[gentoo-commits] proj/linux-patches:5.15 commit in: /

[Mike Pagano]

commit:     6a800ed523206259aa9754f876b9ccb29e412871
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 29 13:05:10 2021 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 29 13:05:10 2021 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6a800ed5

Linux patch 5.15.12

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1011_linux-5.15.12.patch | 4959 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 4963 insertions(+)

diff --git a/0000_README b/0000_README
index 5388e982..259cde90 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch:  1010_linux-5.15.11.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.15.11
 
+Patch:  1011_linux-5.15.12.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.15.12
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1011_linux-5.15.12.patch b/1011_linux-5.15.12.patch
new file mode 100644
index 00000000..3842ad02
--- /dev/null
+++ b/1011_linux-5.15.12.patch
@@ -0,0 +1,4959 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 1396fd2d90319..a454f438bd621 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2403,8 +2403,12 @@
+ 			Default is 1 (enabled)
+ 
+ 	kvm-intel.emulate_invalid_guest_state=
+-			[KVM,Intel] Enable emulation of invalid guest states
+-			Default is 0 (disabled)
++			[KVM,Intel] Disable emulation of invalid guest state.
++			Ignored if kvm-intel.enable_unrestricted_guest=1, as
++			guest state is never invalid for unrestricted guests.
++			This param doesn't apply to nested guests (L2), as KVM
++			never emulates invalid L2 guest state.
++			Default is 1 (enabled)
+ 
+ 	kvm-intel.flexpriority=
+ 			[KVM,Intel] Disable FlexPriority feature (TPR shadow).
+diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst
+index 3da8c6e06a365..05391fb4042d9 100644
+--- a/Documentation/hwmon/lm90.rst
++++ b/Documentation/hwmon/lm90.rst
+@@ -265,6 +265,16 @@ Supported chips:
+ 
+ 	       https://www.ti.com/litv/pdf/sbos686
+ 
++  * Texas Instruments TMP461
++
++    Prefix: 'tmp461'
++
++    Addresses scanned: I2C 0x48 through 0x4F
++
++    Datasheet: Publicly available at TI website
++
++	       https://www.ti.com/lit/gpn/tmp461
++
+ Author: Jean Delvare <jdelvare@××××.de>
+ 
+ 
+diff --git a/Documentation/networking/bonding.rst b/Documentation/networking/bonding.rst
+index 31cfd7d674a6c..c0a789b008063 100644
+--- a/Documentation/networking/bonding.rst
++++ b/Documentation/networking/bonding.rst
+@@ -196,11 +196,12 @@ ad_actor_sys_prio
+ ad_actor_system
+ 
+ 	In an AD system, this specifies the mac-address for the actor in
+-	protocol packet exchanges (LACPDUs). The value cannot be NULL or
+-	multicast. It is preferred to have the local-admin bit set for this
+-	mac but driver does not enforce it. If the value is not given then
+-	system defaults to using the masters' mac address as actors' system
+-	address.
++	protocol packet exchanges (LACPDUs). The value cannot be a multicast
++	address. If the all-zeroes MAC is specified, bonding will internally
++	use the MAC of the bond itself. It is preferred to have the
++	local-admin bit set for this mac but driver does not enforce it. If
++	the value is not given then system defaults to using the masters'
++	mac address as actors' system address.
+ 
+ 	This parameter has effect only in 802.3ad mode and is available through
+ 	SysFs interface.
+diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
+index 0ea967d345838..d25335993e553 100644
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -326,6 +326,8 @@ usi-headset
+     Headset support on USI machines
+ dual-codecs
+     Lenovo laptops with dual codecs
++alc285-hp-amp-init
++    HP laptops which require speaker amplifier initialization (ALC285)
+ 
+ ALC680
+ ======
+diff --git a/Makefile b/Makefile
+index 37a1144c32df7..474b2a2292ca4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 15
+-SUBLEVEL = 11
++SUBLEVEL = 12
+ EXTRAVERSION =
+ NAME = Trick or Treat
+ 
+diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+index b62a0dbb033ff..ec6fba5ee8fde 100644
+--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+@@ -309,6 +309,7 @@
+ 
+ 		ethphy: ethernet-phy@1 {
+ 			reg = <1>;
++			qca,clk-out-frequency = <125000000>;
+ 		};
+ 	};
+ };
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 241b73d64df73..d8e28abd468c0 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -597,11 +597,9 @@ call_fpe:
+ 	tstne	r0, #0x04000000			@ bit 26 set on both ARM and Thumb-2
+ 	reteq	lr
+ 	and	r8, r0, #0x00000f00		@ mask out CP number
+- THUMB(	lsr	r8, r8, #8		)
+ 	mov	r7, #1
+-	add	r6, r10, #TI_USED_CP
+- ARM(	strb	r7, [r6, r8, lsr #8]	)	@ set appropriate used_cp[]
+- THUMB(	strb	r7, [r6, r8]		)	@ set appropriate used_cp[]
++	add	r6, r10, r8, lsr #8		@ add used_cp[] array offset first
++	strb	r7, [r6, #TI_USED_CP]		@ set appropriate used_cp[]
+ #ifdef CONFIG_IWMMXT
+ 	@ Test if we need to give access to iWMMXt coprocessors
+ 	ldr	r5, [r10, #TI_FLAGS]
+@@ -610,7 +608,7 @@ call_fpe:
+ 	bcs	iwmmxt_task_enable
+ #endif
+  ARM(	add	pc, pc, r8, lsr #6	)
+- THUMB(	lsl	r8, r8, #2		)
++ THUMB(	lsr	r8, r8, #6		)
+  THUMB(	add	pc, r8			)
+ 	nop
+ 
+diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
+index 0fc814bbc34b1..8796a69c78e00 100644
+--- a/arch/arm/kernel/head-nommu.S
++++ b/arch/arm/kernel/head-nommu.S
+@@ -114,6 +114,7 @@ ENTRY(secondary_startup)
+ 	add	r12, r12, r10
+ 	ret	r12
+ 1:	bl	__after_proc_init
++	ldr	r7, __secondary_data		@ reload r7
+ 	ldr	sp, [r7, #12]			@ set up the stack pointer
+ 	mov	fp, #0
+ 	b	secondary_start_kernel
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index fee914c716aa2..0758ea0717f98 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1264,7 +1264,8 @@ config KUSER_HELPERS
+ 
+ config COMPAT_VDSO
+ 	bool "Enable vDSO for 32-bit applications"
+-	depends on !CPU_BIG_ENDIAN && "$(CROSS_COMPILE_COMPAT)" != ""
++	depends on !CPU_BIG_ENDIAN
++	depends on (CC_IS_CLANG && LD_IS_LLD) || "$(CROSS_COMPILE_COMPAT)" != ""
+ 	select GENERIC_COMPAT_VDSO
+ 	default y
+ 	help
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
+index d13980ed7a79a..7ec5ac850a0dc 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
+@@ -69,7 +69,7 @@
+ 	pinctrl-0 = <&emac_rgmii_pins>;
+ 	phy-supply = <&reg_gmac_3v3>;
+ 	phy-handle = <&ext_rgmii_phy>;
+-	phy-mode = "rgmii";
++	phy-mode = "rgmii-id";
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
+index c4b1a59ba424b..51c4f61007cdb 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
+@@ -719,7 +719,7 @@
+ 			clock-names = "i2c";
+ 			clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL
+ 					    QORIQ_CLK_PLL_DIV(16)>;
+-			scl-gpio = <&gpio2 15 GPIO_ACTIVE_HIGH>;
++			scl-gpios = <&gpio2 15 GPIO_ACTIVE_HIGH>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -768,7 +768,7 @@
+ 			clock-names = "i2c";
+ 			clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL
+ 					    QORIQ_CLK_PLL_DIV(16)>;
+-			scl-gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>;
++			scl-gpios = <&gpio2 16 GPIO_ACTIVE_HIGH>;
+ 			status = "disabled";
+ 		};
+ 
+diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile
+index 764d1900d5aab..3514269ac75fb 100644
+--- a/arch/arm64/kernel/vdso32/Makefile
++++ b/arch/arm64/kernel/vdso32/Makefile
+@@ -10,18 +10,15 @@ include $(srctree)/lib/vdso/Makefile
+ 
+ # Same as cc-*option, but using CC_COMPAT instead of CC
+ ifeq ($(CONFIG_CC_IS_CLANG), y)
+-CC_COMPAT_CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE_COMPAT:%-=%))
+-
+ CC_COMPAT ?= $(CC)
+-CC_COMPAT += $(CC_COMPAT_CLANG_FLAGS)
+-
+-ifneq ($(LLVM),)
+-LD_COMPAT ?= $(LD)
++CC_COMPAT += --target=arm-linux-gnueabi
+ else
+-LD_COMPAT ?= $(CROSS_COMPILE_COMPAT)ld
++CC_COMPAT ?= $(CROSS_COMPILE_COMPAT)gcc
+ endif
++
++ifeq ($(CONFIG_LD_IS_LLD), y)
++LD_COMPAT ?= $(LD)
+ else
+-CC_COMPAT ?= $(CROSS_COMPILE_COMPAT)gcc
+ LD_COMPAT ?= $(CROSS_COMPILE_COMPAT)ld
+ endif
+ 
+@@ -47,10 +44,6 @@ VDSO_CPPFLAGS += $(LINUXINCLUDE)
+ # Common C and assembly flags
+ # From top-level Makefile
+ VDSO_CAFLAGS := $(VDSO_CPPFLAGS)
+-ifneq ($(shell $(CC_COMPAT) --version 2>&1 | head -n 1 | grep clang),)
+-VDSO_CAFLAGS += --target=$(notdir $(CROSS_COMPILE_COMPAT:%-=%))
+-endif
+-
+ VDSO_CAFLAGS += $(call cc32-option,-fno-PIE)
+ ifdef CONFIG_DEBUG_INFO
+ VDSO_CAFLAGS += -g
+diff --git a/arch/parisc/include/asm/futex.h b/arch/parisc/include/asm/futex.h
+index fceb9cf02fb3a..71aa0921d6c72 100644
+--- a/arch/parisc/include/asm/futex.h
++++ b/arch/parisc/include/asm/futex.h
+@@ -16,7 +16,7 @@ static inline void
+ _futex_spin_lock_irqsave(u32 __user *uaddr, unsigned long int *flags)
+ {
+ 	extern u32 lws_lock_start[];
+-	long index = ((long)uaddr & 0x3f8) >> 1;
++	long index = ((long)uaddr & 0x7f8) >> 1;
+ 	arch_spinlock_t *s = (arch_spinlock_t *)&lws_lock_start[index];
+ 	local_irq_save(*flags);
+ 	arch_spin_lock(s);
+@@ -26,7 +26,7 @@ static inline void
+ _futex_spin_unlock_irqrestore(u32 __user *uaddr, unsigned long int *flags)
+ {
+ 	extern u32 lws_lock_start[];
+-	long index = ((long)uaddr & 0x3f8) >> 1;
++	long index = ((long)uaddr & 0x7f8) >> 1;
+ 	arch_spinlock_t *s = (arch_spinlock_t *)&lws_lock_start[index];
+ 	arch_spin_unlock(s);
+ 	local_irq_restore(*flags);
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 3f24a0af1e047..9842dcb2041e5 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -478,7 +478,7 @@ lws_start:
+ 	extrd,u	%r1,PSW_W_BIT,1,%r1
+ 	/* sp must be aligned on 4, so deposit the W bit setting into
+ 	 * the bottom of sp temporarily */
+-	or,ev	%r1,%r30,%r30
++	or,od	%r1,%r30,%r30
+ 
+ 	/* Clip LWS number to a 32-bit value for 32-bit processes */
+ 	depdi	0, 31, 32, %r20
+diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h
+index cefe1d81e2e8b..9e50da3ed01a3 100644
+--- a/arch/x86/include/asm/kvm-x86-ops.h
++++ b/arch/x86/include/asm/kvm-x86-ops.h
+@@ -47,6 +47,7 @@ KVM_X86_OP(set_dr7)
+ KVM_X86_OP(cache_reg)
+ KVM_X86_OP(get_rflags)
+ KVM_X86_OP(set_rflags)
++KVM_X86_OP(get_if_flag)
+ KVM_X86_OP(tlb_flush_all)
+ KVM_X86_OP(tlb_flush_current)
+ KVM_X86_OP_NULL(tlb_remote_flush)
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index a11785ebf628b..75e21715ecb46 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1341,6 +1341,7 @@ struct kvm_x86_ops {
+ 	void (*cache_reg)(struct kvm_vcpu *vcpu, enum kvm_reg reg);
+ 	unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
+ 	void (*set_rflags)(struct kvm_vcpu *vcpu, unsigned long rflags);
++	bool (*get_if_flag)(struct kvm_vcpu *vcpu);
+ 
+ 	void (*tlb_flush_all)(struct kvm_vcpu *vcpu);
+ 	void (*tlb_flush_current)(struct kvm_vcpu *vcpu);
+diff --git a/arch/x86/include/asm/pkru.h b/arch/x86/include/asm/pkru.h
+index ccc539faa5bbc..4d8b9448fe8d2 100644
+--- a/arch/x86/include/asm/pkru.h
++++ b/arch/x86/include/asm/pkru.h
+@@ -4,8 +4,8 @@
+ 
+ #include <asm/fpu/xstate.h>
+ 
+-#define PKRU_AD_BIT 0x1
+-#define PKRU_WD_BIT 0x2
++#define PKRU_AD_BIT 0x1u
++#define PKRU_WD_BIT 0x2u
+ #define PKRU_BITS_PER_PKEY 2
+ 
+ #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index d71267081153f..48596f9fddf45 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -713,9 +713,6 @@ static void __init early_reserve_memory(void)
+ 
+ 	early_reserve_initrd();
+ 
+-	if (efi_enabled(EFI_BOOT))
+-		efi_memblock_x86_reserve_range();
+-
+ 	memblock_x86_reserve_range_setup_data();
+ 
+ 	reserve_ibft_region();
+@@ -742,28 +739,6 @@ dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
+ 	return 0;
+ }
+ 
+-static char *prepare_command_line(void)
+-{
+-#ifdef CONFIG_CMDLINE_BOOL
+-#ifdef CONFIG_CMDLINE_OVERRIDE
+-	strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+-#else
+-	if (builtin_cmdline[0]) {
+-		/* append boot loader cmdline to builtin */
+-		strlcat(builtin_cmdline, " ", COMMAND_LINE_SIZE);
+-		strlcat(builtin_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+-		strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+-	}
+-#endif
+-#endif
+-
+-	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
+-
+-	parse_early_param();
+-
+-	return command_line;
+-}
+-
+ /*
+  * Determine if we were loaded by an EFI loader.  If so, then we have also been
+  * passed the efi memmap, systab, etc., so we should use these data structures
+@@ -852,23 +827,6 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	x86_init.oem.arch_setup();
+ 
+-	/*
+-	 * x86_configure_nx() is called before parse_early_param() (called by
+-	 * prepare_command_line()) to detect whether hardware doesn't support
+-	 * NX (so that the early EHCI debug console setup can safely call
+-	 * set_fixmap()). It may then be called again from within noexec_setup()
+-	 * during parsing early parameters to honor the respective command line
+-	 * option.
+-	 */
+-	x86_configure_nx();
+-
+-	/*
+-	 * This parses early params and it needs to run before
+-	 * early_reserve_memory() because latter relies on such settings
+-	 * supplied as early params.
+-	 */
+-	*cmdline_p = prepare_command_line();
+-
+ 	/*
+ 	 * Do some memory reservations *before* memory is added to memblock, so
+ 	 * memblock allocations won't overwrite it.
+@@ -902,6 +860,36 @@ void __init setup_arch(char **cmdline_p)
+ 	bss_resource.start = __pa_symbol(__bss_start);
+ 	bss_resource.end = __pa_symbol(__bss_stop)-1;
+ 
++#ifdef CONFIG_CMDLINE_BOOL
++#ifdef CONFIG_CMDLINE_OVERRIDE
++	strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
++#else
++	if (builtin_cmdline[0]) {
++		/* append boot loader cmdline to builtin */
++		strlcat(builtin_cmdline, " ", COMMAND_LINE_SIZE);
++		strlcat(builtin_cmdline, boot_command_line, COMMAND_LINE_SIZE);
++		strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
++	}
++#endif
++#endif
++
++	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
++	*cmdline_p = command_line;
++
++	/*
++	 * x86_configure_nx() is called before parse_early_param() to detect
++	 * whether hardware doesn't support NX (so that the early EHCI debug
++	 * console setup can safely call set_fixmap()). It may then be called
++	 * again from within noexec_setup() during parsing early parameters
++	 * to honor the respective command line option.
++	 */
++	x86_configure_nx();
++
++	parse_early_param();
++
++	if (efi_enabled(EFI_BOOT))
++		efi_memblock_x86_reserve_range();
++
+ #ifdef CONFIG_MEMORY_HOTPLUG
+ 	/*
+ 	 * Memory used by the kernel cannot be hot-removed because Linux
+diff --git a/arch/x86/kvm/mmu/tdp_iter.c b/arch/x86/kvm/mmu/tdp_iter.c
+index b3ed302c1a359..caa96c270b954 100644
+--- a/arch/x86/kvm/mmu/tdp_iter.c
++++ b/arch/x86/kvm/mmu/tdp_iter.c
+@@ -26,6 +26,7 @@ static gfn_t round_gfn_for_level(gfn_t gfn, int level)
+  */
+ void tdp_iter_restart(struct tdp_iter *iter)
+ {
++	iter->yielded = false;
+ 	iter->yielded_gfn = iter->next_last_level_gfn;
+ 	iter->level = iter->root_level;
+ 
+@@ -160,6 +161,11 @@ static bool try_step_up(struct tdp_iter *iter)
+  */
+ void tdp_iter_next(struct tdp_iter *iter)
+ {
++	if (iter->yielded) {
++		tdp_iter_restart(iter);
++		return;
++	}
++
+ 	if (try_step_down(iter))
+ 		return;
+ 
+diff --git a/arch/x86/kvm/mmu/tdp_iter.h b/arch/x86/kvm/mmu/tdp_iter.h
+index b1748b988d3ae..e19cabbcb65c8 100644
+--- a/arch/x86/kvm/mmu/tdp_iter.h
++++ b/arch/x86/kvm/mmu/tdp_iter.h
+@@ -45,6 +45,12 @@ struct tdp_iter {
+ 	 * iterator walks off the end of the paging structure.
+ 	 */
+ 	bool valid;
++	/*
++	 * True if KVM dropped mmu_lock and yielded in the middle of a walk, in
++	 * which case tdp_iter_next() needs to restart the walk at the root
++	 * level instead of advancing to the next entry.
++	 */
++	bool yielded;
+ };
+ 
+ /*
+diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
+index 0e4227b59d7bb..4954cd01c1f0e 100644
+--- a/arch/x86/kvm/mmu/tdp_mmu.c
++++ b/arch/x86/kvm/mmu/tdp_mmu.c
+@@ -501,6 +501,8 @@ static inline bool tdp_mmu_set_spte_atomic_no_dirty_log(struct kvm *kvm,
+ 							struct tdp_iter *iter,
+ 							u64 new_spte)
+ {
++	WARN_ON_ONCE(iter->yielded);
++
+ 	lockdep_assert_held_read(&kvm->mmu_lock);
+ 
+ 	/*
+@@ -611,6 +613,8 @@ static inline void __tdp_mmu_set_spte(struct kvm *kvm, struct tdp_iter *iter,
+ 				      u64 new_spte, bool record_acc_track,
+ 				      bool record_dirty_log)
+ {
++	WARN_ON_ONCE(iter->yielded);
++
+ 	lockdep_assert_held_write(&kvm->mmu_lock);
+ 
+ 	/*
+@@ -676,18 +680,19 @@ static inline void tdp_mmu_set_spte_no_dirty_log(struct kvm *kvm,
+  * If this function should yield and flush is set, it will perform a remote
+  * TLB flush before yielding.
+  *
+- * If this function yields, it will also reset the tdp_iter's walk over the
+- * paging structure and the calling function should skip to the next
+- * iteration to allow the iterator to continue its traversal from the
+- * paging structure root.
++ * If this function yields, iter->yielded is set and the caller must skip to
++ * the next iteration, where tdp_iter_next() will reset the tdp_iter's walk
++ * over the paging structures to allow the iterator to continue its traversal
++ * from the paging structure root.
+  *
+- * Return true if this function yielded and the iterator's traversal was reset.
+- * Return false if a yield was not needed.
++ * Returns true if this function yielded.
+  */
+-static inline bool tdp_mmu_iter_cond_resched(struct kvm *kvm,
+-					     struct tdp_iter *iter, bool flush,
+-					     bool shared)
++static inline bool __must_check tdp_mmu_iter_cond_resched(struct kvm *kvm,
++							  struct tdp_iter *iter,
++							  bool flush, bool shared)
+ {
++	WARN_ON(iter->yielded);
++
+ 	/* Ensure forward progress has been made before yielding. */
+ 	if (iter->next_last_level_gfn == iter->yielded_gfn)
+ 		return false;
+@@ -707,12 +712,10 @@ static inline bool tdp_mmu_iter_cond_resched(struct kvm *kvm,
+ 
+ 		WARN_ON(iter->gfn > iter->next_last_level_gfn);
+ 
+-		tdp_iter_restart(iter);
+-
+-		return true;
++		iter->yielded = true;
+ 	}
+ 
+-	return false;
++	return iter->yielded;
+ }
+ 
+ /*
+diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
+index 1fce044beebea..e64f16237b60b 100644
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -1517,6 +1517,15 @@ static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
+ 	to_svm(vcpu)->vmcb->save.rflags = rflags;
+ }
+ 
++static bool svm_get_if_flag(struct kvm_vcpu *vcpu)
++{
++	struct vmcb *vmcb = to_svm(vcpu)->vmcb;
++
++	return sev_es_guest(vcpu->kvm)
++		? vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK
++		: kvm_get_rflags(vcpu) & X86_EFLAGS_IF;
++}
++
+ static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
+ {
+ 	switch (reg) {
+@@ -3485,14 +3494,7 @@ bool svm_interrupt_blocked(struct kvm_vcpu *vcpu)
+ 	if (!gif_set(svm))
+ 		return true;
+ 
+-	if (sev_es_guest(vcpu->kvm)) {
+-		/*
+-		 * SEV-ES guests to not expose RFLAGS. Use the VMCB interrupt mask
+-		 * bit to determine the state of the IF flag.
+-		 */
+-		if (!(vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK))
+-			return true;
+-	} else if (is_guest_mode(vcpu)) {
++	if (is_guest_mode(vcpu)) {
+ 		/* As long as interrupts are being delivered...  */
+ 		if ((svm->nested.ctl.int_ctl & V_INTR_MASKING_MASK)
+ 		    ? !(svm->vmcb01.ptr->save.rflags & X86_EFLAGS_IF)
+@@ -3503,7 +3505,7 @@ bool svm_interrupt_blocked(struct kvm_vcpu *vcpu)
+ 		if (nested_exit_on_intr(svm))
+ 			return false;
+ 	} else {
+-		if (!(kvm_get_rflags(vcpu) & X86_EFLAGS_IF))
++		if (!svm_get_if_flag(vcpu))
+ 			return true;
+ 	}
+ 
+@@ -4562,6 +4564,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = {
+ 	.cache_reg = svm_cache_reg,
+ 	.get_rflags = svm_get_rflags,
+ 	.set_rflags = svm_set_rflags,
++	.get_if_flag = svm_get_if_flag,
+ 
+ 	.tlb_flush_all = svm_flush_tlb,
+ 	.tlb_flush_current = svm_flush_tlb,
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index 4e212f04268bb..7d280e6f5488a 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -1359,6 +1359,11 @@ void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
+ 		vmx->emulation_required = vmx_emulation_required(vcpu);
+ }
+ 
++static bool vmx_get_if_flag(struct kvm_vcpu *vcpu)
++{
++	return vmx_get_rflags(vcpu) & X86_EFLAGS_IF;
++}
++
+ u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
+ {
+ 	u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
+@@ -3966,8 +3971,7 @@ static int vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
+ 	if (pi_test_and_set_on(&vmx->pi_desc))
+ 		return 0;
+ 
+-	if (vcpu != kvm_get_running_vcpu() &&
+-	    !kvm_vcpu_trigger_posted_interrupt(vcpu, false))
++	if (!kvm_vcpu_trigger_posted_interrupt(vcpu, false))
+ 		kvm_vcpu_kick(vcpu);
+ 
+ 	return 0;
+@@ -5861,18 +5865,14 @@ static int __vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
+ 		vmx_flush_pml_buffer(vcpu);
+ 
+ 	/*
+-	 * We should never reach this point with a pending nested VM-Enter, and
+-	 * more specifically emulation of L2 due to invalid guest state (see
+-	 * below) should never happen as that means we incorrectly allowed a
+-	 * nested VM-Enter with an invalid vmcs12.
++	 * KVM should never reach this point with a pending nested VM-Enter.
++	 * More specifically, short-circuiting VM-Entry to emulate L2 due to
++	 * invalid guest state should never happen as that means KVM knowingly
++	 * allowed a nested VM-Enter with an invalid vmcs12.  More below.
+ 	 */
+ 	if (KVM_BUG_ON(vmx->nested.nested_run_pending, vcpu->kvm))
+ 		return -EIO;
+ 
+-	/* If guest state is invalid, start emulating */
+-	if (vmx->emulation_required)
+-		return handle_invalid_guest_state(vcpu);
+-
+ 	if (is_guest_mode(vcpu)) {
+ 		/*
+ 		 * PML is never enabled when running L2, bail immediately if a
+@@ -5894,10 +5894,30 @@ static int __vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
+ 		 */
+ 		nested_mark_vmcs12_pages_dirty(vcpu);
+ 
++		/*
++		 * Synthesize a triple fault if L2 state is invalid.  In normal
++		 * operation, nested VM-Enter rejects any attempt to enter L2
++		 * with invalid state.  However, those checks are skipped if
++		 * state is being stuffed via RSM or KVM_SET_NESTED_STATE.  If
++		 * L2 state is invalid, it means either L1 modified SMRAM state
++		 * or userspace provided bad state.  Synthesize TRIPLE_FAULT as
++		 * doing so is architecturally allowed in the RSM case, and is
++		 * the least awful solution for the userspace case without
++		 * risking false positives.
++		 */
++		if (vmx->emulation_required) {
++			nested_vmx_vmexit(vcpu, EXIT_REASON_TRIPLE_FAULT, 0, 0);
++			return 1;
++		}
++
+ 		if (nested_vmx_reflect_vmexit(vcpu))
+ 			return 1;
+ 	}
+ 
++	/* If guest state is invalid, start emulating.  L2 is handled above. */
++	if (vmx->emulation_required)
++		return handle_invalid_guest_state(vcpu);
++
+ 	if (exit_reason.failed_vmentry) {
+ 		dump_vmcs(vcpu);
+ 		vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+@@ -6591,9 +6611,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	 * consistency check VM-Exit due to invalid guest state and bail.
+ 	 */
+ 	if (unlikely(vmx->emulation_required)) {
+-
+-		/* We don't emulate invalid state of a nested guest */
+-		vmx->fail = is_guest_mode(vcpu);
++		vmx->fail = 0;
+ 
+ 		vmx->exit_reason.full = EXIT_REASON_INVALID_STATE;
+ 		vmx->exit_reason.failed_vmentry = 1;
+@@ -7573,6 +7591,7 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = {
+ 	.cache_reg = vmx_cache_reg,
+ 	.get_rflags = vmx_get_rflags,
+ 	.set_rflags = vmx_set_rflags,
++	.get_if_flag = vmx_get_if_flag,
+ 
+ 	.tlb_flush_all = vmx_flush_tlb_all,
+ 	.tlb_flush_current = vmx_flush_tlb_current,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index dea578586fa4e..ccb256c377a6e 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -8880,14 +8880,7 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
+ {
+ 	struct kvm_run *kvm_run = vcpu->run;
+ 
+-	/*
+-	 * if_flag is obsolete and useless, so do not bother
+-	 * setting it for SEV-ES guests.  Userspace can just
+-	 * use kvm_run->ready_for_interrupt_injection.
+-	 */
+-	kvm_run->if_flag = !vcpu->arch.guest_state_protected
+-		&& (kvm_get_rflags(vcpu) & X86_EFLAGS_IF) != 0;
+-
++	kvm_run->if_flag = static_call(kvm_x86_get_if_flag)(vcpu);
+ 	kvm_run->cr8 = kvm_get_cr8(vcpu);
+ 	kvm_run->apic_base = kvm_get_apic_base(vcpu);
+ 
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index a7fdd86fad057..6bce40e2506e5 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1906,7 +1906,7 @@ int dpm_prepare(pm_message_t state)
+ 	device_block_probing();
+ 
+ 	mutex_lock(&dpm_list_mtx);
+-	while (!list_empty(&dpm_list)) {
++	while (!list_empty(&dpm_list) && !error) {
+ 		struct device *dev = to_device(dpm_list.next);
+ 
+ 		get_device(dev);
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index 6f225dddc74f4..4566e730ef2b8 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -687,11 +687,11 @@ err_clk_disable:
+ 
+ static void sunxi_rsb_hw_exit(struct sunxi_rsb *rsb)
+ {
+-	/* Keep the clock and PM reference counts consistent. */
+-	if (pm_runtime_status_suspended(rsb->dev))
+-		pm_runtime_resume(rsb->dev);
+ 	reset_control_assert(rsb->rstc);
+-	clk_disable_unprepare(rsb->clk);
++
++	/* Keep the clock and PM reference counts consistent. */
++	if (!pm_runtime_status_suspended(rsb->dev))
++		clk_disable_unprepare(rsb->clk);
+ }
+ 
+ static int __maybe_unused sunxi_rsb_runtime_suspend(struct device *dev)
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index b404cc46cbda7..fe91090e04a46 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -2932,7 +2932,7 @@ cleanup_bmc_device(struct kref *ref)
+ 	 * with removing the device attributes while reading a device
+ 	 * attribute.
+ 	 */
+-	schedule_work(&bmc->remove_work);
++	queue_work(remove_work_wq, &bmc->remove_work);
+ }
+ 
+ /*
+@@ -5148,22 +5148,27 @@ static int ipmi_init_msghandler(void)
+ 	if (initialized)
+ 		goto out;
+ 
+-	init_srcu_struct(&ipmi_interfaces_srcu);
+-
+-	timer_setup(&ipmi_timer, ipmi_timeout, 0);
+-	mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+-
+-	atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++	rv = init_srcu_struct(&ipmi_interfaces_srcu);
++	if (rv)
++		goto out;
+ 
+ 	remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq");
+ 	if (!remove_work_wq) {
+ 		pr_err("unable to create ipmi-msghandler-remove-wq workqueue");
+ 		rv = -ENOMEM;
+-		goto out;
++		goto out_wq;
+ 	}
+ 
++	timer_setup(&ipmi_timer, ipmi_timeout, 0);
++	mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
++
++	atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++
+ 	initialized = true;
+ 
++out_wq:
++	if (rv)
++		cleanup_srcu_struct(&ipmi_interfaces_srcu);
+ out:
+ 	mutex_unlock(&ipmi_interfaces_mutex);
+ 	return rv;
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 20d5af92966d4..8d7a8898e80b0 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -1659,6 +1659,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 		}
+ 	}
+ 
++	ssif_info->client = client;
++	i2c_set_clientdata(client, ssif_info);
++
+ 	rv = ssif_check_and_remove(client, ssif_info);
+ 	/* If rv is 0 and addr source is not SI_ACPI, continue probing */
+ 	if (!rv && ssif_info->addr_source == SI_ACPI) {
+@@ -1679,9 +1682,6 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 		ipmi_addr_src_to_str(ssif_info->addr_source),
+ 		client->addr, client->adapter->name, slave_addr);
+ 
+-	ssif_info->client = client;
+-	i2c_set_clientdata(client, ssif_info);
+-
+ 	/* Now check for system interface capabilities */
+ 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+ 	msg[1] = IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD;
+@@ -1881,6 +1881,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 
+ 		dev_err(&ssif_info->client->dev,
+ 			"Unable to start IPMI SSIF: %d\n", rv);
++		i2c_set_clientdata(client, NULL);
+ 		kfree(ssif_info);
+ 	}
+ 	kfree(resp);
+diff --git a/drivers/gpio/gpio-dln2.c b/drivers/gpio/gpio-dln2.c
+index 026903e3ef543..08b9e2cf4f2d6 100644
+--- a/drivers/gpio/gpio-dln2.c
++++ b/drivers/gpio/gpio-dln2.c
+@@ -46,6 +46,7 @@
+ struct dln2_gpio {
+ 	struct platform_device *pdev;
+ 	struct gpio_chip gpio;
++	struct irq_chip irqchip;
+ 
+ 	/*
+ 	 * Cache pin direction to save us one transfer, since the hardware has
+@@ -383,15 +384,6 @@ static void dln2_irq_bus_unlock(struct irq_data *irqd)
+ 	mutex_unlock(&dln2->irq_lock);
+ }
+ 
+-static struct irq_chip dln2_gpio_irqchip = {
+-	.name = "dln2-irq",
+-	.irq_mask = dln2_irq_mask,
+-	.irq_unmask = dln2_irq_unmask,
+-	.irq_set_type = dln2_irq_set_type,
+-	.irq_bus_lock = dln2_irq_bus_lock,
+-	.irq_bus_sync_unlock = dln2_irq_bus_unlock,
+-};
+-
+ static void dln2_gpio_event(struct platform_device *pdev, u16 echo,
+ 			    const void *data, int len)
+ {
+@@ -473,8 +465,15 @@ static int dln2_gpio_probe(struct platform_device *pdev)
+ 	dln2->gpio.direction_output = dln2_gpio_direction_output;
+ 	dln2->gpio.set_config = dln2_gpio_set_config;
+ 
++	dln2->irqchip.name = "dln2-irq",
++	dln2->irqchip.irq_mask = dln2_irq_mask,
++	dln2->irqchip.irq_unmask = dln2_irq_unmask,
++	dln2->irqchip.irq_set_type = dln2_irq_set_type,
++	dln2->irqchip.irq_bus_lock = dln2_irq_bus_lock,
++	dln2->irqchip.irq_bus_sync_unlock = dln2_irq_bus_unlock,
++
+ 	girq = &dln2->gpio.irq;
+-	girq->chip = &dln2_gpio_irqchip;
++	girq->chip = &dln2->irqchip;
+ 	/* The event comes from the outside so no parent handler */
+ 	girq->parent_handler = NULL;
+ 	girq->num_parents = 0;
+diff --git a/drivers/gpio/gpio-virtio.c b/drivers/gpio/gpio-virtio.c
+index d24f1c9264bc9..dd3b23c9580b1 100644
+--- a/drivers/gpio/gpio-virtio.c
++++ b/drivers/gpio/gpio-virtio.c
+@@ -81,11 +81,7 @@ static int _virtio_gpio_req(struct virtio_gpio *vgpio, u16 type, u16 gpio,
+ 	virtqueue_kick(vgpio->request_vq);
+ 	mutex_unlock(&vgpio->lock);
+ 
+-	if (!wait_for_completion_timeout(&line->completion, HZ)) {
+-		dev_err(dev, "GPIO operation timed out\n");
+-		ret = -ETIMEDOUT;
+-		goto out;
+-	}
++	wait_for_completion(&line->completion);
+ 
+ 	if (unlikely(res->status != VIRTIO_GPIO_STATUS_OK)) {
+ 		dev_err(dev, "GPIO request failed: %d\n", gpio);
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 5838c44cbf6f0..3196189429bcf 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1224,12 +1224,14 @@ static int mtk_hdmi_bridge_mode_valid(struct drm_bridge *bridge,
+ 			return MODE_BAD;
+ 	}
+ 
+-	if (hdmi->conf->cea_modes_only && !drm_match_cea_mode(mode))
+-		return MODE_BAD;
++	if (hdmi->conf) {
++		if (hdmi->conf->cea_modes_only && !drm_match_cea_mode(mode))
++			return MODE_BAD;
+ 
+-	if (hdmi->conf->max_mode_clock &&
+-	    mode->clock > hdmi->conf->max_mode_clock)
+-		return MODE_CLOCK_HIGH;
++		if (hdmi->conf->max_mode_clock &&
++		    mode->clock > hdmi->conf->max_mode_clock)
++			return MODE_CLOCK_HIGH;
++	}
+ 
+ 	if (mode->clock < 27000)
+ 		return MODE_CLOCK_LOW;
+diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
+index b7172c48ef9f0..7c907939bfae1 100644
+--- a/drivers/hid/hid-holtek-mouse.c
++++ b/drivers/hid/hid-holtek-mouse.c
+@@ -65,8 +65,23 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static int holtek_mouse_probe(struct hid_device *hdev,
+ 			      const struct hid_device_id *id)
+ {
++	int ret;
++
+ 	if (!hid_is_usb(hdev))
+ 		return -EINVAL;
++
++	ret = hid_parse(hdev);
++	if (ret) {
++		hid_err(hdev, "hid parse failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
++	if (ret) {
++		hid_err(hdev, "hw start failed: %d\n", ret);
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/hid/hid-vivaldi.c b/drivers/hid/hid-vivaldi.c
+index cd7ada48b1d9f..72957a9f71170 100644
+--- a/drivers/hid/hid-vivaldi.c
++++ b/drivers/hid/hid-vivaldi.c
+@@ -57,6 +57,9 @@ static int vivaldi_probe(struct hid_device *hdev,
+ 	int ret;
+ 
+ 	drvdata = devm_kzalloc(&hdev->dev, sizeof(*drvdata), GFP_KERNEL);
++	if (!drvdata)
++		return -ENOMEM;
++
+ 	hid_set_drvdata(hdev, drvdata);
+ 
+ 	ret = hid_parse(hdev);
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index c4578e8f34bb5..ccdaeafed0bb7 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1317,7 +1317,7 @@ config SENSORS_LM90
+ 	  Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658,
+ 	  MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696,
+ 	  ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG,
+-	  Philips SA56004, GMT G781, and Texas Instruments TMP451
++	  Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461
+ 	  sensor chips.
+ 
+ 	  This driver can also be built as a module. If so, the module
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 567b7c521f388..74019dff2550e 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -35,13 +35,14 @@
+  * explicitly as max6659, or if its address is not 0x4c.
+  * These chips lack the remote temperature offset feature.
+  *
+- * This driver also supports the MAX6654 chip made by Maxim. This chip can
+- * be at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is
+- * otherwise similar to MAX6657/MAX6658/MAX6659. Extended range is available
+- * by setting the configuration register accordingly, and is done during
+- * initialization. Extended precision is only available at conversion rates
+- * of 1 Hz and slower. Note that extended precision is not enabled by
+- * default, as this driver initializes all chips to 2 Hz by design.
++ * This driver also supports the MAX6654 chip made by Maxim. This chip can be
++ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar
++ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature
++ * limits. Extended range is available by setting the configuration register
++ * accordingly, and is done during initialization. Extended precision is only
++ * available at conversion rates of 1 Hz and slower. Note that extended
++ * precision is not enabled by default, as this driver initializes all chips
++ * to 2 Hz by design.
+  *
+  * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and
+  * MAX6692 chips made by Maxim.  These are again similar to the LM86,
+@@ -69,10 +70,10 @@
+  * This driver also supports the G781 from GMT. This device is compatible
+  * with the ADM1032.
+  *
+- * This driver also supports TMP451 from Texas Instruments. This device is
+- * supported in both compatibility and extended mode. It's mostly compatible
+- * with ADT7461 except for local temperature low byte register and max
+- * conversion rate.
++ * This driver also supports TMP451 and TMP461 from Texas Instruments.
++ * Those devices are supported in both compatibility and extended mode.
++ * They are mostly compatible with ADT7461 except for local temperature
++ * low byte register and max conversion rate.
+  *
+  * Since the LM90 was the first chipset supported by this driver, most
+  * comments will refer to this chipset, but are actually general and
+@@ -112,7 +113,7 @@ static const unsigned short normal_i2c[] = {
+ 	0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
+ 
+ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+-	max6646, w83l771, max6696, sa56004, g781, tmp451, max6654 };
++	max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 };
+ 
+ /*
+  * The LM90 registers
+@@ -168,8 +169,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ 
+ #define LM90_MAX_CONVRATE_MS	16000	/* Maximum conversion rate in ms */
+ 
+-/* TMP451 registers */
++/* TMP451/TMP461 registers */
+ #define TMP451_REG_R_LOCAL_TEMPL	0x15
++#define TMP451_REG_CONALERT		0x22
++
++#define TMP461_REG_CHEN			0x16
++#define TMP461_REG_DFC			0x24
+ 
+ /*
+  * Device flags
+@@ -182,7 +187,10 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm		*/
+ #define LM90_HAVE_TEMP3		(1 << 6) /* 3rd temperature sensor	*/
+ #define LM90_HAVE_BROKEN_ALERT	(1 << 7) /* Broken alert		*/
+-#define LM90_PAUSE_FOR_CONFIG	(1 << 8) /* Pause conversion for config	*/
++#define LM90_HAVE_EXTENDED_TEMP	(1 << 8) /* extended temperature support*/
++#define LM90_PAUSE_FOR_CONFIG	(1 << 9) /* Pause conversion for config	*/
++#define LM90_HAVE_CRIT		(1 << 10)/* Chip supports CRIT/OVERT register	*/
++#define LM90_HAVE_CRIT_ALRM_SWP	(1 << 11)/* critical alarm bits swapped	*/
+ 
+ /* LM90 status */
+ #define LM90_STATUS_LTHRM	(1 << 0) /* local THERM limit tripped */
+@@ -192,6 +200,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_STATUS_RHIGH	(1 << 4) /* remote high temp limit tripped */
+ #define LM90_STATUS_LLOW	(1 << 5) /* local low temp limit tripped */
+ #define LM90_STATUS_LHIGH	(1 << 6) /* local high temp limit tripped */
++#define LM90_STATUS_BUSY	(1 << 7) /* conversion is ongoing */
+ 
+ #define MAX6696_STATUS2_R2THRM	(1 << 1) /* remote2 THERM limit tripped */
+ #define MAX6696_STATUS2_R2OPEN	(1 << 2) /* remote2 is an open circuit */
+@@ -229,6 +238,7 @@ static const struct i2c_device_id lm90_id[] = {
+ 	{ "w83l771", w83l771 },
+ 	{ "sa56004", sa56004 },
+ 	{ "tmp451", tmp451 },
++	{ "tmp461", tmp461 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(i2c, lm90_id);
+@@ -326,6 +336,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = {
+ 		.compatible = "ti,tmp451",
+ 		.data = (void *)tmp451
+ 	},
++	{
++		.compatible = "ti,tmp461",
++		.data = (void *)tmp461
++	},
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(of, lm90_of_match);
+@@ -344,38 +358,43 @@ struct lm90_params {
+ static const struct lm90_params lm90_params[] = {
+ 	[adm1032] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 10,
+ 	},
+ 	[adt7461] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 10,
+ 	},
+ 	[g781] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 	},
+ 	[lm86] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 	},
+ 	[lm90] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 	},
+ 	[lm99] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 	},
+ 	[max6646] = {
++		.flags = LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+@@ -386,43 +405,51 @@ static const struct lm90_params lm90_params[] = {
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[max6657] = {
+-		.flags = LM90_PAUSE_FOR_CONFIG,
++		.flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[max6659] = {
+-		.flags = LM90_HAVE_EMERGENCY,
++		.flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[max6680] = {
+-		.flags = LM90_HAVE_OFFSET,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT
++		  | LM90_HAVE_CRIT_ALRM_SWP,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 7,
+ 	},
+ 	[max6696] = {
+ 		.flags = LM90_HAVE_EMERGENCY
+-		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
++		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x1c7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[w83l771] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 	},
+ 	[sa56004] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 		.reg_local_ext = SA56004_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[tmp451] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
++		.alert_alarms = 0x7c,
++		.max_convrate = 9,
++		.reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
++	},
++	[tmp461] = {
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 9,
+ 		.reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
+@@ -651,20 +678,22 @@ static int lm90_update_limits(struct device *dev)
+ 	struct i2c_client *client = data->client;
+ 	int val;
+ 
+-	val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
+-	if (val < 0)
+-		return val;
+-	data->temp8[LOCAL_CRIT] = val;
++	if (data->flags & LM90_HAVE_CRIT) {
++		val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
++		if (val < 0)
++			return val;
++		data->temp8[LOCAL_CRIT] = val;
+ 
+-	val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
+-	if (val < 0)
+-		return val;
+-	data->temp8[REMOTE_CRIT] = val;
++		val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
++		if (val < 0)
++			return val;
++		data->temp8[REMOTE_CRIT] = val;
+ 
+-	val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
+-	if (val < 0)
+-		return val;
+-	data->temp_hyst = val;
++		val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
++		if (val < 0)
++			return val;
++		data->temp_hyst = val;
++	}
+ 
+ 	val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH);
+ 	if (val < 0)
+@@ -792,7 +821,7 @@ static int lm90_update_device(struct device *dev)
+ 		val = lm90_read_reg(client, LM90_REG_R_STATUS);
+ 		if (val < 0)
+ 			return val;
+-		data->alarms = val;	/* lower 8 bit of alarms */
++		data->alarms = val & ~LM90_STATUS_BUSY;
+ 
+ 		if (data->kind == max6696) {
+ 			val = lm90_select_remote_channel(data, 1);
+@@ -998,7 +1027,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index)
+ 	s16 temp11 = data->temp11[index];
+ 	int temp;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u16_adt7461(data, temp11);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u16(temp11);
+@@ -1035,7 +1064,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val)
+ 		val -= 16000;
+ 	}
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		data->temp11[index] = temp_to_u16_adt7461(data, val);
+ 	else if (data->kind == max6646)
+ 		data->temp11[index] = temp_to_u8(val) << 8;
+@@ -1062,7 +1091,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index)
+ 	s8 temp8 = data->temp8[index];
+ 	int temp;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u8_adt7461(data, temp8);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u8(temp8);
+@@ -1098,7 +1127,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val)
+ 		val -= 16000;
+ 	}
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		data->temp8[index] = temp_to_u8_adt7461(data, val);
+ 	else if (data->kind == max6646)
+ 		data->temp8[index] = temp_to_u8(val);
+@@ -1116,7 +1145,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index)
+ {
+ 	int temp;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u8_adt7461(data, data->temp8[index]);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u8(data->temp8[index]);
+@@ -1136,15 +1165,15 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)
+ 	int temp;
+ 	int err;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u8(data->temp8[LOCAL_CRIT]);
+ 	else
+ 		temp = temp_from_s8(data->temp8[LOCAL_CRIT]);
+ 
+-	/* prevent integer underflow */
+-	val = max(val, -128000l);
++	/* prevent integer overflow/underflow */
++	val = clamp_val(val, -128000l, 255000l);
+ 
+ 	data->temp_hyst = hyst_to_reg(temp - val);
+ 	err = i2c_smbus_write_byte_data(client, LM90_REG_W_TCRIT_HYST,
+@@ -1175,6 +1204,7 @@ static const u8 lm90_temp_emerg_index[3] = {
+ static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 };
+ static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 };
+ static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 };
++static const u8 lm90_crit_alarm_bits_swapped[3] = { 1, 0, 9 };
+ static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 };
+ static const u8 lm90_fault_bits[3] = { 0, 2, 10 };
+ 
+@@ -1200,7 +1230,10 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val)
+ 		*val = (data->alarms >> lm90_max_alarm_bits[channel]) & 1;
+ 		break;
+ 	case hwmon_temp_crit_alarm:
+-		*val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1;
++		if (data->flags & LM90_HAVE_CRIT_ALRM_SWP)
++			*val = (data->alarms >> lm90_crit_alarm_bits_swapped[channel]) & 1;
++		else
++			*val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1;
+ 		break;
+ 	case hwmon_temp_emergency_alarm:
+ 		*val = (data->alarms >> lm90_emergency_alarm_bits[channel]) & 1;
+@@ -1448,12 +1481,11 @@ static int lm90_detect(struct i2c_client *client,
+ 	if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0)
+ 		return -ENODEV;
+ 
+-	if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) {
++	if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) {
+ 		config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2);
+ 		if (config2 < 0)
+ 			return -ENODEV;
+-	} else
+-		config2 = 0;		/* Make compiler happy */
++	}
+ 
+ 	if ((address == 0x4C || address == 0x4D)
+ 	 && man_id == 0x01) { /* National Semiconductor */
+@@ -1627,18 +1659,26 @@ static int lm90_detect(struct i2c_client *client,
+ 		 && convrate <= 0x08)
+ 			name = "g781";
+ 	} else
+-	if (address == 0x4C
+-	 && man_id == 0x55) { /* Texas Instruments */
+-		int local_ext;
++	if (man_id == 0x55 && chip_id == 0x00 &&
++	    (config1 & 0x1B) == 0x00 && convrate <= 0x09) {
++		int local_ext, conalert, chen, dfc;
+ 
+ 		local_ext = i2c_smbus_read_byte_data(client,
+ 						     TMP451_REG_R_LOCAL_TEMPL);
+-
+-		if (chip_id == 0x00 /* TMP451 */
+-		 && (config1 & 0x1B) == 0x00
+-		 && convrate <= 0x09
+-		 && (local_ext & 0x0F) == 0x00)
+-			name = "tmp451";
++		conalert = i2c_smbus_read_byte_data(client,
++						    TMP451_REG_CONALERT);
++		chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN);
++		dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC);
++
++		if ((local_ext & 0x0F) == 0x00 &&
++		    (conalert & 0xf1) == 0x01 &&
++		    (chen & 0xfc) == 0x00 &&
++		    (dfc & 0xfc) == 0x00) {
++			if (address == 0x4c && !(chen & 0x03))
++				name = "tmp451";
++			else if (address >= 0x48 && address <= 0x4f)
++				name = "tmp461";
++		}
+ 	}
+ 
+ 	if (!name) { /* identification failed */
+@@ -1685,7 +1725,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
+ 	lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
+ 
+ 	/* Check Temperature Range Select */
+-	if (data->kind == adt7461 || data->kind == tmp451) {
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP) {
+ 		if (config & 0x04)
+ 			data->flags |= LM90_FLAG_ADT7461_EXT;
+ 	}
+@@ -1878,11 +1918,14 @@ static int lm90_probe(struct i2c_client *client)
+ 	info->config = data->channel_config;
+ 
+ 	data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
+-		HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
+-		HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM;
++		HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM;
+ 	data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
+-		HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
+-		HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT;
++		HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT;
++
++	if (data->flags & LM90_HAVE_CRIT) {
++		data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
++		data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
++	}
+ 
+ 	if (data->flags & LM90_HAVE_OFFSET)
+ 		data->channel_config[1] |= HWMON_T_OFFSET;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 51dd134952e77..96fe73ba689c1 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1604,11 +1604,17 @@ static int hns_roce_config_global_param(struct hns_roce_dev *hr_dev)
+ {
+ 	struct hns_roce_cmq_desc desc;
+ 	struct hns_roce_cmq_req *req = (struct hns_roce_cmq_req *)desc.data;
++	u32 clock_cycles_of_1us;
+ 
+ 	hns_roce_cmq_setup_basic_desc(&desc, HNS_ROCE_OPC_CFG_GLOBAL_PARAM,
+ 				      false);
+ 
+-	hr_reg_write(req, CFG_GLOBAL_PARAM_1US_CYCLES, 0x3e8);
++	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
++		clock_cycles_of_1us = HNS_ROCE_1NS_CFG;
++	else
++		clock_cycles_of_1us = HNS_ROCE_1US_CFG;
++
++	hr_reg_write(req, CFG_GLOBAL_PARAM_1US_CYCLES, clock_cycles_of_1us);
+ 	hr_reg_write(req, CFG_GLOBAL_PARAM_UDP_PORT, ROCE_V2_UDP_DPORT);
+ 
+ 	return hns_roce_cmq_send(hr_dev, &desc, 1);
+@@ -4812,6 +4818,30 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp,
+ 	return ret;
+ }
+ 
++static bool check_qp_timeout_cfg_range(struct hns_roce_dev *hr_dev, u8 *timeout)
++{
++#define QP_ACK_TIMEOUT_MAX_HIP08 20
++#define QP_ACK_TIMEOUT_OFFSET 10
++#define QP_ACK_TIMEOUT_MAX 31
++
++	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
++		if (*timeout > QP_ACK_TIMEOUT_MAX_HIP08) {
++			ibdev_warn(&hr_dev->ib_dev,
++				   "Local ACK timeout shall be 0 to 20.\n");
++			return false;
++		}
++		*timeout += QP_ACK_TIMEOUT_OFFSET;
++	} else if (hr_dev->pci_dev->revision > PCI_REVISION_ID_HIP08) {
++		if (*timeout > QP_ACK_TIMEOUT_MAX) {
++			ibdev_warn(&hr_dev->ib_dev,
++				   "Local ACK timeout shall be 0 to 31.\n");
++			return false;
++		}
++	}
++
++	return true;
++}
++
+ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp,
+ 				      const struct ib_qp_attr *attr,
+ 				      int attr_mask,
+@@ -4821,6 +4851,7 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp,
+ 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
+ 	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
+ 	int ret = 0;
++	u8 timeout;
+ 
+ 	if (attr_mask & IB_QP_AV) {
+ 		ret = hns_roce_v2_set_path(ibqp, attr, attr_mask, context,
+@@ -4830,12 +4861,10 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp,
+ 	}
+ 
+ 	if (attr_mask & IB_QP_TIMEOUT) {
+-		if (attr->timeout < 31) {
+-			hr_reg_write(context, QPC_AT, attr->timeout);
++		timeout = attr->timeout;
++		if (check_qp_timeout_cfg_range(hr_dev, &timeout)) {
++			hr_reg_write(context, QPC_AT, timeout);
+ 			hr_reg_clear(qpc_mask, QPC_AT);
+-		} else {
+-			ibdev_warn(&hr_dev->ib_dev,
+-				   "Local ACK timeout shall be 0 to 30.\n");
+ 		}
+ 	}
+ 
+@@ -4892,7 +4921,9 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp,
+ 		set_access_flags(hr_qp, context, qpc_mask, attr, attr_mask);
+ 
+ 	if (attr_mask & IB_QP_MIN_RNR_TIMER) {
+-		hr_reg_write(context, QPC_MIN_RNR_TIME, attr->min_rnr_timer);
++		hr_reg_write(context, QPC_MIN_RNR_TIME,
++			    hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 ?
++			    HNS_ROCE_RNR_TIMER_10NS : attr->min_rnr_timer);
+ 		hr_reg_clear(qpc_mask, QPC_MIN_RNR_TIME);
+ 	}
+ 
+@@ -5509,6 +5540,16 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period)
+ 
+ 	hr_reg_write(cq_context, CQC_CQ_MAX_CNT, cq_count);
+ 	hr_reg_clear(cqc_mask, CQC_CQ_MAX_CNT);
++
++	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
++		if (cq_period * HNS_ROCE_CLOCK_ADJUST > USHRT_MAX) {
++			dev_info(hr_dev->dev,
++				 "cq_period(%u) reached the upper limit, adjusted to 65.\n",
++				 cq_period);
++			cq_period = HNS_ROCE_MAX_CQ_PERIOD;
++		}
++		cq_period *= HNS_ROCE_CLOCK_ADJUST;
++	}
+ 	hr_reg_write(cq_context, CQC_CQ_PERIOD, cq_period);
+ 	hr_reg_clear(cqc_mask, CQC_CQ_PERIOD);
+ 
+@@ -5904,6 +5945,15 @@ static int config_eqc(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq,
+ 	hr_reg_write(eqc, EQC_EQ_PROD_INDX, HNS_ROCE_EQ_INIT_PROD_IDX);
+ 	hr_reg_write(eqc, EQC_EQ_MAX_CNT, eq->eq_max_cnt);
+ 
++	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
++		if (eq->eq_period * HNS_ROCE_CLOCK_ADJUST > USHRT_MAX) {
++			dev_info(hr_dev->dev, "eq_period(%u) reached the upper limit, adjusted to 65.\n",
++				 eq->eq_period);
++			eq->eq_period = HNS_ROCE_MAX_EQ_PERIOD;
++		}
++		eq->eq_period *= HNS_ROCE_CLOCK_ADJUST;
++	}
++
+ 	hr_reg_write(eqc, EQC_EQ_PERIOD, eq->eq_period);
+ 	hr_reg_write(eqc, EQC_EQE_REPORT_TIMER, HNS_ROCE_EQ_INIT_REPORT_TIMER);
+ 	hr_reg_write(eqc, EQC_EQE_BA_L, bt_ba >> 3);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index 4d904d5e82be4..35c61da7ba156 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -1444,6 +1444,14 @@ struct hns_roce_dip {
+ 	struct list_head node;	/* all dips are on a list */
+ };
+ 
++/* only for RNR timeout issue of HIP08 */
++#define HNS_ROCE_CLOCK_ADJUST 1000
++#define HNS_ROCE_MAX_CQ_PERIOD 65
++#define HNS_ROCE_MAX_EQ_PERIOD 65
++#define HNS_ROCE_RNR_TIMER_10NS 1
++#define HNS_ROCE_1US_CFG 999
++#define HNS_ROCE_1NS_CFG 0
++
+ #define HNS_ROCE_AEQ_DEFAULT_BURST_NUM	0x0
+ #define HNS_ROCE_AEQ_DEFAULT_INTERVAL	0x0
+ #define HNS_ROCE_CEQ_DEFAULT_BURST_NUM	0x0
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index 6eee9deadd122..e64ef6903fb4f 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -259,7 +259,7 @@ static int alloc_srq_wrid(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)
+ 
+ static void free_srq_wrid(struct hns_roce_srq *srq)
+ {
+-	kfree(srq->wrid);
++	kvfree(srq->wrid);
+ 	srq->wrid = NULL;
+ }
+ 
+diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
+index ac11943a5ddb0..bf2f30d67949d 100644
+--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
+@@ -941,7 +941,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+ 					       &addrlimit) ||
+ 			    addrlimit > type_max(typeof(pkt->addrlimit))) {
+ 				ret = -EINVAL;
+-				goto free_pbc;
++				goto free_pkt;
+ 			}
+ 			pkt->addrlimit = addrlimit;
+ 
+diff --git a/drivers/input/misc/iqs626a.c b/drivers/input/misc/iqs626a.c
+index d57e996732cf4..23b5dd9552dcc 100644
+--- a/drivers/input/misc/iqs626a.c
++++ b/drivers/input/misc/iqs626a.c
+@@ -456,9 +456,10 @@ struct iqs626_private {
+ 	unsigned int suspend_mode;
+ };
+ 
+-static int iqs626_parse_events(struct iqs626_private *iqs626,
+-			       const struct fwnode_handle *ch_node,
+-			       enum iqs626_ch_id ch_id)
++static noinline_for_stack int
++iqs626_parse_events(struct iqs626_private *iqs626,
++		    const struct fwnode_handle *ch_node,
++		    enum iqs626_ch_id ch_id)
+ {
+ 	struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg;
+ 	struct i2c_client *client = iqs626->client;
+@@ -604,9 +605,10 @@ static int iqs626_parse_events(struct iqs626_private *iqs626,
+ 	return 0;
+ }
+ 
+-static int iqs626_parse_ati_target(struct iqs626_private *iqs626,
+-				   const struct fwnode_handle *ch_node,
+-				   enum iqs626_ch_id ch_id)
++static noinline_for_stack int
++iqs626_parse_ati_target(struct iqs626_private *iqs626,
++			const struct fwnode_handle *ch_node,
++			enum iqs626_ch_id ch_id)
+ {
+ 	struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg;
+ 	struct i2c_client *client = iqs626->client;
+@@ -885,9 +887,10 @@ static int iqs626_parse_trackpad(struct iqs626_private *iqs626,
+ 	return 0;
+ }
+ 
+-static int iqs626_parse_channel(struct iqs626_private *iqs626,
+-				const struct fwnode_handle *ch_node,
+-				enum iqs626_ch_id ch_id)
++static noinline_for_stack int
++iqs626_parse_channel(struct iqs626_private *iqs626,
++		     const struct fwnode_handle *ch_node,
++		     enum iqs626_ch_id ch_id)
+ {
+ 	struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg;
+ 	struct i2c_client *client = iqs626->client;
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 956d9cd347964..ece97f8c6a3e3 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = {
+  */
+ static int elantech_change_report_id(struct psmouse *psmouse)
+ {
+-	unsigned char param[2] = { 0x10, 0x03 };
++	/*
++	 * NOTE: the code is expecting to receive param[] as an array of 3
++	 * items (see __ps2_command()), even if in this case only 2 are
++	 * actually needed. Make sure the array size is 3 to avoid potential
++	 * stack out-of-bound accesses.
++	 */
++	unsigned char param[3] = { 0x10, 0x03 };
+ 
+ 	if (elantech_write_reg_params(psmouse, 0x7, param) ||
+ 	    elantech_read_reg_params(psmouse, 0x7, param) ||
+diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
+index 05de92c0293bc..eb66cd2689b7c 100644
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -1882,7 +1882,7 @@ static int mxt_read_info_block(struct mxt_data *data)
+ 	if (error) {
+ 		dev_err(&client->dev, "Error %d parsing object table\n", error);
+ 		mxt_free_object_table(data);
+-		goto err_free_mem;
++		return error;
+ 	}
+ 
+ 	data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
+diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
+index 68f542bb809f4..b9e2219efbb8f 100644
+--- a/drivers/input/touchscreen/elants_i2c.c
++++ b/drivers/input/touchscreen/elants_i2c.c
+@@ -117,6 +117,19 @@
+ #define ELAN_POWERON_DELAY_USEC	500
+ #define ELAN_RESET_DELAY_MSEC	20
+ 
++/* FW boot code version */
++#define BC_VER_H_BYTE_FOR_EKTH3900x1_I2C        0x72
++#define BC_VER_H_BYTE_FOR_EKTH3900x2_I2C        0x82
++#define BC_VER_H_BYTE_FOR_EKTH3900x3_I2C        0x92
++#define BC_VER_H_BYTE_FOR_EKTH5312x1_I2C        0x6D
++#define BC_VER_H_BYTE_FOR_EKTH5312x2_I2C        0x6E
++#define BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C       0x77
++#define BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C       0x78
++#define BC_VER_H_BYTE_FOR_EKTH5312x1_I2C_USB    0x67
++#define BC_VER_H_BYTE_FOR_EKTH5312x2_I2C_USB    0x68
++#define BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C_USB   0x74
++#define BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C_USB   0x75
++
+ enum elants_chip_id {
+ 	EKTH3500,
+ 	EKTF3624,
+@@ -736,6 +749,37 @@ static int elants_i2c_validate_remark_id(struct elants_data *ts,
+ 	return 0;
+ }
+ 
++static bool elants_i2c_should_check_remark_id(struct elants_data *ts)
++{
++	struct i2c_client *client = ts->client;
++	const u8 bootcode_version = ts->iap_version;
++	bool check;
++
++	/* I2C eKTH3900 and eKTH5312 are NOT support Remark ID */
++	if ((bootcode_version == BC_VER_H_BYTE_FOR_EKTH3900x1_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH3900x2_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH3900x3_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x1_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x2_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x1_I2C_USB) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x2_I2C_USB) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C_USB) ||
++	    (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C_USB)) {
++		dev_dbg(&client->dev,
++			"eKTH3900/eKTH5312(0x%02x) are not support remark id\n",
++			bootcode_version);
++		check = false;
++	} else if (bootcode_version >= 0x60) {
++		check = true;
++	} else {
++		check = false;
++	}
++
++	return check;
++}
++
+ static int elants_i2c_do_update_firmware(struct i2c_client *client,
+ 					 const struct firmware *fw,
+ 					 bool force)
+@@ -749,7 +793,7 @@ static int elants_i2c_do_update_firmware(struct i2c_client *client,
+ 	u16 send_id;
+ 	int page, n_fw_pages;
+ 	int error;
+-	bool check_remark_id = ts->iap_version >= 0x60;
++	bool check_remark_id = elants_i2c_should_check_remark_id(ts);
+ 
+ 	/* Recovery mode detection! */
+ 	if (force) {
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index 4f53d3c57e698..5051a1766aac6 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -162,6 +162,7 @@ static const struct goodix_chip_id goodix_chip_ids[] = {
+ 	{ .id = "911", .data = &gt911_chip_data },
+ 	{ .id = "9271", .data = &gt911_chip_data },
+ 	{ .id = "9110", .data = &gt911_chip_data },
++	{ .id = "9111", .data = &gt911_chip_data },
+ 	{ .id = "927", .data = &gt911_chip_data },
+ 	{ .id = "928", .data = &gt911_chip_data },
+ 
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 240c5af793dce..368f10405e132 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2264,7 +2264,7 @@ void mmc_start_host(struct mmc_host *host)
+ 	_mmc_detect_change(host, 0, false);
+ }
+ 
+-void mmc_stop_host(struct mmc_host *host)
++void __mmc_stop_host(struct mmc_host *host)
+ {
+ 	if (host->slot.cd_irq >= 0) {
+ 		mmc_gpio_set_cd_wake(host, false);
+@@ -2273,6 +2273,11 @@ void mmc_stop_host(struct mmc_host *host)
+ 
+ 	host->rescan_disable = 1;
+ 	cancel_delayed_work_sync(&host->detect);
++}
++
++void mmc_stop_host(struct mmc_host *host)
++{
++	__mmc_stop_host(host);
+ 
+ 	/* clear pm flags now and let card drivers set them as needed */
+ 	host->pm_flags = 0;
+diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h
+index 7931a4f0137d2..f5f3f623ea492 100644
+--- a/drivers/mmc/core/core.h
++++ b/drivers/mmc/core/core.h
+@@ -70,6 +70,7 @@ static inline void mmc_delay(unsigned int ms)
+ 
+ void mmc_rescan(struct work_struct *work);
+ void mmc_start_host(struct mmc_host *host);
++void __mmc_stop_host(struct mmc_host *host);
+ void mmc_stop_host(struct mmc_host *host);
+ 
+ void _mmc_detect_change(struct mmc_host *host, unsigned long delay,
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index d4683b1d263fd..cf140f4ec8643 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -80,9 +80,18 @@ static void mmc_host_classdev_release(struct device *dev)
+ 	kfree(host);
+ }
+ 
++static int mmc_host_classdev_shutdown(struct device *dev)
++{
++	struct mmc_host *host = cls_dev_to_mmc_host(dev);
++
++	__mmc_stop_host(host);
++	return 0;
++}
++
+ static struct class mmc_host_class = {
+ 	.name		= "mmc_host",
+ 	.dev_release	= mmc_host_classdev_release,
++	.shutdown_pre	= mmc_host_classdev_shutdown,
+ 	.pm		= MMC_HOST_CLASS_DEV_PM_OPS,
+ };
+ 
+diff --git a/drivers/mmc/host/meson-mx-sdhc-mmc.c b/drivers/mmc/host/meson-mx-sdhc-mmc.c
+index 7cd9c0ec2fcfe..8fdd0bbbfa21f 100644
+--- a/drivers/mmc/host/meson-mx-sdhc-mmc.c
++++ b/drivers/mmc/host/meson-mx-sdhc-mmc.c
+@@ -135,6 +135,7 @@ static void meson_mx_sdhc_start_cmd(struct mmc_host *mmc,
+ 				    struct mmc_command *cmd)
+ {
+ 	struct meson_mx_sdhc_host *host = mmc_priv(mmc);
++	bool manual_stop = false;
+ 	u32 ictl, send;
+ 	int pack_len;
+ 
+@@ -172,12 +173,27 @@ static void meson_mx_sdhc_start_cmd(struct mmc_host *mmc,
+ 		else
+ 			/* software flush: */
+ 			ictl |= MESON_SDHC_ICTL_DATA_XFER_OK;
++
++		/*
++		 * Mimic the logic from the vendor driver where (only)
++		 * SD_IO_RW_EXTENDED commands with more than one block set the
++		 * MESON_SDHC_MISC_MANUAL_STOP bit. This fixes the firmware
++		 * download in the brcmfmac driver for a BCM43362/1 card.
++		 * Without this sdio_memcpy_toio() (with a size of 219557
++		 * bytes) times out if MESON_SDHC_MISC_MANUAL_STOP is not set.
++		 */
++		manual_stop = cmd->data->blocks > 1 &&
++			      cmd->opcode == SD_IO_RW_EXTENDED;
+ 	} else {
+ 		pack_len = 0;
+ 
+ 		ictl |= MESON_SDHC_ICTL_RESP_OK;
+ 	}
+ 
++	regmap_update_bits(host->regmap, MESON_SDHC_MISC,
++			   MESON_SDHC_MISC_MANUAL_STOP,
++			   manual_stop ? MESON_SDHC_MISC_MANUAL_STOP : 0);
++
+ 	if (cmd->opcode == MMC_STOP_TRANSMISSION)
+ 		send |= MESON_SDHC_SEND_DATA_STOP;
+ 
+diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c
+index fdaa11f92fe6f..a75d3dd34d18c 100644
+--- a/drivers/mmc/host/mmci_stm32_sdmmc.c
++++ b/drivers/mmc/host/mmci_stm32_sdmmc.c
+@@ -441,6 +441,8 @@ static int sdmmc_dlyb_phase_tuning(struct mmci_host *host, u32 opcode)
+ 		return -EINVAL;
+ 	}
+ 
++	writel_relaxed(0, dlyb->base + DLYB_CR);
++
+ 	phase = end_of_len - max_len / 2;
+ 	sdmmc_dlyb_set_cfgr(dlyb, dlyb->unit, phase, false);
+ 
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index a5001875876b9..9762ffab2e236 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -356,23 +356,6 @@ static void tegra_sdhci_set_tap(struct sdhci_host *host, unsigned int tap)
+ 	}
+ }
+ 
+-static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc,
+-					      struct mmc_ios *ios)
+-{
+-	struct sdhci_host *host = mmc_priv(mmc);
+-	u32 val;
+-
+-	val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
+-
+-	if (ios->enhanced_strobe)
+-		val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
+-	else
+-		val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
+-
+-	sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
+-
+-}
+-
+ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask)
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+@@ -793,6 +776,32 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock)
+ 	}
+ }
+ 
++static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc,
++					      struct mmc_ios *ios)
++{
++	struct sdhci_host *host = mmc_priv(mmc);
++	u32 val;
++
++	val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
++
++	if (ios->enhanced_strobe) {
++		val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
++		/*
++		 * When CMD13 is sent from mmc_select_hs400es() after
++		 * switching to HS400ES mode, the bus is operating at
++		 * either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR.
++		 * To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI
++		 * interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host
++		 * controller CAR clock and the interface clock are rate matched.
++		 */
++		tegra_sdhci_set_clock(host, MMC_HS200_MAX_DTR);
++	} else {
++		val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
++	}
++
++	sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
++}
++
+ static unsigned int tegra_sdhci_get_max_clock(struct sdhci_host *host)
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index a8fde3bc458f6..b93337b5a7211 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -1526,7 +1526,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond,
+ 		mac = (u8 *)&newval->value;
+ 	}
+ 
+-	if (!is_valid_ether_addr(mac))
++	if (is_multicast_ether_addr(mac))
+ 		goto err;
+ 
+ 	netdev_dbg(bond->dev, "Setting ad_actor_system to %pM\n", mac);
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
+index 1e46e80f3d6f8..7c2328529ff8e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
+@@ -164,17 +164,10 @@ struct ice_tx_offload_params {
+ };
+ 
+ struct ice_rx_buf {
+-	union {
+-		struct {
+-			dma_addr_t dma;
+-			struct page *page;
+-			unsigned int page_offset;
+-			u16 pagecnt_bias;
+-		};
+-		struct {
+-			struct xdp_buff *xdp;
+-		};
+-	};
++	dma_addr_t dma;
++	struct page *page;
++	unsigned int page_offset;
++	u16 pagecnt_bias;
+ };
+ 
+ struct ice_q_stats {
+@@ -270,6 +263,7 @@ struct ice_ring {
+ 	union {
+ 		struct ice_tx_buf *tx_buf;
+ 		struct ice_rx_buf *rx_buf;
++		struct xdp_buff **xdp_buf;
+ 	};
+ 	/* CL2 - 2nd cacheline starts here */
+ 	u16 q_index;			/* Queue number of ring */
+diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c
+index 5a9f61deeb38d..37c7dc6b44a9f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
+@@ -364,7 +364,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count)
+ {
+ 	union ice_32b_rx_flex_desc *rx_desc;
+ 	u16 ntu = rx_ring->next_to_use;
+-	struct ice_rx_buf *rx_buf;
++	struct xdp_buff **xdp;
+ 	bool ok = true;
+ 	dma_addr_t dma;
+ 
+@@ -372,26 +372,26 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count)
+ 		return true;
+ 
+ 	rx_desc = ICE_RX_DESC(rx_ring, ntu);
+-	rx_buf = &rx_ring->rx_buf[ntu];
++	xdp = &rx_ring->xdp_buf[ntu];
+ 
+ 	do {
+-		rx_buf->xdp = xsk_buff_alloc(rx_ring->xsk_pool);
+-		if (!rx_buf->xdp) {
++		*xdp = xsk_buff_alloc(rx_ring->xsk_pool);
++		if (!xdp) {
+ 			ok = false;
+ 			break;
+ 		}
+ 
+-		dma = xsk_buff_xdp_get_dma(rx_buf->xdp);
++		dma = xsk_buff_xdp_get_dma(*xdp);
+ 		rx_desc->read.pkt_addr = cpu_to_le64(dma);
+ 		rx_desc->wb.status_error0 = 0;
+ 
+ 		rx_desc++;
+-		rx_buf++;
++		xdp++;
+ 		ntu++;
+ 
+ 		if (unlikely(ntu == rx_ring->count)) {
+ 			rx_desc = ICE_RX_DESC(rx_ring, 0);
+-			rx_buf = rx_ring->rx_buf;
++			xdp = rx_ring->xdp_buf;
+ 			ntu = 0;
+ 		}
+ 	} while (--count);
+@@ -421,19 +421,19 @@ static void ice_bump_ntc(struct ice_ring *rx_ring)
+ /**
+  * ice_construct_skb_zc - Create an sk_buff from zero-copy buffer
+  * @rx_ring: Rx ring
+- * @rx_buf: zero-copy Rx buffer
++ * @xdp_arr: Pointer to the SW ring of xdp_buff pointers
+  *
+  * This function allocates a new skb from a zero-copy Rx buffer.
+  *
+  * Returns the skb on success, NULL on failure.
+  */
+ static struct sk_buff *
+-ice_construct_skb_zc(struct ice_ring *rx_ring, struct ice_rx_buf *rx_buf)
++ice_construct_skb_zc(struct ice_ring *rx_ring, struct xdp_buff **xdp_arr)
+ {
+-	unsigned int metasize = rx_buf->xdp->data - rx_buf->xdp->data_meta;
+-	unsigned int datasize = rx_buf->xdp->data_end - rx_buf->xdp->data;
+-	unsigned int datasize_hard = rx_buf->xdp->data_end -
+-				     rx_buf->xdp->data_hard_start;
++	struct xdp_buff *xdp = *xdp_arr;
++	unsigned int metasize = xdp->data - xdp->data_meta;
++	unsigned int datasize = xdp->data_end - xdp->data;
++	unsigned int datasize_hard = xdp->data_end - xdp->data_hard_start;
+ 	struct sk_buff *skb;
+ 
+ 	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize_hard,
+@@ -441,13 +441,13 @@ ice_construct_skb_zc(struct ice_ring *rx_ring, struct ice_rx_buf *rx_buf)
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	skb_reserve(skb, rx_buf->xdp->data - rx_buf->xdp->data_hard_start);
+-	memcpy(__skb_put(skb, datasize), rx_buf->xdp->data, datasize);
++	skb_reserve(skb, xdp->data - xdp->data_hard_start);
++	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+ 	if (metasize)
+ 		skb_metadata_set(skb, metasize);
+ 
+-	xsk_buff_free(rx_buf->xdp);
+-	rx_buf->xdp = NULL;
++	xsk_buff_free(xdp);
++	*xdp_arr = NULL;
+ 	return skb;
+ }
+ 
+@@ -521,7 +521,7 @@ int ice_clean_rx_irq_zc(struct ice_ring *rx_ring, int budget)
+ 	while (likely(total_rx_packets < (unsigned int)budget)) {
+ 		union ice_32b_rx_flex_desc *rx_desc;
+ 		unsigned int size, xdp_res = 0;
+-		struct ice_rx_buf *rx_buf;
++		struct xdp_buff **xdp;
+ 		struct sk_buff *skb;
+ 		u16 stat_err_bits;
+ 		u16 vlan_tag = 0;
+@@ -544,18 +544,18 @@ int ice_clean_rx_irq_zc(struct ice_ring *rx_ring, int budget)
+ 		if (!size)
+ 			break;
+ 
+-		rx_buf = &rx_ring->rx_buf[rx_ring->next_to_clean];
+-		rx_buf->xdp->data_end = rx_buf->xdp->data + size;
+-		xsk_buff_dma_sync_for_cpu(rx_buf->xdp, rx_ring->xsk_pool);
++		xdp = &rx_ring->xdp_buf[rx_ring->next_to_clean];
++		(*xdp)->data_end = (*xdp)->data + size;
++		xsk_buff_dma_sync_for_cpu(*xdp, rx_ring->xsk_pool);
+ 
+-		xdp_res = ice_run_xdp_zc(rx_ring, rx_buf->xdp);
++		xdp_res = ice_run_xdp_zc(rx_ring, *xdp);
+ 		if (xdp_res) {
+ 			if (xdp_res & (ICE_XDP_TX | ICE_XDP_REDIR))
+ 				xdp_xmit |= xdp_res;
+ 			else
+-				xsk_buff_free(rx_buf->xdp);
++				xsk_buff_free(*xdp);
+ 
+-			rx_buf->xdp = NULL;
++			*xdp = NULL;
+ 			total_rx_bytes += size;
+ 			total_rx_packets++;
+ 			cleaned_count++;
+@@ -565,7 +565,7 @@ int ice_clean_rx_irq_zc(struct ice_ring *rx_ring, int budget)
+ 		}
+ 
+ 		/* XDP_PASS path */
+-		skb = ice_construct_skb_zc(rx_ring, rx_buf);
++		skb = ice_construct_skb_zc(rx_ring, xdp);
+ 		if (!skb) {
+ 			rx_ring->rx_stats.alloc_buf_failed++;
+ 			break;
+@@ -810,15 +810,15 @@ bool ice_xsk_any_rx_ring_ena(struct ice_vsi *vsi)
+  */
+ void ice_xsk_clean_rx_ring(struct ice_ring *rx_ring)
+ {
+-	u16 i;
+-
+-	for (i = 0; i < rx_ring->count; i++) {
+-		struct ice_rx_buf *rx_buf = &rx_ring->rx_buf[i];
++	u16 count_mask = rx_ring->count - 1;
++	u16 ntc = rx_ring->next_to_clean;
++	u16 ntu = rx_ring->next_to_use;
+ 
+-		if (!rx_buf->xdp)
+-			continue;
++	for ( ; ntc != ntu; ntc = (ntc + 1) & count_mask) {
++		struct xdp_buff **xdp = &rx_ring->xdp_buf[ntc];
+ 
+-		rx_buf->xdp = NULL;
++		xsk_buff_free(*xdp);
++		*xdp = NULL;
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 533199d819501..82a712f77cb34 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -9247,7 +9247,7 @@ static int __maybe_unused igb_suspend(struct device *dev)
+ 	return __igb_shutdown(to_pci_dev(dev), NULL, 0);
+ }
+ 
+-static int __maybe_unused igb_resume(struct device *dev)
++static int __maybe_unused __igb_resume(struct device *dev, bool rpm)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+ 	struct net_device *netdev = pci_get_drvdata(pdev);
+@@ -9290,17 +9290,24 @@ static int __maybe_unused igb_resume(struct device *dev)
+ 
+ 	wr32(E1000_WUS, ~0);
+ 
+-	rtnl_lock();
++	if (!rpm)
++		rtnl_lock();
+ 	if (!err && netif_running(netdev))
+ 		err = __igb_open(netdev, true);
+ 
+ 	if (!err)
+ 		netif_device_attach(netdev);
+-	rtnl_unlock();
++	if (!rpm)
++		rtnl_unlock();
+ 
+ 	return err;
+ }
+ 
++static int __maybe_unused igb_resume(struct device *dev)
++{
++	return __igb_resume(dev, false);
++}
++
+ static int __maybe_unused igb_runtime_idle(struct device *dev)
+ {
+ 	struct net_device *netdev = dev_get_drvdata(dev);
+@@ -9319,7 +9326,7 @@ static int __maybe_unused igb_runtime_suspend(struct device *dev)
+ 
+ static int __maybe_unused igb_runtime_resume(struct device *dev)
+ {
+-	return igb_resume(dev);
++	return __igb_resume(dev, true);
+ }
+ 
+ static void igb_shutdown(struct pci_dev *pdev)
+@@ -9435,7 +9442,7 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,
+  *  @pdev: Pointer to PCI device
+  *
+  *  Restart the card from scratch, as if from a cold-boot. Implementation
+- *  resembles the first-half of the igb_resume routine.
++ *  resembles the first-half of the __igb_resume routine.
+  **/
+ static pci_ers_result_t igb_io_slot_reset(struct pci_dev *pdev)
+ {
+@@ -9475,7 +9482,7 @@ static pci_ers_result_t igb_io_slot_reset(struct pci_dev *pdev)
+  *
+  *  This callback is called when the error recovery driver tells us that
+  *  its OK to resume normal operation. Implementation resembles the
+- *  second-half of the igb_resume routine.
++ *  second-half of the __igb_resume routine.
+  */
+ static void igb_io_resume(struct pci_dev *pdev)
+ {
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c
+index 44c670807fb3c..aa543b29799ed 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_main.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c
+@@ -54,12 +54,14 @@ int prestera_port_pvid_set(struct prestera_port *port, u16 vid)
+ struct prestera_port *prestera_port_find_by_hwid(struct prestera_switch *sw,
+ 						 u32 dev_id, u32 hw_id)
+ {
+-	struct prestera_port *port = NULL;
++	struct prestera_port *port = NULL, *tmp;
+ 
+ 	read_lock(&sw->port_list_lock);
+-	list_for_each_entry(port, &sw->port_list, list) {
+-		if (port->dev_id == dev_id && port->hw_id == hw_id)
++	list_for_each_entry(tmp, &sw->port_list, list) {
++		if (tmp->dev_id == dev_id && tmp->hw_id == hw_id) {
++			port = tmp;
+ 			break;
++		}
+ 	}
+ 	read_unlock(&sw->port_list_lock);
+ 
+@@ -68,12 +70,14 @@ struct prestera_port *prestera_port_find_by_hwid(struct prestera_switch *sw,
+ 
+ struct prestera_port *prestera_find_port(struct prestera_switch *sw, u32 id)
+ {
+-	struct prestera_port *port = NULL;
++	struct prestera_port *port = NULL, *tmp;
+ 
+ 	read_lock(&sw->port_list_lock);
+-	list_for_each_entry(port, &sw->port_list, list) {
+-		if (port->id == id)
++	list_for_each_entry(tmp, &sw->port_list, list) {
++		if (tmp->id == id) {
++			port = tmp;
+ 			break;
++		}
+ 	}
+ 	read_unlock(&sw->port_list_lock);
+ 
+@@ -703,23 +707,27 @@ static int prestera_netdev_port_event(struct net_device *lower,
+ 				      struct net_device *dev,
+ 				      unsigned long event, void *ptr)
+ {
+-	struct netdev_notifier_changeupper_info *info = ptr;
++	struct netdev_notifier_info *info = ptr;
++	struct netdev_notifier_changeupper_info *cu_info;
+ 	struct prestera_port *port = netdev_priv(dev);
+ 	struct netlink_ext_ack *extack;
+ 	struct net_device *upper;
+ 
+-	extack = netdev_notifier_info_to_extack(&info->info);
+-	upper = info->upper_dev;
++	extack = netdev_notifier_info_to_extack(info);
++	cu_info = container_of(info,
++			       struct netdev_notifier_changeupper_info,
++			       info);
+ 
+ 	switch (event) {
+ 	case NETDEV_PRECHANGEUPPER:
++		upper = cu_info->upper_dev;
+ 		if (!netif_is_bridge_master(upper) &&
+ 		    !netif_is_lag_master(upper)) {
+ 			NL_SET_ERR_MSG_MOD(extack, "Unknown upper device type");
+ 			return -EINVAL;
+ 		}
+ 
+-		if (!info->linking)
++		if (!cu_info->linking)
+ 			break;
+ 
+ 		if (netdev_has_any_upper_dev(upper)) {
+@@ -728,7 +736,7 @@ static int prestera_netdev_port_event(struct net_device *lower,
+ 		}
+ 
+ 		if (netif_is_lag_master(upper) &&
+-		    !prestera_lag_master_check(upper, info->upper_info, extack))
++		    !prestera_lag_master_check(upper, cu_info->upper_info, extack))
+ 			return -EOPNOTSUPP;
+ 		if (netif_is_lag_master(upper) && vlan_uses_dev(dev)) {
+ 			NL_SET_ERR_MSG_MOD(extack,
+@@ -744,14 +752,15 @@ static int prestera_netdev_port_event(struct net_device *lower,
+ 		break;
+ 
+ 	case NETDEV_CHANGEUPPER:
++		upper = cu_info->upper_dev;
+ 		if (netif_is_bridge_master(upper)) {
+-			if (info->linking)
++			if (cu_info->linking)
+ 				return prestera_bridge_port_join(upper, port,
+ 								 extack);
+ 			else
+ 				prestera_bridge_port_leave(upper, port);
+ 		} else if (netif_is_lag_master(upper)) {
+-			if (info->linking)
++			if (cu_info->linking)
+ 				return prestera_lag_port_add(port, upper);
+ 			else
+ 				prestera_lag_port_del(port);
+diff --git a/drivers/net/ethernet/micrel/ks8851_par.c b/drivers/net/ethernet/micrel/ks8851_par.c
+index 2e8fcce50f9d1..c6f517c07bb9a 100644
+--- a/drivers/net/ethernet/micrel/ks8851_par.c
++++ b/drivers/net/ethernet/micrel/ks8851_par.c
+@@ -321,6 +321,8 @@ static int ks8851_probe_par(struct platform_device *pdev)
+ 		return ret;
+ 
+ 	netdev->irq = platform_get_irq(pdev, 0);
++	if (netdev->irq < 0)
++		return netdev->irq;
+ 
+ 	return ks8851_probe_common(netdev, dev, msg_enable);
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+index 7160b42f51ddd..d0111cb3b40e1 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+@@ -201,7 +201,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *,
+ 				   struct qlcnic_info *, u16);
+ int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8);
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *);
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
+ bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *);
+ void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *,
+ 			      struct qlcnic_vf_info *, u16);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+index dd03be3fc82a9..42a44c97572ae 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -432,7 +432,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+ 					    struct qlcnic_cmd_args *cmd)
+ {
+ 	struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+-	int i, num_vlans;
++	int i, num_vlans, ret;
+ 	u16 *vlans;
+ 
+ 	if (sriov->allowed_vlans)
+@@ -443,7 +443,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+ 	dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n",
+ 		 sriov->num_allowed_vlans);
+ 
+-	qlcnic_sriov_alloc_vlans(adapter);
++	ret = qlcnic_sriov_alloc_vlans(adapter);
++	if (ret)
++		return ret;
+ 
+ 	if (!sriov->any_vlan)
+ 		return 0;
+@@ -2154,7 +2156,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter)
+ 	return err;
+ }
+ 
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ {
+ 	struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+ 	struct qlcnic_vf_info *vf;
+@@ -2164,7 +2166,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ 		vf = &sriov->vf_info[i];
+ 		vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,
+ 					  sizeof(*vf->sriov_vlans), GFP_KERNEL);
++		if (!vf->sriov_vlans)
++			return -ENOMEM;
+ 	}
++
++	return 0;
+ }
+ 
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter)
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+index 447720b93e5ab..e90fa97c0ae6c 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+@@ -597,7 +597,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter,
+ 	if (err)
+ 		goto del_flr_queue;
+ 
+-	qlcnic_sriov_alloc_vlans(adapter);
++	err = qlcnic_sriov_alloc_vlans(adapter);
++	if (err)
++		goto del_flr_queue;
+ 
+ 	return err;
+ 
+diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c
+index 966f13e7475dd..11a6aee852e92 100644
+--- a/drivers/net/ethernet/sfc/falcon/rx.c
++++ b/drivers/net/ethernet/sfc/falcon/rx.c
+@@ -728,7 +728,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx,
+ 					    efx->rx_bufs_per_page);
+ 	rx_queue->page_ring = kcalloc(page_ring_size,
+ 				      sizeof(*rx_queue->page_ring), GFP_KERNEL);
+-	rx_queue->page_ptr_mask = page_ring_size - 1;
++	if (!rx_queue->page_ring)
++		rx_queue->page_ptr_mask = 0;
++	else
++		rx_queue->page_ptr_mask = page_ring_size - 1;
+ }
+ 
+ void ef4_init_rx_queue(struct ef4_rx_queue *rx_queue)
+diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c
+index 68fc7d317693b..0983abc0cc5f0 100644
+--- a/drivers/net/ethernet/sfc/rx_common.c
++++ b/drivers/net/ethernet/sfc/rx_common.c
+@@ -150,7 +150,10 @@ static void efx_init_rx_recycle_ring(struct efx_rx_queue *rx_queue)
+ 					    efx->rx_bufs_per_page);
+ 	rx_queue->page_ring = kcalloc(page_ring_size,
+ 				      sizeof(*rx_queue->page_ring), GFP_KERNEL);
+-	rx_queue->page_ptr_mask = page_ring_size - 1;
++	if (!rx_queue->page_ring)
++		rx_queue->page_ptr_mask = 0;
++	else
++		rx_queue->page_ptr_mask = page_ring_size - 1;
+ }
+ 
+ static void efx_fini_rx_recycle_ring(struct efx_rx_queue *rx_queue)
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index b008b4e8a2a5a..0641a1d392b86 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -2070,6 +2070,11 @@ static int smc911x_drv_probe(struct platform_device *pdev)
+ 
+ 	ndev->dma = (unsigned char)-1;
+ 	ndev->irq = platform_get_irq(pdev, 0);
++	if (ndev->irq < 0) {
++		ret = ndev->irq;
++		goto release_both;
++	}
++
+ 	lp = netdev_priv(ndev);
+ 	lp->netdev = ndev;
+ #ifdef SMC_DYNAMIC_BUS_CONFIG
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
+index d046e33b8a297..fac788718c045 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
+@@ -26,7 +26,7 @@
+ #define ETHER_CLK_SEL_FREQ_SEL_125M	(BIT(9) | BIT(8))
+ #define ETHER_CLK_SEL_FREQ_SEL_50M	BIT(9)
+ #define ETHER_CLK_SEL_FREQ_SEL_25M	BIT(8)
+-#define ETHER_CLK_SEL_FREQ_SEL_2P5M	BIT(0)
++#define ETHER_CLK_SEL_FREQ_SEL_2P5M	0
+ #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN BIT(0)
+ #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC BIT(10)
+ #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV BIT(11)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index 580cc035536bd..be9b58b2abf9b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -102,7 +102,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
+ 		time.tv_nsec = priv->plat->est->btr_reserve[0];
+ 		time.tv_sec = priv->plat->est->btr_reserve[1];
+ 		basetime = timespec64_to_ktime(time);
+-		cycle_time = priv->plat->est->ctr[1] * NSEC_PER_SEC +
++		cycle_time = (u64)priv->plat->est->ctr[1] * NSEC_PER_SEC +
+ 			     priv->plat->est->ctr[0];
+ 		time = stmmac_calc_tas_basetime(basetime,
+ 						current_time_ns,
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 185c8a3986816..1d1808afd5295 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1261,6 +1261,11 @@ static int fjes_probe(struct platform_device *plat_dev)
+ 	hw->hw_res.start = res->start;
+ 	hw->hw_res.size = resource_size(res);
+ 	hw->hw_res.irq = platform_get_irq(plat_dev, 0);
++	if (hw->hw_res.irq < 0) {
++		err = hw->hw_res.irq;
++		goto err_free_control_wq;
++	}
++
+ 	err = fjes_hw_init(&adapter->hw);
+ 	if (err)
+ 		goto err_free_control_wq;
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 8666110bec555..35728f1af6a6a 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -792,13 +792,14 @@ static void mkiss_close(struct tty_struct *tty)
+ 	 */
+ 	netif_stop_queue(ax->dev);
+ 
+-	/* Free all AX25 frame buffers. */
++	unregister_netdev(ax->dev);
++
++	/* Free all AX25 frame buffers after unreg. */
+ 	kfree(ax->rbuff);
+ 	kfree(ax->xbuff);
+ 
+ 	ax->tty = NULL;
+ 
+-	unregister_netdev(ax->dev);
+ 	free_netdev(ax->dev);
+ }
+ 
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 1572878c34031..45a67e72a02c6 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -209,6 +209,9 @@ struct tun_struct {
+ 	struct tun_prog __rcu *steering_prog;
+ 	struct tun_prog __rcu *filter_prog;
+ 	struct ethtool_link_ksettings link_ksettings;
++	/* init args */
++	struct file *file;
++	struct ifreq *ifr;
+ };
+ 
+ struct veth {
+@@ -216,6 +219,9 @@ struct veth {
+ 	__be16 h_vlan_TCI;
+ };
+ 
++static void tun_flow_init(struct tun_struct *tun);
++static void tun_flow_uninit(struct tun_struct *tun);
++
+ static int tun_napi_receive(struct napi_struct *napi, int budget)
+ {
+ 	struct tun_file *tfile = container_of(napi, struct tun_file, napi);
+@@ -953,6 +959,49 @@ static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
+ 
+ static const struct ethtool_ops tun_ethtool_ops;
+ 
++static int tun_net_init(struct net_device *dev)
++{
++	struct tun_struct *tun = netdev_priv(dev);
++	struct ifreq *ifr = tun->ifr;
++	int err;
++
++	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
++	if (!dev->tstats)
++		return -ENOMEM;
++
++	spin_lock_init(&tun->lock);
++
++	err = security_tun_dev_alloc_security(&tun->security);
++	if (err < 0) {
++		free_percpu(dev->tstats);
++		return err;
++	}
++
++	tun_flow_init(tun);
++
++	dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
++			   TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
++			   NETIF_F_HW_VLAN_STAG_TX;
++	dev->features = dev->hw_features | NETIF_F_LLTX;
++	dev->vlan_features = dev->features &
++			     ~(NETIF_F_HW_VLAN_CTAG_TX |
++			       NETIF_F_HW_VLAN_STAG_TX);
++
++	tun->flags = (tun->flags & ~TUN_FEATURES) |
++		      (ifr->ifr_flags & TUN_FEATURES);
++
++	INIT_LIST_HEAD(&tun->disabled);
++	err = tun_attach(tun, tun->file, false, ifr->ifr_flags & IFF_NAPI,
++			 ifr->ifr_flags & IFF_NAPI_FRAGS, false);
++	if (err < 0) {
++		tun_flow_uninit(tun);
++		security_tun_dev_free_security(tun->security);
++		free_percpu(dev->tstats);
++		return err;
++	}
++	return 0;
++}
++
+ /* Net device detach from fd. */
+ static void tun_net_uninit(struct net_device *dev)
+ {
+@@ -1169,6 +1218,7 @@ static int tun_net_change_carrier(struct net_device *dev, bool new_carrier)
+ }
+ 
+ static const struct net_device_ops tun_netdev_ops = {
++	.ndo_init		= tun_net_init,
+ 	.ndo_uninit		= tun_net_uninit,
+ 	.ndo_open		= tun_net_open,
+ 	.ndo_stop		= tun_net_close,
+@@ -1252,6 +1302,7 @@ static int tun_xdp_tx(struct net_device *dev, struct xdp_buff *xdp)
+ }
+ 
+ static const struct net_device_ops tap_netdev_ops = {
++	.ndo_init		= tun_net_init,
+ 	.ndo_uninit		= tun_net_uninit,
+ 	.ndo_open		= tun_net_open,
+ 	.ndo_stop		= tun_net_close,
+@@ -1292,7 +1343,7 @@ static void tun_flow_uninit(struct tun_struct *tun)
+ #define MAX_MTU 65535
+ 
+ /* Initialize net device. */
+-static void tun_net_init(struct net_device *dev)
++static void tun_net_initialize(struct net_device *dev)
+ {
+ 	struct tun_struct *tun = netdev_priv(dev);
+ 
+@@ -2206,11 +2257,6 @@ static void tun_free_netdev(struct net_device *dev)
+ 	BUG_ON(!(list_empty(&tun->disabled)));
+ 
+ 	free_percpu(dev->tstats);
+-	/* We clear tstats so that tun_set_iff() can tell if
+-	 * tun_free_netdev() has been called from register_netdevice().
+-	 */
+-	dev->tstats = NULL;
+-
+ 	tun_flow_uninit(tun);
+ 	security_tun_dev_free_security(tun->security);
+ 	__tun_set_ebpf(tun, &tun->steering_prog, NULL);
+@@ -2716,41 +2762,16 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+ 		tun->rx_batched = 0;
+ 		RCU_INIT_POINTER(tun->steering_prog, NULL);
+ 
+-		dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+-		if (!dev->tstats) {
+-			err = -ENOMEM;
+-			goto err_free_dev;
+-		}
+-
+-		spin_lock_init(&tun->lock);
+-
+-		err = security_tun_dev_alloc_security(&tun->security);
+-		if (err < 0)
+-			goto err_free_stat;
+-
+-		tun_net_init(dev);
+-		tun_flow_init(tun);
++		tun->ifr = ifr;
++		tun->file = file;
+ 
+-		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
+-				   TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
+-				   NETIF_F_HW_VLAN_STAG_TX;
+-		dev->features = dev->hw_features | NETIF_F_LLTX;
+-		dev->vlan_features = dev->features &
+-				     ~(NETIF_F_HW_VLAN_CTAG_TX |
+-				       NETIF_F_HW_VLAN_STAG_TX);
+-
+-		tun->flags = (tun->flags & ~TUN_FEATURES) |
+-			      (ifr->ifr_flags & TUN_FEATURES);
+-
+-		INIT_LIST_HEAD(&tun->disabled);
+-		err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
+-				 ifr->ifr_flags & IFF_NAPI_FRAGS, false);
+-		if (err < 0)
+-			goto err_free_flow;
++		tun_net_initialize(dev);
+ 
+ 		err = register_netdevice(tun->dev);
+-		if (err < 0)
+-			goto err_detach;
++		if (err < 0) {
++			free_netdev(dev);
++			return err;
++		}
+ 		/* free_netdev() won't check refcnt, to avoid race
+ 		 * with dev_put() we need publish tun after registration.
+ 		 */
+@@ -2767,24 +2788,6 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+ 
+ 	strcpy(ifr->ifr_name, tun->dev->name);
+ 	return 0;
+-
+-err_detach:
+-	tun_detach_all(dev);
+-	/* We are here because register_netdevice() has failed.
+-	 * If register_netdevice() already called tun_free_netdev()
+-	 * while dealing with the error, dev->stats has been cleared.
+-	 */
+-	if (!dev->tstats)
+-		goto err_free_dev;
+-
+-err_free_flow:
+-	tun_flow_uninit(tun);
+-	security_tun_dev_free_security(tun->security);
+-err_free_stat:
+-	free_percpu(dev->tstats);
+-err_free_dev:
+-	free_netdev(dev);
+-	return err;
+ }
+ 
+ static void tun_get_iff(struct tun_struct *tun, struct ifreq *ifr)
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 38cda590895cc..9aa92076500af 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -9,6 +9,8 @@
+ 
+ #include "asix.h"
+ 
++#define AX_HOST_EN_RETRIES	30
++
+ int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+ 		  u16 size, void *data, int in_pm)
+ {
+@@ -68,7 +70,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)
+ 	int i, ret;
+ 	u8 smsr;
+ 
+-	for (i = 0; i < 30; ++i) {
++	for (i = 0; i < AX_HOST_EN_RETRIES; ++i) {
+ 		ret = asix_set_sw_mii(dev, in_pm);
+ 		if (ret == -ENODEV || ret == -ETIMEDOUT)
+ 			break;
+@@ -77,13 +79,13 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)
+ 				    0, 0, 1, &smsr, in_pm);
+ 		if (ret == -ENODEV)
+ 			break;
+-		else if (ret < 0)
++		else if (ret < sizeof(smsr))
+ 			continue;
+ 		else if (smsr & AX_HOST_EN)
+ 			break;
+ 	}
+ 
+-	return ret;
++	return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret;
+ }
+ 
+ static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index a0401a9dade5b..3e1a83a22fdd6 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -76,6 +76,8 @@
+ #define LAN7801_USB_PRODUCT_ID		(0x7801)
+ #define LAN78XX_EEPROM_MAGIC		(0x78A5)
+ #define LAN78XX_OTP_MAGIC		(0x78F3)
++#define AT29M2AF_USB_VENDOR_ID		(0x07C9)
++#define AT29M2AF_USB_PRODUCT_ID	(0x0012)
+ 
+ #define	MII_READ			1
+ #define	MII_WRITE			0
+@@ -4734,6 +4736,10 @@ static const struct usb_device_id products[] = {
+ 	/* LAN7801 USB Gigabit Ethernet Device */
+ 	USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID),
+ 	},
++	{
++	/* ATM2-AF USB Gigabit Ethernet Device */
++	USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID),
++	},
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, products);
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index d3da350777a4d..c08e0857e8a70 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -32,7 +32,7 @@
+ #define NETNEXT_VERSION		"12"
+ 
+ /* Information for net */
+-#define NET_VERSION		"11"
++#define NET_VERSION		"12"
+ 
+ #define DRIVER_VERSION		"v1." NETNEXT_VERSION "." NET_VERSION
+ #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@×××××××.com>"
+@@ -4016,6 +4016,11 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type)
+ 	ocp_write_word(tp, type, PLA_BP_BA, 0);
+ }
+ 
++static inline void rtl_reset_ocp_base(struct r8152 *tp)
++{
++	tp->ocp_base = -1;
++}
++
+ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait)
+ {
+ 	u16 data, check;
+@@ -4087,8 +4092,6 @@ static int rtl_post_ram_code(struct r8152 *tp, u16 key_addr, bool wait)
+ 
+ 	rtl_phy_patch_request(tp, false, wait);
+ 
+-	ocp_write_word(tp, MCU_TYPE_PLA, PLA_OCP_GPHY_BASE, tp->ocp_base);
+-
+ 	return 0;
+ }
+ 
+@@ -4800,6 +4803,8 @@ static void rtl_ram_code_speed_up(struct r8152 *tp, struct fw_phy_speed_up *phy,
+ 	u32 len;
+ 	u8 *data;
+ 
++	rtl_reset_ocp_base(tp);
++
+ 	if (sram_read(tp, SRAM_GPHY_FW_VER) >= __le16_to_cpu(phy->version)) {
+ 		dev_dbg(&tp->intf->dev, "PHY firmware has been the newest\n");
+ 		return;
+@@ -4845,7 +4850,8 @@ static void rtl_ram_code_speed_up(struct r8152 *tp, struct fw_phy_speed_up *phy,
+ 		}
+ 	}
+ 
+-	ocp_write_word(tp, MCU_TYPE_PLA, PLA_OCP_GPHY_BASE, tp->ocp_base);
++	rtl_reset_ocp_base(tp);
++
+ 	rtl_phy_patch_request(tp, false, wait);
+ 
+ 	if (sram_read(tp, SRAM_GPHY_FW_VER) == __le16_to_cpu(phy->version))
+@@ -4861,6 +4867,8 @@ static int rtl8152_fw_phy_ver(struct r8152 *tp, struct fw_phy_ver *phy_ver)
+ 	ver_addr = __le16_to_cpu(phy_ver->ver.addr);
+ 	ver = __le16_to_cpu(phy_ver->ver.data);
+ 
++	rtl_reset_ocp_base(tp);
++
+ 	if (sram_read(tp, ver_addr) >= ver) {
+ 		dev_dbg(&tp->intf->dev, "PHY firmware has been the newest\n");
+ 		return 0;
+@@ -4877,6 +4885,8 @@ static void rtl8152_fw_phy_fixup(struct r8152 *tp, struct fw_phy_fixup *fix)
+ {
+ 	u16 addr, data;
+ 
++	rtl_reset_ocp_base(tp);
++
+ 	addr = __le16_to_cpu(fix->setting.addr);
+ 	data = ocp_reg_read(tp, addr);
+ 
+@@ -4908,6 +4918,8 @@ static void rtl8152_fw_phy_union_apply(struct r8152 *tp, struct fw_phy_union *ph
+ 	u32 length;
+ 	int i, num;
+ 
++	rtl_reset_ocp_base(tp);
++
+ 	num = phy->pre_num;
+ 	for (i = 0; i < num; i++)
+ 		sram_write(tp, __le16_to_cpu(phy->pre_set[i].addr),
+@@ -4938,6 +4950,8 @@ static void rtl8152_fw_phy_nc_apply(struct r8152 *tp, struct fw_phy_nc *phy)
+ 	u32 length, i, num;
+ 	__le16 *data;
+ 
++	rtl_reset_ocp_base(tp);
++
+ 	mode_reg = __le16_to_cpu(phy->mode_reg);
+ 	sram_write(tp, mode_reg, __le16_to_cpu(phy->mode_pre));
+ 	sram_write(tp, __le16_to_cpu(phy->ba_reg),
+@@ -5107,6 +5121,7 @@ post_fw:
+ 	if (rtl_fw->post_fw)
+ 		rtl_fw->post_fw(tp);
+ 
++	rtl_reset_ocp_base(tp);
+ 	strscpy(rtl_fw->version, fw_hdr->version, RTL_VER_SIZE);
+ 	dev_info(&tp->intf->dev, "load %s successfully\n", rtl_fw->version);
+ }
+@@ -6584,6 +6599,21 @@ static bool rtl8153_in_nway(struct r8152 *tp)
+ 		return true;
+ }
+ 
++static void r8156_mdio_force_mode(struct r8152 *tp)
++{
++	u16 data;
++
++	/* Select force mode through 0xa5b4 bit 15
++	 * 0: MDIO force mode
++	 * 1: MMD force mode
++	 */
++	data = ocp_reg_read(tp, 0xa5b4);
++	if (data & BIT(15)) {
++		data &= ~BIT(15);
++		ocp_reg_write(tp, 0xa5b4, data);
++	}
++}
++
+ static void set_carrier(struct r8152 *tp)
+ {
+ 	struct net_device *netdev = tp->netdev;
+@@ -8016,6 +8046,7 @@ static void r8156_init(struct r8152 *tp)
+ 	ocp_data |= ACT_ODMA;
+ 	ocp_write_byte(tp, MCU_TYPE_USB, USB_BMU_CONFIG, ocp_data);
+ 
++	r8156_mdio_force_mode(tp);
+ 	rtl_tally_reset(tp);
+ 
+ 	tp->coalesce = 15000;	/* 15 us */
+@@ -8145,6 +8176,7 @@ static void r8156b_init(struct r8152 *tp)
+ 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+ 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
+ 
++	r8156_mdio_force_mode(tp);
+ 	rtl_tally_reset(tp);
+ 
+ 	tp->coalesce = 15000;	/* 15 us */
+@@ -8467,6 +8499,8 @@ static int rtl8152_resume(struct usb_interface *intf)
+ 
+ 	mutex_lock(&tp->control);
+ 
++	rtl_reset_ocp_base(tp);
++
+ 	if (test_bit(SELECTIVE_SUSPEND, &tp->flags))
+ 		ret = rtl8152_runtime_resume(tp);
+ 	else
+@@ -8482,6 +8516,7 @@ static int rtl8152_reset_resume(struct usb_interface *intf)
+ 	struct r8152 *tp = usb_get_intfdata(intf);
+ 
+ 	clear_bit(SELECTIVE_SUSPEND, &tp->flags);
++	rtl_reset_ocp_base(tp);
+ 	tp->rtl_ops.init(tp);
+ 	queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ 	set_ethernet_addr(tp, true);
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 50eb43e5bf459..2acdb8ad6c713 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -879,8 +879,12 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget,
+ 
+ 			stats->xdp_bytes += skb->len;
+ 			skb = veth_xdp_rcv_skb(rq, skb, bq, stats);
+-			if (skb)
+-				napi_gro_receive(&rq->xdp_napi, skb);
++			if (skb) {
++				if (skb_shared(skb) || skb_unclone(skb, GFP_ATOMIC))
++					netif_receive_skb(skb);
++				else
++					napi_gro_receive(&rq->xdp_napi, skb);
++			}
+ 		}
+ 		done++;
+ 	}
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 6e6fefeb21ead..cc39c0e18b474 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -1243,6 +1243,18 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+ 		raw_spin_lock_init(&pc->irq_lock[i]);
+ 	}
+ 
++	pc->pctl_desc = *pdata->pctl_desc;
++	pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc);
++	if (IS_ERR(pc->pctl_dev)) {
++		gpiochip_remove(&pc->gpio_chip);
++		return PTR_ERR(pc->pctl_dev);
++	}
++
++	pc->gpio_range = *pdata->gpio_range;
++	pc->gpio_range.base = pc->gpio_chip.base;
++	pc->gpio_range.gc = &pc->gpio_chip;
++	pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
++
+ 	girq = &pc->gpio_chip.irq;
+ 	girq->chip = &bcm2835_gpio_irq_chip;
+ 	girq->parent_handler = bcm2835_gpio_irq_handler;
+@@ -1250,8 +1262,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+ 	girq->parents = devm_kcalloc(dev, BCM2835_NUM_IRQS,
+ 				     sizeof(*girq->parents),
+ 				     GFP_KERNEL);
+-	if (!girq->parents)
++	if (!girq->parents) {
++		pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range);
+ 		return -ENOMEM;
++	}
+ 
+ 	if (is_7211) {
+ 		pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS,
+@@ -1306,21 +1320,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+ 	err = gpiochip_add_data(&pc->gpio_chip, pc);
+ 	if (err) {
+ 		dev_err(dev, "could not add GPIO chip\n");
++		pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range);
+ 		return err;
+ 	}
+ 
+-	pc->pctl_desc = *pdata->pctl_desc;
+-	pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc);
+-	if (IS_ERR(pc->pctl_dev)) {
+-		gpiochip_remove(&pc->gpio_chip);
+-		return PTR_ERR(pc->pctl_dev);
+-	}
+-
+-	pc->gpio_range = *pdata->gpio_range;
+-	pc->gpio_range.base = pc->gpio_chip.base;
+-	pc->gpio_range.gc = &pc->gpio_chip;
+-	pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+index 45ebdeba985ae..12163d3c4bcb0 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -285,8 +285,12 @@ static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n,
+ 	desc = (const struct mtk_pin_desc *)hw->soc->pins;
+ 	*gpio_chip = &hw->chip;
+ 
+-	/* Be greedy to guess first gpio_n is equal to eint_n */
+-	if (desc[eint_n].eint.eint_n == eint_n)
++	/*
++	 * Be greedy to guess first gpio_n is equal to eint_n.
++	 * Only eint virtual eint number is greater than gpio number.
++	 */
++	if (hw->soc->npins > eint_n &&
++	    desc[eint_n].eint.eint_n == eint_n)
+ 		*gpio_n = eint_n;
+ 	else
+ 		*gpio_n = mtk_xt_find_eint_num(hw, eint_n);
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index dfd8888a222a4..8934b4878fa85 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1251,10 +1251,10 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl,
+ 		bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK;
+ 		bank->gpio_chip.base = args.args[1];
+ 
+-		npins = args.args[2];
+-		while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3,
+-							 ++i, &args))
+-			npins += args.args[2];
++		/* get the last defined gpio line (offset + nb of pins) */
++		npins = args.args[0] + args.args[2];
++		while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, ++i, &args))
++			npins = max(npins, (int)(args.args[0] + args.args[2]));
+ 	} else {
+ 		bank_nr = pctl->nbanks;
+ 		bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index 69690e26bb6d4..2734a771d1f00 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -67,7 +67,7 @@ obj-$(CONFIG_THINKPAD_ACPI)	+= thinkpad_acpi.o
+ obj-$(CONFIG_THINKPAD_LMI)	+= think-lmi.o
+ 
+ # Intel
+-obj-$(CONFIG_X86_PLATFORM_DRIVERS_INTEL)		+= intel/
++obj-y				+= intel/
+ 
+ # MSI
+ obj-$(CONFIG_MSI_LAPTOP)	+= msi-laptop.o
+diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c
+index 54b88bedecdf1..d3efd514614c0 100644
+--- a/drivers/platform/x86/amd-pmc.c
++++ b/drivers/platform/x86/amd-pmc.c
+@@ -375,7 +375,8 @@ static int __maybe_unused amd_pmc_resume(struct device *dev)
+ }
+ 
+ static const struct dev_pm_ops amd_pmc_pm_ops = {
+-	SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(amd_pmc_suspend, amd_pmc_resume)
++	.suspend_noirq = amd_pmc_suspend,
++	.resume_noirq = amd_pmc_resume,
+ };
+ 
+ static const struct pci_device_id pmc_pci_ids[] = {
+diff --git a/drivers/platform/x86/intel/Kconfig b/drivers/platform/x86/intel/Kconfig
+index 0b21468e1bd01..02e4481b384e4 100644
+--- a/drivers/platform/x86/intel/Kconfig
++++ b/drivers/platform/x86/intel/Kconfig
+@@ -3,19 +3,6 @@
+ # Intel x86 Platform Specific Drivers
+ #
+ 
+-menuconfig X86_PLATFORM_DRIVERS_INTEL
+-	bool "Intel x86 Platform Specific Device Drivers"
+-	default y
+-	help
+-	  Say Y here to get to see options for device drivers for
+-	  various Intel x86 platforms, including vendor-specific
+-	  drivers. This option alone does not add any kernel code.
+-
+-	  If you say N, all options in this submenu will be skipped
+-	  and disabled.
+-
+-if X86_PLATFORM_DRIVERS_INTEL
+-
+ source "drivers/platform/x86/intel/atomisp2/Kconfig"
+ source "drivers/platform/x86/intel/int1092/Kconfig"
+ source "drivers/platform/x86/intel/int33fe/Kconfig"
+@@ -167,5 +154,3 @@ config INTEL_UNCORE_FREQ_CONTROL
+ 
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called intel-uncore-frequency.
+-
+-endif # X86_PLATFORM_DRIVERS_INTEL
+diff --git a/drivers/platform/x86/intel/pmc/pltdrv.c b/drivers/platform/x86/intel/pmc/pltdrv.c
+index 73797680b895c..15ca8afdd973d 100644
+--- a/drivers/platform/x86/intel/pmc/pltdrv.c
++++ b/drivers/platform/x86/intel/pmc/pltdrv.c
+@@ -65,7 +65,7 @@ static int __init pmc_core_platform_init(void)
+ 
+ 	retval = platform_device_register(pmc_core_device);
+ 	if (retval)
+-		kfree(pmc_core_device);
++		platform_device_put(pmc_core_device);
+ 
+ 	return retval;
+ }
+diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
+index 46feafe4e201c..d8cc4b270644a 100644
+--- a/drivers/spi/spi-armada-3700.c
++++ b/drivers/spi/spi-armada-3700.c
+@@ -901,7 +901,7 @@ static int a3700_spi_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ error_clk:
+-	clk_disable_unprepare(spi->clk);
++	clk_unprepare(spi->clk);
+ error:
+ 	spi_master_put(master);
+ out:
+diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c
+index d167039af519e..1aa843f2ecc7c 100644
+--- a/drivers/tee/optee/shm_pool.c
++++ b/drivers/tee/optee/shm_pool.c
+@@ -41,10 +41,8 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
+ 			goto err;
+ 		}
+ 
+-		for (i = 0; i < nr_pages; i++) {
+-			pages[i] = page;
+-			page++;
+-		}
++		for (i = 0; i < nr_pages; i++)
++			pages[i] = page + i;
+ 
+ 		shm->flags |= TEE_SHM_REGISTER;
+ 		rc = optee_shm_register(shm->ctx, shm, pages, nr_pages,
+diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
+index 8a9384a64f3e2..499fccba3d74b 100644
+--- a/drivers/tee/tee_shm.c
++++ b/drivers/tee/tee_shm.c
+@@ -1,11 +1,11 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2015-2016, Linaro Limited
++ * Copyright (c) 2015-2017, 2019-2021 Linaro Limited
+  */
++#include <linux/anon_inodes.h>
+ #include <linux/device.h>
+-#include <linux/dma-buf.h>
+-#include <linux/fdtable.h>
+ #include <linux/idr.h>
++#include <linux/mm.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/tee_drv.h>
+@@ -28,16 +28,8 @@ static void release_registered_pages(struct tee_shm *shm)
+ 	}
+ }
+ 
+-static void tee_shm_release(struct tee_shm *shm)
++static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)
+ {
+-	struct tee_device *teedev = shm->ctx->teedev;
+-
+-	if (shm->flags & TEE_SHM_DMA_BUF) {
+-		mutex_lock(&teedev->mutex);
+-		idr_remove(&teedev->idr, shm->id);
+-		mutex_unlock(&teedev->mutex);
+-	}
+-
+ 	if (shm->flags & TEE_SHM_POOL) {
+ 		struct tee_shm_pool_mgr *poolm;
+ 
+@@ -64,45 +56,6 @@ static void tee_shm_release(struct tee_shm *shm)
+ 	tee_device_put(teedev);
+ }
+ 
+-static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment
+-			*attach, enum dma_data_direction dir)
+-{
+-	return NULL;
+-}
+-
+-static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach,
+-				     struct sg_table *table,
+-				     enum dma_data_direction dir)
+-{
+-}
+-
+-static void tee_shm_op_release(struct dma_buf *dmabuf)
+-{
+-	struct tee_shm *shm = dmabuf->priv;
+-
+-	tee_shm_release(shm);
+-}
+-
+-static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+-{
+-	struct tee_shm *shm = dmabuf->priv;
+-	size_t size = vma->vm_end - vma->vm_start;
+-
+-	/* Refuse sharing shared memory provided by application */
+-	if (shm->flags & TEE_SHM_USER_MAPPED)
+-		return -EINVAL;
+-
+-	return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
+-			       size, vma->vm_page_prot);
+-}
+-
+-static const struct dma_buf_ops tee_shm_dma_buf_ops = {
+-	.map_dma_buf = tee_shm_op_map_dma_buf,
+-	.unmap_dma_buf = tee_shm_op_unmap_dma_buf,
+-	.release = tee_shm_op_release,
+-	.mmap = tee_shm_op_mmap,
+-};
+-
+ struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags)
+ {
+ 	struct tee_device *teedev = ctx->teedev;
+@@ -137,6 +90,7 @@ struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags)
+ 		goto err_dev_put;
+ 	}
+ 
++	refcount_set(&shm->refcount, 1);
+ 	shm->flags = flags | TEE_SHM_POOL;
+ 	shm->ctx = ctx;
+ 	if (flags & TEE_SHM_DMA_BUF)
+@@ -150,10 +104,7 @@ struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags)
+ 		goto err_kfree;
+ 	}
+ 
+-
+ 	if (flags & TEE_SHM_DMA_BUF) {
+-		DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+-
+ 		mutex_lock(&teedev->mutex);
+ 		shm->id = idr_alloc(&teedev->idr, shm, 1, 0, GFP_KERNEL);
+ 		mutex_unlock(&teedev->mutex);
+@@ -161,28 +112,11 @@ struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags)
+ 			ret = ERR_PTR(shm->id);
+ 			goto err_pool_free;
+ 		}
+-
+-		exp_info.ops = &tee_shm_dma_buf_ops;
+-		exp_info.size = shm->size;
+-		exp_info.flags = O_RDWR;
+-		exp_info.priv = shm;
+-
+-		shm->dmabuf = dma_buf_export(&exp_info);
+-		if (IS_ERR(shm->dmabuf)) {
+-			ret = ERR_CAST(shm->dmabuf);
+-			goto err_rem;
+-		}
+ 	}
+ 
+ 	teedev_ctx_get(ctx);
+ 
+ 	return shm;
+-err_rem:
+-	if (flags & TEE_SHM_DMA_BUF) {
+-		mutex_lock(&teedev->mutex);
+-		idr_remove(&teedev->idr, shm->id);
+-		mutex_unlock(&teedev->mutex);
+-	}
+ err_pool_free:
+ 	poolm->ops->free(poolm, shm);
+ err_kfree:
+@@ -243,6 +177,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
+ 		goto err;
+ 	}
+ 
++	refcount_set(&shm->refcount, 1);
+ 	shm->flags = flags | TEE_SHM_REGISTER;
+ 	shm->ctx = ctx;
+ 	shm->id = -1;
+@@ -303,22 +238,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
+ 		goto err;
+ 	}
+ 
+-	if (flags & TEE_SHM_DMA_BUF) {
+-		DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+-
+-		exp_info.ops = &tee_shm_dma_buf_ops;
+-		exp_info.size = shm->size;
+-		exp_info.flags = O_RDWR;
+-		exp_info.priv = shm;
+-
+-		shm->dmabuf = dma_buf_export(&exp_info);
+-		if (IS_ERR(shm->dmabuf)) {
+-			ret = ERR_CAST(shm->dmabuf);
+-			teedev->desc->ops->shm_unregister(ctx, shm);
+-			goto err;
+-		}
+-	}
+-
+ 	return shm;
+ err:
+ 	if (shm) {
+@@ -336,6 +255,35 @@ err:
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_register);
+ 
++static int tee_shm_fop_release(struct inode *inode, struct file *filp)
++{
++	tee_shm_put(filp->private_data);
++	return 0;
++}
++
++static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma)
++{
++	struct tee_shm *shm = filp->private_data;
++	size_t size = vma->vm_end - vma->vm_start;
++
++	/* Refuse sharing shared memory provided by application */
++	if (shm->flags & TEE_SHM_USER_MAPPED)
++		return -EINVAL;
++
++	/* check for overflowing the buffer's size */
++	if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT)
++		return -EINVAL;
++
++	return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
++			       size, vma->vm_page_prot);
++}
++
++static const struct file_operations tee_shm_fops = {
++	.owner = THIS_MODULE,
++	.release = tee_shm_fop_release,
++	.mmap = tee_shm_fop_mmap,
++};
++
+ /**
+  * tee_shm_get_fd() - Increase reference count and return file descriptor
+  * @shm:	Shared memory handle
+@@ -348,10 +296,11 @@ int tee_shm_get_fd(struct tee_shm *shm)
+ 	if (!(shm->flags & TEE_SHM_DMA_BUF))
+ 		return -EINVAL;
+ 
+-	get_dma_buf(shm->dmabuf);
+-	fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
++	/* matched by tee_shm_put() in tee_shm_op_release() */
++	refcount_inc(&shm->refcount);
++	fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR);
+ 	if (fd < 0)
+-		dma_buf_put(shm->dmabuf);
++		tee_shm_put(shm);
+ 	return fd;
+ }
+ 
+@@ -361,17 +310,7 @@ int tee_shm_get_fd(struct tee_shm *shm)
+  */
+ void tee_shm_free(struct tee_shm *shm)
+ {
+-	/*
+-	 * dma_buf_put() decreases the dmabuf reference counter and will
+-	 * call tee_shm_release() when the last reference is gone.
+-	 *
+-	 * In the case of driver private memory we call tee_shm_release
+-	 * directly instead as it doesn't have a reference counter.
+-	 */
+-	if (shm->flags & TEE_SHM_DMA_BUF)
+-		dma_buf_put(shm->dmabuf);
+-	else
+-		tee_shm_release(shm);
++	tee_shm_put(shm);
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_free);
+ 
+@@ -478,10 +417,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id)
+ 	teedev = ctx->teedev;
+ 	mutex_lock(&teedev->mutex);
+ 	shm = idr_find(&teedev->idr, id);
++	/*
++	 * If the tee_shm was found in the IDR it must have a refcount
++	 * larger than 0 due to the guarantee in tee_shm_put() below. So
++	 * it's safe to use refcount_inc().
++	 */
+ 	if (!shm || shm->ctx != ctx)
+ 		shm = ERR_PTR(-EINVAL);
+-	else if (shm->flags & TEE_SHM_DMA_BUF)
+-		get_dma_buf(shm->dmabuf);
++	else
++		refcount_inc(&shm->refcount);
+ 	mutex_unlock(&teedev->mutex);
+ 	return shm;
+ }
+@@ -493,7 +437,24 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
+  */
+ void tee_shm_put(struct tee_shm *shm)
+ {
+-	if (shm->flags & TEE_SHM_DMA_BUF)
+-		dma_buf_put(shm->dmabuf);
++	struct tee_device *teedev = shm->ctx->teedev;
++	bool do_release = false;
++
++	mutex_lock(&teedev->mutex);
++	if (refcount_dec_and_test(&shm->refcount)) {
++		/*
++		 * refcount has reached 0, we must now remove it from the
++		 * IDR before releasing the mutex. This will guarantee that
++		 * the refcount_inc() in tee_shm_get_from_id() never starts
++		 * from 0.
++		 */
++		if (shm->flags & TEE_SHM_DMA_BUF)
++			idr_remove(&teedev->idr, shm->id);
++		do_release = true;
++	}
++	mutex_unlock(&teedev->mutex);
++
++	if (do_release)
++		tee_shm_release(teedev, shm);
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_put);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 01c00ae8e06d6..daa83525749b3 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -136,15 +136,25 @@ int ext4_datasem_ensure_credits(handle_t *handle, struct inode *inode,
+ static int ext4_ext_get_access(handle_t *handle, struct inode *inode,
+ 				struct ext4_ext_path *path)
+ {
++	int err = 0;
++
+ 	if (path->p_bh) {
+ 		/* path points to block */
+ 		BUFFER_TRACE(path->p_bh, "get_write_access");
+-		return ext4_journal_get_write_access(handle, inode->i_sb,
+-						     path->p_bh, EXT4_JTR_NONE);
++		err = ext4_journal_get_write_access(handle, inode->i_sb,
++						    path->p_bh, EXT4_JTR_NONE);
++		/*
++		 * The extent buffer's verified bit will be set again in
++		 * __ext4_ext_dirty(). We could leave an inconsistent
++		 * buffer if the extents updating procudure break off du
++		 * to some error happens, force to check it again.
++		 */
++		if (!err)
++			clear_buffer_verified(path->p_bh);
+ 	}
+ 	/* path points to leaf/index in inode body */
+ 	/* we use in-core data, no need to protect them */
+-	return 0;
++	return err;
+ }
+ 
+ /*
+@@ -165,6 +175,9 @@ static int __ext4_ext_dirty(const char *where, unsigned int line,
+ 		/* path points to block */
+ 		err = __ext4_handle_dirty_metadata(where, line, handle,
+ 						   inode, path->p_bh);
++		/* Extents updating done, re-set verified flag */
++		if (!err)
++			set_buffer_verified(path->p_bh);
+ 	} else {
+ 		/* path points to leaf/index in inode body */
+ 		err = ext4_mark_inode_dirty(handle, inode);
+@@ -354,9 +367,13 @@ static int ext4_valid_extent_idx(struct inode *inode,
+ 
+ static int ext4_valid_extent_entries(struct inode *inode,
+ 				     struct ext4_extent_header *eh,
+-				     ext4_fsblk_t *pblk, int depth)
++				     ext4_lblk_t lblk, ext4_fsblk_t *pblk,
++				     int depth)
+ {
+ 	unsigned short entries;
++	ext4_lblk_t lblock = 0;
++	ext4_lblk_t prev = 0;
++
+ 	if (eh->eh_entries == 0)
+ 		return 1;
+ 
+@@ -365,31 +382,51 @@ static int ext4_valid_extent_entries(struct inode *inode,
+ 	if (depth == 0) {
+ 		/* leaf entries */
+ 		struct ext4_extent *ext = EXT_FIRST_EXTENT(eh);
+-		ext4_lblk_t lblock = 0;
+-		ext4_lblk_t prev = 0;
+-		int len = 0;
++
++		/*
++		 * The logical block in the first entry should equal to
++		 * the number in the index block.
++		 */
++		if (depth != ext_depth(inode) &&
++		    lblk != le32_to_cpu(ext->ee_block))
++			return 0;
+ 		while (entries) {
+ 			if (!ext4_valid_extent(inode, ext))
+ 				return 0;
+ 
+ 			/* Check for overlapping extents */
+ 			lblock = le32_to_cpu(ext->ee_block);
+-			len = ext4_ext_get_actual_len(ext);
+ 			if ((lblock <= prev) && prev) {
+ 				*pblk = ext4_ext_pblock(ext);
+ 				return 0;
+ 			}
++			prev = lblock + ext4_ext_get_actual_len(ext) - 1;
+ 			ext++;
+ 			entries--;
+-			prev = lblock + len - 1;
+ 		}
+ 	} else {
+ 		struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh);
++
++		/*
++		 * The logical block in the first entry should equal to
++		 * the number in the parent index block.
++		 */
++		if (depth != ext_depth(inode) &&
++		    lblk != le32_to_cpu(ext_idx->ei_block))
++			return 0;
+ 		while (entries) {
+ 			if (!ext4_valid_extent_idx(inode, ext_idx))
+ 				return 0;
++
++			/* Check for overlapping index extents */
++			lblock = le32_to_cpu(ext_idx->ei_block);
++			if ((lblock <= prev) && prev) {
++				*pblk = ext4_idx_pblock(ext_idx);
++				return 0;
++			}
+ 			ext_idx++;
+ 			entries--;
++			prev = lblock;
+ 		}
+ 	}
+ 	return 1;
+@@ -397,7 +434,7 @@ static int ext4_valid_extent_entries(struct inode *inode,
+ 
+ static int __ext4_ext_check(const char *function, unsigned int line,
+ 			    struct inode *inode, struct ext4_extent_header *eh,
+-			    int depth, ext4_fsblk_t pblk)
++			    int depth, ext4_fsblk_t pblk, ext4_lblk_t lblk)
+ {
+ 	const char *error_msg;
+ 	int max = 0, err = -EFSCORRUPTED;
+@@ -423,7 +460,7 @@ static int __ext4_ext_check(const char *function, unsigned int line,
+ 		error_msg = "invalid eh_entries";
+ 		goto corrupted;
+ 	}
+-	if (!ext4_valid_extent_entries(inode, eh, &pblk, depth)) {
++	if (!ext4_valid_extent_entries(inode, eh, lblk, &pblk, depth)) {
+ 		error_msg = "invalid extent entries";
+ 		goto corrupted;
+ 	}
+@@ -453,7 +490,7 @@ corrupted:
+ }
+ 
+ #define ext4_ext_check(inode, eh, depth, pblk)			\
+-	__ext4_ext_check(__func__, __LINE__, (inode), (eh), (depth), (pblk))
++	__ext4_ext_check(__func__, __LINE__, (inode), (eh), (depth), (pblk), 0)
+ 
+ int ext4_ext_check_inode(struct inode *inode)
+ {
+@@ -486,16 +523,18 @@ static void ext4_cache_extents(struct inode *inode,
+ 
+ static struct buffer_head *
+ __read_extent_tree_block(const char *function, unsigned int line,
+-			 struct inode *inode, ext4_fsblk_t pblk, int depth,
+-			 int flags)
++			 struct inode *inode, struct ext4_extent_idx *idx,
++			 int depth, int flags)
+ {
+ 	struct buffer_head		*bh;
+ 	int				err;
+ 	gfp_t				gfp_flags = __GFP_MOVABLE | GFP_NOFS;
++	ext4_fsblk_t			pblk;
+ 
+ 	if (flags & EXT4_EX_NOFAIL)
+ 		gfp_flags |= __GFP_NOFAIL;
+ 
++	pblk = ext4_idx_pblock(idx);
+ 	bh = sb_getblk_gfp(inode->i_sb, pblk, gfp_flags);
+ 	if (unlikely(!bh))
+ 		return ERR_PTR(-ENOMEM);
+@@ -508,8 +547,8 @@ __read_extent_tree_block(const char *function, unsigned int line,
+ 	}
+ 	if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE))
+ 		return bh;
+-	err = __ext4_ext_check(function, line, inode,
+-			       ext_block_hdr(bh), depth, pblk);
++	err = __ext4_ext_check(function, line, inode, ext_block_hdr(bh),
++			       depth, pblk, le32_to_cpu(idx->ei_block));
+ 	if (err)
+ 		goto errout;
+ 	set_buffer_verified(bh);
+@@ -527,8 +566,8 @@ errout:
+ 
+ }
+ 
+-#define read_extent_tree_block(inode, pblk, depth, flags)		\
+-	__read_extent_tree_block(__func__, __LINE__, (inode), (pblk),   \
++#define read_extent_tree_block(inode, idx, depth, flags)		\
++	__read_extent_tree_block(__func__, __LINE__, (inode), (idx),	\
+ 				 (depth), (flags))
+ 
+ /*
+@@ -578,8 +617,7 @@ int ext4_ext_precache(struct inode *inode)
+ 			i--;
+ 			continue;
+ 		}
+-		bh = read_extent_tree_block(inode,
+-					    ext4_idx_pblock(path[i].p_idx++),
++		bh = read_extent_tree_block(inode, path[i].p_idx++,
+ 					    depth - i - 1,
+ 					    EXT4_EX_FORCE_CACHE);
+ 		if (IS_ERR(bh)) {
+@@ -884,8 +922,7 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
+ 		path[ppos].p_depth = i;
+ 		path[ppos].p_ext = NULL;
+ 
+-		bh = read_extent_tree_block(inode, path[ppos].p_block, --i,
+-					    flags);
++		bh = read_extent_tree_block(inode, path[ppos].p_idx, --i, flags);
+ 		if (IS_ERR(bh)) {
+ 			ret = PTR_ERR(bh);
+ 			goto err;
+@@ -1494,7 +1531,6 @@ static int ext4_ext_search_right(struct inode *inode,
+ 	struct ext4_extent_header *eh;
+ 	struct ext4_extent_idx *ix;
+ 	struct ext4_extent *ex;
+-	ext4_fsblk_t block;
+ 	int depth;	/* Note, NOT eh_depth; depth from top of tree */
+ 	int ee_len;
+ 
+@@ -1561,20 +1597,17 @@ got_index:
+ 	 * follow it and find the closest allocated
+ 	 * block to the right */
+ 	ix++;
+-	block = ext4_idx_pblock(ix);
+ 	while (++depth < path->p_depth) {
+ 		/* subtract from p_depth to get proper eh_depth */
+-		bh = read_extent_tree_block(inode, block,
+-					    path->p_depth - depth, 0);
++		bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0);
+ 		if (IS_ERR(bh))
+ 			return PTR_ERR(bh);
+ 		eh = ext_block_hdr(bh);
+ 		ix = EXT_FIRST_INDEX(eh);
+-		block = ext4_idx_pblock(ix);
+ 		put_bh(bh);
+ 	}
+ 
+-	bh = read_extent_tree_block(inode, block, path->p_depth - depth, 0);
++	bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0);
+ 	if (IS_ERR(bh))
+ 		return PTR_ERR(bh);
+ 	eh = ext_block_hdr(bh);
+@@ -2953,9 +2986,9 @@ again:
+ 			ext_debug(inode, "move to level %d (block %llu)\n",
+ 				  i + 1, ext4_idx_pblock(path[i].p_idx));
+ 			memset(path + i + 1, 0, sizeof(*path));
+-			bh = read_extent_tree_block(inode,
+-				ext4_idx_pblock(path[i].p_idx), depth - i - 1,
+-				EXT4_EX_NOCACHE);
++			bh = read_extent_tree_block(inode, path[i].p_idx,
++						    depth - i - 1,
++						    EXT4_EX_NOCACHE);
+ 			if (IS_ERR(bh)) {
+ 				/* should we reset i_size? */
+ 				err = PTR_ERR(bh);
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 1d2d29dcd41ce..6a3b3bec7989d 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -684,8 +684,17 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	}
+ 
+ 	last = here;
+-	while (!IS_XATTR_LAST_ENTRY(last))
++	while (!IS_XATTR_LAST_ENTRY(last)) {
++		if ((void *)(last) + sizeof(__u32) > last_base_addr ||
++			(void *)XATTR_NEXT_ENTRY(last) > last_base_addr) {
++			f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %zu",
++					inode->i_ino, ENTRY_SIZE(last));
++			set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
++			error = -EFSCORRUPTED;
++			goto exit;
++		}
+ 		last = XATTR_NEXT_ENTRY(last);
++	}
+ 
+ 	newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size);
+ 
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index e9b06e339c4b0..0006fc7479ca3 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -2879,9 +2879,13 @@ static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe,
+ 		req->flags |= REQ_F_ISREG;
+ 
+ 	kiocb->ki_pos = READ_ONCE(sqe->off);
+-	if (kiocb->ki_pos == -1 && !(file->f_mode & FMODE_STREAM)) {
+-		req->flags |= REQ_F_CUR_POS;
+-		kiocb->ki_pos = file->f_pos;
++	if (kiocb->ki_pos == -1) {
++		if (!(file->f_mode & FMODE_STREAM)) {
++			req->flags |= REQ_F_CUR_POS;
++			kiocb->ki_pos = file->f_pos;
++		} else {
++			kiocb->ki_pos = 0;
++		}
+ 	}
+ 	kiocb->ki_hint = ki_hint_validate(file_write_hint(kiocb->ki_filp));
+ 	kiocb->ki_flags = iocb_flags(kiocb->ki_filp);
+diff --git a/fs/ksmbd/ndr.c b/fs/ksmbd/ndr.c
+index 8317f7ca402b4..5052be9261d91 100644
+--- a/fs/ksmbd/ndr.c
++++ b/fs/ksmbd/ndr.c
+@@ -148,7 +148,7 @@ static int ndr_read_int16(struct ndr *n, __u16 *value)
+ static int ndr_read_int32(struct ndr *n, __u32 *value)
+ {
+ 	if (n->offset + sizeof(__u32) > n->length)
+-		return 0;
++		return -EINVAL;
+ 
+ 	if (value)
+ 		*value = le32_to_cpu(*(__le32 *)ndr_get_field(n));
+diff --git a/fs/ksmbd/smb2ops.c b/fs/ksmbd/smb2ops.c
+index fb6a65d231391..2a6205103df2c 100644
+--- a/fs/ksmbd/smb2ops.c
++++ b/fs/ksmbd/smb2ops.c
+@@ -272,9 +272,6 @@ int init_smb3_11_server(struct ksmbd_conn *conn)
+ 	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
+ 		conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING;
+ 
+-	if (conn->cipher_type)
+-		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
+-
+ 	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL)
+ 		conn->vals->capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL;
+ 
+diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
+index ad0ea5d36f2ee..cb71cbfc5fc9b 100644
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -917,6 +917,25 @@ static void decode_encrypt_ctxt(struct ksmbd_conn *conn,
+ 	}
+ }
+ 
++/**
++ * smb3_encryption_negotiated() - checks if server and client agreed on enabling encryption
++ * @conn:	smb connection
++ *
++ * Return:	true if connection should be encrypted, else false
++ */
++static bool smb3_encryption_negotiated(struct ksmbd_conn *conn)
++{
++	if (!conn->ops->generate_encryptionkey)
++		return false;
++
++	/*
++	 * SMB 3.0 and 3.0.2 dialects use the SMB2_GLOBAL_CAP_ENCRYPTION flag.
++	 * SMB 3.1.1 uses the cipher_type field.
++	 */
++	return (conn->vals->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) ||
++	    conn->cipher_type;
++}
++
+ static void decode_compress_ctxt(struct ksmbd_conn *conn,
+ 				 struct smb2_compression_ctx *pneg_ctxt)
+ {
+@@ -1471,8 +1490,7 @@ static int ntlm_authenticate(struct ksmbd_work *work)
+ 		    (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
+ 			sess->sign = true;
+ 
+-		if (conn->vals->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION &&
+-		    conn->ops->generate_encryptionkey &&
++		if (smb3_encryption_negotiated(conn) &&
+ 		    !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
+ 			rc = conn->ops->generate_encryptionkey(sess);
+ 			if (rc) {
+@@ -1562,8 +1580,7 @@ static int krb5_authenticate(struct ksmbd_work *work)
+ 	    (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
+ 		sess->sign = true;
+ 
+-	if ((conn->vals->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) &&
+-	    conn->ops->generate_encryptionkey) {
++	if (smb3_encryption_negotiated(conn)) {
+ 		retval = conn->ops->generate_encryptionkey(sess);
+ 		if (retval) {
+ 			ksmbd_debug(SMB,
+@@ -2964,6 +2981,10 @@ int smb2_open(struct ksmbd_work *work)
+ 							    &pntsd_size, &fattr);
+ 					posix_acl_release(fattr.cf_acls);
+ 					posix_acl_release(fattr.cf_dacls);
++					if (rc) {
++						kfree(pntsd);
++						goto err_out;
++					}
+ 
+ 					rc = ksmbd_vfs_set_sd_xattr(conn,
+ 								    user_ns,
+diff --git a/fs/netfs/read_helper.c b/fs/netfs/read_helper.c
+index 4b54529f8176b..242f8bcb34a4c 100644
+--- a/fs/netfs/read_helper.c
++++ b/fs/netfs/read_helper.c
+@@ -958,7 +958,7 @@ int netfs_readpage(struct file *file,
+ 	rreq = netfs_alloc_read_request(ops, netfs_priv, file);
+ 	if (!rreq) {
+ 		if (netfs_priv)
+-			ops->cleanup(netfs_priv, page_file_mapping(page));
++			ops->cleanup(page_file_mapping(page), netfs_priv);
+ 		unlock_page(page);
+ 		return -ENOMEM;
+ 	}
+@@ -1185,7 +1185,7 @@ have_page:
+ 		goto error;
+ have_page_no_wait:
+ 	if (netfs_priv)
+-		ops->cleanup(netfs_priv, mapping);
++		ops->cleanup(mapping, netfs_priv);
+ 	*_page = page;
+ 	_leave(" = 0");
+ 	return 0;
+@@ -1196,7 +1196,7 @@ error:
+ 	unlock_page(page);
+ 	put_page(page);
+ 	if (netfs_priv)
+-		ops->cleanup(netfs_priv, mapping);
++		ops->cleanup(mapping, netfs_priv);
+ 	_leave(" = %d", ret);
+ 	return ret;
+ }
+diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
+index 17715a6c7a409..a0ccba636bf99 100644
+--- a/fs/nfsd/nfs3proc.c
++++ b/fs/nfsd/nfs3proc.c
+@@ -439,22 +439,19 @@ nfsd3_proc_link(struct svc_rqst *rqstp)
+ 
+ static void nfsd3_init_dirlist_pages(struct svc_rqst *rqstp,
+ 				     struct nfsd3_readdirres *resp,
+-				     int count)
++				     u32 count)
+ {
+ 	struct xdr_buf *buf = &resp->dirlist;
+ 	struct xdr_stream *xdr = &resp->xdr;
+ 
+-	count = min_t(u32, count, svc_max_payload(rqstp));
++	count = clamp(count, (u32)(XDR_UNIT * 2), svc_max_payload(rqstp));
+ 
+ 	memset(buf, 0, sizeof(*buf));
+ 
+ 	/* Reserve room for the NULL ptr & eof flag (-2 words) */
+ 	buf->buflen = count - XDR_UNIT * 2;
+ 	buf->pages = rqstp->rq_next_page;
+-	while (count > 0) {
+-		rqstp->rq_next_page++;
+-		count -= PAGE_SIZE;
+-	}
++	rqstp->rq_next_page += (buf->buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 
+ 	/* This is xdr_init_encode(), but it assumes that
+ 	 * the head kvec has already been consumed. */
+@@ -463,7 +460,7 @@ static void nfsd3_init_dirlist_pages(struct svc_rqst *rqstp,
+ 	xdr->page_ptr = buf->pages;
+ 	xdr->iov = NULL;
+ 	xdr->p = page_address(*buf->pages);
+-	xdr->end = xdr->p + (PAGE_SIZE >> 2);
++	xdr->end = (void *)xdr->p + min_t(u32, buf->buflen, PAGE_SIZE);
+ 	xdr->rqst = NULL;
+ }
+ 
+diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
+index 90fcd6178823b..19c568b8a527f 100644
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -557,17 +557,17 @@ nfsd_proc_rmdir(struct svc_rqst *rqstp)
+ 
+ static void nfsd_init_dirlist_pages(struct svc_rqst *rqstp,
+ 				    struct nfsd_readdirres *resp,
+-				    int count)
++				    u32 count)
+ {
+ 	struct xdr_buf *buf = &resp->dirlist;
+ 	struct xdr_stream *xdr = &resp->xdr;
+ 
+-	count = min_t(u32, count, PAGE_SIZE);
++	count = clamp(count, (u32)(XDR_UNIT * 2), svc_max_payload(rqstp));
+ 
+ 	memset(buf, 0, sizeof(*buf));
+ 
+ 	/* Reserve room for the NULL ptr & eof flag (-2 words) */
+-	buf->buflen = count - sizeof(__be32) * 2;
++	buf->buflen = count - XDR_UNIT * 2;
+ 	buf->pages = rqstp->rq_next_page;
+ 	rqstp->rq_next_page++;
+ 
+@@ -578,7 +578,7 @@ static void nfsd_init_dirlist_pages(struct svc_rqst *rqstp,
+ 	xdr->page_ptr = buf->pages;
+ 	xdr->iov = NULL;
+ 	xdr->p = page_address(*buf->pages);
+-	xdr->end = xdr->p + (PAGE_SIZE >> 2);
++	xdr->end = (void *)xdr->p + min_t(u32, buf->buflen, PAGE_SIZE);
+ 	xdr->rqst = NULL;
+ }
+ 
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 3d5af56337bdb..429dcebe2b992 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -121,7 +121,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ 	asm volatile(__stringify_label(c) ":\n\t"			\
+ 		     ".pushsection .discard.reachable\n\t"		\
+ 		     ".long " __stringify_label(c) "b - .\n\t"		\
+-		     ".popsection\n\t");				\
++		     ".popsection\n\t" : : "i" (c));			\
+ })
+ #define annotate_reachable() __annotate_reachable(__COUNTER__)
+ 
+@@ -129,7 +129,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ 	asm volatile(__stringify_label(c) ":\n\t"			\
+ 		     ".pushsection .discard.unreachable\n\t"		\
+ 		     ".long " __stringify_label(c) "b - .\n\t"		\
+-		     ".popsection\n\t");				\
++		     ".popsection\n\t" : : "i" (c));			\
+ })
+ #define annotate_unreachable() __annotate_unreachable(__COUNTER__)
+ 
+diff --git a/include/linux/instrumentation.h b/include/linux/instrumentation.h
+index fa2cd8c63dcc9..24359b4a96053 100644
+--- a/include/linux/instrumentation.h
++++ b/include/linux/instrumentation.h
+@@ -11,7 +11,7 @@
+ 	asm volatile(__stringify(c) ": nop\n\t"				\
+ 		     ".pushsection .discard.instr_begin\n\t"		\
+ 		     ".long " __stringify(c) "b - .\n\t"		\
+-		     ".popsection\n\t");				\
++		     ".popsection\n\t" : : "i" (c));			\
+ })
+ #define instrumentation_begin() __instrumentation_begin(__COUNTER__)
+ 
+@@ -50,7 +50,7 @@
+ 	asm volatile(__stringify(c) ": nop\n\t"				\
+ 		     ".pushsection .discard.instr_end\n\t"		\
+ 		     ".long " __stringify(c) "b - .\n\t"		\
+-		     ".popsection\n\t");				\
++		     ".popsection\n\t" : : "i" (c));			\
+ })
+ #define instrumentation_end() __instrumentation_end(__COUNTER__)
+ #else
+diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
+index ef4a69865737c..c383630d3f065 100644
+--- a/include/linux/ipv6.h
++++ b/include/linux/ipv6.h
+@@ -282,7 +282,6 @@ struct ipv6_pinfo {
+ 	__be32			rcv_flowinfo;
+ 
+ 	__u32			dst_cookie;
+-	__u32			rx_dst_cookie;
+ 
+ 	struct ipv6_mc_socklist	__rcu *ipv6_mc_list;
+ 	struct ipv6_ac_socklist	*ipv6_ac_list;
+diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
+index 3ebfea0781f10..feda1dc7f98ee 100644
+--- a/include/linux/tee_drv.h
++++ b/include/linux/tee_drv.h
+@@ -195,7 +195,7 @@ int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
+  * @offset:	offset of buffer in user space
+  * @pages:	locked pages from userspace
+  * @num_pages:	number of locked pages
+- * @dmabuf:	dmabuf used to for exporting to user space
++ * @refcount:	reference counter
+  * @flags:	defined by TEE_SHM_* in tee_drv.h
+  * @id:		unique id of a shared memory object on this device
+  *
+@@ -210,7 +210,7 @@ struct tee_shm {
+ 	unsigned int offset;
+ 	struct page **pages;
+ 	size_t num_pages;
+-	struct dma_buf *dmabuf;
++	refcount_t refcount;
+ 	u32 flags;
+ 	int id;
+ };
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index 04e87f4b9417c..a960de68ac69e 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -7,9 +7,27 @@
+ #include <uapi/linux/udp.h>
+ #include <uapi/linux/virtio_net.h>
+ 
++static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type)
++{
++	switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
++	case VIRTIO_NET_HDR_GSO_TCPV4:
++		return protocol == cpu_to_be16(ETH_P_IP);
++	case VIRTIO_NET_HDR_GSO_TCPV6:
++		return protocol == cpu_to_be16(ETH_P_IPV6);
++	case VIRTIO_NET_HDR_GSO_UDP:
++		return protocol == cpu_to_be16(ETH_P_IP) ||
++		       protocol == cpu_to_be16(ETH_P_IPV6);
++	default:
++		return false;
++	}
++}
++
+ static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
+ 					   const struct virtio_net_hdr *hdr)
+ {
++	if (skb->protocol)
++		return 0;
++
+ 	switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+ 	case VIRTIO_NET_HDR_GSO_TCPV4:
+ 	case VIRTIO_NET_HDR_GSO_UDP:
+@@ -88,9 +106,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ 			if (!skb->protocol) {
+ 				__be16 protocol = dev_parse_header_protocol(skb);
+ 
+-				virtio_net_hdr_set_proto(skb, hdr);
+-				if (protocol && protocol != skb->protocol)
++				if (!protocol)
++					virtio_net_hdr_set_proto(skb, hdr);
++				else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type))
+ 					return -EINVAL;
++				else
++					skb->protocol = protocol;
+ 			}
+ retry:
+ 			if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
+diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
+index 89163ef8cf4be..9e1111f5915bd 100644
+--- a/include/net/inet_sock.h
++++ b/include/net/inet_sock.h
+@@ -207,11 +207,10 @@ struct inet_sock {
+ 	__be32			inet_saddr;
+ 	__s16			uc_ttl;
+ 	__u16			cmsg_flags;
++	struct ip_options_rcu __rcu	*inet_opt;
+ 	__be16			inet_sport;
+ 	__u16			inet_id;
+ 
+-	struct ip_options_rcu __rcu	*inet_opt;
+-	int			rx_dst_ifindex;
+ 	__u8			tos;
+ 	__u8			min_ttl;
+ 	__u8			mc_ttl;
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 7ac5075f9c18a..dfb92f91d5be5 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -259,6 +259,8 @@ struct bpf_local_storage;
+   *	@sk_rcvbuf: size of receive buffer in bytes
+   *	@sk_wq: sock wait queue and async head
+   *	@sk_rx_dst: receive input route used by early demux
++  *	@sk_rx_dst_ifindex: ifindex for @sk_rx_dst
++  *	@sk_rx_dst_cookie: cookie for @sk_rx_dst
+   *	@sk_dst_cache: destination cache
+   *	@sk_dst_pending_confirm: need to confirm neighbour
+   *	@sk_policy: flow policy
+@@ -430,7 +432,10 @@ struct sock {
+ #ifdef CONFIG_XFRM
+ 	struct xfrm_policy __rcu *sk_policy[2];
+ #endif
+-	struct dst_entry	*sk_rx_dst;
++	struct dst_entry __rcu	*sk_rx_dst;
++	int			sk_rx_dst_ifindex;
++	u32			sk_rx_dst_cookie;
++
+ 	struct dst_entry __rcu	*sk_dst_cache;
+ 	atomic_t		sk_omem_alloc;
+ 	int			sk_sndbuf;
+diff --git a/include/uapi/linux/byteorder/big_endian.h b/include/uapi/linux/byteorder/big_endian.h
+index 2199adc6a6c20..80aa5c41a7636 100644
+--- a/include/uapi/linux/byteorder/big_endian.h
++++ b/include/uapi/linux/byteorder/big_endian.h
+@@ -9,6 +9,7 @@
+ #define __BIG_ENDIAN_BITFIELD
+ #endif
+ 
++#include <linux/stddef.h>
+ #include <linux/types.h>
+ #include <linux/swab.h>
+ 
+diff --git a/include/uapi/linux/byteorder/little_endian.h b/include/uapi/linux/byteorder/little_endian.h
+index 601c904fd5cd9..cd98982e7523e 100644
+--- a/include/uapi/linux/byteorder/little_endian.h
++++ b/include/uapi/linux/byteorder/little_endian.h
+@@ -9,6 +9,7 @@
+ #define __LITTLE_ENDIAN_BITFIELD
+ #endif
+ 
++#include <linux/stddef.h>
+ #include <linux/types.h>
+ #include <linux/swab.h>
+ 
+diff --git a/kernel/crash_core.c b/kernel/crash_core.c
+index eb53f5ec62c90..256cf6db573cd 100644
+--- a/kernel/crash_core.c
++++ b/kernel/crash_core.c
+@@ -6,6 +6,7 @@
+ 
+ #include <linux/buildid.h>
+ #include <linux/crash_core.h>
++#include <linux/init.h>
+ #include <linux/utsname.h>
+ #include <linux/vmalloc.h>
+ 
+@@ -295,6 +296,16 @@ int __init parse_crashkernel_low(char *cmdline,
+ 				"crashkernel=", suffix_tbl[SUFFIX_LOW]);
+ }
+ 
++/*
++ * Add a dummy early_param handler to mark crashkernel= as a known command line
++ * parameter and suppress incorrect warnings in init/main.c.
++ */
++static int __init parse_crashkernel_dummy(char *arg)
++{
++	return 0;
++}
++early_param("crashkernel", parse_crashkernel_dummy);
++
+ Elf_Word *append_elf_note(Elf_Word *buf, char *name, unsigned int type,
+ 			  void *data, size_t data_len)
+ {
+diff --git a/kernel/ucount.c b/kernel/ucount.c
+index eb03f3c68375d..16feb710ee638 100644
+--- a/kernel/ucount.c
++++ b/kernel/ucount.c
+@@ -258,15 +258,16 @@ void dec_ucount(struct ucounts *ucounts, enum ucount_type type)
+ long inc_rlimit_ucounts(struct ucounts *ucounts, enum ucount_type type, long v)
+ {
+ 	struct ucounts *iter;
++	long max = LONG_MAX;
+ 	long ret = 0;
+ 
+ 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
+-		long max = READ_ONCE(iter->ns->ucount_max[type]);
+ 		long new = atomic_long_add_return(v, &iter->ucount[type]);
+ 		if (new < 0 || new > max)
+ 			ret = LONG_MAX;
+ 		else if (iter == ucounts)
+ 			ret = new;
++		max = READ_ONCE(iter->ns->ucount_max[type]);
+ 	}
+ 	return ret;
+ }
+@@ -306,15 +307,16 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type)
+ {
+ 	/* Caller must hold a reference to ucounts */
+ 	struct ucounts *iter;
++	long max = LONG_MAX;
+ 	long dec, ret = 0;
+ 
+ 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
+-		long max = READ_ONCE(iter->ns->ucount_max[type]);
+ 		long new = atomic_long_add_return(1, &iter->ucount[type]);
+ 		if (new < 0 || new > max)
+ 			goto unwind;
+ 		if (iter == ucounts)
+ 			ret = new;
++		max = READ_ONCE(iter->ns->ucount_max[type]);
+ 		/*
+ 		 * Grab an extra ucount reference for the caller when
+ 		 * the rlimit count was previously 0.
+@@ -333,15 +335,16 @@ unwind:
+ 	return 0;
+ }
+ 
+-bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long max)
++bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsigned long rlimit)
+ {
+ 	struct ucounts *iter;
+-	if (get_ucounts_value(ucounts, type) > max)
+-		return true;
++	long max = rlimit;
++	if (rlimit > LONG_MAX)
++		max = LONG_MAX;
+ 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
+-		max = READ_ONCE(iter->ns->ucount_max[type]);
+ 		if (get_ucounts_value(iter, type) > max)
+ 			return true;
++		max = READ_ONCE(iter->ns->ucount_max[type]);
+ 	}
+ 	return false;
+ }
+diff --git a/mm/damon/dbgfs.c b/mm/damon/dbgfs.c
+index f94d19a690dfa..d3bc110430f9d 100644
+--- a/mm/damon/dbgfs.c
++++ b/mm/damon/dbgfs.c
+@@ -309,10 +309,12 @@ static int dbgfs_before_terminate(struct damon_ctx *ctx)
+ 	if (!targetid_is_pid(ctx))
+ 		return 0;
+ 
++	mutex_lock(&ctx->kdamond_lock);
+ 	damon_for_each_target_safe(t, next, ctx) {
+ 		put_pid((struct pid *)t->id);
+ 		damon_destroy_target(t);
+ 	}
++	mutex_unlock(&ctx->kdamond_lock);
+ 	return 0;
+ }
+ 
+diff --git a/mm/kfence/core.c b/mm/kfence/core.c
+index 4b69236aea722..84555b8233efc 100644
+--- a/mm/kfence/core.c
++++ b/mm/kfence/core.c
+@@ -578,6 +578,7 @@ static const struct file_operations objects_fops = {
+ 	.open = open_objects,
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
++	.release = seq_release,
+ };
+ 
+ static int __init kfence_debugfs_init(void)
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index bdbbb32211a58..f66977a171966 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1437,17 +1437,12 @@ static int memory_failure_hugetlb(unsigned long pfn, int flags)
+ 	if (!(flags & MF_COUNT_INCREASED)) {
+ 		res = get_hwpoison_page(p, flags);
+ 		if (!res) {
+-			/*
+-			 * Check "filter hit" and "race with other subpage."
+-			 */
+ 			lock_page(head);
+-			if (PageHWPoison(head)) {
+-				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
+-				    || (p != head && TestSetPageHWPoison(head))) {
++			if (hwpoison_filter(p)) {
++				if (TestClearPageHWPoison(head))
+ 					num_poisoned_pages_dec();
+-					unlock_page(head);
+-					return 0;
+-				}
++				unlock_page(head);
++				return 0;
+ 			}
+ 			unlock_page(head);
+ 			res = MF_FAILED;
+@@ -2206,6 +2201,7 @@ retry:
+ 	} else if (ret == 0) {
+ 		if (soft_offline_free_page(page) && try_again) {
+ 			try_again = false;
++			flags &= ~MF_COUNT_INCREASED;
+ 			goto retry;
+ 		}
+ 	}
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index d12e0608fced2..fa9ed9c98739a 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2140,8 +2140,7 @@ struct page *alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
+ 			 * memory with both reclaim and compact as well.
+ 			 */
+ 			if (!page && (gfp & __GFP_DIRECT_RECLAIM))
+-				page = __alloc_pages_node(hpage_node,
+-								gfp, order);
++				page = __alloc_pages(gfp, order, hpage_node, nmask);
+ 
+ 			goto out;
+ 		}
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 2631efc6e359f..aa7785687e757 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -85,8 +85,10 @@ static void ax25_kill_by_device(struct net_device *dev)
+ again:
+ 	ax25_for_each(s, &ax25_list) {
+ 		if (s->ax25_dev == ax25_dev) {
+-			s->ax25_dev = NULL;
+ 			spin_unlock_bh(&ax25_list_lock);
++			lock_sock(s->sk);
++			s->ax25_dev = NULL;
++			release_sock(s->sk);
+ 			ax25_disconnect(s, ENETUNREACH);
+ 			spin_lock_bh(&ax25_list_lock);
+ 
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 793b0db9d9a36..9922497e59f8c 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -71,7 +71,8 @@ static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
+ 
+ 	num = br_fdb_fillbuf(br, buf, maxnum, offset);
+ 	if (num > 0) {
+-		if (copy_to_user(userbuf, buf, num*sizeof(struct __fdb_entry)))
++		if (copy_to_user(userbuf, buf,
++				 array_size(num, sizeof(struct __fdb_entry))))
+ 			num = -EFAULT;
+ 	}
+ 	kfree(buf);
+@@ -188,7 +189,7 @@ int br_dev_siocdevprivate(struct net_device *dev, struct ifreq *rq, void __user
+ 			return -ENOMEM;
+ 
+ 		get_port_ifindices(br, indices, num);
+-		if (copy_to_user(argp, indices, num * sizeof(int)))
++		if (copy_to_user(argp, indices, array_size(num, sizeof(int))))
+ 			num =  -EFAULT;
+ 		kfree(indices);
+ 		return num;
+@@ -336,7 +337,8 @@ static int old_deviceless(struct net *net, void __user *uarg)
+ 
+ 		args[2] = get_bridge_ifindices(net, indices, args[2]);
+ 
+-		ret = copy_to_user(uarg, indices, args[2]*sizeof(int))
++		ret = copy_to_user((void __user *)args[1], indices,
++				   array_size(args[2], sizeof(int)))
+ 			? -EFAULT : args[2];
+ 
+ 		kfree(indices);
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 64062b7ce61df..3a9422a5873eb 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -158,7 +158,7 @@ void inet_sock_destruct(struct sock *sk)
+ 
+ 	kfree(rcu_dereference_protected(inet->inet_opt, 1));
+ 	dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
+-	dst_release(sk->sk_rx_dst);
++	dst_release(rcu_dereference_protected(sk->sk_rx_dst, 1));
+ 	sk_refcnt_debug_dec(sk);
+ }
+ EXPORT_SYMBOL(inet_sock_destruct);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 844c6e5a82891..f48f1059b31a6 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3039,8 +3039,7 @@ int tcp_disconnect(struct sock *sk, int flags)
+ 	icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
+ 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
+ 	__sk_dst_reset(sk);
+-	dst_release(sk->sk_rx_dst);
+-	sk->sk_rx_dst = NULL;
++	dst_release(xchg((__force struct dst_entry **)&sk->sk_rx_dst, NULL));
+ 	tcp_saved_syn_free(tp);
+ 	tp->compressed_ack = 0;
+ 	tp->segs_in = 0;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 141e85e6422b1..f3b6239674361 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5770,7 +5770,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb)
+ 	trace_tcp_probe(sk, skb);
+ 
+ 	tcp_mstamp_refresh(tp);
+-	if (unlikely(!sk->sk_rx_dst))
++	if (unlikely(!rcu_access_pointer(sk->sk_rx_dst)))
+ 		inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb);
+ 	/*
+ 	 *	Header prediction.
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 5b8ce65dfc067..0fe9461647da5 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1698,16 +1698,19 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+ 	struct sock *rsk;
+ 
+ 	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+-		struct dst_entry *dst = sk->sk_rx_dst;
++		struct dst_entry *dst;
++
++		dst = rcu_dereference_protected(sk->sk_rx_dst,
++						lockdep_sock_is_held(sk));
+ 
+ 		sock_rps_save_rxhash(sk, skb);
+ 		sk_mark_napi_id(sk, skb);
+ 		if (dst) {
+-			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
++			if (sk->sk_rx_dst_ifindex != skb->skb_iif ||
+ 			    !INDIRECT_CALL_1(dst->ops->check, ipv4_dst_check,
+ 					     dst, 0)) {
++				RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
+ 				dst_release(dst);
+-				sk->sk_rx_dst = NULL;
+ 			}
+ 		}
+ 		tcp_rcv_established(sk, skb);
+@@ -1783,12 +1786,12 @@ int tcp_v4_early_demux(struct sk_buff *skb)
+ 		skb->sk = sk;
+ 		skb->destructor = sock_edemux;
+ 		if (sk_fullsock(sk)) {
+-			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
++			struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
+ 
+ 			if (dst)
+ 				dst = dst_check(dst, 0);
+ 			if (dst &&
+-			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
++			    sk->sk_rx_dst_ifindex == skb->skb_iif)
+ 				skb_dst_set_noref(skb, dst);
+ 		}
+ 	}
+@@ -2200,8 +2203,8 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+ 	struct dst_entry *dst = skb_dst(skb);
+ 
+ 	if (dst && dst_hold_safe(dst)) {
+-		sk->sk_rx_dst = dst;
+-		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
++		rcu_assign_pointer(sk->sk_rx_dst, dst);
++		sk->sk_rx_dst_ifindex = skb->skb_iif;
+ 	}
+ }
+ EXPORT_SYMBOL(inet_sk_rx_dst_set);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 3f6823bdd31e5..be07e3d2b77bc 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2251,7 +2251,7 @@ bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+ 	struct dst_entry *old;
+ 
+ 	if (dst_hold_safe(dst)) {
+-		old = xchg(&sk->sk_rx_dst, dst);
++		old = xchg((__force struct dst_entry **)&sk->sk_rx_dst, dst);
+ 		dst_release(old);
+ 		return old != dst;
+ 	}
+@@ -2441,7 +2441,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 		struct dst_entry *dst = skb_dst(skb);
+ 		int ret;
+ 
+-		if (unlikely(sk->sk_rx_dst != dst))
++		if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst))
+ 			udp_sk_rx_dst_set(sk, dst);
+ 
+ 		ret = udp_unicast_rcv_skb(sk, skb, uh);
+@@ -2600,7 +2600,7 @@ int udp_v4_early_demux(struct sk_buff *skb)
+ 
+ 	skb->sk = sk;
+ 	skb->destructor = sock_efree;
+-	dst = READ_ONCE(sk->sk_rx_dst);
++	dst = rcu_dereference(sk->sk_rx_dst);
+ 
+ 	if (dst)
+ 		dst = dst_check(dst, 0);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index b03dd02c9f13c..8eedf59e9cf25 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -107,9 +107,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+ 	if (dst && dst_hold_safe(dst)) {
+ 		const struct rt6_info *rt = (const struct rt6_info *)dst;
+ 
+-		sk->sk_rx_dst = dst;
+-		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+-		tcp_inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
++		rcu_assign_pointer(sk->sk_rx_dst, dst);
++		sk->sk_rx_dst_ifindex = skb->skb_iif;
++		sk->sk_rx_dst_cookie = rt6_get_cookie(rt);
+ 	}
+ }
+ 
+@@ -1504,16 +1504,19 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ 		opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
+ 
+ 	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+-		struct dst_entry *dst = sk->sk_rx_dst;
++		struct dst_entry *dst;
++
++		dst = rcu_dereference_protected(sk->sk_rx_dst,
++						lockdep_sock_is_held(sk));
+ 
+ 		sock_rps_save_rxhash(sk, skb);
+ 		sk_mark_napi_id(sk, skb);
+ 		if (dst) {
+-			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
++			if (sk->sk_rx_dst_ifindex != skb->skb_iif ||
+ 			    INDIRECT_CALL_1(dst->ops->check, ip6_dst_check,
+-					    dst, np->rx_dst_cookie) == NULL) {
++					    dst, sk->sk_rx_dst_cookie) == NULL) {
++				RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
+ 				dst_release(dst);
+-				sk->sk_rx_dst = NULL;
+ 			}
+ 		}
+ 
+@@ -1875,12 +1878,12 @@ INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb)
+ 		skb->sk = sk;
+ 		skb->destructor = sock_edemux;
+ 		if (sk_fullsock(sk)) {
+-			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
++			struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
+ 
+ 			if (dst)
+-				dst = dst_check(dst, tcp_inet6_sk(sk)->rx_dst_cookie);
++				dst = dst_check(dst, sk->sk_rx_dst_cookie);
+ 			if (dst &&
+-			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
++			    sk->sk_rx_dst_ifindex == skb->skb_iif)
+ 				skb_dst_set_noref(skb, dst);
+ 		}
+ 	}
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index be6dc64ece29f..7bee95d8d2df0 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -884,7 +884,7 @@ static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+ 	if (udp_sk_rx_dst_set(sk, dst)) {
+ 		const struct rt6_info *rt = (const struct rt6_info *)dst;
+ 
+-		inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
++		sk->sk_rx_dst_cookie = rt6_get_cookie(rt);
+ 	}
+ }
+ 
+@@ -956,7 +956,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 		struct dst_entry *dst = skb_dst(skb);
+ 		int ret;
+ 
+-		if (unlikely(sk->sk_rx_dst != dst))
++		if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst))
+ 			udp6_sk_rx_dst_set(sk, dst);
+ 
+ 		if (!uh->check && !udp_sk(sk)->no_check6_rx) {
+@@ -1070,10 +1070,10 @@ INDIRECT_CALLABLE_SCOPE void udp_v6_early_demux(struct sk_buff *skb)
+ 
+ 	skb->sk = sk;
+ 	skb->destructor = sock_efree;
+-	dst = READ_ONCE(sk->sk_rx_dst);
++	dst = rcu_dereference(sk->sk_rx_dst);
+ 
+ 	if (dst)
+-		dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
++		dst = dst_check(dst, sk->sk_rx_dst_cookie);
+ 	if (dst) {
+ 		/* set noref for now.
+ 		 * any place which wants to hold dst has to call
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index d3f62fd12f0b5..1bf83b8d84021 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1226,7 +1226,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 	return 0;
+ 
+ error:
++	mutex_lock(&local->mtx);
+ 	ieee80211_vif_release_channel(sdata);
++	mutex_unlock(&local->mtx);
++
+ 	return err;
+ }
+ 
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index c0851fec11d46..c207728226372 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4481,9 +4481,9 @@ struct nft_set_elem_catchall {
+ static void nft_set_catchall_destroy(const struct nft_ctx *ctx,
+ 				     struct nft_set *set)
+ {
+-	struct nft_set_elem_catchall *catchall;
++	struct nft_set_elem_catchall *next, *catchall;
+ 
+-	list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
++	list_for_each_entry_safe(catchall, next, &set->catchall_list, list) {
+ 		list_del_rcu(&catchall->list);
+ 		nft_set_elem_destroy(set, catchall->elem, true);
+ 		kfree_rcu(catchall);
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 691ef4cffdd90..7f83f9697fc14 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -556,7 +556,8 @@ __build_packet_message(struct nfnl_log_net *log,
+ 		goto nla_put_failure;
+ 
+ 	if (indev && skb->dev &&
+-	    skb->mac_header != skb->network_header) {
++	    skb_mac_header_was_set(skb) &&
++	    skb_mac_header_len(skb) != 0) {
+ 		struct nfulnl_msg_packet_hw phw;
+ 		int len;
+ 
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index 4acc4b8e9fe5a..959527708e382 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -560,7 +560,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ 		goto nla_put_failure;
+ 
+ 	if (indev && entskb->dev &&
+-	    skb_mac_header_was_set(entskb)) {
++	    skb_mac_header_was_set(entskb) &&
++	    skb_mac_header_len(entskb) != 0) {
+ 		struct nfqnl_msg_packet_hw phw;
+ 		int len;
+ 
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index a1525916885ae..72018e5e4d8ef 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -946,6 +946,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ 			ret =  -EBUSY;
+ 		else if (sk->sk_state == TCP_ESTABLISHED)
+ 			ret = -EISCONN;
++		else if (!pn->pn_sk.sobject)
++			ret = -EADDRNOTAVAIL;
+ 		else
+ 			ret = pep_sock_enable(sk, NULL, 0);
+ 		release_sock(sk);
+diff --git a/sound/core/jack.c b/sound/core/jack.c
+index 32350c6aba849..537df1e98f8ac 100644
+--- a/sound/core/jack.c
++++ b/sound/core/jack.c
+@@ -509,6 +509,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,
+ 		return -ENOMEM;
+ 
+ 	jack->id = kstrdup(id, GFP_KERNEL);
++	if (jack->id == NULL) {
++		kfree(jack);
++		return -ENOMEM;
++	}
+ 
+ 	/* don't creat input device for phantom jack */
+ 	if (!phantom_jack) {
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 6f30231bdb884..befa9809ff001 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -447,6 +447,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
+ 		err = -ENOMEM;
+ 		goto __error;
+ 	}
++	rawmidi_file->user_pversion = 0;
+ 	init_waitqueue_entry(&wait, current);
+ 	add_wait_queue(&rmidi->open_wait, &wait);
+ 	while (1) {
+diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
+index e1b69c65c3c88..e2b7be67f0e30 100644
+--- a/sound/drivers/opl3/opl3_midi.c
++++ b/sound/drivers/opl3/opl3_midi.c
+@@ -397,7 +397,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
+ 	}
+ 	if (instr_4op) {
+ 		vp2 = &opl3->voices[voice + 3];
+-		if (vp->state > 0) {
++		if (vp2->state > 0) {
+ 			opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK +
+ 					       voice_offset + 3);
+ 			reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 415701bd10ac8..ffcde7409d2a5 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2947,7 +2947,8 @@ static int parse_intel_hdmi(struct hda_codec *codec)
+ 
+ /* Intel Haswell and onwards; audio component with eld notifier */
+ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid,
+-				 const int *port_map, int port_num, int dev_num)
++				 const int *port_map, int port_num, int dev_num,
++				 bool send_silent_stream)
+ {
+ 	struct hdmi_spec *spec;
+ 	int err;
+@@ -2980,7 +2981,7 @@ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid,
+ 	 * Enable silent stream feature, if it is enabled via
+ 	 * module param or Kconfig option
+ 	 */
+-	if (enable_silent_stream)
++	if (send_silent_stream)
+ 		spec->send_silent_stream = true;
+ 
+ 	return parse_intel_hdmi(codec);
+@@ -2988,12 +2989,18 @@ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid,
+ 
+ static int patch_i915_hsw_hdmi(struct hda_codec *codec)
+ {
+-	return intel_hsw_common_init(codec, 0x08, NULL, 0, 3);
++	return intel_hsw_common_init(codec, 0x08, NULL, 0, 3,
++				     enable_silent_stream);
+ }
+ 
+ static int patch_i915_glk_hdmi(struct hda_codec *codec)
+ {
+-	return intel_hsw_common_init(codec, 0x0b, NULL, 0, 3);
++	/*
++	 * Silent stream calls audio component .get_power() from
++	 * .pin_eld_notify(). On GLK this will deadlock in i915 due
++	 * to the audio vs. CDCLK workaround.
++	 */
++	return intel_hsw_common_init(codec, 0x0b, NULL, 0, 3, false);
+ }
+ 
+ static int patch_i915_icl_hdmi(struct hda_codec *codec)
+@@ -3004,7 +3011,8 @@ static int patch_i915_icl_hdmi(struct hda_codec *codec)
+ 	 */
+ 	static const int map[] = {0x0, 0x4, 0x6, 0x8, 0xa, 0xb};
+ 
+-	return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map), 3);
++	return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map), 3,
++				     enable_silent_stream);
+ }
+ 
+ static int patch_i915_tgl_hdmi(struct hda_codec *codec)
+@@ -3016,7 +3024,8 @@ static int patch_i915_tgl_hdmi(struct hda_codec *codec)
+ 	static const int map[] = {0x4, 0x6, 0x8, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf};
+ 	int ret;
+ 
+-	ret = intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map), 4);
++	ret = intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map), 4,
++				    enable_silent_stream);
+ 	if (!ret) {
+ 		struct hdmi_spec *spec = codec->spec;
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3599f4c85ebf7..28255e752c4a1 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6546,6 +6546,23 @@ static void alc233_fixup_no_audio_jack(struct hda_codec *codec,
+ 	alc_process_coef_fw(codec, alc233_fixup_no_audio_jack_coefs);
+ }
+ 
++static void alc256_fixup_mic_no_presence_and_resume(struct hda_codec *codec,
++						    const struct hda_fixup *fix,
++						    int action)
++{
++	/*
++	 * The Clevo NJ51CU comes either with the ALC293 or the ALC256 codec,
++	 * but uses the 0x8686 subproduct id in both cases. The ALC256 codec
++	 * needs an additional quirk for sound working after suspend and resume.
++	 */
++	if (codec->core.vendor_id == 0x10ec0256) {
++		alc_update_coef_idx(codec, 0x10, 1<<9, 0);
++		snd_hda_codec_set_pincfg(codec, 0x19, 0x04a11120);
++	} else {
++		snd_hda_codec_set_pincfg(codec, 0x1a, 0x04a1113c);
++	}
++}
++
+ enum {
+ 	ALC269_FIXUP_GPIO2,
+ 	ALC269_FIXUP_SONY_VAIO,
+@@ -6766,6 +6783,7 @@ enum {
+ 	ALC256_FIXUP_SET_COEF_DEFAULTS,
+ 	ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ 	ALC233_FIXUP_NO_AUDIO_JACK,
++	ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME,
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -8490,6 +8508,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc233_fixup_no_audio_jack,
+ 	},
++	[ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc256_fixup_mic_no_presence_and_resume,
++		.chained = true,
++		.chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -8660,6 +8684,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN),
+ 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
++	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ 	SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
+@@ -8705,6 +8730,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
+ 	SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ 	SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
++	SND_PCI_QUIRK(0x103c, 0x89ca, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+ 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -8829,7 +8855,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[57][0-9]RZ[Q]", ALC269_FIXUP_DMIC),
+ 	SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+-	SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME),
+ 	SND_PCI_QUIRK(0x1558, 0x8a20, "Clevo NH55DCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+@@ -9123,6 +9149,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
+ 	{.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
+ 	{.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},
++	{.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"},
+ 	{}
+ };
+ #define ALC225_STANDARD_PINS \
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 5ac2b1444694d..757d1362b5f48 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -927,6 +927,8 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert)
+ 	unsigned int val, count;
+ 
+ 	if (jack_insert) {
++		snd_soc_dapm_mutex_lock(dapm);
++
+ 		snd_soc_component_update_bits(component, RT5682_PWR_ANLG_1,
+ 			RT5682_PWR_VREF2 | RT5682_PWR_MB,
+ 			RT5682_PWR_VREF2 | RT5682_PWR_MB);
+@@ -973,6 +975,8 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert)
+ 		snd_soc_component_update_bits(component, RT5682_MICBIAS_2,
+ 			RT5682_PWR_CLK25M_MASK | RT5682_PWR_CLK1M_MASK,
+ 			RT5682_PWR_CLK25M_PU | RT5682_PWR_CLK1M_PU);
++
++		snd_soc_dapm_mutex_unlock(dapm);
+ 	} else {
+ 		rt5682_enable_push_button_irq(component, false);
+ 		snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
+diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c
+index 172e79cbe0daf..6549e7fef3e32 100644
+--- a/sound/soc/codecs/tas2770.c
++++ b/sound/soc/codecs/tas2770.c
+@@ -291,11 +291,11 @@ static int tas2770_set_samplerate(struct tas2770_priv *tas2770, int samplerate)
+ 		ramp_rate_val = TAS2770_TDM_CFG_REG0_SMP_44_1KHZ |
+ 				TAS2770_TDM_CFG_REG0_31_88_2_96KHZ;
+ 		break;
+-	case 19200:
++	case 192000:
+ 		ramp_rate_val = TAS2770_TDM_CFG_REG0_SMP_48KHZ |
+ 				TAS2770_TDM_CFG_REG0_31_176_4_192KHZ;
+ 		break;
+-	case 17640:
++	case 176400:
+ 		ramp_rate_val = TAS2770_TDM_CFG_REG0_SMP_44_1KHZ |
+ 				TAS2770_TDM_CFG_REG0_31_176_4_192KHZ;
+ 		break;
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index 9322245521463..67729de41a73e 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -18,7 +18,6 @@
+ #define AIU_RST_SOFT_I2S_FAST		BIT(0)
+ 
+ #define AIU_I2S_DAC_CFG_MSB_FIRST	BIT(2)
+-#define AIU_I2S_MISC_HOLD_EN		BIT(2)
+ #define AIU_CLK_CTRL_I2S_DIV_EN		BIT(0)
+ #define AIU_CLK_CTRL_I2S_DIV		GENMASK(3, 2)
+ #define AIU_CLK_CTRL_AOCLK_INVERT	BIT(6)
+@@ -36,37 +35,6 @@ static void aiu_encoder_i2s_divider_enable(struct snd_soc_component *component,
+ 				      enable ? AIU_CLK_CTRL_I2S_DIV_EN : 0);
+ }
+ 
+-static void aiu_encoder_i2s_hold(struct snd_soc_component *component,
+-				 bool enable)
+-{
+-	snd_soc_component_update_bits(component, AIU_I2S_MISC,
+-				      AIU_I2S_MISC_HOLD_EN,
+-				      enable ? AIU_I2S_MISC_HOLD_EN : 0);
+-}
+-
+-static int aiu_encoder_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+-				   struct snd_soc_dai *dai)
+-{
+-	struct snd_soc_component *component = dai->component;
+-
+-	switch (cmd) {
+-	case SNDRV_PCM_TRIGGER_START:
+-	case SNDRV_PCM_TRIGGER_RESUME:
+-	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+-		aiu_encoder_i2s_hold(component, false);
+-		return 0;
+-
+-	case SNDRV_PCM_TRIGGER_STOP:
+-	case SNDRV_PCM_TRIGGER_SUSPEND:
+-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+-		aiu_encoder_i2s_hold(component, true);
+-		return 0;
+-
+-	default:
+-		return -EINVAL;
+-	}
+-}
+-
+ static int aiu_encoder_i2s_setup_desc(struct snd_soc_component *component,
+ 				      struct snd_pcm_hw_params *params)
+ {
+@@ -353,7 +321,6 @@ static void aiu_encoder_i2s_shutdown(struct snd_pcm_substream *substream,
+ }
+ 
+ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+-	.trigger	= aiu_encoder_i2s_trigger,
+ 	.hw_params	= aiu_encoder_i2s_hw_params,
+ 	.hw_free	= aiu_encoder_i2s_hw_free,
+ 	.set_fmt	= aiu_encoder_i2s_set_fmt,
+diff --git a/sound/soc/meson/aiu-fifo-i2s.c b/sound/soc/meson/aiu-fifo-i2s.c
+index 2388a2d0b3a6c..57e6e7160d2f2 100644
+--- a/sound/soc/meson/aiu-fifo-i2s.c
++++ b/sound/soc/meson/aiu-fifo-i2s.c
+@@ -20,6 +20,8 @@
+ #define AIU_MEM_I2S_CONTROL_MODE_16BIT	BIT(6)
+ #define AIU_MEM_I2S_BUF_CNTL_INIT	BIT(0)
+ #define AIU_RST_SOFT_I2S_FAST		BIT(0)
++#define AIU_I2S_MISC_HOLD_EN		BIT(2)
++#define AIU_I2S_MISC_FORCE_LEFT_RIGHT	BIT(4)
+ 
+ #define AIU_FIFO_I2S_BLOCK		256
+ 
+@@ -90,6 +92,10 @@ static int aiu_fifo_i2s_hw_params(struct snd_pcm_substream *substream,
+ 	unsigned int val;
+ 	int ret;
+ 
++	snd_soc_component_update_bits(component, AIU_I2S_MISC,
++				      AIU_I2S_MISC_HOLD_EN,
++				      AIU_I2S_MISC_HOLD_EN);
++
+ 	ret = aiu_fifo_hw_params(substream, params, dai);
+ 	if (ret)
+ 		return ret;
+@@ -117,6 +123,19 @@ static int aiu_fifo_i2s_hw_params(struct snd_pcm_substream *substream,
+ 	snd_soc_component_update_bits(component, AIU_MEM_I2S_MASKS,
+ 				      AIU_MEM_I2S_MASKS_IRQ_BLOCK, val);
+ 
++	/*
++	 * Most (all?) supported SoCs have this bit set by default. The vendor
++	 * driver however sets it manually (depending on the version either
++	 * while un-setting AIU_I2S_MISC_HOLD_EN or right before that). Follow
++	 * the same approach for consistency with the vendor driver.
++	 */
++	snd_soc_component_update_bits(component, AIU_I2S_MISC,
++				      AIU_I2S_MISC_FORCE_LEFT_RIGHT,
++				      AIU_I2S_MISC_FORCE_LEFT_RIGHT);
++
++	snd_soc_component_update_bits(component, AIU_I2S_MISC,
++				      AIU_I2S_MISC_HOLD_EN, 0);
++
+ 	return 0;
+ }
+ 
+diff --git a/sound/soc/meson/aiu-fifo.c b/sound/soc/meson/aiu-fifo.c
+index 4ad23267cace5..d67ff4cdabd5a 100644
+--- a/sound/soc/meson/aiu-fifo.c
++++ b/sound/soc/meson/aiu-fifo.c
+@@ -5,6 +5,7 @@
+ 
+ #include <linux/bitfield.h>
+ #include <linux/clk.h>
++#include <linux/dma-mapping.h>
+ #include <sound/pcm_params.h>
+ #include <sound/soc.h>
+ #include <sound/soc-dai.h>
+@@ -179,6 +180,11 @@ int aiu_fifo_pcm_new(struct snd_soc_pcm_runtime *rtd,
+ 	struct snd_card *card = rtd->card->snd_card;
+ 	struct aiu_fifo *fifo = dai->playback_dma_data;
+ 	size_t size = fifo->pcm->buffer_bytes_max;
++	int ret;
++
++	ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32));
++	if (ret)
++		return ret;
+ 
+ 	snd_pcm_set_managed_buffer_all(rtd->pcm, SNDRV_DMA_TYPE_DEV,
+ 				       card->dev, size, size);
+diff --git a/sound/soc/sof/intel/pci-tgl.c b/sound/soc/sof/intel/pci-tgl.c
+index d04ce84fe7cc2..beb2fb3cd0141 100644
+--- a/sound/soc/sof/intel/pci-tgl.c
++++ b/sound/soc/sof/intel/pci-tgl.c
+@@ -117,8 +117,12 @@ static const struct pci_device_id sof_pci_ids[] = {
+ 		.driver_data = (unsigned long)&adls_desc},
+ 	{ PCI_DEVICE(0x8086, 0x51c8), /* ADL-P */
+ 		.driver_data = (unsigned long)&adl_desc},
++	{ PCI_DEVICE(0x8086, 0x51cd), /* ADL-P */
++		.driver_data = (unsigned long)&adl_desc},
+ 	{ PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */
+ 		.driver_data = (unsigned long)&adl_desc},
++	{ PCI_DEVICE(0x8086, 0x54c8), /* ADL-N */
++		.driver_data = (unsigned long)&adl_desc},
+ 	{ 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, sof_pci_ids);
+diff --git a/sound/soc/tegra/tegra_asoc_machine.c b/sound/soc/tegra/tegra_asoc_machine.c
+index 78fb423df550b..2e549b69061ca 100644
+--- a/sound/soc/tegra/tegra_asoc_machine.c
++++ b/sound/soc/tegra/tegra_asoc_machine.c
+@@ -116,16 +116,24 @@ static const struct snd_kcontrol_new tegra_machine_controls[] = {
+ 	SOC_DAPM_PIN_SWITCH("Headset Mic"),
+ 	SOC_DAPM_PIN_SWITCH("Internal Mic 1"),
+ 	SOC_DAPM_PIN_SWITCH("Internal Mic 2"),
++	SOC_DAPM_PIN_SWITCH("Headphones"),
++	SOC_DAPM_PIN_SWITCH("Mic Jack"),
+ };
+ 
+ int tegra_asoc_machine_init(struct snd_soc_pcm_runtime *rtd)
+ {
+ 	struct snd_soc_card *card = rtd->card;
+ 	struct tegra_machine *machine = snd_soc_card_get_drvdata(card);
++	const char *jack_name;
+ 	int err;
+ 
+ 	if (machine->gpiod_hp_det && machine->asoc->add_hp_jack) {
+-		err = snd_soc_card_jack_new(card, "Headphones Jack",
++		if (machine->asoc->hp_jack_name)
++			jack_name = machine->asoc->hp_jack_name;
++		else
++			jack_name = "Headphones Jack";
++
++		err = snd_soc_card_jack_new(card, jack_name,
+ 					    SND_JACK_HEADPHONE,
+ 					    &tegra_machine_hp_jack,
+ 					    tegra_machine_hp_jack_pins,
+@@ -658,6 +666,7 @@ static struct snd_soc_card snd_soc_tegra_max98090 = {
+ static const struct tegra_asoc_data tegra_max98090_data = {
+ 	.mclk_rate = tegra_machine_mclk_rate_12mhz,
+ 	.card = &snd_soc_tegra_max98090,
++	.hp_jack_name = "Headphones",
+ 	.add_common_dapm_widgets = true,
+ 	.add_common_controls = true,
+ 	.add_common_snd_ops = true,
+diff --git a/sound/soc/tegra/tegra_asoc_machine.h b/sound/soc/tegra/tegra_asoc_machine.h
+index d6a8d13205516..6f795d7dff7c1 100644
+--- a/sound/soc/tegra/tegra_asoc_machine.h
++++ b/sound/soc/tegra/tegra_asoc_machine.h
+@@ -14,6 +14,7 @@ struct snd_soc_pcm_runtime;
+ struct tegra_asoc_data {
+ 	unsigned int (*mclk_rate)(unsigned int srate);
+ 	const char *codec_dev_name;
++	const char *hp_jack_name;
+ 	struct snd_soc_card *card;
+ 	unsigned int mclk_id;
+ 	bool hp_jack_gpio_active_low;
+diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
+index 35314277fb586..1876d148ea0ae 100644
+--- a/tools/testing/selftests/kvm/include/kvm_util.h
++++ b/tools/testing/selftests/kvm/include/kvm_util.h
+@@ -69,15 +69,6 @@ enum vm_guest_mode {
+ 
+ #endif
+ 
+-#if defined(__x86_64__)
+-unsigned long vm_compute_max_gfn(struct kvm_vm *vm);
+-#else
+-static inline unsigned long vm_compute_max_gfn(struct kvm_vm *vm)
+-{
+-	return ((1ULL << vm->pa_bits) >> vm->page_shift) - 1;
+-}
+-#endif
+-
+ #define MIN_PAGE_SIZE		(1U << MIN_PAGE_SHIFT)
+ #define PTES_PER_MIN_PAGE	ptes_per_page(MIN_PAGE_SIZE)
+ 
+@@ -318,6 +309,7 @@ bool vm_is_unrestricted_guest(struct kvm_vm *vm);
+ 
+ unsigned int vm_get_page_size(struct kvm_vm *vm);
+ unsigned int vm_get_page_shift(struct kvm_vm *vm);
++unsigned long vm_compute_max_gfn(struct kvm_vm *vm);
+ uint64_t vm_get_max_gfn(struct kvm_vm *vm);
+ int vm_get_fd(struct kvm_vm *vm);
+ 
+diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
+index c439fb653fde2..e9d0ab9567fbf 100644
+--- a/tools/testing/selftests/kvm/lib/kvm_util.c
++++ b/tools/testing/selftests/kvm/lib/kvm_util.c
+@@ -2282,6 +2282,11 @@ unsigned int vm_get_page_shift(struct kvm_vm *vm)
+ 	return vm->page_shift;
+ }
+ 
++unsigned long __attribute__((weak)) vm_compute_max_gfn(struct kvm_vm *vm)
++{
++	return ((1ULL << vm->pa_bits) >> vm->page_shift) - 1;
++}
++
+ uint64_t vm_get_max_gfn(struct kvm_vm *vm)
+ {
+ 	return vm->max_gfn;