
3007 +- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) {
3008 +- retval = -EFAULT;
3009 +- goto err_out;
3010 +- }
3011 +- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) {
3012 +- retval = -EINVAL;
3013 +- goto err_out;
3014 +- }
3015 +- buffer = (unsigned char *) __get_free_page(GFP_KERNEL);
3016 +- if (buffer == NULL) {
3017 +- retval = -ENOMEM;
3018 +- goto err_out;
3019 +- }
3020 +- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) {
3021 +- free_page((unsigned long)buffer);
3022 +- retval = -EFAULT;
3023 +- goto err_out;
3024 +- }
3025 +-
3026 +- requesttype = rio_cmd.requesttype | USB_DIR_OUT |
3027 +- USB_TYPE_VENDOR | USB_RECIP_DEVICE;
3028 +- dev_dbg(&rio->rio_dev->dev,
3029 +- "sending command: reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n",
3030 +- requesttype, rio_cmd.request, rio_cmd.value,
3031 +- rio_cmd.index, rio_cmd.length);
3032 +- /* Send rio control message */
3033 +- retries = 3;
3034 +- while (retries) {
3035 +- result = usb_control_msg(rio->rio_dev,
3036 +- usb_sndctrlpipe(rio-> rio_dev, 0),
3037 +- rio_cmd.request,
3038 +- requesttype,
3039 +- rio_cmd.value,
3040 +- rio_cmd.index, buffer,
3041 +- rio_cmd.length,
3042 +- jiffies_to_msecs(rio_cmd.timeout));
3043 +- if (result == -ETIMEDOUT)
3044 +- retries--;
3045 +- else if (result < 0) {
3046 +- dev_err(&rio->rio_dev->dev,
3047 +- "Error executing ioctrl. code = %d\n",
3048 +- result);
3049 +- retries = 0;
3050 +- } else {
3051 +- dev_dbg(&rio->rio_dev->dev,
3052 +- "Executed ioctl. Result = %d\n", result);
3053 +- retries = 0;
3054 +-
3055 +- }
3056 +-
3057 +- }
3058 +- free_page((unsigned long) buffer);
3059 +- break;
3060 +-
3061 +- default:
3062 +- retval = -ENOTTY;
3063 +- break;
3064 +- }
3065 +-
3066 +-
3067 +-err_out:
3068 +- mutex_unlock(&(rio->lock));
3069 +- return retval;
3070 +-}
3071 +-
3072 +-static ssize_t
3073 +-write_rio(struct file *file, const char __user *buffer,
3074 +- size_t count, loff_t * ppos)
3075 +-{
3076 +- DEFINE_WAIT(wait);
3077 +- struct rio_usb_data *rio = &rio_instance;
3078 +-
3079 +- unsigned long copy_size;
3080 +- unsigned long bytes_written = 0;
3081 +- unsigned int partial;
3082 +-
3083 +- int result = 0;
3084 +- int maxretry;
3085 +- int errn = 0;
3086 +- int intr;
3087 +-
3088 +- intr = mutex_lock_interruptible(&(rio->lock));
3089 +- if (intr)
3090 +- return -EINTR;
3091 +- /* Sanity check to make sure rio is connected, powered, etc */
3092 +- if (rio->present == 0 || rio->rio_dev == NULL) {
3093 +- mutex_unlock(&(rio->lock));
3094 +- return -ENODEV;
3095 +- }
3096 +-
3097 +-
3098 +-
3099 +- do {
3100 +- unsigned long thistime;
3101 +- char *obuf = rio->obuf;
3102 +-
3103 +- thistime = copy_size =
3104 +- (count >= OBUF_SIZE) ? OBUF_SIZE : count;
3105 +- if (copy_from_user(rio->obuf, buffer, copy_size)) {
3106 +- errn = -EFAULT;
3107 +- goto error;
3108 +- }
3109 +- maxretry = 5;
3110 +- while (thistime) {
3111 +- if (!rio->rio_dev) {
3112 +- errn = -ENODEV;
3113 +- goto error;
3114 +- }
3115 +- if (signal_pending(current)) {
3116 +- mutex_unlock(&(rio->lock));
3117 +- return bytes_written ? bytes_written : -EINTR;
3118 +- }
3119 +-
3120 +- result = usb_bulk_msg(rio->rio_dev,
3121 +- usb_sndbulkpipe(rio->rio_dev, 2),
3122 +- obuf, thistime, &partial, 5000);
3123 +-
3124 +- dev_dbg(&rio->rio_dev->dev,
3125 +- "write stats: result:%d thistime:%lu partial:%u\n",
3126 +- result, thistime, partial);
3127 +-
3128 +- if (result == -ETIMEDOUT) { /* NAK - so hold for a while */
3129 +- if (!maxretry--) {
3130 +- errn = -ETIME;
3131 +- goto error;
3132 +- }
3133 +- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE);
3134 +- schedule_timeout(NAK_TIMEOUT);
3135 +- finish_wait(&rio->wait_q, &wait);
3136 +- continue;
3137 +- } else if (!result && partial) {
3138 +- obuf += partial;
3139 +- thistime -= partial;
3140 +- } else
3141 +- break;
3142 +- }
3143 +- if (result) {
3144 +- dev_err(&rio->rio_dev->dev, "Write Whoops - %x\n",
3145 +- result);
3146 +- errn = -EIO;
3147 +- goto error;
3148 +- }
3149 +- bytes_written += copy_size;
3150 +- count -= copy_size;
3151 +- buffer += copy_size;
3152 +- } while (count > 0);
3153 +-
3154 +- mutex_unlock(&(rio->lock));
3155 +-
3156 +- return bytes_written ? bytes_written : -EIO;
3157 +-
3158 +-error:
3159 +- mutex_unlock(&(rio->lock));
3160 +- return errn;
3161 +-}
3162 +-
3163 +-static ssize_t
3164 +-read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos)
3165 +-{
3166 +- DEFINE_WAIT(wait);
3167 +- struct rio_usb_data *rio = &rio_instance;
3168 +- ssize_t read_count;
3169 +- unsigned int partial;
3170 +- int this_read;
3171 +- int result;
3172 +- int maxretry = 10;
3173 +- char *ibuf;
3174 +- int intr;
3175 +-
3176 +- intr = mutex_lock_interruptible(&(rio->lock));
3177 +- if (intr)
3178 +- return -EINTR;
3179 +- /* Sanity check to make sure rio is connected, powered, etc */
3180 +- if (rio->present == 0 || rio->rio_dev == NULL) {
3181 +- mutex_unlock(&(rio->lock));
3182 +- return -ENODEV;
3183 +- }
3184 +-
3185 +- ibuf = rio->ibuf;
3186 +-
3187 +- read_count = 0;
3188 +-
3189 +-
3190 +- while (count > 0) {
3191 +- if (signal_pending(current)) {
3192 +- mutex_unlock(&(rio->lock));
3193 +- return read_count ? read_count : -EINTR;
3194 +- }
3195 +- if (!rio->rio_dev) {
3196 +- mutex_unlock(&(rio->lock));
3197 +- return -ENODEV;
3198 +- }
3199 +- this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count;
3200 +-
3201 +- result = usb_bulk_msg(rio->rio_dev,
3202 +- usb_rcvbulkpipe(rio->rio_dev, 1),
3203 +- ibuf, this_read, &partial,
3204 +- 8000);
3205 +-
3206 +- dev_dbg(&rio->rio_dev->dev,
3207 +- "read stats: result:%d this_read:%u partial:%u\n",
3208 +- result, this_read, partial);
3209 +-
3210 +- if (partial) {
3211 +- count = this_read = partial;
3212 +- } else if (result == -ETIMEDOUT || result == 15) { /* FIXME: 15 ??? */
3213 +- if (!maxretry--) {
3214 +- mutex_unlock(&(rio->lock));
3215 +- dev_err(&rio->rio_dev->dev,
3216 +- "read_rio: maxretry timeout\n");
3217 +- return -ETIME;
3218 +- }
3219 +- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE);
3220 +- schedule_timeout(NAK_TIMEOUT);
3221 +- finish_wait(&rio->wait_q, &wait);
3222 +- continue;
3223 +- } else if (result != -EREMOTEIO) {
3224 +- mutex_unlock(&(rio->lock));
3225 +- dev_err(&rio->rio_dev->dev,
3226 +- "Read Whoops - result:%d partial:%u this_read:%u\n",
3227 +- result, partial, this_read);
3228 +- return -EIO;
3229 +- } else {
3230 +- mutex_unlock(&(rio->lock));
3231 +- return (0);
3232 +- }
3233 +-
3234 +- if (this_read) {
3235 +- if (copy_to_user(buffer, ibuf, this_read)) {
3236 +- mutex_unlock(&(rio->lock));
3237 +- return -EFAULT;
3238 +- }
3239 +- count -= this_read;
3240 +- read_count += this_read;
3241 +- buffer += this_read;
3242 +- }
3243 +- }
3244 +- mutex_unlock(&(rio->lock));
3245 +- return read_count;
3246 +-}
3247 +-
3248 +-static const struct file_operations usb_rio_fops = {
3249 +- .owner = THIS_MODULE,
3250 +- .read = read_rio,
3251 +- .write = write_rio,
3252 +- .unlocked_ioctl = ioctl_rio,
3253 +- .open = open_rio,
3254 +- .release = close_rio,
3255 +- .llseek = noop_llseek,
3256 +-};
3257 +-
3258 +-static struct usb_class_driver usb_rio_class = {
3259 +- .name = "rio500%d",
3260 +- .fops = &usb_rio_fops,
3261 +- .minor_base = RIO_MINOR,
3262 +-};
3263 +-
3264 +-static int probe_rio(struct usb_interface *intf,
3265 +- const struct usb_device_id *id)
3266 +-{
3267 +- struct usb_device *dev = interface_to_usbdev(intf);
3268 +- struct rio_usb_data *rio = &rio_instance;
3269 +- int retval = 0;
3270 +-
3271 +- mutex_lock(&rio500_mutex);
3272 +- if (rio->present) {
3273 +- dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum);
3274 +- retval = -EBUSY;
3275 +- goto bail_out;
3276 +- } else {
3277 +- dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
3278 +- }
3279 +-
3280 +- retval = usb_register_dev(intf, &usb_rio_class);
3281 +- if (retval) {
3282 +- dev_err(&dev->dev,
3283 +- "Not able to get a minor for this device.\n");
3284 +- retval = -ENOMEM;
3285 +- goto bail_out;
3286 +- }
3287 +-
3288 +- rio->rio_dev = dev;
3289 +-
3290 +- if (!(rio->obuf = kmalloc(OBUF_SIZE, GFP_KERNEL))) {
3291 +- dev_err(&dev->dev,
3292 +- "probe_rio: Not enough memory for the output buffer\n");
3293 +- usb_deregister_dev(intf, &usb_rio_class);
3294 +- retval = -ENOMEM;
3295 +- goto bail_out;
3296 +- }
3297 +- dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf);
3298 +-
3299 +- if (!(rio->ibuf = kmalloc(IBUF_SIZE, GFP_KERNEL))) {
3300 +- dev_err(&dev->dev,
3301 +- "probe_rio: Not enough memory for the input buffer\n");
3302 +- usb_deregister_dev(intf, &usb_rio_class);
3303 +- kfree(rio->obuf);
3304 +- retval = -ENOMEM;
3305 +- goto bail_out;
3306 +- }
3307 +- dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
3308 +-
3309 +- mutex_init(&(rio->lock));
3310 +-
3311 +- usb_set_intfdata (intf, rio);
3312 +- rio->present = 1;
3313 +-bail_out:
3314 +- mutex_unlock(&rio500_mutex);
3315 +-
3316 +- return retval;
3317 +-}
3318 +-
3319 +-static void disconnect_rio(struct usb_interface *intf)
3320 +-{
3321 +- struct rio_usb_data *rio = usb_get_intfdata (intf);
3322 +-
3323 +- usb_set_intfdata (intf, NULL);
3324 +- mutex_lock(&rio500_mutex);
3325 +- if (rio) {
3326 +- usb_deregister_dev(intf, &usb_rio_class);
3327 +-
3328 +- mutex_lock(&(rio->lock));
3329 +- if (rio->isopen) {
3330 +- rio->isopen = 0;
3331 +- /* better let it finish - the release will do whats needed */
3332 +- rio->rio_dev = NULL;
3333 +- mutex_unlock(&(rio->lock));
3334 +- mutex_unlock(&rio500_mutex);
3335 +- return;
3336 +- }
3337 +- kfree(rio->ibuf);
3338 +- kfree(rio->obuf);
3339 +-
3340 +- dev_info(&intf->dev, "USB Rio disconnected.\n");
3341 +-
3342 +- rio->present = 0;
3343 +- mutex_unlock(&(rio->lock));
3344 +- }
3345 +- mutex_unlock(&rio500_mutex);
3346 +-}
3347 +-
3348 +-static const struct usb_device_id rio_table[] = {
3349 +- { USB_DEVICE(0x0841, 1) }, /* Rio 500 */
3350 +- { } /* Terminating entry */
3351 +-};
3352 +-
3353 +-MODULE_DEVICE_TABLE (usb, rio_table);
3354 +-
3355 +-static struct usb_driver rio_driver = {
3356 +- .name = "rio500",
3357 +- .probe = probe_rio,
3358 +- .disconnect = disconnect_rio,
3359 +- .id_table = rio_table,
3360 +-};
3361 +-
3362 +-module_usb_driver(rio_driver);
3363 +-
3364 +-MODULE_AUTHOR( DRIVER_AUTHOR );
3365 +-MODULE_DESCRIPTION( DRIVER_DESC );
3366 +-MODULE_LICENSE("GPL");
3367 +-
3368 +diff --git a/drivers/usb/misc/rio500_usb.h b/drivers/usb/misc/rio500_usb.h
3369 +deleted file mode 100644
3370 +index 6db7a5863496..000000000000
3371 +--- a/drivers/usb/misc/rio500_usb.h
3372 ++++ /dev/null
3373 +@@ -1,20 +0,0 @@
3374 +-// SPDX-License-Identifier: GPL-2.0+
3375 +-/* ----------------------------------------------------------------------
3376 +- Copyright (C) 2000 Cesar Miquel (miquel@××××××.ar)
3377 +- ---------------------------------------------------------------------- */
3378 +-
3379 +-#define RIO_SEND_COMMAND 0x1
3380 +-#define RIO_RECV_COMMAND 0x2
3381 +-
3382 +-#define RIO_DIR_OUT 0x0
3383 +-#define RIO_DIR_IN 0x1
3384 +-
3385 +-struct RioCommand {
3386 +- short length;
3387 +- int request;
3388 +- int requesttype;
3389 +- int value;
3390 +- int index;
3391 +- void __user *buffer;
3392 +- int timeout;
3393 +-};
3394 +diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
3395 +index 9ba4a4e68d91..aa982d3ca36b 100644
3396 +--- a/drivers/usb/misc/usblcd.c
3397 ++++ b/drivers/usb/misc/usblcd.c
3398 +@@ -18,6 +18,7 @@
3399 + #include <linux/slab.h>
3400 + #include <linux/errno.h>
3401 + #include <linux/mutex.h>
3402 ++#include <linux/rwsem.h>
3403 + #include <linux/uaccess.h>
3404 + #include <linux/usb.h>
3405 +
3406 +@@ -57,6 +58,8 @@ struct usb_lcd {
3407 + using up all RAM */
3408 + struct usb_anchor submitted; /* URBs to wait for
3409 + before suspend */
3410 ++ struct rw_semaphore io_rwsem;
3411 ++ unsigned long disconnected:1;
3412 + };
3413 + #define to_lcd_dev(d) container_of(d, struct usb_lcd, kref)
3414 +
3415 +@@ -142,6 +145,13 @@ static ssize_t lcd_read(struct file *file, char __user * buffer,
3416 +
3417 + dev = file->private_data;
3418 +
3419 ++ down_read(&dev->io_rwsem);
3420 ++
3421 ++ if (dev->disconnected) {
3422 ++ retval = -ENODEV;
3423 ++ goto out_up_io;
3424 ++ }
3425 ++
3426 + /* do a blocking bulk read to get data from the device */
3427 + retval = usb_bulk_msg(dev->udev,
3428 + usb_rcvbulkpipe(dev->udev,
3429 +@@ -158,6 +168,9 @@ static ssize_t lcd_read(struct file *file, char __user * buffer,
3430 + retval = bytes_read;
3431 + }
3432 +
3433 ++out_up_io:
3434 ++ up_read(&dev->io_rwsem);
3435 ++
3436 + return retval;
3437 + }
3438 +
3439 +@@ -237,11 +250,18 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
3440 + if (r < 0)
3441 + return -EINTR;
3442 +
3443 ++ down_read(&dev->io_rwsem);
3444 ++
3445 ++ if (dev->disconnected) {
3446 ++ retval = -ENODEV;
3447 ++ goto err_up_io;
3448 ++ }
3449 ++
3450 + /* create a urb, and a buffer for it, and copy the data to the urb */
3451 + urb = usb_alloc_urb(0, GFP_KERNEL);
3452 + if (!urb) {
3453 + retval = -ENOMEM;
3454 +- goto err_no_buf;
3455 ++ goto err_up_io;
3456 + }
3457 +
3458 + buf = usb_alloc_coherent(dev->udev, count, GFP_KERNEL,
3459 +@@ -278,6 +298,7 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
3460 + the USB core will eventually free it entirely */
3461 + usb_free_urb(urb);
3462 +
3463 ++ up_read(&dev->io_rwsem);
3464 + exit:
3465 + return count;
3466 + error_unanchor:
3467 +@@ -285,7 +306,8 @@ error_unanchor:
3468 + error:
3469 + usb_free_coherent(dev->udev, count, buf, urb->transfer_dma);
3470 + usb_free_urb(urb);
3471 +-err_no_buf:
3472 ++err_up_io:
3473 ++ up_read(&dev->io_rwsem);
3474 + up(&dev->limit_sem);
3475 + return retval;
3476 + }
3477 +@@ -325,6 +347,7 @@ static int lcd_probe(struct usb_interface *interface,
3478 +
3479 + kref_init(&dev->kref);
3480 + sema_init(&dev->limit_sem, USB_LCD_CONCURRENT_WRITES);
3481 ++ init_rwsem(&dev->io_rwsem);
3482 + init_usb_anchor(&dev->submitted);
3483 +
3484 + dev->udev = usb_get_dev(interface_to_usbdev(interface));
3485 +@@ -422,6 +445,12 @@ static void lcd_disconnect(struct usb_interface *interface)
3486 + /* give back our minor */
3487 + usb_deregister_dev(interface, &lcd_class);
3488 +
3489 ++ down_write(&dev->io_rwsem);
3490 ++ dev->disconnected = 1;
3491 ++ up_write(&dev->io_rwsem);
3492 ++
3493 ++ usb_kill_anchored_urbs(&dev->submitted);
3494 ++
3495 + /* decrement our usage count */
3496 + kref_put(&dev->kref, lcd_delete);
3497 +
3498 +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
3499 +index 6715a128e6c8..be0505b8b5d4 100644
3500 +--- a/drivers/usb/misc/yurex.c
3501 ++++ b/drivers/usb/misc/yurex.c
3502 +@@ -60,6 +60,7 @@ struct usb_yurex {
3503 +
3504 + struct kref kref;
3505 + struct mutex io_mutex;
3506 ++ unsigned long disconnected:1;
3507 + struct fasync_struct *async_queue;
3508 + wait_queue_head_t waitq;
3509 +
3510 +@@ -107,6 +108,7 @@ static void yurex_delete(struct kref *kref)
3511 + dev->int_buffer, dev->urb->transfer_dma);
3512 + usb_free_urb(dev->urb);
3513 + }
3514 ++ usb_put_intf(dev->interface);
3515 + usb_put_dev(dev->udev);
3516 + kfree(dev);
3517 + }
3518 +@@ -132,6 +134,7 @@ static void yurex_interrupt(struct urb *urb)
3519 + switch (status) {
3520 + case 0: /*success*/
3521 + break;
3522 ++ /* The device is terminated or messed up, give up */
3523 + case -EOVERFLOW:
3524 + dev_err(&dev->interface->dev,
3525 + "%s - overflow with length %d, actual length is %d\n",
3526 +@@ -140,12 +143,13 @@ static void yurex_interrupt(struct urb *urb)
3527 + case -ENOENT:
3528 + case -ESHUTDOWN:
3529 + case -EILSEQ:
3530 +- /* The device is terminated, clean up */
3531 ++ case -EPROTO:
3532 ++ case -ETIME:
3533 + return;
3534 + default:
3535 + dev_err(&dev->interface->dev,
3536 + "%s - unknown status received: %d\n", __func__, status);
3537 +- goto exit;
3538 ++ return;
3539 + }
3540 +
3541 + /* handle received message */
3542 +@@ -177,7 +181,6 @@ static void yurex_interrupt(struct urb *urb)
3543 + break;
3544 + }
3545 +
3546 +-exit:
3547 + retval = usb_submit_urb(dev->urb, GFP_ATOMIC);
3548 + if (retval) {
3549 + dev_err(&dev->interface->dev, "%s - usb_submit_urb failed: %d\n",
3550 +@@ -204,7 +207,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
3551 + init_waitqueue_head(&dev->waitq);
3552 +
3553 + dev->udev = usb_get_dev(interface_to_usbdev(interface));
3554 +- dev->interface = interface;
3555 ++ dev->interface = usb_get_intf(interface);
3556 +
3557 + /* set up the endpoint information */
3558 + iface_desc = interface->cur_altsetting;
3559 +@@ -315,8 +318,9 @@ static void yurex_disconnect(struct usb_interface *interface)
3560 +
3561 + /* prevent more I/O from starting */
3562 + usb_poison_urb(dev->urb);
3563 ++ usb_poison_urb(dev->cntl_urb);
3564 + mutex_lock(&dev->io_mutex);
3565 +- dev->interface = NULL;
3566 ++ dev->disconnected = 1;
3567 + mutex_unlock(&dev->io_mutex);
3568 +
3569 + /* wakeup waiters */
3570 +@@ -404,7 +408,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
3571 + dev = file->private_data;
3572 +
3573 + mutex_lock(&dev->io_mutex);
3574 +- if (!dev->interface) { /* already disconnected */
3575 ++ if (dev->disconnected) { /* already disconnected */
3576 + mutex_unlock(&dev->io_mutex);
3577 + return -ENODEV;
3578 + }
3579 +@@ -439,7 +443,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
3580 + goto error;
3581 +
3582 + mutex_lock(&dev->io_mutex);
3583 +- if (!dev->interface) { /* already disconnected */
3584 ++ if (dev->disconnected) { /* already disconnected */
3585 + mutex_unlock(&dev->io_mutex);
3586 + retval = -ENODEV;
3587 + goto error;
3588 +diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h
3589 +index d1a0a35ecfff..0824099b905e 100644
3590 +--- a/drivers/usb/renesas_usbhs/common.h
3591 ++++ b/drivers/usb/renesas_usbhs/common.h
3592 +@@ -211,6 +211,7 @@ struct usbhs_priv;
3593 + /* DCPCTR */
3594 + #define BSTS (1 << 15) /* Buffer Status */
3595 + #define SUREQ (1 << 14) /* Sending SETUP Token */
3596 ++#define INBUFM (1 << 14) /* (PIPEnCTR) Transfer Buffer Monitor */
3597 + #define CSSTS (1 << 12) /* CSSTS Status */
3598 + #define ACLRM (1 << 9) /* Buffer Auto-Clear Mode */
3599 + #define SQCLR (1 << 8) /* Toggle Bit Clear */
3600 +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
3601 +index 2a01ceb71641..86637cd066cf 100644
3602 +--- a/drivers/usb/renesas_usbhs/fifo.c
3603 ++++ b/drivers/usb/renesas_usbhs/fifo.c
3604 +@@ -89,7 +89,7 @@ static void __usbhsf_pkt_del(struct usbhs_pkt *pkt)
3605 + list_del_init(&pkt->node);
3606 + }
3607 +
3608 +-static struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
3609 ++struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
3610 + {
3611 + return list_first_entry_or_null(&pipe->list, struct usbhs_pkt, node);
3612 + }
3613 +diff --git a/drivers/usb/renesas_usbhs/fifo.h b/drivers/usb/renesas_usbhs/fifo.h
3614 +index 88d1816bcda2..c3d3cc35cee0 100644
3615 +--- a/drivers/usb/renesas_usbhs/fifo.h
3616 ++++ b/drivers/usb/renesas_usbhs/fifo.h
3617 +@@ -97,5 +97,6 @@ void usbhs_pkt_push(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt,
3618 + void *buf, int len, int zero, int sequence);
3619 + struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt);
3620 + void usbhs_pkt_start(struct usbhs_pipe *pipe);
3621 ++struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe);
3622 +
3623 + #endif /* RENESAS_USB_FIFO_H */
3624 +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
3625 +index 4d571a5205e2..e5ef56991dba 100644
3626 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c
3627 ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
3628 +@@ -722,8 +722,7 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
3629 + struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
3630 + struct device *dev = usbhsg_gpriv_to_dev(gpriv);
3631 + unsigned long flags;
3632 +-
3633 +- usbhsg_pipe_disable(uep);
3634 ++ int ret = 0;
3635 +
3636 + dev_dbg(dev, "set halt %d (pipe %d)\n",
3637 + halt, usbhs_pipe_number(pipe));
3638 +@@ -731,6 +730,18 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
3639 + /******************** spin lock ********************/
3640 + usbhs_lock(priv, flags);
3641 +
3642 ++ /*
3643 ++ * According to usb_ep_set_halt()'s description, this function should
3644 ++ * return -EAGAIN if the IN endpoint has any queue or data. Note
3645 ++ * that the usbhs_pipe_is_dir_in() returns false if the pipe is an
3646 ++ * IN endpoint in the gadget mode.
3647 ++ */
3648 ++ if (!usbhs_pipe_is_dir_in(pipe) && (__usbhsf_pkt_get(pipe) ||
3649 ++ usbhs_pipe_contains_transmittable_data(pipe))) {
3650 ++ ret = -EAGAIN;
3651 ++ goto out;
3652 ++ }
3653 ++
3654 + if (halt)
3655 + usbhs_pipe_stall(pipe);
3656 + else
3657 +@@ -741,10 +752,11 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
3658 + else
3659 + usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE);
3660 +
3661 ++out:
3662 + usbhs_unlock(priv, flags);
3663 + /******************** spin unlock ******************/
3664 +
3665 +- return 0;
3666 ++ return ret;
3667 + }
3668 +
3669 + static int usbhsg_ep_set_halt(struct usb_ep *ep, int value)
3670 +diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c
3671 +index c4922b96c93b..9e5afdde1adb 100644
3672 +--- a/drivers/usb/renesas_usbhs/pipe.c
3673 ++++ b/drivers/usb/renesas_usbhs/pipe.c
3674 +@@ -277,6 +277,21 @@ int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe)
3675 + return -EBUSY;
3676 + }
3677 +
3678 ++bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe)
3679 ++{
3680 ++ u16 val;
3681 ++
3682 ++ /* Do not support for DCP pipe */
3683 ++ if (usbhs_pipe_is_dcp(pipe))
3684 ++ return false;
3685 ++
3686 ++ val = usbhsp_pipectrl_get(pipe);
3687 ++ if (val & INBUFM)
3688 ++ return true;
3689 ++
3690 ++ return false;
3691 ++}
3692 ++
3693 + /*
3694 + * PID ctrl
3695 + */
3696 +diff --git a/drivers/usb/renesas_usbhs/pipe.h b/drivers/usb/renesas_usbhs/pipe.h
3697 +index 3080423e600c..3b130529408b 100644
3698 +--- a/drivers/usb/renesas_usbhs/pipe.h
3699 ++++ b/drivers/usb/renesas_usbhs/pipe.h
3700 +@@ -83,6 +83,7 @@ void usbhs_pipe_clear(struct usbhs_pipe *pipe);
3701 + void usbhs_pipe_clear_without_sequence(struct usbhs_pipe *pipe,
3702 + int needs_bfre, int bfre_enable);
3703 + int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe);
3704 ++bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe);
3705 + void usbhs_pipe_enable(struct usbhs_pipe *pipe);
3706 + void usbhs_pipe_disable(struct usbhs_pipe *pipe);
3707 + void usbhs_pipe_stall(struct usbhs_pipe *pipe);
3708 +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
3709 +index 4b3a049561f3..e25352932ba7 100644
3710 +--- a/drivers/usb/serial/ftdi_sio.c
3711 ++++ b/drivers/usb/serial/ftdi_sio.c
3712 +@@ -1030,6 +1030,9 @@ static const struct usb_device_id id_table_combined[] = {
3713 + /* EZPrototypes devices */
3714 + { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) },
3715 + { USB_DEVICE_INTERFACE_NUMBER(UNJO_VID, UNJO_ISODEBUG_V1_PID, 1) },
3716 ++ /* Sienna devices */
3717 ++ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
3718 ++ { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
3719 + { } /* Terminating entry */
3720 + };
3721 +
3722 +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
3723 +index f12d806220b4..22d66217cb41 100644
3724 +--- a/drivers/usb/serial/ftdi_sio_ids.h
3725 ++++ b/drivers/usb/serial/ftdi_sio_ids.h
3726 +@@ -39,6 +39,9 @@
3727 +
3728 + #define FTDI_LUMEL_PD12_PID 0x6002
3729 +
3730 ++/* Sienna Serial Interface by Secyourit GmbH */
3731 ++#define FTDI_SIENNA_PID 0x8348
3732 ++
3733 + /* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
3734 + #define CYBER_CORTEX_AV_PID 0x8698
3735 +
3736 +@@ -688,6 +691,12 @@
3737 + #define BANDB_TTL3USB9M_PID 0xAC50
3738 + #define BANDB_ZZ_PROG1_USB_PID 0xBA02
3739 +
3740 ++/*
3741 ++ * Echelon USB Serial Interface
3742 ++ */
3743 ++#define ECHELON_VID 0x0920
3744 ++#define ECHELON_U20_PID 0x7500
3745 ++
3746 + /*
3747 + * Intrepid Control Systems (http://www.intrepidcs.com/) ValueCAN and NeoVI
3748 + */
3749 +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
3750 +index d34779fe4a8d..e66a59ef43a1 100644
3751 +--- a/drivers/usb/serial/keyspan.c
3752 ++++ b/drivers/usb/serial/keyspan.c
3753 +@@ -1741,8 +1741,8 @@ static struct urb *keyspan_setup_urb(struct usb_serial *serial, int endpoint,
3754 +
3755 + ep_desc = find_ep(serial, endpoint);
3756 + if (!ep_desc) {
3757 +- /* leak the urb, something's wrong and the callers don't care */
3758 +- return urb;
3759 ++ usb_free_urb(urb);
3760 ++ return NULL;
3761 + }
3762 + if (usb_endpoint_xfer_int(ep_desc)) {
3763 + ep_type_name = "INT";
3764 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
3765 +index 38e920ac7f82..06ab016be0b6 100644
3766 +--- a/drivers/usb/serial/option.c
3767 ++++ b/drivers/usb/serial/option.c
3768 +@@ -419,6 +419,7 @@ static void option_instat_callback(struct urb *urb);
3769 + #define CINTERION_PRODUCT_PH8_AUDIO 0x0083
3770 + #define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
3771 + #define CINTERION_PRODUCT_AHXX_AUDIO 0x0085
3772 ++#define CINTERION_PRODUCT_CLS8 0x00b0
3773 +
3774 + /* Olivetti products */
3775 + #define OLIVETTI_VENDOR_ID 0x0b3c
3776 +@@ -1154,6 +1155,14 @@ static const struct usb_device_id option_ids[] = {
3777 + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
3778 + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
3779 + .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) },
3780 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1050, 0xff), /* Telit FN980 (rmnet) */
3781 ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
3782 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1051, 0xff), /* Telit FN980 (MBIM) */
3783 ++ .driver_info = NCTRL(0) | RSVD(1) },
3784 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1052, 0xff), /* Telit FN980 (RNDIS) */
3785 ++ .driver_info = NCTRL(2) | RSVD(3) },
3786 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */
3787 ++ .driver_info = NCTRL(0) | RSVD(1) },
3788 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
3789 + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
3790 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
3791 +@@ -1847,6 +1856,8 @@ static const struct usb_device_id option_ids[] = {
3792 + .driver_info = RSVD(4) },
3793 + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) },
3794 + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
3795 ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff),
3796 ++ .driver_info = RSVD(0) | RSVD(4) },
3797 + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
3798 + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
3799 + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
3800 +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
3801 +index a3179fea38c8..8f066bb55d7d 100644
3802 +--- a/drivers/usb/serial/usb-serial.c
3803 ++++ b/drivers/usb/serial/usb-serial.c
3804 +@@ -314,10 +314,7 @@ static void serial_cleanup(struct tty_struct *tty)
3805 + serial = port->serial;
3806 + owner = serial->type->driver.owner;
3807 +
3808 +- mutex_lock(&serial->disc_mutex);
3809 +- if (!serial->disconnected)
3810 +- usb_autopm_put_interface(serial->interface);
3811 +- mutex_unlock(&serial->disc_mutex);
3812 ++ usb_autopm_put_interface(serial->interface);
3813 +
3814 + usb_serial_put(serial);
3815 + module_put(owner);
3816 +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
3817 +index bcfdb55fd198..a3cf27120164 100644
3818 +--- a/drivers/usb/typec/tcpm/tcpm.c
3819 ++++ b/drivers/usb/typec/tcpm/tcpm.c
3820 +@@ -4416,18 +4416,20 @@ static int tcpm_fw_get_caps(struct tcpm_port *port,
3821 + /* USB data support is optional */
3822 + ret = fwnode_property_read_string(fwnode, "data-role", &cap_str);
3823 + if (ret == 0) {
3824 +- port->typec_caps.data = typec_find_port_data_role(cap_str);
3825 +- if (port->typec_caps.data < 0)
3826 +- return -EINVAL;
3827 ++ ret = typec_find_port_data_role(cap_str);
3828 ++ if (ret < 0)
3829 ++ return ret;
3830 ++ port->typec_caps.data = ret;
3831 + }
3832 +
3833 + ret = fwnode_property_read_string(fwnode, "power-role", &cap_str);
3834 + if (ret < 0)
3835 + return ret;
3836 +
3837 +- port->typec_caps.type = typec_find_port_power_role(cap_str);
3838 +- if (port->typec_caps.type < 0)
3839 +- return -EINVAL;
3840 ++ ret = typec_find_port_power_role(cap_str);
3841 ++ if (ret < 0)
3842 ++ return ret;
3843 ++ port->typec_caps.type = ret;
3844 + port->port_type = port->typec_caps.type;
3845 +
3846 + if (port->port_type == TYPEC_PORT_SNK)
3847 +diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c
3848 +index 6c103697c582..d99700cb4dca 100644
3849 +--- a/drivers/usb/typec/ucsi/displayport.c
3850 ++++ b/drivers/usb/typec/ucsi/displayport.c
3851 +@@ -75,6 +75,8 @@ static int ucsi_displayport_enter(struct typec_altmode *alt)
3852 +
3853 + if (cur != 0xff) {
3854 + mutex_unlock(&dp->con->lock);
3855 ++ if (dp->con->port_altmode[cur] == alt)
3856 ++ return 0;
3857 + return -EBUSY;
3858 + }
3859 +
3860 +diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
3861 +index 8e9f8fba55af..95378d8f7e4e 100644
3862 +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
3863 ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
3864 +@@ -195,7 +195,6 @@ struct ucsi_ccg {
3865 +
3866 + /* fw build with vendor information */
3867 + u16 fw_build;
3868 +- bool run_isr; /* flag to call ISR routine during resume */
3869 + struct work_struct pm_work;
3870 + };
3871 +
3872 +@@ -224,18 +223,6 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
3873 + if (quirks && quirks->max_read_len)
3874 + max_read_len = quirks->max_read_len;
3875 +
3876 +- if (uc->fw_build == CCG_FW_BUILD_NVIDIA &&
3877 +- uc->fw_version <= CCG_OLD_FW_VERSION) {
3878 +- mutex_lock(&uc->lock);
3879 +- /*
3880 +- * Do not schedule pm_work to run ISR in
3881 +- * ucsi_ccg_runtime_resume() after pm_runtime_get_sync()
3882 +- * since we are already in ISR path.
3883 +- */
3884 +- uc->run_isr = false;
3885 +- mutex_unlock(&uc->lock);
3886 +- }
3887 +-
3888 + pm_runtime_get_sync(uc->dev);
3889 + while (rem_len > 0) {
3890 + msgs[1].buf = &data[len - rem_len];
3891 +@@ -278,18 +265,6 @@ static int ccg_write(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
3892 + msgs[0].len = len + sizeof(rab);
3893 + msgs[0].buf = buf;
3894 +
3895 +- if (uc->fw_build == CCG_FW_BUILD_NVIDIA &&
3896 +- uc->fw_version <= CCG_OLD_FW_VERSION) {
3897 +- mutex_lock(&uc->lock);
3898 +- /*
3899 +- * Do not schedule pm_work to run ISR in
3900 +- * ucsi_ccg_runtime_resume() after pm_runtime_get_sync()
3901 +- * since we are already in ISR path.
3902 +- */
3903 +- uc->run_isr = false;
3904 +- mutex_unlock(&uc->lock);
3905 +- }
3906 +-
3907 + pm_runtime_get_sync(uc->dev);
3908 + status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
3909 + if (status < 0) {
3910 +@@ -1133,7 +1108,6 @@ static int ucsi_ccg_probe(struct i2c_client *client,
3911 + uc->ppm.sync = ucsi_ccg_sync;
3912 + uc->dev = dev;
3913 + uc->client = client;
3914 +- uc->run_isr = true;
3915 + mutex_init(&uc->lock);
3916 + INIT_WORK(&uc->work, ccg_update_firmware);
3917 + INIT_WORK(&uc->pm_work, ccg_pm_workaround_work);
3918 +@@ -1195,6 +1169,8 @@ static int ucsi_ccg_probe(struct i2c_client *client,
3919 +
3920 + pm_runtime_set_active(uc->dev);
3921 + pm_runtime_enable(uc->dev);
3922 ++ pm_runtime_use_autosuspend(uc->dev);
3923 ++ pm_runtime_set_autosuspend_delay(uc->dev, 5000);
3924 + pm_runtime_idle(uc->dev);
3925 +
3926 + return 0;
3927 +@@ -1237,7 +1213,6 @@ static int ucsi_ccg_runtime_resume(struct device *dev)
3928 + {
3929 + struct i2c_client *client = to_i2c_client(dev);
3930 + struct ucsi_ccg *uc = i2c_get_clientdata(client);
3931 +- bool schedule = true;
3932 +
3933 + /*
3934 + * Firmware version 3.1.10 or earlier, built for NVIDIA has known issue
3935 +@@ -1245,17 +1220,8 @@ static int ucsi_ccg_runtime_resume(struct device *dev)
3936 + * Schedule a work to call ISR as a workaround.
3937 + */
3938 + if (uc->fw_build == CCG_FW_BUILD_NVIDIA &&
3939 +- uc->fw_version <= CCG_OLD_FW_VERSION) {
3940 +- mutex_lock(&uc->lock);
3941 +- if (!uc->run_isr) {
3942 +- uc->run_isr = true;
3943 +- schedule = false;
3944 +- }
3945 +- mutex_unlock(&uc->lock);
3946 +-
3947 +- if (schedule)
3948 +- schedule_work(&uc->pm_work);
3949 +- }
3950 ++ uc->fw_version <= CCG_OLD_FW_VERSION)
3951 ++ schedule_work(&uc->pm_work);
3952 +
3953 + return 0;
3954 + }
3955 +diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
3956 +index f101347e3ea3..e0cf11f798c5 100644
3957 +--- a/drivers/usb/usb-skeleton.c
3958 ++++ b/drivers/usb/usb-skeleton.c
3959 +@@ -59,6 +59,7 @@ struct usb_skel {
3960 + spinlock_t err_lock; /* lock for errors */
3961 + struct kref kref;
3962 + struct mutex io_mutex; /* synchronize I/O with disconnect */
3963 ++ unsigned long disconnected:1;
3964 + wait_queue_head_t bulk_in_wait; /* to wait for an ongoing read */
3965 + };
3966 + #define to_skel_dev(d) container_of(d, struct usb_skel, kref)
3967 +@@ -71,6 +72,7 @@ static void skel_delete(struct kref *kref)
3968 + struct usb_skel *dev = to_skel_dev(kref);
3969 +
3970 + usb_free_urb(dev->bulk_in_urb);
3971 ++ usb_put_intf(dev->interface);
3972 + usb_put_dev(dev->udev);
3973 + kfree(dev->bulk_in_buffer);
3974 + kfree(dev);
3975 +@@ -122,10 +124,7 @@ static int skel_release(struct inode *inode, struct file *file)
3976 + return -ENODEV;
3977 +
3978 + /* allow the device to be autosuspended */
3979 +- mutex_lock(&dev->io_mutex);
3980 +- if (dev->interface)
3981 +- usb_autopm_put_interface(dev->interface);
3982 +- mutex_unlock(&dev->io_mutex);
3983 ++ usb_autopm_put_interface(dev->interface);
3984 +
3985 + /* decrement the count on our device */
3986 + kref_put(&dev->kref, skel_delete);
3987 +@@ -238,7 +237,7 @@ static ssize_t skel_read(struct file *file, char *buffer, size_t count,
3988 + if (rv < 0)
3989 + return rv;
3990 +
3991 +- if (!dev->interface) { /* disconnect() was called */
3992 ++ if (dev->disconnected) { /* disconnect() was called */
3993 + rv = -ENODEV;
3994 + goto exit;
3995 + }
3996 +@@ -420,7 +419,7 @@ static ssize_t skel_write(struct file *file, const char *user_buffer,
3997 +
3998 + /* this lock makes sure we don't submit URBs to gone devices */
3999 + mutex_lock(&dev->io_mutex);
4000 +- if (!dev->interface) { /* disconnect() was called */
4001 ++ if (dev->disconnected) { /* disconnect() was called */
4002 + mutex_unlock(&dev->io_mutex);
4003 + retval = -ENODEV;
4004 + goto error;
4005 +@@ -505,7 +504,7 @@ static int skel_probe(struct usb_interface *interface,
4006 + init_waitqueue_head(&dev->bulk_in_wait);
4007 +
4008 + dev->udev = usb_get_dev(interface_to_usbdev(interface));
4009 +- dev->interface = interface;
4010 ++ dev->interface = usb_get_intf(interface);
4011 +
4012 + /* set up the endpoint information */
4013 + /* use only the first bulk-in and bulk-out endpoints */
4014 +@@ -571,7 +570,7 @@ static void skel_disconnect(struct usb_interface *interface)
4015 +
4016 + /* prevent more I/O from starting */
4017 + mutex_lock(&dev->io_mutex);
4018 +- dev->interface = NULL;
4019 ++ dev->disconnected = 1;
4020 + mutex_unlock(&dev->io_mutex);
4021 +
4022 + usb_kill_anchored_urbs(&dev->submitted);
4023 +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
4024 +index 58a18ed11546..abcda051eee2 100644
4025 +--- a/fs/btrfs/file.c
4026 ++++ b/fs/btrfs/file.c
4027 +@@ -1591,7 +1591,6 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
4028 + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
4029 + struct btrfs_root *root = BTRFS_I(inode)->root;
4030 + struct page **pages = NULL;
4031 +- struct extent_state *cached_state = NULL;
4032 + struct extent_changeset *data_reserved = NULL;
4033 + u64 release_bytes = 0;
4034 + u64 lockstart;
4035 +@@ -1611,6 +1610,7 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
4036 + return -ENOMEM;
4037 +
4038 + while (iov_iter_count(i) > 0) {
4039 ++ struct extent_state *cached_state = NULL;
4040 + size_t offset = offset_in_page(pos);
4041 + size_t sector_offset;
4042 + size_t write_bytes = min(iov_iter_count(i),
4043 +@@ -1758,9 +1758,20 @@ again:
4044 + if (copied > 0)
4045 + ret = btrfs_dirty_pages(inode, pages, dirty_pages,
4046 + pos, copied, &cached_state);
4047 ++
4048 ++ /*
4049 ++ * If we have not locked the extent range, because the range's
4050 ++ * start offset is >= i_size, we might still have a non-NULL
4051 ++ * cached extent state, acquired while marking the extent range
4052 ++ * as delalloc through btrfs_dirty_pages(). Therefore free any
4053 ++ * possible cached extent state to avoid a memory leak.
4054 ++ */
4055 + if (extents_locked)
4056 + unlock_extent_cached(&BTRFS_I(inode)->io_tree,
4057 + lockstart, lockend, &cached_state);
4058 ++ else
4059 ++ free_extent_state(cached_state);
4060 ++
4061 + btrfs_delalloc_release_extents(BTRFS_I(inode), reserve_bytes,
4062 + true);
4063 + if (ret) {
4064 +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
4065 +index d51d9466feb0..b3453adb214d 100644
4066 +--- a/fs/btrfs/inode.c
4067 ++++ b/fs/btrfs/inode.c
4068 +@@ -6276,13 +6276,16 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
4069 + u32 sizes[2];
4070 + int nitems = name ? 2 : 1;
4071 + unsigned long ptr;
4072 ++ unsigned int nofs_flag;
4073 + int ret;
4074 +
4075 + path = btrfs_alloc_path();
4076 + if (!path)
4077 + return ERR_PTR(-ENOMEM);
4078 +
4079 ++ nofs_flag = memalloc_nofs_save();
4080 + inode = new_inode(fs_info->sb);
4081 ++ memalloc_nofs_restore(nofs_flag);
4082 + if (!inode) {
4083 + btrfs_free_path(path);
4084 + return ERR_PTR(-ENOMEM);
4085 +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
4086 +index e87cbdad02a3..b57f3618e58e 100644
4087 +--- a/fs/btrfs/ref-verify.c
4088 ++++ b/fs/btrfs/ref-verify.c
4089 +@@ -500,7 +500,7 @@ static int process_leaf(struct btrfs_root *root,
4090 + struct btrfs_extent_data_ref *dref;
4091 + struct btrfs_shared_data_ref *sref;
4092 + u32 count;
4093 +- int i = 0, tree_block_level = 0, ret;
4094 ++ int i = 0, tree_block_level = 0, ret = 0;
4095 + struct btrfs_key key;
4096 + int nritems = btrfs_header_nritems(leaf);
4097 +
4098 +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
4099 +index 7f219851fa23..fbd66c33dd63 100644
4100 +--- a/fs/btrfs/relocation.c
4101 ++++ b/fs/btrfs/relocation.c
4102 +@@ -1434,6 +1434,13 @@ int btrfs_init_reloc_root(struct btrfs_trans_handle *trans,
4103 + int clear_rsv = 0;
4104 + int ret;
4105 +
4106 ++ /*
4107 ++ * The subvolume has reloc tree but the swap is finished, no need to
4108 ++ * create/update the dead reloc tree
4109 ++ */
4110 ++ if (test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state))
4111 ++ return 0;
4112 ++
4113 + if (root->reloc_root) {
4114 + reloc_root = root->reloc_root;
4115 + reloc_root->last_trans = trans->transid;
4116 +@@ -2186,7 +2193,6 @@ static int clean_dirty_subvols(struct reloc_control *rc)
4117 + /* Merged subvolume, cleanup its reloc root */
4118 + struct btrfs_root *reloc_root = root->reloc_root;
4119 +
4120 +- clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state);
4121 + list_del_init(&root->reloc_dirty_list);
4122 + root->reloc_root = NULL;
4123 + if (reloc_root) {
4124 +@@ -2195,6 +2201,7 @@ static int clean_dirty_subvols(struct reloc_control *rc)
4125 + if (ret2 < 0 && !ret)
4126 + ret = ret2;
4127 + }
4128 ++ clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state);
4129 + btrfs_put_fs_root(root);
4130 + } else {
4131 + /* Orphan reloc tree, just clean it up */
4132 +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
4133 +index 1bfd7e34f31e..c6bafb8b5f42 100644
4134 +--- a/fs/btrfs/tree-log.c
4135 ++++ b/fs/btrfs/tree-log.c
4136 +@@ -2932,7 +2932,8 @@ out:
4137 + * in the tree of log roots
4138 + */
4139 + static int update_log_root(struct btrfs_trans_handle *trans,
4140 +- struct btrfs_root *log)
4141 ++ struct btrfs_root *log,
4142 ++ struct btrfs_root_item *root_item)
4143 + {
4144 + struct btrfs_fs_info *fs_info = log->fs_info;
4145 + int ret;
4146 +@@ -2940,10 +2941,10 @@ static int update_log_root(struct btrfs_trans_handle *trans,
4147 + if (log->log_transid == 1) {
4148 + /* insert root item on the first sync */
4149 + ret = btrfs_insert_root(trans, fs_info->log_root_tree,
4150 +- &log->root_key, &log->root_item);
4151 ++ &log->root_key, root_item);
4152 + } else {
4153 + ret = btrfs_update_root(trans, fs_info->log_root_tree,
4154 +- &log->root_key, &log->root_item);
4155 ++ &log->root_key, root_item);
4156 + }
4157 + return ret;
4158 + }
4159 +@@ -3041,6 +3042,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
4160 + struct btrfs_fs_info *fs_info = root->fs_info;
4161 + struct btrfs_root *log = root->log_root;
4162 + struct btrfs_root *log_root_tree = fs_info->log_root_tree;
4163 ++ struct btrfs_root_item new_root_item;
4164 + int log_transid = 0;
4165 + struct btrfs_log_ctx root_log_ctx;
4166 + struct blk_plug plug;
4167 +@@ -3104,17 +3106,25 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
4168 + goto out;
4169 + }
4170 +
4171 ++ /*
4172 ++ * We _must_ update under the root->log_mutex in order to make sure we
4173 ++ * have a consistent view of the log root we are trying to commit at
4174 ++ * this moment.
4175 ++ *
4176 ++ * We _must_ copy this into a local copy, because we are not holding the
4177 ++ * log_root_tree->log_mutex yet. This is important because when we
4178 ++ * commit the log_root_tree we must have a consistent view of the
4179 ++ * log_root_tree when we update the super block to point at the
4180 ++ * log_root_tree bytenr. If we update the log_root_tree here we'll race
4181 ++ * with the commit and possibly point at the new block which we may not
4182 ++ * have written out.
4183 ++ */
4184 + btrfs_set_root_node(&log->root_item, log->node);
4185 ++ memcpy(&new_root_item, &log->root_item, sizeof(new_root_item));
4186 +
4187 + root->log_transid++;
4188 + log->log_transid = root->log_transid;
4189 + root->log_start_pid = 0;
4190 +- /*
4191 +- * Update or create log root item under the root's log_mutex to prevent
4192 +- * races with concurrent log syncs that can lead to failure to update
4193 +- * log root item because it was not created yet.
4194 +- */
4195 +- ret = update_log_root(trans, log);
4196 + /*
4197 + * IO has been started, blocks of the log tree have WRITTEN flag set
4198 + * in their headers. new modifications of the log will be written to
4199 +@@ -3135,6 +3145,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
4200 + mutex_unlock(&log_root_tree->log_mutex);
4201 +
4202 + mutex_lock(&log_root_tree->log_mutex);
4203 ++
4204 ++ /*
4205 ++ * Now we are safe to update the log_root_tree because we're under the
4206 ++ * log_mutex, and we're a current writer so we're holding the commit
4207 ++ * open until we drop the log_mutex.
4208 ++ */
4209 ++ ret = update_log_root(trans, log, &new_root_item);
4210 ++
4211 + if (atomic_dec_and_test(&log_root_tree->log_writers)) {
4212 + /* atomic_dec_and_test implies a barrier */
4213 + cond_wake_up_nomb(&log_root_tree->log_writer_wait);
4214 +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
4215 +index e821a0e97cd8..9c057609eaec 100644
4216 +--- a/fs/btrfs/volumes.c
4217 ++++ b/fs/btrfs/volumes.c
4218 +@@ -3854,7 +3854,11 @@ static int alloc_profile_is_valid(u64 flags, int extended)
4219 + return !extended; /* "0" is valid for usual profiles */
4220 +
4221 + /* true if exactly one bit set */
4222 +- return is_power_of_2(flags);
4223 ++ /*
4224 ++ * Don't use is_power_of_2(unsigned long) because it won't work
4225 ++ * for the single profile (1ULL << 48) on 32-bit CPUs.
4226 ++ */
4227 ++ return flags != 0 && (flags & (flags - 1)) == 0;
4228 + }
4229 +
4230 + static inline int balance_need_close(struct btrfs_fs_info *fs_info)
4231 +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
4232 +index be424e81e3ad..1cc1f298e01a 100644
4233 +--- a/fs/cifs/dir.c
4234 ++++ b/fs/cifs/dir.c
4235 +@@ -738,10 +738,16 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
4236 + static int
4237 + cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
4238 + {
4239 ++ struct inode *inode;
4240 ++
4241 + if (flags & LOOKUP_RCU)
4242 + return -ECHILD;
4243 +
4244 + if (d_really_is_positive(direntry)) {
4245 ++ inode = d_inode(direntry);
4246 ++ if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode)))
4247 ++ CIFS_I(inode)->time = 0; /* force reval */
4248 ++
4249 + if (cifs_revalidate_dentry(direntry))
4250 + return 0;
4251 + else {
4252 +@@ -752,7 +758,7 @@ cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
4253 + * attributes will have been updated by
4254 + * cifs_revalidate_dentry().
4255 + */
4256 +- if (IS_AUTOMOUNT(d_inode(direntry)) &&
4257 ++ if (IS_AUTOMOUNT(inode) &&
4258 + !(direntry->d_flags & DCACHE_NEED_AUTOMOUNT)) {
4259 + spin_lock(&direntry->d_lock);
4260 + direntry->d_flags |= DCACHE_NEED_AUTOMOUNT;
4261 +diff --git a/fs/cifs/file.c b/fs/cifs/file.c
4262 +index 97090693d182..4c1aeb2cf7f5 100644
4263 +--- a/fs/cifs/file.c
4264 ++++ b/fs/cifs/file.c
4265 +@@ -253,6 +253,12 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
4266 + rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
4267 + xid, fid);
4268 +
4269 ++ if (rc) {
4270 ++ server->ops->close(xid, tcon, fid);
4271 ++ if (rc == -ESTALE)
4272 ++ rc = -EOPENSTALE;
4273 ++ }
4274 ++
4275 + out:
4276 + kfree(buf);
4277 + return rc;
4278 +@@ -1847,13 +1853,12 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
4279 + {
4280 + struct cifsFileInfo *open_file = NULL;
4281 + struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
4282 +- struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
4283 +
4284 + /* only filter by fsuid on multiuser mounts */
4285 + if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
4286 + fsuid_only = false;
4287 +
4288 +- spin_lock(&tcon->open_file_lock);
4289 ++ spin_lock(&cifs_inode->open_file_lock);
4290 + /* we could simply get the first_list_entry since write-only entries
4291 + are always at the end of the list but since the first entry might
4292 + have a close pending, we go through the whole list */
4293 +@@ -1865,7 +1870,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
4294 + /* found a good file */
4295 + /* lock it so it will not be closed on us */
4296 + cifsFileInfo_get(open_file);
4297 +- spin_unlock(&tcon->open_file_lock);
4298 ++ spin_unlock(&cifs_inode->open_file_lock);
4299 + return open_file;
4300 + } /* else might as well continue, and look for
4301 + another, or simply have the caller reopen it
4302 +@@ -1873,7 +1878,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
4303 + } else /* write only file */
4304 + break; /* write only files are last so must be done */
4305 + }
4306 +- spin_unlock(&tcon->open_file_lock);
4307 ++ spin_unlock(&cifs_inode->open_file_lock);
4308 + return NULL;
4309 + }
4310 +
4311 +@@ -1884,7 +1889,6 @@ cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, bool fsuid_only,
4312 + {
4313 + struct cifsFileInfo *open_file, *inv_file = NULL;
4314 + struct cifs_sb_info *cifs_sb;
4315 +- struct cifs_tcon *tcon;
4316 + bool any_available = false;
4317 + int rc = -EBADF;
4318 + unsigned int refind = 0;
4319 +@@ -1904,16 +1908,15 @@ cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, bool fsuid_only,
4320 + }
4321 +
4322 + cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
4323 +- tcon = cifs_sb_master_tcon(cifs_sb);
4324 +
4325 + /* only filter by fsuid on multiuser mounts */
4326 + if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
4327 + fsuid_only = false;
4328 +
4329 +- spin_lock(&tcon->open_file_lock);
4330 ++ spin_lock(&cifs_inode->open_file_lock);
4331 + refind_writable:
4332 + if (refind > MAX_REOPEN_ATT) {
4333 +- spin_unlock(&tcon->open_file_lock);
4334 ++ spin_unlock(&cifs_inode->open_file_lock);
4335 + return rc;
4336 + }
4337 + list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
4338 +@@ -1925,7 +1928,7 @@ refind_writable:
4339 + if (!open_file->invalidHandle) {
4340 + /* found a good writable file */
4341 + cifsFileInfo_get(open_file);
4342 +- spin_unlock(&tcon->open_file_lock);
4343 ++ spin_unlock(&cifs_inode->open_file_lock);
4344 + *ret_file = open_file;
4345 + return 0;
4346 + } else {
4347 +@@ -1945,7 +1948,7 @@ refind_writable:
4348 + cifsFileInfo_get(inv_file);
4349 + }
4350 +
4351 +- spin_unlock(&tcon->open_file_lock);
4352 ++ spin_unlock(&cifs_inode->open_file_lock);
4353 +
4354 + if (inv_file) {
4355 + rc = cifs_reopen_file(inv_file, false);
4356 +@@ -1960,7 +1963,7 @@ refind_writable:
4357 + cifsFileInfo_put(inv_file);
4358 + ++refind;
4359 + inv_file = NULL;
4360 +- spin_lock(&tcon->open_file_lock);
4361 ++ spin_lock(&cifs_inode->open_file_lock);
4362 + goto refind_writable;
4363 + }
4364 +
4365 +@@ -4399,17 +4402,15 @@ static int cifs_readpage(struct file *file, struct page *page)
4366 + static int is_inode_writable(struct cifsInodeInfo *cifs_inode)
4367 + {
4368 + struct cifsFileInfo *open_file;
4369 +- struct cifs_tcon *tcon =
4370 +- cifs_sb_master_tcon(CIFS_SB(cifs_inode->vfs_inode.i_sb));
4371 +
4372 +- spin_lock(&tcon->open_file_lock);
4373 ++ spin_lock(&cifs_inode->open_file_lock);
4374 + list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
4375 + if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
4376 +- spin_unlock(&tcon->open_file_lock);
4377 ++ spin_unlock(&cifs_inode->open_file_lock);
4378 + return 1;
4379 + }
4380 + }
4381 +- spin_unlock(&tcon->open_file_lock);
4382 ++ spin_unlock(&cifs_inode->open_file_lock);
4383 + return 0;
4384 + }
4385 +
4386 +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
4387 +index 56ca4b8ccaba..79d9a60f21ba 100644
4388 +--- a/fs/cifs/inode.c
4389 ++++ b/fs/cifs/inode.c
4390 +@@ -414,6 +414,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
4391 + /* if uniqueid is different, return error */
4392 + if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
4393 + CIFS_I(*pinode)->uniqueid != fattr.cf_uniqueid)) {
4394 ++ CIFS_I(*pinode)->time = 0; /* force reval */
4395 + rc = -ESTALE;
4396 + goto cgiiu_exit;
4397 + }
4398 +@@ -421,6 +422,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
4399 + /* if filetype is different, return error */
4400 + if (unlikely(((*pinode)->i_mode & S_IFMT) !=
4401 + (fattr.cf_mode & S_IFMT))) {
4402 ++ CIFS_I(*pinode)->time = 0; /* force reval */
4403 + rc = -ESTALE;
4404 + goto cgiiu_exit;
4405 + }
4406 +@@ -924,6 +926,7 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
4407 + /* if uniqueid is different, return error */
4408 + if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
4409 + CIFS_I(*inode)->uniqueid != fattr.cf_uniqueid)) {
4410 ++ CIFS_I(*inode)->time = 0; /* force reval */
4411 + rc = -ESTALE;
4412 + goto cgii_exit;
4413 + }
4414 +@@ -931,6 +934,7 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
4415 + /* if filetype is different, return error */
4416 + if (unlikely(((*inode)->i_mode & S_IFMT) !=
4417 + (fattr.cf_mode & S_IFMT))) {
4418 ++ CIFS_I(*inode)->time = 0; /* force reval */
4419 + rc = -ESTALE;
4420 + goto cgii_exit;
4421 + }
4422 +diff --git a/fs/io_uring.c b/fs/io_uring.c
4423 +index 06d048341fa4..30149652c379 100644
4424 +--- a/fs/io_uring.c
4425 ++++ b/fs/io_uring.c
4426 +@@ -2566,7 +2566,8 @@ static void io_destruct_skb(struct sk_buff *skb)
4427 + {
4428 + struct io_ring_ctx *ctx = skb->sk->sk_user_data;
4429 +
4430 +- io_finish_async(ctx);
4431 ++ if (ctx->sqo_wq)
4432 ++ flush_workqueue(ctx->sqo_wq);
4433 + unix_destruct_scm(skb);
4434 + }
4435 +
4436 +diff --git a/fs/libfs.c b/fs/libfs.c
4437 +index c9b2850c0f7c..8e023b08a240 100644
4438 +--- a/fs/libfs.c
4439 ++++ b/fs/libfs.c
4440 +@@ -89,58 +89,47 @@ int dcache_dir_close(struct inode *inode, struct file *file)
4441 + EXPORT_SYMBOL(dcache_dir_close);
4442 +
4443 + /* parent is locked at least shared */
4444 +-static struct dentry *next_positive(struct dentry *parent,
4445 +- struct list_head *from,
4446 +- int count)
4447 ++/*
4448 ++ * Returns an element of siblings' list.
4449 ++ * We are looking for <count>th positive after <p>; if
4450 ++ * found, dentry is grabbed and passed to caller via *<res>.
4451 ++ * If no such element exists, the anchor of list is returned
4452 ++ * and *<res> is set to NULL.
4453 ++ */
4454 ++static struct list_head *scan_positives(struct dentry *cursor,
4455 ++ struct list_head *p,
4456 ++ loff_t count,
4457 ++ struct dentry **res)
4458 + {
4459 +- unsigned *seq = &parent->d_inode->i_dir_seq, n;
4460 +- struct dentry *res;
4461 +- struct list_head *p;
4462 +- bool skipped;
4463 +- int i;
4464 ++ struct dentry *dentry = cursor->d_parent, *found = NULL;
4465 +
4466 +-retry:
4467 +- i = count;
4468 +- skipped = false;
4469 +- n = smp_load_acquire(seq) & ~1;
4470 +- res = NULL;
4471 +- rcu_read_lock();
4472 +- for (p = from->next; p != &parent->d_subdirs; p = p->next) {
4473 ++ spin_lock(&dentry->d_lock);
4474 ++ while ((p = p->next) != &dentry->d_subdirs) {
4475 + struct dentry *d = list_entry(p, struct dentry, d_child);
4476 +- if (!simple_positive(d)) {
4477 +- skipped = true;
4478 +- } else if (!--i) {
4479 +- res = d;
4480 +- break;
4481 ++ // we must at least skip cursors, to avoid livelocks
4482 ++ if (d->d_flags & DCACHE_DENTRY_CURSOR)
4483 ++ continue;
4484 ++ if (simple_positive(d) && !--count) {
4485 ++ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
4486 ++ if (simple_positive(d))
4487 ++ found = dget_dlock(d);
4488 ++ spin_unlock(&d->d_lock);
4489 ++ if (likely(found))
4490 ++ break;
4491 ++ count = 1;
4492 ++ }
4493 ++ if (need_resched()) {
4494 ++ list_move(&cursor->d_child, p);
4495 ++ p = &cursor->d_child;
4496 ++ spin_unlock(&dentry->d_lock);
4497 ++ cond_resched();
4498 ++ spin_lock(&dentry->d_lock);
4499 + }
4500 + }
4501 +- rcu_read_unlock();
4502 +- if (skipped) {
4503 +- smp_rmb();
4504 +- if (unlikely(*seq != n))
4505 +- goto retry;
4506 +- }
4507 +- return res;
4508 +-}
4509 +-
4510 +-static void move_cursor(struct dentry *cursor, struct list_head *after)
4511 +-{
4512 +- struct dentry *parent = cursor->d_parent;
4513 +- unsigned n, *seq = &parent->d_inode->i_dir_seq;
4514 +- spin_lock(&parent->d_lock);
4515 +- for (;;) {
4516 +- n = *seq;
4517 +- if (!(n & 1) && cmpxchg(seq, n, n + 1) == n)
4518 +- break;
4519 +- cpu_relax();
4520 +- }
4521 +- __list_del(cursor->d_child.prev, cursor->d_child.next);
4522 +- if (after)
4523 +- list_add(&cursor->d_child, after);
4524 +- else
4525 +- list_add_tail(&cursor->d_child, &parent->d_subdirs);
4526 +- smp_store_release(seq, n + 2);
4527 +- spin_unlock(&parent->d_lock);
4528 ++ spin_unlock(&dentry->d_lock);
4529 ++ dput(*res);
4530 ++ *res = found;
4531 ++ return p;
4532 + }
4533 +
4534 + loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
4535 +@@ -158,17 +147,28 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
4536 + return -EINVAL;
4537 + }
4538 + if (offset != file->f_pos) {
4539 ++ struct dentry *cursor = file->private_data;
4540 ++ struct dentry *to = NULL;
4541 ++ struct list_head *p;
4542 ++
4543 + file->f_pos = offset;
4544 +- if (file->f_pos >= 2) {
4545 +- struct dentry *cursor = file->private_data;
4546 +- struct dentry *to;
4547 +- loff_t n = file->f_pos - 2;
4548 +-
4549 +- inode_lock_shared(dentry->d_inode);
4550 +- to = next_positive(dentry, &dentry->d_subdirs, n);
4551 +- move_cursor(cursor, to ? &to->d_child : NULL);
4552 +- inode_unlock_shared(dentry->d_inode);
4553 ++ inode_lock_shared(dentry->d_inode);
4554 ++
4555 ++ if (file->f_pos > 2) {
4556 ++ p = scan_positives(cursor, &dentry->d_subdirs,
4557 ++ file->f_pos - 2, &to);
4558 ++ spin_lock(&dentry->d_lock);
4559 ++ list_move(&cursor->d_child, p);
4560 ++ spin_unlock(&dentry->d_lock);
4561 ++ } else {
4562 ++ spin_lock(&dentry->d_lock);
4563 ++ list_del_init(&cursor->d_child);
4564 ++ spin_unlock(&dentry->d_lock);
4565 + }
4566 ++
4567 ++ dput(to);
4568 ++
4569 ++ inode_unlock_shared(dentry->d_inode);
4570 + }
4571 + return offset;
4572 + }
4573 +@@ -190,25 +190,29 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
4574 + {
4575 + struct dentry *dentry = file->f_path.dentry;
4576 + struct dentry *cursor = file->private_data;
4577 +- struct list_head *p = &cursor->d_child;
4578 +- struct dentry *next;
4579 +- bool moved = false;
4580 ++ struct list_head *anchor = &dentry->d_subdirs;
4581 ++ struct dentry *next = NULL;
4582 ++ struct list_head *p;
4583 +
4584 + if (!dir_emit_dots(file, ctx))
4585 + return 0;
4586 +
4587 + if (ctx->pos == 2)
4588 +- p = &dentry->d_subdirs;
4589 +- while ((next = next_positive(dentry, p, 1)) != NULL) {
4590 ++ p = anchor;
4591 ++ else
4592 ++ p = &cursor->d_child;
4593 ++
4594 ++ while ((p = scan_positives(cursor, p, 1, &next)) != anchor) {
4595 + if (!dir_emit(ctx, next->d_name.name, next->d_name.len,
4596 + d_inode(next)->i_ino, dt_type(d_inode(next))))
4597 + break;
4598 +- moved = true;
4599 +- p = &next->d_child;
4600 + ctx->pos++;
4601 + }
4602 +- if (moved)
4603 +- move_cursor(cursor, p);
4604 ++ spin_lock(&dentry->d_lock);
4605 ++ list_move_tail(&cursor->d_child, p);
4606 ++ spin_unlock(&dentry->d_lock);
4607 ++ dput(next);
4608 ++
4609 + return 0;
4610 + }
4611 + EXPORT_SYMBOL(dcache_readdir);
4612 +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
4613 +index 222d7115db71..98a9a0bcdf38 100644
4614 +--- a/fs/nfs/direct.c
4615 ++++ b/fs/nfs/direct.c
4616 +@@ -123,32 +123,49 @@ static inline int put_dreq(struct nfs_direct_req *dreq)
4617 + }
4618 +
4619 + static void
4620 +-nfs_direct_good_bytes(struct nfs_direct_req *dreq, struct nfs_pgio_header *hdr)
4621 ++nfs_direct_handle_truncated(struct nfs_direct_req *dreq,
4622 ++ const struct nfs_pgio_header *hdr,
4623 ++ ssize_t dreq_len)
4624 + {
4625 +- int i;
4626 +- ssize_t count;
4627 ++ struct nfs_direct_mirror *mirror = &dreq->mirrors[hdr->pgio_mirror_idx];
4628 ++
4629 ++ if (!(test_bit(NFS_IOHDR_ERROR, &hdr->flags) ||
4630 ++ test_bit(NFS_IOHDR_EOF, &hdr->flags)))
4631 ++ return;
4632 ++ if (dreq->max_count >= dreq_len) {
4633 ++ dreq->max_count = dreq_len;
4634 ++ if (dreq->count > dreq_len)
4635 ++ dreq->count = dreq_len;
4636 ++
4637 ++ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
4638 ++ dreq->error = hdr->error;
4639 ++ else /* Clear outstanding error if this is EOF */
4640 ++ dreq->error = 0;
4641 ++ }
4642 ++ if (mirror->count > dreq_len)
4643 ++ mirror->count = dreq_len;
4644 ++}
4645 +
4646 +- WARN_ON_ONCE(dreq->count >= dreq->max_count);
4647 ++static void
4648 ++nfs_direct_count_bytes(struct nfs_direct_req *dreq,
4649 ++ const struct nfs_pgio_header *hdr)
4650 ++{
4651 ++ struct nfs_direct_mirror *mirror = &dreq->mirrors[hdr->pgio_mirror_idx];
4652 ++ loff_t hdr_end = hdr->io_start + hdr->good_bytes;
4653 ++ ssize_t dreq_len = 0;
4654 +
4655 +- if (dreq->mirror_count == 1) {
4656 +- dreq->mirrors[hdr->pgio_mirror_idx].count += hdr->good_bytes;
4657 +- dreq->count += hdr->good_bytes;
4658 +- } else {
4659 +- /* mirrored writes */
4660 +- count = dreq->mirrors[hdr->pgio_mirror_idx].count;
4661 +- if (count + dreq->io_start < hdr->io_start + hdr->good_bytes) {
4662 +- count = hdr->io_start + hdr->good_bytes - dreq->io_start;
4663 +- dreq->mirrors[hdr->pgio_mirror_idx].count = count;
4664 +- }
4665 +- /* update the dreq->count by finding the minimum agreed count from all
4666 +- * mirrors */
4667 +- count = dreq->mirrors[0].count;
4668 ++ if (hdr_end > dreq->io_start)
4669 ++ dreq_len = hdr_end - dreq->io_start;
4670 +
4671 +- for (i = 1; i < dreq->mirror_count; i++)
4672 +- count = min(count, dreq->mirrors[i].count);
4673 ++ nfs_direct_handle_truncated(dreq, hdr, dreq_len);
4674 +
4675 +- dreq->count = count;
4676 +- }
4677 ++ if (dreq_len > dreq->max_count)
4678 ++ dreq_len = dreq->max_count;
4679 ++
4680 ++ if (mirror->count < dreq_len)
4681 ++ mirror->count = dreq_len;
4682 ++ if (dreq->count < dreq_len)
4683 ++ dreq->count = dreq_len;
4684 + }
4685 +
4686 + /*
4687 +@@ -402,20 +419,12 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
4688 + struct nfs_direct_req *dreq = hdr->dreq;
4689 +
4690 + spin_lock(&dreq->lock);
4691 +- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
4692 +- dreq->error = hdr->error;
4693 +-
4694 + if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
4695 + spin_unlock(&dreq->lock);
4696 + goto out_put;
4697 + }
4698 +
4699 +- if (hdr->good_bytes != 0)
4700 +- nfs_direct_good_bytes(dreq, hdr);
4701 +-
4702 +- if (test_bit(NFS_IOHDR_EOF, &hdr->flags))
4703 +- dreq->error = 0;
4704 +-
4705 ++ nfs_direct_count_bytes(dreq, hdr);
4706 + spin_unlock(&dreq->lock);
4707 +
4708 + while (!list_empty(&hdr->pages)) {
4709 +@@ -652,6 +661,9 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
4710 + nfs_direct_write_scan_commit_list(dreq->inode, &reqs, &cinfo);
4711 +
4712 + dreq->count = 0;
4713 ++ dreq->max_count = 0;
4714 ++ list_for_each_entry(req, &reqs, wb_list)
4715 ++ dreq->max_count += req->wb_bytes;
4716 + dreq->verf.committed = NFS_INVALID_STABLE_HOW;
4717 + nfs_clear_pnfs_ds_commit_verifiers(&dreq->ds_cinfo);
4718 + for (i = 0; i < dreq->mirror_count; i++)
4719 +@@ -791,17 +803,13 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
4720 + nfs_init_cinfo_from_dreq(&cinfo, dreq);
4721 +
4722 + spin_lock(&dreq->lock);
4723 +-
4724 +- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
4725 +- dreq->error = hdr->error;
4726 +-
4727 + if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
4728 + spin_unlock(&dreq->lock);
4729 + goto out_put;
4730 + }
4731 +
4732 ++ nfs_direct_count_bytes(dreq, hdr);
4733 + if (hdr->good_bytes != 0) {
4734 +- nfs_direct_good_bytes(dreq, hdr);
4735 + if (nfs_write_need_commit(hdr)) {
4736 + if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
4737 + request_commit = true;
4738 +diff --git a/include/linux/acpi.h b/include/linux/acpi.h
4739 +index 9426b9aaed86..9d0e20a2ac83 100644
4740 +--- a/include/linux/acpi.h
4741 ++++ b/include/linux/acpi.h
4742 +@@ -1302,11 +1302,16 @@ static inline int lpit_read_residency_count_address(u64 *address)
4743 + #endif
4744 +
4745 + #ifdef CONFIG_ACPI_PPTT
4746 ++int acpi_pptt_cpu_is_thread(unsigned int cpu);
4747 + int find_acpi_cpu_topology(unsigned int cpu, int level);
4748 + int find_acpi_cpu_topology_package(unsigned int cpu);
4749 + int find_acpi_cpu_topology_hetero_id(unsigned int cpu);
4750 + int find_acpi_cpu_cache_topology(unsigned int cpu, int level);
4751 + #else
4752 ++static inline int acpi_pptt_cpu_is_thread(unsigned int cpu)
4753 ++{
4754 ++ return -EINVAL;
4755 ++}
4756 + static inline int find_acpi_cpu_topology(unsigned int cpu, int level)
4757 + {
4758 + return -EINVAL;
4759 +diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h
4760 +index 04c36b7a61dd..72579168189d 100644
4761 +--- a/include/linux/hwmon.h
4762 ++++ b/include/linux/hwmon.h
4763 +@@ -235,7 +235,7 @@ enum hwmon_power_attributes {
4764 + #define HWMON_P_LABEL BIT(hwmon_power_label)
4765 + #define HWMON_P_ALARM BIT(hwmon_power_alarm)
4766 + #define HWMON_P_CAP_ALARM BIT(hwmon_power_cap_alarm)
4767 +-#define HWMON_P_MIN_ALARM BIT(hwmon_power_max_alarm)
4768 ++#define HWMON_P_MIN_ALARM BIT(hwmon_power_min_alarm)
4769 + #define HWMON_P_MAX_ALARM BIT(hwmon_power_max_alarm)
4770 + #define HWMON_P_LCRIT_ALARM BIT(hwmon_power_lcrit_alarm)
4771 + #define HWMON_P_CRIT_ALARM BIT(hwmon_power_crit_alarm)
4772 +diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
4773 +index 63238c84dc0b..131ea1bad458 100644
4774 +--- a/include/linux/tpm_eventlog.h
4775 ++++ b/include/linux/tpm_eventlog.h
4776 +@@ -152,7 +152,7 @@ struct tcg_algorithm_info {
4777 + * total. Once we've done this we know the offset of the data length field,
4778 + * and can calculate the total size of the event.
4779 + *
4780 +- * Return: size of the event on success, <0 on failure
4781 ++ * Return: size of the event on success, 0 on failure
4782 + */
4783 +
4784 + static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
4785 +@@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
4786 + u16 halg;
4787 + int i;
4788 + int j;
4789 ++ u32 count, event_type;
4790 +
4791 + marker = event;
4792 + marker_start = marker;
4793 +@@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
4794 + }
4795 +
4796 + event = (struct tcg_pcr_event2_head *)mapping;
4797 ++ /*
4798 ++ * The loop below will unmap these fields if the log is larger than
4799 ++ * one page, so save them here for reference:
4800 ++ */
4801 ++ count = READ_ONCE(event->count);
4802 ++ event_type = READ_ONCE(event->event_type);
4803 +
4804 + efispecid = (struct tcg_efi_specid_event_head *)event_header->event;
4805 +
4806 + /* Check if event is malformed. */
4807 +- if (event->count > efispecid->num_algs) {
4808 ++ if (count > efispecid->num_algs) {
4809 + size = 0;
4810 + goto out;
4811 + }
4812 +
4813 +- for (i = 0; i < event->count; i++) {
4814 ++ for (i = 0; i < count; i++) {
4815 + halg_size = sizeof(event->digests[i].alg_id);
4816 +
4817 + /* Map the digest's algorithm identifier */
4818 +@@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
4819 + + event_field->event_size;
4820 + size = marker - marker_start;
4821 +
4822 +- if ((event->event_type == 0) && (event_field->event_size == 0))
4823 ++ if (event_type == 0 && event_field->event_size == 0)
4824 + size = 0;
4825 ++
4826 + out:
4827 + if (do_mapping)
4828 + TPM_MEMUNMAP(mapping, mapping_size);
4829 +diff --git a/kernel/fork.c b/kernel/fork.c
4830 +index 541fd805fb88..3647097e6783 100644
4831 +--- a/kernel/fork.c
4832 ++++ b/kernel/fork.c
4833 +@@ -2939,7 +2939,7 @@ int sysctl_max_threads(struct ctl_table *table, int write,
4834 + struct ctl_table t;
4835 + int ret;
4836 + int threads = max_threads;
4837 +- int min = MIN_THREADS;
4838 ++ int min = 1;
4839 + int max = MAX_THREADS;
4840 +
4841 + t = *table;
4842 +@@ -2951,7 +2951,7 @@ int sysctl_max_threads(struct ctl_table *table, int write,
4843 + if (ret || !write)
4844 + return ret;
4845 +
4846 +- set_max_threads(threads);
4847 ++ max_threads = threads;
4848 +
4849 + return 0;
4850 + }
4851 +diff --git a/kernel/panic.c b/kernel/panic.c
4852 +index 057540b6eee9..02d0de31c42d 100644
4853 +--- a/kernel/panic.c
4854 ++++ b/kernel/panic.c
4855 +@@ -179,6 +179,7 @@ void panic(const char *fmt, ...)
4856 + * after setting panic_cpu) from invoking panic() again.
4857 + */
4858 + local_irq_disable();
4859 ++ preempt_disable_notrace();
4860 +
4861 + /*
4862 + * It's possible to come here directly from a panic-assertion and
4863 +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
4864 +index f9821a3374e9..a33c524eba0d 100644
4865 +--- a/kernel/trace/ftrace.c
4866 ++++ b/kernel/trace/ftrace.c
4867 +@@ -3540,21 +3540,22 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
4868 + struct ftrace_hash *hash;
4869 + struct list_head *mod_head;
4870 + struct trace_array *tr = ops->private;
4871 +- int ret = 0;
4872 ++ int ret = -ENOMEM;
4873 +
4874 + ftrace_ops_init(ops);
4875 +
4876 + if (unlikely(ftrace_disabled))
4877 + return -ENODEV;
4878 +
4879 ++ if (tr && trace_array_get(tr) < 0)
4880 ++ return -ENODEV;
4881 ++
4882 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
4883 + if (!iter)
4884 +- return -ENOMEM;
4885 ++ goto out;
4886 +
4887 +- if (trace_parser_get_init(&iter->parser, FTRACE_BUFF_MAX)) {
4888 +- kfree(iter);
4889 +- return -ENOMEM;
4890 +- }
4891 ++ if (trace_parser_get_init(&iter->parser, FTRACE_BUFF_MAX))
4892 ++ goto out;
4893 +
4894 + iter->ops = ops;
4895 + iter->flags = flag;
4896 +@@ -3584,13 +3585,13 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
4897 +
4898 + if (!iter->hash) {
4899 + trace_parser_put(&iter->parser);
4900 +- kfree(iter);
4901 +- ret = -ENOMEM;
4902 + goto out_unlock;
4903 + }
4904 + } else
4905 + iter->hash = hash;
4906 +
4907 ++ ret = 0;
4908 ++
4909 + if (file->f_mode & FMODE_READ) {
4910 + iter->pg = ftrace_pages_start;
4911 +
4912 +@@ -3602,7 +3603,6 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
4913 + /* Failed */
4914 + free_ftrace_hash(iter->hash);
4915 + trace_parser_put(&iter->parser);
4916 +- kfree(iter);
4917 + }
4918 + } else
4919 + file->private_data = iter;
4920 +@@ -3610,6 +3610,13 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
4921 + out_unlock:
4922 + mutex_unlock(&ops->func_hash->regex_lock);
4923 +
4924 ++ out:
4925 ++ if (ret) {
4926 ++ kfree(iter);
4927 ++ if (tr)
4928 ++ trace_array_put(tr);
4929 ++ }
4930 ++
4931 + return ret;
4932 + }
4933 +
4934 +@@ -5037,6 +5044,8 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
4935 +
4936 + mutex_unlock(&iter->ops->func_hash->regex_lock);
4937 + free_ftrace_hash(iter->hash);
4938 ++ if (iter->tr)
4939 ++ trace_array_put(iter->tr);
4940 + kfree(iter);
4941 +
4942 + return 0;
4943 +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
4944 +index 563e80f9006a..04458ed44a55 100644
4945 +--- a/kernel/trace/trace.c
4946 ++++ b/kernel/trace/trace.c
4947 +@@ -4355,9 +4355,14 @@ static int show_traces_open(struct inode *inode, struct file *file)
4948 + if (tracing_disabled)
4949 + return -ENODEV;
4950 +
4951 ++ if (trace_array_get(tr) < 0)
4952 ++ return -ENODEV;
4953 ++
4954 + ret = seq_open(file, &show_traces_seq_ops);
4955 +- if (ret)
4956 ++ if (ret) {
4957 ++ trace_array_put(tr);
4958 + return ret;
4959 ++ }
4960 +
4961 + m = file->private_data;
4962 + m->private = tr;
4963 +@@ -4365,6 +4370,14 @@ static int show_traces_open(struct inode *inode, struct file *file)
4964 + return 0;
4965 + }
4966 +
4967 ++static int show_traces_release(struct inode *inode, struct file *file)
4968 ++{
4969 ++ struct trace_array *tr = inode->i_private;
4970 ++
4971 ++ trace_array_put(tr);
4972 ++ return seq_release(inode, file);
4973 ++}
4974 ++
4975 + static ssize_t
4976 + tracing_write_stub(struct file *filp, const char __user *ubuf,
4977 + size_t count, loff_t *ppos)
4978 +@@ -4395,8 +4408,8 @@ static const struct file_operations tracing_fops = {
4979 + static const struct file_operations show_traces_fops = {
4980 + .open = show_traces_open,
4981 + .read = seq_read,
4982 +- .release = seq_release,
4983 + .llseek = seq_lseek,
4984 ++ .release = show_traces_release,
4985 + };
4986 +
4987 + static ssize_t
4988 +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
4989 +index fa95139445b2..862f4b0139fc 100644
4990 +--- a/kernel/trace/trace_hwlat.c
4991 ++++ b/kernel/trace/trace_hwlat.c
4992 +@@ -150,7 +150,7 @@ void trace_hwlat_callback(bool enter)
4993 + if (enter)
4994 + nmi_ts_start = time_get();
4995 + else
4996 +- nmi_total_ts = time_get() - nmi_ts_start;
4997 ++ nmi_total_ts += time_get() - nmi_ts_start;
4998 + }
4999 +
5000 + if (enter)
5001 +@@ -256,6 +256,8 @@ static int get_sample(void)
5002 + /* Keep a running maximum ever recorded hardware latency */
5003 + if (sample > tr->max_latency)
5004 + tr->max_latency = sample;
5005 ++ if (outer_sample > tr->max_latency)
5006 ++ tr->max_latency = outer_sample;
5007 + }
5008 +
5009 + out:
5010 +diff --git a/mm/page_alloc.c b/mm/page_alloc.c
5011 +index 9c9194959271..bfa5815e59f8 100644
5012 +--- a/mm/page_alloc.c
5013 ++++ b/mm/page_alloc.c
5014 +@@ -1174,11 +1174,17 @@ static __always_inline bool free_pages_prepare(struct page *page,
5015 + debug_check_no_obj_freed(page_address(page),
5016 + PAGE_SIZE << order);
5017 + }
5018 +- arch_free_page(page, order);
5019 + if (want_init_on_free())
5020 + kernel_init_free_pages(page, 1 << order);
5021 +
5022 + kernel_poison_pages(page, 1 << order, 0);
5023 ++ /*
5024 ++ * arch_free_page() can make the page's contents inaccessible. s390
5025 ++ * does this. So nothing which can access the page's contents should
5026 ++ * happen after this.
5027 ++ */
5028 ++ arch_free_page(page, order);
5029 ++
5030 + if (debug_pagealloc_enabled())
5031 + kernel_map_pages(page, 1 << order, 0);
5032 +
5033 +diff --git a/mm/vmpressure.c b/mm/vmpressure.c
5034 +index f3b50811497a..4bac22fe1aa2 100644
5035 +--- a/mm/vmpressure.c
5036 ++++ b/mm/vmpressure.c
5037 +@@ -355,6 +355,9 @@ void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio)
5038 + * "hierarchy" or "local").
5039 + *
5040 + * To be used as memcg event method.
5041 ++ *
5042 ++ * Return: 0 on success, -ENOMEM on memory failure or -EINVAL if @args could
5043 ++ * not be parsed.
5044 + */
5045 + int vmpressure_register_event(struct mem_cgroup *memcg,
5046 + struct eventfd_ctx *eventfd, const char *args)
5047 +@@ -362,7 +365,7 @@ int vmpressure_register_event(struct mem_cgroup *memcg,
5048 + struct vmpressure *vmpr = memcg_to_vmpressure(memcg);
5049 + struct vmpressure_event *ev;
5050 + enum vmpressure_modes mode = VMPRESSURE_NO_PASSTHROUGH;
5051 +- enum vmpressure_levels level = -1;
5052 ++ enum vmpressure_levels level;
5053 + char *spec, *spec_orig;
5054 + char *token;
5055 + int ret = 0;
5056 +@@ -375,20 +378,18 @@ int vmpressure_register_event(struct mem_cgroup *memcg,
5057 +
5058 + /* Find required level */
5059 + token = strsep(&spec, ",");
5060 +- level = match_string(vmpressure_str_levels, VMPRESSURE_NUM_LEVELS, token);
5061 +- if (level < 0) {
5062 +- ret = level;
5063 ++ ret = match_string(vmpressure_str_levels, VMPRESSURE_NUM_LEVELS, token);
5064 ++ if (ret < 0)
5065 + goto out;
5066 +- }
5067 ++ level = ret;
5068 +
5069 + /* Find optional mode */
5070 + token = strsep(&spec, ",");
5071 + if (token) {
5072 +- mode = match_string(vmpressure_str_modes, VMPRESSURE_NUM_MODES, token);
5073 +- if (mode < 0) {
5074 +- ret = mode;
5075 ++ ret = match_string(vmpressure_str_modes, VMPRESSURE_NUM_MODES, token);
5076 ++ if (ret < 0)
5077 + goto out;
5078 +- }
5079 ++ mode = ret;
5080 + }
5081 +
5082 + ev = kzalloc(sizeof(*ev), GFP_KERNEL);
5083 +@@ -404,6 +405,7 @@ int vmpressure_register_event(struct mem_cgroup *memcg,
5084 + mutex_lock(&vmpr->events_lock);
5085 + list_add(&ev->node, &vmpr->events);
5086 + mutex_unlock(&vmpr->events_lock);
5087 ++ ret = 0;
5088 + out:
5089 + kfree(spec_orig);
5090 + return ret;
5091 +diff --git a/mm/z3fold.c b/mm/z3fold.c
5092 +index 05bdf90646e7..6d3d3f698ebb 100644
5093 +--- a/mm/z3fold.c
5094 ++++ b/mm/z3fold.c
5095 +@@ -998,9 +998,11 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
5096 + struct z3fold_header *zhdr;
5097 + struct page *page;
5098 + enum buddy bud;
5099 ++ bool page_claimed;
5100 +
5101 + zhdr = handle_to_z3fold_header(handle);
5102 + page = virt_to_page(zhdr);
5103 ++ page_claimed = test_and_set_bit(PAGE_CLAIMED, &page->private);
5104 +
5105 + if (test_bit(PAGE_HEADLESS, &page->private)) {
5106 + /* if a headless page is under reclaim, just leave.
5107 +@@ -1008,7 +1010,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
5108 + * has not been set before, we release this page
5109 + * immediately so we don't care about its value any more.
5110 + */
5111 +- if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) {
5112 ++ if (!page_claimed) {
5113 + spin_lock(&pool->lock);
5114 + list_del(&page->lru);
5115 + spin_unlock(&pool->lock);
5116 +@@ -1044,13 +1046,15 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
5117 + atomic64_dec(&pool->pages_nr);
5118 + return;
5119 + }
5120 +- if (test_bit(PAGE_CLAIMED, &page->private)) {
5121 ++ if (page_claimed) {
5122 ++ /* the page has not been claimed by us */
5123 + z3fold_page_unlock(zhdr);
5124 + return;
5125 + }
5126 + if (unlikely(PageIsolated(page)) ||
5127 + test_and_set_bit(NEEDS_COMPACTING, &page->private)) {
5128 + z3fold_page_unlock(zhdr);
5129 ++ clear_bit(PAGE_CLAIMED, &page->private);
5130 + return;
5131 + }
5132 + if (zhdr->cpu < 0 || !cpu_online(zhdr->cpu)) {
5133 +@@ -1060,10 +1064,12 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
5134 + zhdr->cpu = -1;
5135 + kref_get(&zhdr->refcount);
5136 + do_compact_page(zhdr, true);
5137 ++ clear_bit(PAGE_CLAIMED, &page->private);
5138 + return;
5139 + }
5140 + kref_get(&zhdr->refcount);
5141 + queue_work_on(zhdr->cpu, pool->compact_wq, &zhdr->work);
5142 ++ clear_bit(PAGE_CLAIMED, &page->private);
5143 + z3fold_page_unlock(zhdr);
5144 + }
5145 +
5146 +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
5147 +index d61563a3695e..8218e837a58c 100644
5148 +--- a/security/selinux/ss/services.c
5149 ++++ b/security/selinux/ss/services.c
5150 +@@ -1946,7 +1946,14 @@ static int convert_context(struct context *oldc, struct context *newc, void *p)
5151 + rc = string_to_context_struct(args->newp, NULL, s,
5152 + newc, SECSID_NULL);
5153 + if (rc == -EINVAL) {
5154 +- /* Retain string representation for later mapping. */
5155 ++ /*
5156 ++ * Retain string representation for later mapping.
5157 ++ *
5158 ++ * IMPORTANT: We need to copy the contents of oldc->str
5159 ++ * back into s again because string_to_context_struct()
5160 ++ * may have garbled it.
5161 ++ */
5162 ++ memcpy(s, oldc->str, oldc->len);
5163 + context_init(newc);
5164 + newc->str = s;
5165 + newc->len = oldc->len;
5166 +diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
5167 +index 18c34f0c1966..d36d86490d1d 100644
5168 +--- a/tools/perf/util/jitdump.c
5169 ++++ b/tools/perf/util/jitdump.c
5170 +@@ -396,7 +396,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd, union jr_entry *jr)
5171 + size_t size;
5172 + u16 idr_size;
5173 + const char *sym;
5174 +- uint32_t count;
5175 ++ uint64_t count;
5176 + int ret, csize, usize;
5177 + pid_t pid, tid;
5178 + struct {
5179 +@@ -419,7 +419,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd, union jr_entry *jr)
5180 + return -1;
5181 +
5182 + filename = event->mmap2.filename;
5183 +- size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%u.so",
5184 ++ size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%" PRIu64 ".so",
5185 + jd->dir,
5186 + pid,
5187 + count);
5188 +@@ -530,7 +530,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd, union jr_entry *jr)
5189 + return -1;
5190 +
5191 + filename = event->mmap2.filename;
5192 +- size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%"PRIu64,
5193 ++ size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%" PRIu64 ".so",
5194 + jd->dir,
5195 + pid,
5196 + jr->move.code_index);
5197 +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
5198 +index 9f0470ecbca9..35bb082f5782 100644
5199 +--- a/tools/perf/util/llvm-utils.c
5200 ++++ b/tools/perf/util/llvm-utils.c
5201 +@@ -231,14 +231,14 @@ static int detect_kbuild_dir(char **kbuild_dir)
5202 + const char *prefix_dir = "";
5203 + const char *suffix_dir = "";
5204 +
5205 ++ /* _UTSNAME_LENGTH is 65 */
5206 ++ char release[128];
5207 ++
5208 + char *autoconf_path;
5209 +
5210 + int err;
5211 +
5212 + if (!test_dir) {
5213 +- /* _UTSNAME_LENGTH is 65 */
5214 +- char release[128];
5215 +-
5216 + err = fetch_kernel_version(NULL, release,
5217 + sizeof(release));
5218 + if (err)