Merge tag 'android12-5.10.226_r00' into android12-5.10

This merges up to the 5.10.226 LTS release into android12-5.10.
Included in here are the following commits:

* bfa0f472d5 Revert "udf: Avoid excessive partition lengths"
* 90336334a0 Revert "bareudp: Fix device stats updates."
* bcfc839140 ANDROID: fix up change to pti_clone_pgtable()
* ebdacb6176 Revert "perf/aux: Fix AUX buffer serialization"
* 3c59c9aebf Revert "clocksource/drivers/timer-of: Remove percpu irq related code"
*   7d3ca1ed3f Merge 5.10.226 into android12-5.10-lts
|\
| * ceb091e2c4 Linux 5.10.226
| * 912736a043 memcg: protect concurrent access to mem_cgroup_idr
| * 02ee1976ed net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
| * dad75cf2c3 x86/mm: Fix PTI for i386 some more
| * 1401da1486 rtmutex: Drop rt_mutex::wait_lock before scheduling
| * c6bd80f585 mmc: cqhci: Fix checking of CQHCI_HALT state
| * b35d3c8181 drm/i915/fence: Mark debug_fence_free() with __maybe_unused
| * b8dfa35f00 drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
| * 50632b877c nvmet-tcp: fix kernel crash if commands allocation fails
| * 4c3b21204a arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
| * ccb95b37e9 arm64: acpi: Move get_cpu_for_acpi_id() to a header
| * 3658388cd3 ACPI: processor: Fix memory leaks in error paths of processor_add()
| * 5dac987d1b ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
| * 157c0d94b4 nilfs2: protect references to superblock parameters exposed in sysfs
| * 0630e3d435 nilfs2: replace snprintf in show functions with sysfs_emit
| * 7882923f1c perf/aux: Fix AUX buffer serialization
| * 0f511f2840 uprobes: Use kzalloc to allocate xol area
| * 0af6b80dac clocksource/drivers/timer-of: Remove percpu irq related code
| * 3ded318cf0 clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
| * cf6ffb1688 clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
| * 6c563a2985 VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
| * 359ea5edc9 Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
| * 1d8e020e51 uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
| * 38cd8bde8a nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
| * 3a8154bb4a binder: fix UAF caused by offsets overwrite
| * d0d3edb56e iio: adc: ad7124: fix chip ID mismatch
| * 1719ebc8e3 iio: fix scale application in iio_convert_raw_to_processed_unlocked
| * f3a54c27ba iio: buffer-dmaengine: fix releasing dma channel on error
| * 41cc91e313 staging: iio: frequency: ad9834: Validate frequency parameter value
| * d8a61e69f8 NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
| * 6fb7b7f5ba ata: pata_macio: Use WARN instead of BUG
| * d3ff0f98a5 MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
| * 99418ec776 lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
| * 9d1e9f0876 of/irq: Prevent device address out-of-bounds read in interrupt map walk
| * 5c8906de98 Squashfs: sanity check symbolic link size
| * 2f14160d9f usbnet: ipheth: race between ipheth_close and error handling
| * 51fa08edd8 Input: uinput - reject requests with unreasonable number of slots
| * 34185de73d HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
| * 3206e4a4b0 s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
| * 912bcdc51b btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry()
| * 3eaad59258 kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
| * e6f3008de8 net: dpaa: avoid on-stack arrays of NR_CPUS elements
| * e2355d513b PCI: Add missing bridge lock to pci_bus_lock()
| * c60676b81f btrfs: clean up our handling of refs == 0 in snapshot delete
| * ed1b61398c btrfs: replace BUG_ON with ASSERT in walk_down_proc()
| * 8780129cbc smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
| * 9813770f25 wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
| * fb2257089a libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
| * 56cfdeb2c7 hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
| * 8a1e958e26 hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
| * 59c1fb9874 hwmon: (lm95234) Fix underflows seen when writing limit attributes
| * 2a3add62f1 hwmon: (adc128d818) Fix underflows seen when writing limit attributes
| * bc1faed19d pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
| * 9b884bdc29 devres: Initialize an uninitialized struct member
| * c8944d449f um: line: always fill *error_out in setup_one_line()
| * 1434b72a2d cgroup: Protect css->cgroup write under css_set_lock
| * 70854bf003 iommu/vt-d: Handle volatile descriptor status read
| * 8a7ef20bf7 dm init: Handle minors larger than 255
| * 583b5d2d43 ASoC: topology: Properly initialize soc_enum values
| * 43b442c972 net: dsa: vsc73xx: fix possible subblocks range of CAPT block
| * 19af8a23a1 net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
| * 231c235d2f fou: Fix null-ptr-deref in GRO.
| * 0ea3f2798d gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
| * 77ad44ee33 gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
| * bc18f3c806 fou: remove sparse errors
| * 3c0cedc22c bareudp: Fix device stats updates.
| * 32cbafeebf usbnet: modern method to get random MAC
| * 594cc1dba0 net: usb: don't write directly to netdev->dev_addr
| * 98a4cabf87 drivers/net/usb: Remove all strcpy() uses
| * acd2985137 igc: Unlock on error in igc_io_resume()
| * 3efe53eb22 tcp_bpf: fix return value of tcp_bpf_sendmsg()
| * ee1c2ecf7b platform/x86: dell-smbios: Fix error path in dell_smbios_init()
| * 45c0c747df svcrdma: Catch another Reply chunk overflow case
| * 449d70b16b igb: Fix not clearing TimeSync interrupts for 82580
| * aec92dbebd can: bcm: Remove proc entry when dev is unregistered.
| * ee50abebdc pcmcia: Use resource_size function on resource object
| * 9380fe33ab media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
| * ebbdbbc580 PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
| * 1fa40e0d27 media: vivid: don't set HDMI TX controls if there are no HDMI outputs
| * 44a595f897 usb: uas: set host status byte on data completion error
| * 3ab3ee4125 wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
| * 9e28a1df18 leds: spi-byte: Call of_node_put() on error path
| * e73b63f138 media: vivid: fix wrong sizeimage value for mplane
| * 551966371e udf: Avoid excessive partition lengths
| * 66234da64d netfilter: nf_conncount: fix wrong variable type
| * f56089a180 iommu: sun50i: clear bypass register
| * 1c5bad90e0 af_unix: Remove put_pid()/put_cred() in copy_peercred().
| * ec08e30082 irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
| * 500e4bf673 smack: unix sockets: fix accept()ed socket label
| * 414736fcb7 ALSA: hda: Add input value sanity checks to HDMI channel map controls
* | 70fe52b634 Revert "Merge 751777a79a ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts"
* | c3e9a280ba Merge 751777a79a ("nfsd: make svc_stat per-network namespace instead of global") into android12-5.10-lts
|\|
| * 751777a79a nfsd: make svc_stat per-network namespace instead of global
| * f8219c4b80 nfsd: remove nfsd_stats, make th_cnt a global counter
| * f2fe1ec906 nfsd: make all of the nfsd stats per-network namespace
| * 5545496966 nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
| * fec6561e75 nfsd: rename NFSD_NET_* to NFSD_STATS_*
| * 9eb5d44b8f sunrpc: use the struct net as the svc proc private
| * e0fba78ab9 sunrpc: remove ->pg_stats from svc_program
| * 7f2476914e sunrpc: pass in the sv_stats struct through svc_create_pooled
| * d06254ae7d nfsd: stop setting ->pg_stats for unused stats
| * 2197b23eda sunrpc: don't change ->sv_stats if it doesn't exist
| * d47c660e8c NFSD: Fix frame size warning in svc_export_parse()
| * a8aaffc0c1 NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
| * c532274202 NFSD: simplify error paths in nfsd_svc()
| * ebfce8dd7e NFSD: Refactor the duplicate reply cache shrinker
| * 895807268a NFSD: Replace nfsd_prune_bucket()
| * a02f9d6ea3 NFSD: Rename nfsd_reply_cache_alloc()
| * 73b72f4b3b NFSD: Refactor nfsd_reply_cache_free_locked()
| * 3025d489f9 nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
| * 4e18b58b10 nfsd: move reply cache initialization into nfsd startup
* | 00588cd66d Revert "hwspinlock: Introduce hwspin_lock_bust()"
* | c2345ad899 Revert "bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode"
* | fe709a1a77 Revert "bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt"
* | b22678f8ef Merge ddee5b4b6a ("mptcp: pm: avoid possible UaF when selecting endp") into android12-5.10-lts
|\|
| * ddee5b4b6a mptcp: pm: avoid possible UaF when selecting endp
| * 91fb0512a0 mptcp: pr_debug: add missing \n at the end
| * 7e4c72dbaf btrfs: fix use-after-free after failure to create a snapshot
| * efdde00d4a nilfs2: fix state management in error path of log writing function
| * 07e4dc2fe0 nilfs2: fix missing cleanup on rollforward recovery error
| * 7725152b54 sched: sch_cake: fix bulk flow accounting logic for host fairness
| * 93ee345ba3 ila: call nf_unregister_net_hooks() sooner
| * e3ad85c477 tracing: Avoid possible softlockup in tracing_iter_reset()
| * 3a49b6b1ca can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
| * 6949a97f6d clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
| * f540bc71d5 clk: qcom: clk-alpha-pll: Fix the pll post div mask
| * 0811d57384 fuse: use unsigned type for getxattr/listxattr size truncation
| * 9d38c704b4 fuse: update stats for pages in dropped aux writeback list
| * 4be36d9d18 mmc: sdhci-of-aspeed: fix module autoloading
| * 2793f42389 mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
| * b2ead09489 Bluetooth: MGMT: Ignore keys being loaded with invalid type
| * 029e462bb4 Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
| * cb27399b3d irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
| * e0b122a8f6 ata: libata: Fix memory leak for error path in ata_host_alloc()
| * 0f27b8c07e ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
| * 2ef683b058 ALSA: hda/realtek: add patch for internal mic in Lenovo V145
| * adc688a505 ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
| * 8ca21e7a27 ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
| * 98c75d7618 sch/netem: fix use after free in netem_dequeue
| * 06e7be6934 bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt
| * b140074560 i2c: Use IS_REACHABLE() for substituting empty ACPI functions
| * dfc8eb4d7e ext4: handle redirtying in ext4_bio_write_page()
| * 5895541d73 udf: Limit file size to 4TB
| * 17c43211d4 rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
| * 842a97b5e4 virtio_net: Fix napi_skb_cache_put warning
| * c8e5439b5b net: set SOCK_RCU_FREE before inserting socket into hashtable
| * cf002be3b8 bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode
| * 2ac9deb7e0 drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
| * 3fd11fe4f2 block: initialize integrity buffer to zero before writing it to media
| * 0623c9f371 media: uvcvideo: Enforce alignment of frame and interval
| * c083c8be6b drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
| * 5eb04f9894 block: remove the blk_flush_integrity call in blk_integrity_unregister
| * 0305a885cc wifi: cfg80211: make hash table duplicates more survivable
| * d24bc270b7 drm/meson: plane: Add error handling
| * a948ec9935 smack: tcp: ipv4, fix incorrect labeling
| * 3f3ef1d9f6 fsnotify: clear PARENT_WATCHED flags lazily
| * 7e64cabe81 usb: typec: ucsi: Fix null pointer dereference in trace
| * bd13c1119a usbip: Don't submit special requests twice
| * c7975f09ae ionic: fix potential irq name truncation
| * e85cf9a5a4 hwspinlock: Introduce hwspin_lock_bust()
| * 7eb7888021 PCI: al: Check IORESOURCE_BUS existence during probe
| * 9aa7dd5e31 wifi: iwlwifi: remove fw_running op
| * ed7e9ed973 drm/amd/pm: check negtive return for table entries
| * 614564a5b2 drm/amdgpu: the warning dereferencing obj for nbio_v7_4
| * 008933832a drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
| * 52338a3aa7 apparmor: fix possible NULL pointer dereference
| * 0842db679d drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
| * 310b9d8363 drm/amdgpu: fix mc_data out-of-bounds read warning
| * 5f09fa5e0a drm/amdgpu: fix ucode out-of-bounds read warning
| * 725b728cc0 drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
| * c253b87c7c drm/amdgpu: Fix out-of-bounds write warning
| * 60097df938 drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
| * 74c5d8b057 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
| * 9160830546 drm/amd/display: Check msg_id before processing transcation
| * 7c47dd2e92 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
| * 2a63c90c7a drm/amd/display: Add array index check for hdcp ddc access
| * 754321ed63 drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
| * 40c2e8bc11 drm/amd/display: Check gpio_id before used as array index
| * e24fa82729 drm/amdgpu: avoid reading vf2pf info size from FB
| * 1d0c85d0fc drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
| * 59ac791297 drm/amdgpu: fix uninitialized scalar variable warning
| * 38e32a0d83 drm/amd/pm: fix the Out-of-bounds read warning
| * d592768c17 drm/amd/pm: fix warning using uninitialized value of max_vid_step
| * a601129c78 drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
| * 774bae3b8d drm/amdgpu: fix overflowed array index read warning
| * 28b539bbcc drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
| * 40d0fedacf net: usb: qmi_wwan: add MeiG Smart SRM825L
| * ff5af3f9b5 dma-debug: avoid deadlock between dma debug vs printk and netconsole
| * 712921d2ab i2c: Fix conditional for substituting empty ACPI functions
| * 0e69cf9b65 ALSA: hda/conexant: Mute speakers at suspend / shutdown
| * 221ebded43 ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
| * e78bc7099c drm: panel-orientation-quirks: Add quirk for OrangePi Neo
* | 52c4910c65 ANDROID: fix up crc issue for cpuset_cpus_allowed()
* | 4951c68022 Merge 5.10.225 into android12-5.10-lts
|\|
| * b57d01c66f Linux 5.10.225
| * 7e8bad2cf3 apparmor: fix policy_unpack_test on big endian systems
| * 9e96dea7ef scsi: aacraid: Fix double-free on probe failure
| * 4538335cc2 usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
| * 59579a627a usb: dwc3: st: add missing depopulate in probe error path
| * 6aee4c5635 usb: dwc3: st: fix probed platform device ref count on probe error path
| * b72da4d89b usb: dwc3: core: Prevent USB core invalid event buffer address access
| * 16cc6114c9 usb: dwc3: omap: add missing depopulate in probe error path
| * f84d5dccc8 USB: serial: option: add MeiG Smart SRM825L
| * 612843f842 cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
| * f5a5a5a0e9 soc: qcom: cmd-db: Map shared memory as WC, not WB
| * 8ddaea033d nfc: pn533: Add poll mod list filling check
| * 7e5d5c4ae7 net: busy-poll: use ktime_get_ns() instead of local_clock()
| * 8bbb9e4e0e gtp: fix a potential NULL pointer dereference
| * 842a40c727 ethtool: check device is present when getting link settings
| * 2e8e93dea0 dmaengine: dw: Add memory bus width verification
| * 9cfe7c53fe dmaengine: dw: Add peripheral bus width verification
| * f8e1c92868 soundwire: stream: fix programming slave ports for non-continous port maps
| * acddd7c6b7 ovl: do not fail because of O_NOATIME
| * 338a3ba30c net:rds: Fix possible deadlock in rds_message_put
| * 688325078a cgroup/cpuset: Prevent UAF in proc_cpuset_show()
| * e83405e75d ata: libata-core: Fix null pointer dereference on error
| * f2b6cd1335 Revert "Input: ioc3kbd - convert to platform remove callback returning void"
| * 777d9c223e media: uvcvideo: Fix integer overflow calculating timestamp
| * f7276cdc19 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
| * 0365c9029a ipc: replace costly bailout check in sysvipc_find_ipc()
| * 2933b4f8a6 mptcp: sched: check both backup in retrans
| * 1388df72dc wifi: mwifiex: duplicate static structs used in driver instances
| * 4e9436375f pinctrl: single: fix potential NULL dereference in pcs_get_function()
| * d57e6298cc pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
| * a45ee4c98d KVM: arm64: Don't use cbz/adr with external symbols
| * df02642c21 drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
| * 239b1cacce tools: move alignment-related macros to new <linux/align.h>
| * 05dd9aabd0 Input: MT - limit max slots
| * 56b82e6ff3 Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
| * 93000b2949 nfsd: Don't call freezable_schedule_timeout() after each successful page allocation in svc_alloc_arg().
| * b009444700 ALSA: timer: Relax start tick time check for slave timer elements
| * b891438bc3 Revert "drm/amd/display: Validate hw_points_num before using it"
| * 92915fa734 mmc: dw_mmc: allow biu and ciu clocks to defer
| * 15818af2f7 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
| * 65e79c9437 cxgb4: add forgotten u64 ivlan cast before shift
| * d1623e7b43 HID: microsoft: Add rumble support to latest xbox controllers
| * 8c0a21d37d HID: wacom: Defer calculation of resolution until resolution_code is known
| * fc73103a94 MIPS: Loongson64: Set timer mode in cpu-probe
| * 7fd3a59268 binfmt_misc: pass binfmt_misc flags to the interpreter
| * 9df9783bd8 Bluetooth: MGMT: Add error handling to pair_device()
| * 9b9ba386d7 mmc: mmc_test: Fix NULL dereference on allocation failure
| * 4370448fca drm/msm/dp: reset the link phy params before link training
| * e54b082752 drm/msm/dpu: don't play tricks with debug macros
| * ff6607a477 net: xilinx: axienet: Fix dangling multicast addresses
| * 2884e73978 net: xilinx: axienet: Always disable promiscuous mode
| * cb5880a0de ipv6: prevent UAF in ip6_send_skb()
| * c414000da1 netem: fix return value if duplicate enqueue fails
| * 050e7274ab net: dsa: mv88e6xxx: Fix out-of-bound access
| * 5885217d66 net: dsa: mv88e6xxx: replace ATU violation prints with trace points
| * 5d8aed3ca6 net: dsa: mv88e6xxx: read FID when handling ATU violations
| * 544571911b ice: fix ICE_LAST_OFFSET formula
| * 5c14483544 bonding: fix xfrm state handling when clearing active slave
| * 21816b696c bonding: fix xfrm real_dev null pointer dereference
| * 81216b9352 bonding: fix null pointer deref in bond_ipsec_offload_ok
| * e8c85f2ff3 bonding: fix bond_ipsec_offload_ok return type
| * 6e630e1d77 ip6_tunnel: Fix broken GRO
| * 4d42a2257b netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
| * eb06c8d302 kcm: Serialise kcm_sendmsg() for the same socket.
| * f4b762cf7e tc-testing: don't access non-existent variable on exception
| * 095a1f19d4 Bluetooth: SMP: Fix assumption of Central always being Initiator
| * 7a4e7a0c6b Bluetooth: hci_core: Fix LE quote calculation
| * ce70b09150 dm suspend: return -ERESTARTSYS instead of -EINTR
| * 0ba3401777 media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
| * d1bd8e0a11 block: use "unsigned long" for blk_validate_block_size().
| * cbb9a969fc gtp: pull network headers in gtp_dev_xmit()
| * 5970a540da hrtimer: Prevent queuing of hrtimer without a function callback
| * b09a5ec8de nvmet-rdma: fix possible bad dereference when freeing rsps
| * 2143cba143 ext4: set the type of max_zeroout to unsigned int to avoid overflow
| * f14cd61826 irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
| * 9e1c4d0d6a usb: dwc3: core: Skip setting event buffers for host only controllers
| * 1b8e318f99 s390/iucv: fix receive buffer virtual vs physical address confusion
| * d0414f5436 openrisc: Call setup_memory() earlier in the init sequence
| * e5272645a0 NFS: avoid infinite loop in pnfs_update_layout.
| * 9e0414220b nvmet-tcp: do not continue for invalid icreq
| * 5ee7495ac2 net: hns3: add checking for vf id of mailbox
| * c7c43a784f Bluetooth: bnep: Fix out-of-bound access
| * bf2f79970b usb: gadget: fsl: Increase size of name buffer for endpoints
| * bf0c603ab4 f2fs: fix to do sanity check in update_sit_entry
| * 8ec052c544 btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
| * 0c1d7b960f btrfs: send: handle unexpected data in header buffer in begin_cmd()
| * 94a7dff229 btrfs: handle invalid root reference found in may_destroy_subvol()
| * 3dd13074e7 btrfs: change BUG_ON to assertion when checking for delayed_node root
| * e21448a49b powerpc/boot: Only free if realloc() succeeds
| * 486fb5ebd5 powerpc/boot: Handle allocation failure in simple_realloc()
| * 05c21f285d parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
| * 4e5464005b memory: stm32-fmc2-ebi: check regmap_read return value
| * 25d31baf92 x86: Increase brk randomness entropy for 64-bit systems
| * 76ec27b709 md: clean up invalid BUG_ON in md_ioctl
| * 95e49b9258 netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
| * 316bf51edd virtiofs: forbid newlines in tags
| * be49c4f2a1 drm/lima: set gp bus_stop bit before hard reset
| * aa469c3d28 net/sun3_82586: Avoid reading past buffer in debug output
| * 5fb0cbf84b scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
| * a441ce39ad fs: binfmt_elf_efpic: don't use missing interpreter's properties
| * e7385510e2 media: pci: cx23885: check cx23885_vdev_init() return
| * 00d4f971fa quota: Remove BUG_ON from dqget()
| * 239c5e988e ext4: do not trim the group with corrupted block bitmap
| * 0f6425d90d nvmet-trace: avoid dereferencing pointer too early
| * 5380f1b2b9 powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
| * 372928e8be IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
| * 7138c59856 wifi: iwlwifi: abort scan when rfkill on but device enabled
| * d483de53d4 gfs2: setattr_chown: Add missing initialization
| * 80456d39f0 scsi: spi: Fix sshdr use
| * 3663e78fab media: qcom: venus: fix incorrect return value
| * a43edc7abc binfmt_misc: cleanup on filesystem umount
| * c13541c5ef staging: ks7010: disable bh on tx_dev_lock
| * db3b679f66 drm/amd/display: Validate hw_points_num before using it
| * cc49ee3433 staging: iio: resolver: ad2s1210: fix use before initialization
| * 01fa4415c3 media: radio-isa: use dev_name to fill in bus_info
| * 0f83d77926 s390/smp,mcck: fix early IPI handling
| * aeda7043c4 RDMA/rtrs: Fix the problem of variable not initialized fully
| * bbb662d0c2 i2c: riic: avoid potential division by zero
| * 5335c7f8db wifi: cw1200: Avoid processing an invalid TIM IE
| * 11b0c7323c wifi: mac80211: fix BA session teardown race
| * 5fe7bdbe4f ssb: Fix division by zero issue in ssb_calc_clock_rate
| * dfa894f7ea ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
| * fc250eca15 net: hns3: fix a deadlock problem when config TC during resetting
| * dbdbadec8a net: hns3: fix wrong use of semaphore up
| * e5ceff2196 netfilter: flowtable: initialise extack before use
| * 50c914b0e6 mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
| * 8e8d306f3b net: dsa: vsc73xx: check busy flag in MDIO operations
| * 351ad72c50 net: dsa: vsc73xx: use read_poll_timeout instead delay loop
| * 665a4caa9c net: dsa: vsc73xx: pass value in phy_write operation
| * aa9ce4193c net: axienet: Fix register defines comment description
| * 1cece837e3 atm: idt77252: prevent use after free in dequeue_rx()
| * 4b730a1475 net/mlx5e: Correctly report errors for ethtool rx flows
| * 8e0e6b15ab s390/uv: Panic for set and remove shared access UVC errors
| * 6bcd0f95b8 btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
| * c10ac31a72 s390/cio: rename bitmap_size() -> idset_bitmap_size()
| * e24625310c drm/amdgpu/jpeg2: properly set atomics vmid field
| * ad149f5585 memcg_write_event_control(): fix a user-triggerable oops
| * 0452e15e7f drm/amdgpu: Actually check flags for all context ops.
| * d88083916f btrfs: tree-checker: add dev extent item checks
| * bbcdda4b0d selinux: fix potential counting error in avc_add_xperms_decision()
| * fe5bf14881 fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
| * de7be1940c bitmap: introduce generic optimized bitmap_size()
| * 03880af02a vfs: Don't evict inode under the inode lru traversing context
| * ee030e4ffa dm persistent data: fix memory allocation failure
| * 63fd38af88 dm resume: don't return EINVAL when signalled
| * 1b21a791af arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
| * e245a18281 s390/dasd: fix error recovery leading to data corruption on ESE devices
| * 747bc15457 thunderbolt: Mark XDomain as unplugged when router is removed
| * 0f0654318e xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
| * 4905e56f7b ALSA: usb-audio: Support Yamaha P-125 quirk entry
| * 4690e2171f fuse: Initialize beyond-EOF page contents before setting uptodate
* | 39a8a0618d ANDROID: Fix gki allmodconfig build errors in mptcp
* | 0c105dabe6 Revert "genirq: Allow the PM device to originate from irq domain"
* | e62a1579e0 Revert "genirq: Allow irq_chip registration functions to take a const irq_chip"
* | b5df17128a Revert "irqchip/imx-irqsteer: Constify irq_chip struct"
* | 6943c015b0 Revert "irqchip/imx-irqsteer: Add runtime PM support"
* | 3141b23999 Revert "irqchip/imx-irqsteer: Handle runtime power management correctly"
* | b84ad15be5 Merge 5.10.224 into android12-5.10-lts
|\|
| * b2add7c50b Linux 5.10.224
| * 2de18b5cc3 media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
| * e1ee1c4198 ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
| * 80ac0cc9c0 wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
| * a563f12430 vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
| * 06e9e6ac59 vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro
| * b21ea49e6e nvme/pci: Add APST quirk for Lenovo N60z laptop
| * 15469d46ba exec: Fix ToCToU between perm check and set-uid/gid usage
| * d39e0f582b media: uvcvideo: Use entity get_cur in uvc_ctrl_set
| * ec54634f91 arm64: cpufeature: Fix the visibility of compat hwcaps
| * fb6675db04 powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
| * 50111a8098 drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
| * 31c35f9f89 netfilter: nf_tables: prefer nft_chain_validate
| * d5f87c1111 netfilter: nf_tables: allow clone callbacks to sleep
| * 7b17de2a71 netfilter: nf_tables: use timestamp to check for set element timeout
| * 191fc44395 netfilter: nf_tables: set element extended ACK reporting support
| * c52f9e1a9e PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
| * 7e62564d5e Fix gcc 4.9 build issue in 5.10.y
| * 329eae03d0 Add gitignore file for samples/fanotify/ subdirectory
| * 9bdf0624bd samples: Make fs-monitor depend on libc and headers
| * 5b9f49cc86 samples: Add fs error monitoring example
| * 3f84b37abb mptcp: pm: fix backup support in signal endpoints
| * 44165604dd mptcp: export local_address
| * 9b9a64ef9a mptcp: mib: count MPJ with backup flag
| * 96f3c8a850 mptcp: fix NL PM announced address accounting
| * 1008f2bcbc mptcp: distinguish rcv vs sent backup flag in requests
| * 381cad7a08 mptcp: sched: check both directions for backup
| * 32b133fb78 drm/mgag200: Set DDC timeout in milliseconds
| * fd65cf86ca drm/bridge: analogix_dp: properly handle zero sized AUX transactions
| * 450b6b22ac x86/mtrr: Check if fixed MTRRs exist before saving them
| * ab8b397d59 padata: Fix possible divide-by-0 panic in padata_mt_helper()
| * eb223bf01e tracing: Fix overflow in get_free_elt()
| * ca2ea2dec1 power: supply: axp288_charger: Round constant_charge_voltage writes down
| * 51e8360d94 power: supply: axp288_charger: Fix constant_charge_voltage writes
| * a26bcfeea3 genirq/irqdesc: Honor caller provided affinity in alloc_desc()
| * db959cdfe6 irqchip/xilinx: Fix shift out of bounds
| * 52b138f102 serial: core: check uartclk for zero to avoid divide by zero
| * 227d455e6c irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
| * 7dddf560e2 irqchip/meson-gpio: support more than 8 channels gpio irq
| * 5f1aa8ce64 scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
| * 8f209716ea scsi: mpt3sas: Remove scsi_dma_map() error messages
| * f3405f4997 ntp: Safeguard against time_constant overflow
| * f098e8fc72 driver core: Fix uevent_show() vs driver detach race
| * dc335b92e5 ntp: Clamp maxerror and esterror to operating range
| * 668c6c4a7e tick/broadcast: Move per CPU pointer access into the atomic section
| * 005c318981 scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
| * ef1b208ca8 usb: gadget: u_serial: Set start_delayed during suspend
| * 7cc9ebcfe5 usb: gadget: core: Check for unset descriptor
| * f1205a5aad USB: serial: debug: do not echo input by default
| * 4dacdb9720 usb: vhci-hcd: Do not drop references before new references are gained
| * d993cb25ef ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
| * c7c1ca6e25 ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
| * e7e7d2b180 ALSA: line6: Fix racy access to midibuf
| * 5291d4f734 drm/client: fix null pointer dereference in drm_client_modeset_probe
| * 44e11ae8f9 ALSA: usb-audio: Re-add ScratchAmp quirk entries
| * c9c11ece5a spi: spi-fsl-lpspi: Fix scldiv calculation
| * c6ba514732 kprobes: Fix to check symbol prefixes correctly
| * 9ddd5e7835 bpf: kprobe: remove unused declaring of bpf_kprobe_override
| * 455769ebb6 i2c: smbus: Send alert notifications to all devices if source not found
| * 56f106d2c4 ASoC: codecs: wsa881x: Correct Soundwire ports mask
| * 5605992ad4 i2c: smbus: Improve handling of stuck alerts
| * 706f18a8fa arm64: errata: Expand speculative SSBS workaround (again)
| * f261c5d8d0 arm64: cputype: Add Cortex-A725 definitions
| * bdae104b09 arm64: cputype: Add Cortex-X1C definitions
| * 4a500d4bdc arm64: errata: Expand speculative SSBS workaround
| * bf0d247dfb arm64: errata: Unify speculative SSBS errata logic
| * 17ff37fe45 arm64: cputype: Add Cortex-X925 definitions
| * 77741cdc25 arm64: cputype: Add Cortex-A720 definitions
| * b8d683f5b5 arm64: cputype: Add Cortex-X3 definitions
| * 9f7ba00782 arm64: errata: Add workaround for Arm errata 3194386 and 3312417
| * d8029a49c8 arm64: cputype: Add Neoverse-V3 definitions
| * c46b7570c9 arm64: cputype: Add Cortex-X4 definitions
| * 55920e407a arm64: Add Neoverse-V2 part
| * 5b9ae6bb33 arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
| * 69299a4282 ext4: fix wrong unit use in ext4_mb_find_by_goal
| * 1d21d41750 sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
| * 3b2b169fad SUNRPC: Fix a race to wake a sync task
| * a3e52a4c22 s390/sclp: Prevent release of buffer in I/O
| * 1a6b4240b0 jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
| * e48a901ce6 media: uvcvideo: Fix the bandwdith quirk on USB 3.x
| * de305abd36 media: uvcvideo: Ignore empty TS packets
| * c1749313f3 drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
| * d81c1eeb33 drm/amdgpu: Fix the null pointer dereference to ras_manager
| * 1d4e65fa62 btrfs: fix bitmap leak when loading free space cache on duplicate entry
| * 29ce18d767 wifi: nl80211: don't give key data to userspace
| * 934f815345 udf: prevent integer overflow in udf_bitmap_free_blocks()
| * 65b982b9af PCI: Add Edimax Vendor ID to pci_ids.h
| * 55985e3aa1 selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
| * 8e665ccc52 ACPI: SBS: manage alarm sysfs attribute through psy core
| * 85d8fe79a3 ACPI: battery: create alarm sysfs attribute atomically
| * 64ac0c0235 clocksource/drivers/sh_cmt: Address race condition for clock events
| * c384dd4f1f md/raid5: avoid BUG_ON() while continue reshape after reassembling
| * 5ccf99545c md: do not delete safemode_timer in mddev_suspend
| * 464d242868 rcutorture: Fix rcu_torture_fwd_cb_cr() data race
| * adc491f3e7 net: fec: Stop PPS on driver remove
| * 865948628a l2tp: fix lockdep splat
| * b7b8d9f5e6 net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
| * 01150020c0 Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
| * 085fb116c4 net: linkwatch: use system_unbound_wq
| * e87f52225e net: usb: qmi_wwan: fix memory leak for not ip packets
| * 52319d9d2f sctp: Fix null-ptr-deref in reuseport_add_sock().
| * 17a93a8201 sctp: move hlist_node and hashent out of sctp_ep_common
| * ba4e59f34c x86/mm: Fix pti_clone_entry_text() for i386
| * d00c9b4bbc x86/mm: Fix pti_clone_pgtable() alignment assumption
| * 75880302cf irqchip/mbigen: Fix mbigen node address layout
| * c476c5c7bb genirq: Allow irq_chip registration functions to take a const irq_chip
| * 12fa993433 netfilter: ipset: Add list flush to cancel_gc
| * e93fa44f07 mptcp: fix duplicate data handling
| * 3deac6f686 r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
| * 646e9e9071 net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
| * 8b0a5709ac ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
| * 7b745257ff ALSA: usb-audio: Correct surround channels in UAC1 channel map
| * 08775b3d6e protect the fetch of ->fd[fd] in do_dup2() from mispredictions
| * e4b2b0306b HID: wacom: Modify pen IDs
| * b12a67976b platform/chrome: cros_ec_proto: Lock device when updating MKBP version
| * 59be4a1677 riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
| * 7d72f51951 ipv6: fix ndisc_is_useropt() handling for PIO
| * 8e97cc828d net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
| * c65f72eec6 net/iucv: fix use after free in iucv_sock_close()
| * 7c03ab555e sched: act_ct: take care of padding in struct zones_ht_key
| * b17eeed7cd drm/vmwgfx: Fix overlay when using Screen Targets
| * 906372e753 drm/nouveau: prime: fix refcount underflow
| * 6b50462b47 remoteproc: imx_rproc: Skip over memory region when node value is NULL
| * 5991ef8e7a remoteproc: imx_rproc: Fix ignoring mapping vdev regions
| * a4ed3286a5 remoteproc: imx_rproc: ignore mapping vdev regions
| * 3a2884a44e irqchip/imx-irqsteer: Handle runtime power management correctly
| * 0548b54d0a irqchip/imx-irqsteer: Add runtime PM support
| * 06a93b7203 irqchip/imx-irqsteer: Constify irq_chip struct
| * 652e7b4d73 genirq: Allow the PM device to originate from irq domain
| * ef56dcdca8 devres: Fix memory leakage caused by driver API devm_free_percpu()
| * 81484ab285 driver core: Cast to (void *) with __force for __percpu pointer
| * 6bb9cc6e25 drivers: soc: xilinx: check return status of get_api_version()
| * 79ec4cde1d soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver
| * 58b07286ae ext4: check the extent status again before inserting delalloc block
| * 4b6d9a0fe7 ext4: factor out a common helper to query extent map
| * b2591c89a6 sysctl: always initialize i_uid/i_gid
| * 88f053a1dd fuse: verify {g,u}id mount options correctly
| * 997d3c9cbe fuse: name fs_context consistently
| * 2fa82af6fd powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
| * d28869a145 fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
| * be23ae6308 nvme-pci: add missing condition check for existence of mapped data
| * ce90f30157 nvme: split command copy into a helper
| * b59013d264 ceph: fix incorrect kmalloc size of pagevec mempool
| * eb1b7575fe ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
| * 3ff4316953 lirc: rc_dev_get_from_fd(): fix file leak
| * ea72a88810 powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
| * 347dcb84a4 apparmor: Fix null pointer deref when receiving skb during sock creation
| * 9460ac3dd1 mISDN: Fix a use after free in hfcmulti_tx()
| * dda518dea6 bpf: Fix a segment issue when downgrading gso_size
| * 5cc4d71dda net: nexthop: Initialize all fields in dumped nexthops
| * dc2a655437 net: stmmac: Correct byte order of perfect_match
| * aa38bf7489 tipc: Return non-zero value from tipc_udp_addr2str() on error
| * cf791b98fe netfilter: nft_set_pipapo_avx2: disable softinterrupts
| * c8ae5939f4 net: bonding: correctly annotate RCU in bond_should_notify_peers()
| * 3bf09eab40 ipv4: Fix incorrect source address in Record Route option
| * f62a9cc0c2 MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
| * 257193083e dma: fix call order in dmam_free_coherent
| * 641b7a8920 libbpf: Fix no-args func prototype BTF dumping syntax
| * ff2387553f f2fs: fix start segno of large section
| * 721190921a um: time-travel: fix time-travel-start option
| * 538a27c804 jfs: Fix array-index-out-of-bounds in diFree
| * 1c089efe76 kdb: Use the passed prompt in kdb_position_cursor()
| * f0ad62559f kdb: address -Wformat-security warnings
| * 65dba3c9ce kernel: rerun task_work while freezing in get_signal()
| * b839175c06 io_uring/io-wq: limit retrying worker initialisation
| * 5f0a6800b8 nilfs2: handle inconsistent state in nilfs_btnode_create_block()
| * 9fa8eca259 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
| * 4d3eb40ccd Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
| * 1fccae3fd7 rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
| * 52d8d27fd6 rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
| * 76b62f3035 drm/panfrost: Mark simple_ondemand governor as softdep
| * 77411a2d22 MIPS: Loongson64: env: Hook up Loongsson-2K
| * 636163de03 MIPS: ip30: ip30-console: Add missing include
| * 4e8f70d3cc rbd: don't assume rbd_is_lock_owner() for exclusive mappings
| * 24933a55bf selftests/sigaltstack: Fix ppc64 GCC build
| * 94ee7ff99b RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
| * 9667d46f8a platform: mips: cpu_hwmon: Disable driver on unsupported hardware
| * 19f108b3d1 watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
| * 9cba1ec637 rtc: isl1208: Fix return value of nvmem callbacks
| * a49321257f perf/x86/intel/pt: Fix a topa_entry base address calculation
| * 3b8e1b7d26 perf/x86/intel/pt: Fix topa_entry base length
| * a3ab508a48 scsi: qla2xxx: validate nvme_local_port correctly
| * 57ba756371 scsi: qla2xxx: Complete command early within lock
| * b0c39dcbd8 scsi: qla2xxx: Fix flash read failure
| * 87db8d7b75 scsi: qla2xxx: Fix for possible memory corruption
| * e5ed6a26ff scsi: qla2xxx: During vport delete send async logout explicitly
| * 2fcd485289 rtc: cmos: Fix return value of nvmem callbacks
| * d4d814159f devres: Fix devm_krealloc() wasting memory
| * 648d549046 kobject_uevent: Fix OOB access within zap_modalias_env()
| * 41dd963641 kbuild: Fix '-S -c' in x86 stack protector scripts
| * 0730ea8502 decompress_bunzip2: fix rare decompression failure
| * bed9580165 ubi: eba: properly rollback inside self_check_eba
| * ae99754cd8 clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
| * 54bc4e8844 f2fs: fix to don't dirty inode for readonly filesystem
| * b848b40794 scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
| * a44f88f757 dev/parport: fix the array out-of-bounds risk
| * 388ee7a4d3 binder: fix hang of unregistered readers
| * ac2459460c PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
| * e5bae95306 PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
| * af1d27f88e hwrng: amd - Convert PCIBIOS_* return codes to errnos
| * 43aab4483d tools/memory-model: Fix bug in lock.cat
| * 9d289ce917 KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
| * cdbcb4e9f6 jbd2: make jbd2_journal_get_max_txn_bufs() internal
| * 6d5223be13 leds: ss4200: Convert PCIBIOS_* return codes to errnos
| * 35f8c9ac0c wifi: mwifiex: Fix interface type change
| * de2a011a13 ext4: make sure the first directory block is not a hole
| * 42d4205170 ext4: check dot and dotdot of dx_root before making dir indexed
| * 3846394785 m68k: amiga: Turn off Warp1260 interrupts during boot
| * 2199e157a4 udf: Avoid using corrupted block bitmap buffer
| * 5c59cb8dd9 task_work: Introduce task_work_cancel() again
| * 1fd27cc6f0 task_work: s/task_work_cancel()/task_work_cancel_func()/
| * 973155ca67 apparmor: use kvfree_sensitive to free data->data
| * eb46367187 sched/fair: Use all little CPUs for CPU-bound workloads
| * 9ce89824ff drm/amd/display: Check for NULL pointer
| * 748e9ad7c0 scsi: qla2xxx: Fix optrom version displayed in FDMI
| * 6735d02ead drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
| * b6ac46a001 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
| * 86f4ca8b3b ext2: Verify bitmap and itable block numbers before using them
| * 10f7163bfb hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
| * 4c9d235630 media: venus: fix use after free in vdec_close
| * e65cccfae7 char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
| * cf0c713c69 sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
| * 5c5b02d489 ipv6: take care of scope when choosing the src addr
| * 83e2dfadcb af_packet: Handle outgoing VLAN packets without hardware offloading
| * 7e36a3c701 net: netconsole: Disable target before netpoll cleanup
| * 9ef7190228 tick/broadcast: Make takeover of broadcast hrtimer reliable
| * f2c2c4cc5a dt-bindings: thermal: correct thermal zone node name limit
| * 14083dc69b rtc: interface: Add RTC offset to alarm after fix-up
| * 84ffa27eb0 nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
| * 9d6571b1c4 fs/nilfs2: remove some unused macros to tame gcc
| * 3c6fa67023 fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
| * 21a15d52bc pinctrl: freescale: mxs: Fix refcount of child
| * d2de7746e5 pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
| * 73303a4a8f pinctrl: ti: ti-iodelay: Drop if block with always false condition
| * 15014206f9 pinctrl: single: fix possible memory leak when pinctrl_enable() fails
| * 8c3bef7ca8 pinctrl: core: fix possible memory leak when pinctrl_enable() fails
| * 53f2d5bce1 pinctrl: rockchip: update rk3308 iomux routes
| * 01c0341e98 net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
| * ef6af29942 net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
| * eb4ca1a97e netfilter: ctnetlink: use helper function to calculate expect ID
| * 9118c408ee bnxt_re: Fix imm_data endianness
| * edc2dee07a RDMA/hns: Fix missing pagesize and alignment check in FRMR
| * 29723ad948 macintosh/therm_windtunnel: fix module unload.
| * 445ffbccd0 powerpc/xmon: Fix disassembly CPU feature checks
| * 38a7e4b8bf MIPS: Octeron: remove source file executable bit
| * 3009d371a2 Input: elan_i2c - do not leave interrupt disabled on suspend failure
| * 37a484f771 RDMA/device: Return error earlier if port in not valid
| * 695d70c60b mtd: make mtd_test.c a separate module
| * ab2114f6ff ASoC: max98088: Check for clk_prepare_enable() error
| * 771f129bed RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
| * 506e71b0e1 RDMA/mlx4: Fix truncated output warning in alias_GUID.c
| * 6bf3cf61f3 RDMA/mlx4: Fix truncated output warning in mad.c
| * 26b6512d5d Input: qt1050 - handle CHIP_ID reading error
| * 2be7e24056 coresight: Fix ref leak when of_coresight_parse_endpoint() fails
| * 3d1c4bf57d PCI: Fix resource double counting on remove & rescan
| * 8105318210 SUNRPC: Fixup gss_status tracepoint error output
| * 8f1dc3f33f sparc64: Fix incorrect function signature and add prototype for prom_cif_init
| * 3d096f2a99 ext4: avoid writing unitialized memory to disk in EA inodes
| * 91c22df701 SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
| * 84edcf61bd xprtrdma: Fix rpcrdma_reqs_reset()
| * 974294806b xprtrdma: Rename frwr_release_mr()
| * cf9141d2f7 mfd: omap-usb-tll: Use struct_size to allocate tll
| * 72ac78ec1a media: venus: flush all buffers in output plane streamoff
| * 5ed0496e38 ext4: fix infinite loop when replaying fast_commit
| * c9106ad5ea Revert "leds: led-core: Fix refcount leak in of_led_get()"
| * 4e87f592a4 drm/qxl: Add check for drm_cvt_mode
| * cd105977b1 drm/etnaviv: fix DMA direction handling for cached RW buffers
| * 6ef4f1e981 perf report: Fix condition in sort__sym_cmp()
| * 09c1583f0e leds: trigger: Unregister sysfs attributes before calling deactivate()
| * 3c9071a871 media: renesas: vsp1: Store RPF partition configuration per RPF instance
| * 3944484005 media: renesas: vsp1: Fix _irqsave and _irq mix
| * 9459f33175 media: uvcvideo: Override default flags
| * 115d814d6a media: uvcvideo: Allow entity-defined get_info and get_cur
| * e470e95616 saa7134: Unchecked i2c_transfer function result fixed
| * f3968b3d3c media: imon: Fix race getting ictx->lock
| * bcc963f591 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
| * 7aaa368c68 drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
| * fb20da8338 drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
| * be9d08ff10 xdp: fix invalid wait context of page_pool_destroy()
| * 96178b12c8 selftests: forwarding: devlink_lib: Wait for udev events after reloading
| * 859bc76374 bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
| * 6ce46045f9 bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
| * 28c8fce207 bpf: annotate BTF show functions with __printf
| * 1ccb1399bd selftests/bpf: Close fd in error path in drop_on_reuseport
| * be53b70fc0 wifi: virt_wifi: don't use strlen() in const context
| * f851ff5c6e gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
| * 05c4488a0e wifi: virt_wifi: avoid reporting connection success with wrong SSID
| * b33dd45086 qed: Improve the stack space of filter_config()
| * 7f132aca18 perf: Prevent passing zero nr_pages to rb_alloc_aux()
| * a2450206c0 perf: Fix perf_aux_size() for greater-than 32-bit size
| * a497a6b72b perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
| * d4f4188ecf netfilter: nf_tables: rise cap on SELinux secmark context
| * 0d08015bee ipvs: Avoid unnecessary calls to skb_is_gso_sctp
| * 2912a0d136 net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
| * 29254059a1 net: fec: Refactor: #define magic constants
| * 2e201b3d16 wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
| * 72e470089f wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
| * 4055275ca3 wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
| * 2aa1739334 ath11k: dp: stop rx pktlog before suspend
| * dae1ab7040 mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
| * aa98eb0740 mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
| * 36a9996e02 mlxsw: spectrum_acl_erp: Fix object nesting warning
| * 22ae17a267 lib: objagg: Fix general protection fault
| * ada0c31925 selftests/bpf: Check length of recv in test_sockmap
| * 249adb30cb net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
| * 15c2ec7c28 net/smc: Allow SMC-D 1MB DMB allocations
| * 8d0d50a8b7 net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
| * 2f5738bdd6 selftests/bpf: Fix prog numbers in test_sockmap
| * 1302433dc6 wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
| * 1eb5751e23 firmware: turris-mox-rwtm: Initialize completion before mailbox
| * 085dc94289 firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
| * 6f3cb1fd6b ARM: spitz: fix GPIO assignment for backlight
| * 7b7d06a310 ARM: pxa: spitz: use gpio descriptors for audio
| * 3ae2ec97d8 m68k: cmpxchg: Fix return value for default case in __arch_xchg()
| * ba1d2ecfcf x86/xen: Convert comma to semicolon
| * 4a49ce2d63 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
| * e04654f425 arm64: dts: amlogic: gx: correct hdmi clocks
| * 4745535fce arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
| * be5ca40647 arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
| * b1e9396ac4 ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
| * a992c88fbb ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
| * c79a7cad41 ARM: dts: imx6qdl-kontron-samx6i: fix board reset
| * efd89b5db5 ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
| * bbfa9a71ae ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
| * 31a9a0958b arm64: dts: rockchip: Increase VOP clk rate on RK3328
| * 5cc525351b soc: qcom: pdr: fix parsing of domains lists
| * eab05737ee soc: qcom: pdr: protect locator_addr with the main mutex
| * a584e5d3f7 arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
| * eedd9fd986 soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers
| * 39f4cb508e arm64: dts: qcom: sdm845: add power-domain to UFS PHY
| * d3e6b30c9c hwmon: (max6697) Fix swapped temp{1,8} critical alarms
| * 15770a1476 hwmon: (max6697) Fix underflow when writing limit attributes
| * ae8bd075a9 pwm: stm32: Always do lazy disabling
| * d8571b9a83 hwmon: (adt7475) Fix default duty on fan is disabled
| * 685976438b x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
| * 010441f083 x86/pci/xen: Fix PCIBIOS_* return code handling
| * c995bea85e x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
| * e2fdf7b79f x86/of: Return consistent error type from x86_of_pci_irq_enable()
| * 97795f23a8 hfsplus: fix to avoid false alarm of circular locking
| * c0748b7684 platform/chrome: cros_ec_debugfs: fix wrong EC message version
| * 3070e81609 EDAC, i10nm: make skx_common.o a separate module
| * 9bff9479e1 EDAC/skx_common: Add new ADXL components for 2-level memory
* 767b3cdf4f Merge branch 'android12-5.10' into android12-5.10-lts

Change-Id: I0e05e42a679534cd2d7254df19f21f2d8732df5f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Documentation/arm64/cpu-feature-registers.rst

@@ -92,7 +92,7 @@ operation if the source belongs to the supported system register space.
 
 The infrastructure emulates only the following system register space::
 
-	Op0=3, Op1=0, CRn=0, CRm=0,4,5,6,7
+	Op0=3, Op1=0, CRn=0, CRm=0,2,3,4,5,6,7
 
 (See Table C5-6 'System instruction encodings for non-Debug System
 register accesses' in ARMv8 ARM DDI 0487A.h, for the list of
@@ -291,6 +291,42 @@ infrastructure:
      | RPRES                        | [7-4]   |    y    |
      +------------------------------+---------+---------+
 
+  10) MVFR0_EL1 - AArch32 Media and VFP Feature Register 0
+
+     +------------------------------+---------+---------+
+     | Name                         |  bits   | visible |
+     +------------------------------+---------+---------+
+     | FPDP                         | [11-8]  |    y    |
+     +------------------------------+---------+---------+
+
+  11) MVFR1_EL1 - AArch32 Media and VFP Feature Register 1
+
+     +------------------------------+---------+---------+
+     | Name                         |  bits   | visible |
+     +------------------------------+---------+---------+
+     | SIMDFMAC                     | [31-28] |    y    |
+     +------------------------------+---------+---------+
+     | SIMDSP                       | [19-16] |    y    |
+     +------------------------------+---------+---------+
+     | SIMDInt                      | [15-12] |    y    |
+     +------------------------------+---------+---------+
+     | SIMDLS                       | [11-8]  |    y    |
+     +------------------------------+---------+---------+
+
+  12) ID_ISAR5_EL1 - AArch32 Instruction Set Attribute Register 5
+
+     +------------------------------+---------+---------+
+     | Name                         |  bits   | visible |
+     +------------------------------+---------+---------+
+     | CRC32                        | [19-16] |    y    |
+     +------------------------------+---------+---------+
+     | SHA2                         | [15-12] |    y    |
+     +------------------------------+---------+---------+
+     | SHA1                         | [11-8]  |    y    |
+     +------------------------------+---------+---------+
+     | AES                          | [7-4]   |    y    |
+     +------------------------------+---------+---------+
+
 
 Appendix I: Example
 -------------------

Documentation/arm64/silicon-errata.rst

@@ -94,6 +94,8 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A76      | #1463225        | ARM64_ERRATUM_1463225       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A76      | #3324349        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A77      | #1508412        | ARM64_ERRATUM_1508412       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A510     | #2051678        | ARM64_ERRATUM_2051678       |
@@ -102,6 +104,30 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A710     | #2054223        | ARM64_ERRATUM_2054223       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A77      | #3324348        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A78      | #3324344        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A78C     | #3324346,3324347| ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A710     | #3324338        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A720     | #3456091        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A725     | #3456106        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X1       | #3324344        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X1C      | #3324346        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X2       | #3324338        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X3       | #3324335        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X4       | #3194386        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X925     | #3324334        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1188873,1418040| ARM64_ERRATUM_1418040       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1349291        | N/A                         |
@@ -110,6 +136,16 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N2     | #2067961        | ARM64_ERRATUM_2067961       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N1     | #3324349        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N2     | #3324339        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V1     | #3324341        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V2     | #3324336        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V3     | #3312417        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | MMU-500         | #841119,826419  | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+

Documentation/devicetree/bindings/thermal/thermal-zones.yaml

@@ -49,7 +49,10 @@ properties:
       to take when the temperature crosses those thresholds.
 
 patternProperties:
-  "^[a-zA-Z][a-zA-Z0-9\\-]{1,12}-thermal$":
+  # Node name is limited in size due to Linux kernel requirements - 19
+  # characters in total (see THERMAL_NAME_LENGTH, including terminating NUL
+  # byte):
+  "^[a-zA-Z][a-zA-Z0-9\\-]{1,10}-thermal$":
     type: object
     description:
       Each thermal zone node contains information about how frequently it

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 223
+SUBLEVEL = 226
 EXTRAVERSION =
 NAME = Dare mighty things
 

arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi

@@ -5,31 +5,8 @@
 
 #include "imx6q.dtsi"
 #include "imx6qdl-kontron-samx6i.dtsi"
-#include <dt-bindings/gpio/gpio.h>
 
 / {
 	model = "Kontron SMARC sAMX6i Quad/Dual";
 	compatible = "kontron,imx6q-samx6i", "fsl,imx6q";
 };
-
-/* Quad/Dual SoMs have 3 chip-select signals */
-&ecspi4 {
-	cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>,
-		   <&gpio3 29 GPIO_ACTIVE_LOW>,
-		   <&gpio3 25 GPIO_ACTIVE_LOW>;
-};
-
-&pinctrl_ecspi4 {
-	fsl,pins = <
-		MX6QDL_PAD_EIM_D21__ECSPI4_SCLK 0x100b1
-		MX6QDL_PAD_EIM_D28__ECSPI4_MOSI 0x100b1
-		MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1
-
-		/* SPI4_IMX_CS2# - connected to internal flash */
-		MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0
-		/* SPI4_IMX_CS0# - connected to SMARC SPI0_CS0# */
-		MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0
-		/* SPI4_CS3# - connected to  SMARC SPI0_CS1# */
-		MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0
-	>;
-};

arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi

@@ -244,7 +244,8 @@ &ecspi4 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_ecspi4>;
 	cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>,
-		   <&gpio3 29 GPIO_ACTIVE_LOW>;
+		   <&gpio3 29 GPIO_ACTIVE_LOW>,
+		   <&gpio3 25 GPIO_ACTIVE_LOW>;
 	status = "okay";
 
 	/* default boot source: workaround #1 for errata ERR006282 */
@@ -259,8 +260,20 @@ smarc_flash: flash@0 {
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-connection-type = "rgmii-id";
-	phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+	phy-handle = <&ethphy>;
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		ethphy: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+			reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <1000>;
+		};
+	};
 };
 
 &i2c_intern {
@@ -448,6 +461,8 @@ MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1
 			MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0
 			/* SPI_IMX_CS0# - connected to SMARC SPI0_CS0# */
 			MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0
+			/* SPI4_CS3# - connected to SMARC SPI0_CS1# */
+			MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0
 		>;
 	};
 
@@ -500,7 +515,7 @@ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b0b0
 			MX6QDL_PAD_ENET_MDIO__ENET_MDIO       0x1b0b0
 			MX6QDL_PAD_ENET_MDC__ENET_MDC         0x1b0b0
 			MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK  0x1b0b0
-			MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25    0x1b0b0 /* RST_GBE0_PHY# */
+			MX6QDL_PAD_NANDF_D1__GPIO2_IO01       0x1b0b0 /* RST_GBE0_PHY# */
 		>;
 	};
 
@@ -713,7 +728,7 @@ &pcie {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_pcie>;
 	wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>;
-	reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>;
+	reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>;
 };
 
 /* LCD_BKLT_PWM */
@@ -801,5 +816,6 @@ &wdog1 {
 	/* CPLD is feeded by watchdog (hardwired) */
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_wdog1>;
+	fsl,ext-reset-output;
 	status = "okay";
 };

arch/arm/mach-pxa/spitz.c

@@ -43,7 +43,7 @@
 #include <linux/platform_data/mmc-pxamci.h>
 #include <linux/platform_data/usb-ohci-pxa27x.h>
 #include <linux/platform_data/video-pxafb.h>
-#include <mach/spitz.h>
+#include "spitz.h"
 #include "sharpsl_pm.h"
 #include <mach/smemc.h>
 
@@ -516,10 +516,8 @@ static struct pxa2xx_spi_chip spitz_ads7846_chip = {
 static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {
 	.dev_id = "spi2.1",
 	.table = {
-		GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_CONT,
+		GPIO_LOOKUP("sharp-scoop.1", 6, "BL_CONT", GPIO_ACTIVE_LOW),
-			    "BL_CONT", GPIO_ACTIVE_LOW),
+		GPIO_LOOKUP("sharp-scoop.1", 7, "BL_ON", GPIO_ACTIVE_HIGH),
-		GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_ON,
-			    "BL_ON", GPIO_ACTIVE_HIGH),
 		{ },
 	},
 };
@@ -527,10 +525,8 @@ static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {
 static struct gpiod_lookup_table akita_lcdcon_gpio_table = {
 	.dev_id = "spi2.1",
 	.table = {
-		GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_CONT,
+		GPIO_LOOKUP("i2c-max7310", 3, "BL_ON", GPIO_ACTIVE_HIGH),
-			    "BL_CONT", GPIO_ACTIVE_LOW),
+		GPIO_LOOKUP("i2c-max7310", 4, "BL_CONT", GPIO_ACTIVE_LOW),
-		GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_ON,
-			    "BL_ON", GPIO_ACTIVE_HIGH),
 		{ },
 	},
 };
@@ -954,11 +950,36 @@ static void __init spitz_i2c_init(void)
 static inline void spitz_i2c_init(void) {}
 #endif
 
+static struct gpiod_lookup_table spitz_audio_gpio_table = {
+	.dev_id = "spitz-audio",
+	.table = {
+		GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.1", 8, "mic", GPIO_ACTIVE_HIGH),
+		{ },
+	},
+};
+
+static struct gpiod_lookup_table akita_audio_gpio_table = {
+	.dev_id = "spitz-audio",
+	.table = {
+		GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("i2c-max7310", 2, "mic", GPIO_ACTIVE_HIGH),
+		{ },
+	},
+};
+
 /******************************************************************************
  * Audio devices
  ******************************************************************************/
 static inline void spitz_audio_init(void)
 {
+	if (machine_is_akita())
+		gpiod_add_lookup_table(&akita_audio_gpio_table);
+	else
+		gpiod_add_lookup_table(&spitz_audio_gpio_table);
+
 	platform_device_register_simple("spitz-audio", -1, NULL, 0);
 }
 

arch/arm/mach-pxa/spitz.h

@@ -11,7 +11,7 @@
 #define __ASM_ARCH_SPITZ_H  1
 #endif
 
-#include "irqs.h" /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */
+#include <mach/irqs.h> /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */
 #include <linux/fb.h>
 
 /* Spitz/Akita GPIOs */

arch/arm/mach-pxa/spitz_pm.c

@@ -20,7 +20,7 @@
 #include <asm/mach-types.h>
 #include <mach/hardware.h>
 
-#include <mach/spitz.h>
+#include "spitz.h"
 #include "pxa27x.h"
 #include "sharpsl_pm.h"
 

arch/arm64/Kconfig

@@ -770,6 +770,44 @@ config ARM64_ERRATUM_2457168
 
 	  If unsure, say Y.
 
+config ARM64_ERRATUM_3194386
+	bool "Cortex-*/Neoverse-*: workaround for MSR SSBS not self-synchronizing"
+	default y
+	help
+	  This option adds the workaround for the following errata:
+
+	  * ARM Cortex-A76 erratum 3324349
+	  * ARM Cortex-A77 erratum 3324348
+	  * ARM Cortex-A78 erratum 3324344
+	  * ARM Cortex-A78C erratum 3324346
+	  * ARM Cortex-A78C erratum 3324347
+	  * ARM Cortex-A710 erratam 3324338
+	  * ARM Cortex-A720 erratum 3456091
+	  * ARM Cortex-A725 erratum 3456106
+	  * ARM Cortex-X1 erratum 3324344
+	  * ARM Cortex-X1C erratum 3324346
+	  * ARM Cortex-X2 erratum 3324338
+	  * ARM Cortex-X3 erratum 3324335
+	  * ARM Cortex-X4 erratum 3194386
+	  * ARM Cortex-X925 erratum 3324334
+	  * ARM Neoverse-N1 erratum 3324349
+	  * ARM Neoverse N2 erratum 3324339
+	  * ARM Neoverse-V1 erratum 3324341
+	  * ARM Neoverse V2 erratum 3324336
+	  * ARM Neoverse-V3 erratum 3312417
+
+	  On affected cores "MSR SSBS, #0" instructions may not affect
+	  subsequent speculative instructions, which may permit unexepected
+	  speculative store bypassing.
+
+	  Work around this problem by placing a Speculation Barrier (SB) or
+	  Instruction Synchronization Barrier (ISB) after kernel changes to
+	  SSBS. The presence of the SSBS special-purpose register is hidden
+	  from hwcaps and EL0 reads of ID_AA64PFR1_EL1, such that userspace
+	  will use the PR_SPEC_STORE_BYPASS prctl to change SSBS.
+
+	  If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
 	bool "Cavium erratum 22375, 24313"
 	default y

arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi

@@ -311,8 +311,8 @@ &hdmi_tx {
 		 <&reset RESET_HDMI_SYSTEM_RESET>,
 		 <&reset RESET_HDMI_TX>;
 	reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy";
-	clocks = <&clkc CLKID_HDMI_PCLK>,
+	clocks = <&clkc CLKID_HDMI>,
-		 <&clkc CLKID_CLK81>,
+		 <&clkc CLKID_HDMI_PCLK>,
 		 <&clkc CLKID_GCLK_VENCI_INT0>;
 	clock-names = "isfr", "iahb", "venci";
 };

arch/arm64/boot/dts/amlogic/meson-gxl.dtsi

@@ -323,8 +323,8 @@ &hdmi_tx {
 		 <&reset RESET_HDMI_SYSTEM_RESET>,
 		 <&reset RESET_HDMI_TX>;
 	reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy";
-	clocks = <&clkc CLKID_HDMI_PCLK>,
+	clocks = <&clkc CLKID_HDMI>,
-		 <&clkc CLKID_CLK81>,
+		 <&clkc CLKID_HDMI_PCLK>,
 		 <&clkc CLKID_GCLK_VENCI_INT0>;
 	clock-names = "isfr", "iahb", "venci";
 };

arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts

@@ -285,8 +285,8 @@ asm_sel {
 	/* eMMC is shared pin with parallel NAND */
 	emmc_pins_default: emmc-pins-default {
 		mux {
-			function = "emmc", "emmc_rst";
+			function = "emmc";
-			groups = "emmc";
+			groups = "emmc", "emmc_rst";
 		};
 
 		/* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",

arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts

@@ -249,8 +249,8 @@ &pio {
 	/* eMMC is shared pin with parallel NAND */
 	emmc_pins_default: emmc-pins-default {
 		mux {
-			function = "emmc", "emmc_rst";
+			function = "emmc";
-			groups = "emmc";
+			groups = "emmc", "emmc_rst";
 		};
 
 		/* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",

arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi

@@ -628,7 +628,6 @@ pins_tx {
 		};
 		pins_rts {
 			pinmux = <PINMUX_GPIO47__FUNC_URTS1>;
-			output-enable;
 		};
 		pins_cts {
 			pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
@@ -647,7 +646,6 @@ pins_tx {
 		};
 		pins_rts {
 			pinmux = <PINMUX_GPIO47__FUNC_URTS1>;
-			output-enable;
 		};
 		pins_cts {
 			pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;

arch/arm64/boot/dts/qcom/msm8996.dtsi

@@ -927,7 +927,7 @@ ufshc: ufshc@624000 {
 				<&gcc GCC_UFS_RX_SYMBOL_0_CLK>;
 			freq-table-hz =
 				<100000000 200000000>,
-				<0 0>,
+				<100000000 200000000>,
 				<0 0>,
 				<0 0>,
 				<0 0>,

arch/arm64/boot/dts/qcom/sdm845.dtsi

@@ -2125,6 +2125,8 @@ ufs_mem_phy: phy@1d87000 {
 			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
 				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 			status = "disabled";

arch/arm64/boot/dts/rockchip/rk3328.dtsi

@@ -811,8 +811,8 @@ cru: clock-controller@ff440000 {
 			<0>, <24000000>,
 			<24000000>, <24000000>,
 			<15000000>, <15000000>,
-			<100000000>, <100000000>,
+			<300000000>, <100000000>,
-			<100000000>, <100000000>,
+			<400000000>, <100000000>,
 			<50000000>, <100000000>,
 			<100000000>, <100000000>,
 			<50000000>, <50000000>,

arch/arm64/include/asm/acpi.h

@@ -97,6 +97,18 @@ static inline u32 get_acpi_id_for_cpu(unsigned int cpu)
 	return	acpi_cpu_get_madt_gicc(cpu)->uid;
 }
 
+static inline int get_cpu_for_acpi_id(u32 uid)
+{
+	int cpu;
+
+	for (cpu = 0; cpu < nr_cpu_ids; cpu++)
+		if (acpi_cpu_get_madt_gicc(cpu) &&
+		    uid == get_acpi_id_for_cpu(cpu))
+			return cpu;
+
+	return -EINVAL;
+}
+
 static inline void arch_fix_phys_package_id(int num, u32 slot) { }
 void __init acpi_init_cpus(void);
 int apei_claim_sea(struct pt_regs *regs);

arch/arm64/include/asm/cpucaps.h

@@ -73,8 +73,9 @@
 #define ARM64_SPECTRE_BHB			62
 #define ARM64_WORKAROUND_2457168		63
 #define ARM64_WORKAROUND_1742098		64
+#define ARM64_WORKAROUND_SPECULATIVE_SSBS	65
 
-/* kabi: reserve 65 - 76 for future cpu capabilities */
+/* kabi: reserve 66 - 76 for future cpu capabilities */
 #define ARM64_NCAPS				76
 
 #endif /* __ASM_CPUCAPS_H */

arch/arm64/include/asm/cputype.h

@@ -84,6 +84,14 @@
 #define ARM_CPU_PART_CORTEX_X2		0xD48
 #define ARM_CPU_PART_NEOVERSE_N2	0xD49
 #define ARM_CPU_PART_CORTEX_A78C	0xD4B
+#define ARM_CPU_PART_CORTEX_X1C		0xD4C
+#define ARM_CPU_PART_CORTEX_X3		0xD4E
+#define ARM_CPU_PART_NEOVERSE_V2	0xD4F
+#define ARM_CPU_PART_CORTEX_A720	0xD81
+#define ARM_CPU_PART_CORTEX_X4		0xD82
+#define ARM_CPU_PART_NEOVERSE_V3	0xD84
+#define ARM_CPU_PART_CORTEX_X925	0xD85
+#define ARM_CPU_PART_CORTEX_A725	0xD87
 
 #define APM_CPU_PART_POTENZA		0x000
 
@@ -136,6 +144,14 @@
 #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)
 #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)
 #define MIDR_CORTEX_A78C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)
+#define MIDR_CORTEX_X1C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C)
+#define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3)
+#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2)
+#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720)
+#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4)
+#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)
+#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)
+#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
 #define MIDR_THUNDERX	MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)

arch/arm64/kernel/acpi_numa.c

@@ -27,24 +27,13 @@
 
 #include <asm/numa.h>
 
-static int acpi_early_node_map[NR_CPUS] __initdata = { NUMA_NO_NODE };
+static int acpi_early_node_map[NR_CPUS] __initdata = { [0 ... NR_CPUS - 1] = NUMA_NO_NODE };
 
 int __init acpi_numa_get_nid(unsigned int cpu)
 {
 	return acpi_early_node_map[cpu];
 }
 
-static inline int get_cpu_for_acpi_id(u32 uid)
-{
-	int cpu;
-
-	for (cpu = 0; cpu < nr_cpu_ids; cpu++)
-		if (uid == get_acpi_id_for_cpu(cpu))
-			return cpu;
-
-	return -EINVAL;
-}
-
 static int __init acpi_parse_gicc_pxm(union acpi_subtable_headers *header,
 				      const unsigned long end)
 {

arch/arm64/kernel/cpu_errata.c

@@ -366,6 +366,30 @@ static struct midr_range broken_aarch32_aes[] = {
 };
 #endif
 
+#ifdef CONFIG_ARM64_ERRATUM_3194386
+static const struct midr_range erratum_spec_ssbs_list[] = {
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A720),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A725),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+	{}
+};
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE
 	{
@@ -582,6 +606,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 		CAP_MIDR_RANGE_LIST(broken_aarch32_aes),
 		.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
 	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_3194386
+	{
+		.desc = "SSBS not fully self-synchronizing",
+		.capability = ARM64_WORKAROUND_SPECULATIVE_SSBS,
+		ERRATA_MIDR_RANGE_LIST(erratum_spec_ssbs_list),
+	},
 #endif
 	{
 	}

arch/arm64/kernel/cpufeature.c

@@ -423,6 +423,30 @@ static const struct arm64_ftr_bits ftr_id_aa64dfr0[] = {
 	ARM64_FTR_END,
 };
 
+static const struct arm64_ftr_bits ftr_mvfr0[] = {
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPROUND_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPSHVEC_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPSQRT_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPDIVIDE_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPTRAP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPDP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPSP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_SIMD_SHIFT, 4, 0),
+	ARM64_FTR_END,
+};
+
+static const struct arm64_ftr_bits ftr_mvfr1[] = {
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDFMAC_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_FPHP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDHP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDSP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDINT_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDLS_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_FPDNAN_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_FPFTZ_SHIFT, 4, 0),
+	ARM64_FTR_END,
+};
+
 static const struct arm64_ftr_bits ftr_mvfr2[] = {
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR2_FPMISC_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR2_SIMDMISC_SHIFT, 4, 0),
@@ -448,10 +472,10 @@ static const struct arm64_ftr_bits ftr_id_isar0[] = {
 
 static const struct arm64_ftr_bits ftr_id_isar5[] = {
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_RDM_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_CRC32_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_CRC32_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA2_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA2_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA1_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA1_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_AES_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_AES_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SEVL_SHIFT, 4, 0),
 	ARM64_FTR_END,
 };
@@ -558,7 +582,7 @@ static const struct arm64_ftr_bits ftr_zcr[] = {
  * Common ftr bits for a 32bit register with all hidden, strict
  * attributes, with 4bit feature fields and a default safe value of
  * 0. Covers the following 32bit registers:
- * id_isar[1-4], id_mmfr[1-3], id_pfr1, mvfr[0-1]
+ * id_isar[1-3], id_mmfr[1-3]
  */
 static const struct arm64_ftr_bits ftr_generic_32bits[] = {
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 28, 4, 0),
@@ -625,8 +649,8 @@ static const struct __ftr_reg_entry {
 	ARM64_FTR_REG(SYS_ID_ISAR6_EL1, ftr_id_isar6),
 
 	/* Op1 = 0, CRn = 0, CRm = 3 */
-	ARM64_FTR_REG(SYS_MVFR0_EL1, ftr_generic_32bits),
+	ARM64_FTR_REG(SYS_MVFR0_EL1, ftr_mvfr0),
-	ARM64_FTR_REG(SYS_MVFR1_EL1, ftr_generic_32bits),
+	ARM64_FTR_REG(SYS_MVFR1_EL1, ftr_mvfr1),
 	ARM64_FTR_REG(SYS_MVFR2_EL1, ftr_mvfr2),
 	ARM64_FTR_REG(SYS_ID_PFR2_EL1, ftr_id_pfr2),
 	ARM64_FTR_REG(SYS_ID_DFR1_EL1, ftr_id_dfr1),
@@ -1292,17 +1316,39 @@ feature_matches(u64 reg, const struct arm64_cpu_capabilities *entry)
 	return val >= entry->min_field_value;
 }
 
+static u64
+read_scoped_sysreg(const struct arm64_cpu_capabilities *entry, int scope)
+{
+	WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible());
+	if (scope == SCOPE_SYSTEM)
+		return read_sanitised_ftr_reg(entry->sys_reg);
+	else
+		return __read_sysreg_by_encoding(entry->sys_reg);
+}
+
+static bool
+has_user_cpuid_feature(const struct arm64_cpu_capabilities *entry, int scope)
+{
+	int mask;
+	struct arm64_ftr_reg *regp;
+	u64 val = read_scoped_sysreg(entry, scope);
+
+	regp = get_arm64_ftr_reg(entry->sys_reg);
+	if (!regp)
+		return false;
+
+	mask = cpuid_feature_extract_unsigned_field(regp->user_mask,
+						    entry->field_pos);
+	if (!mask)
+		return false;
+
+	return feature_matches(val, entry);
+}
+
 static bool
 has_cpuid_feature(const struct arm64_cpu_capabilities *entry, int scope)
 {
-	u64 val;
+	u64 val = read_scoped_sysreg(entry, scope);
-
-	WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible());
-	if (scope == SCOPE_SYSTEM)
-		val = read_sanitised_ftr_reg(entry->sys_reg);
-	else
-		val = __read_sysreg_by_encoding(entry->sys_reg);
-
 	return feature_matches(val, entry);
 }
 
@@ -1899,6 +1945,17 @@ static bool is_kvm_protected_mode(const struct arm64_cpu_capabilities *entry, in
 }
 #endif /* CONFIG_KVM */
 
+static void user_feature_fixup(void)
+{
+	if (cpus_have_cap(ARM64_WORKAROUND_SPECULATIVE_SSBS)) {
+		struct arm64_ftr_reg *regp;
+
+		regp = get_arm64_ftr_reg(SYS_ID_AA64PFR1_EL1);
+		if (regp)
+			regp->user_mask &= ~GENMASK(7, 4); /* SSBS */
+	}
+}
+
 static void elf_hwcap_fixup(void)
 {
 #ifdef CONFIG_ARM64_ERRATUM_1742098
@@ -2355,7 +2412,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 };
 
 #define HWCAP_CPUID_MATCH(reg, field, s, min_value)				\
-		.matches = has_cpuid_feature,					\
+		.matches = has_user_cpuid_feature,				\
 		.sys_reg = reg,							\
 		.field_pos = field,						\
 		.sign = s,							\
@@ -2929,6 +2986,7 @@ void __init setup_cpu_features(void)
 	u32 cwg;
 
 	setup_system_capabilities();
+	user_feature_fixup();
 	setup_elf_hwcaps(arm64_elf_hwcaps);
 
 	if (system_supports_32bit_el0()) {
@@ -3013,7 +3071,7 @@ static void __maybe_unused cpu_enable_cnp(struct arm64_cpu_capabilities const *c
 
 /*
  * We emulate only the following system register space.
- * Op0 = 0x3, CRn = 0x0, Op1 = 0x0, CRm = [0, 4 - 7]
+ * Op0 = 0x3, CRn = 0x0, Op1 = 0x0, CRm = [0, 2 - 7]
  * See Table C5-6 System instruction encodings for System register accesses,
  * ARMv8 ARM(ARM DDI 0487A.f) for more details.
  */
@@ -3023,7 +3081,7 @@ static inline bool __attribute_const__ is_emulated(u32 id)
 		sys_reg_CRn(id) == 0x0 &&
 		sys_reg_Op1(id) == 0x0 &&
 		(sys_reg_CRm(id) == 0 ||
-		 ((sys_reg_CRm(id) >= 4) && (sys_reg_CRm(id) <= 7))));
+		 ((sys_reg_CRm(id) >= 2) && (sys_reg_CRm(id) <= 7))));
 }
 
 /*

arch/arm64/kernel/proton-pack.c

@@ -570,6 +570,18 @@ static enum mitigation_state spectre_v4_enable_hw_mitigation(void)
 
 	/* SCTLR_EL1.DSSBS was initialised to 0 during boot */
 	set_pstate_ssbs(0);
+
+	/*
+	 * SSBS is self-synchronizing and is intended to affect subsequent
+	 * speculative instructions, but some CPUs can speculate with a stale
+	 * value of SSBS.
+	 *
+	 * Mitigate this with an unconditional speculation barrier, as CPUs
+	 * could mis-speculate branches and bypass a conditional barrier.
+	 */
+	if (IS_ENABLED(CONFIG_ARM64_ERRATUM_3194386))
+		spec_bar();
+
 	return SPECTRE_MITIGATED;
 }
 

arch/arm64/kvm/sys_regs.c

@@ -30,6 +30,7 @@
 #include <trace/events/kvm.h>
 
 #include "sys_regs.h"
+#include "vgic/vgic.h"
 
 #include "trace.h"
 
@@ -207,6 +208,11 @@ static bool access_gic_sgi(struct kvm_vcpu *vcpu,
 {
 	bool g1;
 
+	if (!kvm_has_gicv3(vcpu->kvm)) {
+		kvm_inject_undefined(vcpu);
+		return false;
+	}
+
 	if (!p->is_write)
 		return read_from_write_only(vcpu, p, r);
 

arch/arm64/kvm/vgic/vgic.h

@@ -318,4 +318,11 @@ int vgic_v4_init(struct kvm *kvm);
 void vgic_v4_teardown(struct kvm *kvm);
 void vgic_v4_configure_vsgis(struct kvm *kvm);
 
+static inline bool kvm_has_gicv3(struct kvm *kvm)
+{
+	return (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) &&
+		irqchip_in_kernel(kvm) &&
+		kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3);
+}
+
 #endif

arch/m68k/amiga/config.c

@@ -179,6 +179,15 @@ int __init amiga_parse_bootinfo(const struct bi_record *record)
 			dev->slotsize = be16_to_cpu(cd->cd_SlotSize);
 			dev->boardaddr = be32_to_cpu(cd->cd_BoardAddr);
 			dev->boardsize = be32_to_cpu(cd->cd_BoardSize);
+
+			/* CS-LAB Warp 1260 workaround */
+			if (be16_to_cpu(dev->rom.er_Manufacturer) == ZORRO_MANUF(ZORRO_PROD_CSLAB_WARP_1260) &&
+			    dev->rom.er_Product == ZORRO_PROD(ZORRO_PROD_CSLAB_WARP_1260)) {
+
+				/* turn off all interrupts */
+				pr_info("Warp 1260 card detected: applying interrupt storm workaround\n");
+				*(uint32_t *)(dev->boardaddr + 0x1000) = 0xfff;
+			}
 		} else
 			pr_warn("amiga_parse_bootinfo: too many AutoConfig devices\n");
 #endif /* CONFIG_ZORRO */

arch/m68k/atari/ataints.c

@@ -302,11 +302,7 @@ void __init atari_init_IRQ(void)
 
 	if (ATARIHW_PRESENT(SCU)) {
 		/* init the SCU if present */
-		tt_scu.sys_mask = 0x10;		/* enable VBL (for the cursor) and
+		tt_scu.sys_mask = 0x0;		/* disable all interrupts */
-									 * disable HSYNC interrupts (who
-									 * needs them?)  MFP and SCC are
-									 * enabled in VME mask
-									 */
 		tt_scu.vme_mask = 0x60;		/* enable MFP and SCC ints */
 	} else {
 		/* If no SCU and no Hades, the HSYNC interrupt needs to be

arch/m68k/include/asm/cmpxchg.h

@@ -33,7 +33,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
 		x = tmp;
 		break;
 	default:
-		tmp = __invalid_xchg_size(x, ptr, size);
+		x = __invalid_xchg_size(x, ptr, size);
 		break;
 	}
 

arch/mips/include/asm/mach-loongson64/boot_param.h

@@ -38,12 +38,14 @@ enum loongson_cpu_type {
 	Legacy_1B = 0x5,
 	Legacy_2G = 0x6,
 	Legacy_2H = 0x7,
+	Legacy_2K = 0x8,
 	Loongson_1A = 0x100,
 	Loongson_1B = 0x101,
 	Loongson_2E = 0x200,
 	Loongson_2F = 0x201,
 	Loongson_2G = 0x202,
 	Loongson_2H = 0x203,
+	Loongson_2K = 0x204,
 	Loongson_3A = 0x300,
 	Loongson_3B = 0x301
 };

arch/mips/include/asm/mips-cm.h

@@ -228,6 +228,10 @@ GCR_ACCESSOR_RO(32, 0x0d0, gic_status)
 GCR_ACCESSOR_RO(32, 0x0f0, cpc_status)
 #define CM_GCR_CPC_STATUS_EX			BIT(0)
 
+/* GCR_ACCESS - Controls core/IOCU access to GCRs */
+GCR_ACCESSOR_RW(32, 0x120, access_cm3)
+#define CM_GCR_ACCESS_ACCESSEN			GENMASK(7, 0)
+
 /* GCR_L2_CONFIG - Indicates L2 cache configuration when Config5.L2C=1 */
 GCR_ACCESSOR_RW(32, 0x130, l2_config)
 #define CM_GCR_L2_CONFIG_BYPASS			BIT(20)

arch/mips/kernel/cevt-r4k.c

@@ -307,13 +307,6 @@ int r4k_clockevent_init(void)
 	if (!c0_compare_int_usable())
 		return -ENXIO;
 
-	/*
-	 * With vectored interrupts things are getting platform specific.
-	 * get_c0_compare_int is a hook to allow a platform to return the
-	 * interrupt number of its liking.
-	 */
-	irq = get_c0_compare_int();
-
 	cd = &per_cpu(mips_clockevent_device, cpu);
 
 	cd->name		= "MIPS";
@@ -324,7 +317,6 @@ int r4k_clockevent_init(void)
 	min_delta		= calculate_min_delta();
 
 	cd->rating		= 300;
-	cd->irq			= irq;
 	cd->cpumask		= cpumask_of(cpu);
 	cd->set_next_event	= mips_next_event;
 	cd->event_handler	= mips_event_handler;
@@ -336,6 +328,13 @@ int r4k_clockevent_init(void)
 
 	cp0_timer_irq_installed = 1;
 
+	/*
+	 * With vectored interrupts things are getting platform specific.
+	 * get_c0_compare_int is a hook to allow a platform to return the
+	 * interrupt number of its liking.
+	 */
+	irq = get_c0_compare_int();
+
 	if (request_irq(irq, c0_compare_interrupt, flags, "timer",
 			c0_compare_interrupt))
 		pr_err("Failed to request irq %d (timer)\n", irq);

arch/mips/kernel/cpu-probe.c

@@ -1769,12 +1769,16 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)
 		c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM |
 			MIPS_ASE_LOONGSON_EXT | MIPS_ASE_LOONGSON_EXT2);
 		c->ases &= ~MIPS_ASE_VZ; /* VZ of Loongson-3A2000/3000 is incomplete */
+		change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER,
+				  LOONGSON_CONF6_INTIMER);
 		break;
 	case PRID_IMP_LOONGSON_64G:
 		__cpu_name[cpu] = "ICT Loongson-3";
 		set_elf_platform(cpu, "loongson3a");
 		set_isa(c, MIPS_CPU_ISA_M64R2);
 		decode_cpucfg(c);
+		change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER,
+				  LOONGSON_CONF6_INTIMER);
 		break;
 	default:
 		panic("Unknown Loongson Processor ID!");

arch/mips/kernel/smp-cps.c

@@ -229,7 +229,10 @@ static void boot_core(unsigned int core, unsigned int vpe_id)
 	write_gcr_co_reset_ext_base(CM_GCR_Cx_RESET_EXT_BASE_UEB);
 
 	/* Ensure the core can access the GCRs */
-	set_gcr_access(1 << core);
+	if (mips_cm_revision() < CM_REV_CM3)
+		set_gcr_access(1 << core);
+	else
+		set_gcr_access_cm3(1 << core);
 
 	if (mips_cpc_present()) {
 		/* Reset the core */

arch/mips/loongson64/env.c

@@ -65,6 +65,12 @@ void __init prom_init_env(void)
 	cpu_clock_freq = ecpu->cpu_clock_freq;
 	loongson_sysconf.cputype = ecpu->cputype;
 	switch (ecpu->cputype) {
+	case Legacy_2K:
+	case Loongson_2K:
+		smp_group[0] = 0x900000001fe11000;
+		loongson_sysconf.cores_per_node = 2;
+		loongson_sysconf.cores_per_package = 2;
+		break;
 	case Legacy_3A:
 	case Loongson_3A:
 		loongson_sysconf.cores_per_node = 4;
@@ -213,6 +219,8 @@ void __init prom_init_env(void)
 		default:
 			break;
 		}
+	} else if ((read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64R) {
+		loongson_fdt_blob = __dtb_loongson64_2core_2k1000_begin;
 	} else if ((read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64G) {
 		if (loongson_sysconf.bridgetype == LS7A)
 			loongson_fdt_blob = __dtb_loongson64g_4core_ls7a_begin;

arch/mips/sgi-ip30/ip30-console.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 
 #include <linux/io.h>
+#include <linux/processor.h>
 
 #include <asm/sn/ioc3.h>
 

arch/openrisc/kernel/setup.c

@@ -284,6 +284,9 @@ void calibrate_delay(void)
 
 void __init setup_arch(char **cmdline_p)
 {
+	/* setup memblock allocator */
+	setup_memory();
+
 	unflatten_and_copy_device_tree();
 
 	setup_cpuinfo();
@@ -310,9 +313,6 @@ void __init setup_arch(char **cmdline_p)
 	}
 #endif
 
-	/* setup memblock allocator */
-	setup_memory();
-
 	/* paging_init() sets up the MMU and marks all pages as reserved */
 	paging_init();
 

arch/parisc/kernel/irq.c

@@ -520,7 +520,7 @@ void do_cpu_irq_mask(struct pt_regs *regs)
 
 	old_regs = set_irq_regs(regs);
 	local_irq_disable();
-	irq_enter();
+	irq_enter_rcu();
 
 	eirr_val = mfctl(23) & cpu_eiem & per_cpu(local_ack_eiem, cpu);
 	if (!eirr_val)
@@ -555,7 +555,7 @@ void do_cpu_irq_mask(struct pt_regs *regs)
 #endif /* CONFIG_IRQSTACKS */
 
  out:
-	irq_exit();
+	irq_exit_rcu();
 	set_irq_regs(old_regs);
 	return;
 

arch/powerpc/boot/simple_alloc.c

@@ -114,8 +114,11 @@ static void *simple_realloc(void *ptr, unsigned long size)
 		return ptr;
 
 	new = simple_malloc(size);
-	memcpy(new, ptr, p->size);
+	if (new) {
-	simple_free(ptr);
+		memcpy(new, ptr, p->size);
+		simple_free(ptr);
+	}
+
 	return new;
 }
 

arch/powerpc/configs/85xx-hw.config

@@ -24,6 +24,7 @@ CONFIG_FS_ENET=y
 CONFIG_FSL_CORENET_CF=y
 CONFIG_FSL_DMA=y
 CONFIG_FSL_HV_MANAGER=y
+CONFIG_FSL_IFC=y
 CONFIG_FSL_PQ_MDIO=y
 CONFIG_FSL_RIO=y
 CONFIG_FSL_XGMAC_MDIO=y
@@ -58,6 +59,7 @@ CONFIG_INPUT_FF_MEMLESS=m
 CONFIG_MARVELL_PHY=y
 CONFIG_MDIO_BUS_MUX_GPIO=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_MEMORY=y
 CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI=y

arch/powerpc/include/asm/percpu.h

@@ -15,6 +15,16 @@
 #endif /* CONFIG_SMP */
 #endif /* __powerpc64__ */
 
+#if defined(CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK) && defined(CONFIG_SMP)
+#include <linux/jump_label.h>
+DECLARE_STATIC_KEY_FALSE(__percpu_first_chunk_is_paged);
+
+#define percpu_first_chunk_is_paged	\
+		(static_key_enabled(&__percpu_first_chunk_is_paged.key))
+#else
+#define percpu_first_chunk_is_paged	false
+#endif /* CONFIG_PPC64 && CONFIG_SMP */
+
 #include <asm-generic/percpu.h>
 
 #include <asm/paca.h>

arch/powerpc/kernel/mce.c

@@ -594,8 +594,15 @@ long notrace machine_check_early(struct pt_regs *regs)
 	u8 ftrace_enabled = this_cpu_get_ftrace_enabled();
 
 	this_cpu_set_ftrace_enabled(0);
-	/* Do not use nmi_enter/exit for pseries hpte guest */
+	/*
-	if (radix_enabled() || !firmware_has_feature(FW_FEATURE_LPAR))
+	 * Do not use nmi_enter/exit for pseries hpte guest
+	 *
+	 * Likewise, do not use it in real mode if percpu first chunk is not
+	 * embedded. With CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled there
+	 * are chances where percpu allocation can come from vmalloc area.
+	 */
+	if ((radix_enabled() || !firmware_has_feature(FW_FEATURE_LPAR)) &&
+	    !percpu_first_chunk_is_paged)
 		nmi_enter();
 
 	hv_nmi_check_nonrecoverable(regs);
@@ -606,7 +613,8 @@ long notrace machine_check_early(struct pt_regs *regs)
 	if (ppc_md.machine_check_early)
 		handled = ppc_md.machine_check_early(regs);
 
-	if (radix_enabled() || !firmware_has_feature(FW_FEATURE_LPAR))
+	if ((radix_enabled() || !firmware_has_feature(FW_FEATURE_LPAR)) &&
+	    !percpu_first_chunk_is_paged)
 		nmi_exit();
 
 	this_cpu_set_ftrace_enabled(ftrace_enabled);

arch/powerpc/kernel/setup_64.c

@@ -824,6 +824,7 @@ static int pcpu_cpu_distance(unsigned int from, unsigned int to)
 
 unsigned long __per_cpu_offset[NR_CPUS] __read_mostly;
 EXPORT_SYMBOL(__per_cpu_offset);
+DEFINE_STATIC_KEY_FALSE(__percpu_first_chunk_is_paged);
 
 static void __init pcpu_populate_pte(unsigned long addr)
 {
@@ -903,6 +904,7 @@ void __init setup_per_cpu_areas(void)
 	if (rc < 0)
 		panic("cannot initialize percpu area (err=%d)", rc);
 
+	static_key_enable(&__percpu_first_chunk_is_paged.key);
 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
 	for_each_possible_cpu(cpu) {
                 __per_cpu_offset[cpu] = delta + pcpu_unit_offsets[cpu];

arch/powerpc/kernel/traps.c

@@ -835,8 +835,14 @@ void machine_check_exception(struct pt_regs *regs)
 	 * This is silly. The BOOK3S_64 should just call a different function
 	 * rather than expecting semantics to magically change. Something
 	 * like 'non_nmi_machine_check_exception()', perhaps?
+	 *
+	 * Do not use nmi_enter/exit in real mode if percpu first chunk is
+	 * not embedded. With CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled
+	 * there are chances where percpu allocation can come from
+	 * vmalloc area.
 	 */
-	const bool nmi = !IS_ENABLED(CONFIG_PPC_BOOK3S_64);
+	const bool nmi = !IS_ENABLED(CONFIG_PPC_BOOK3S_64) &&
+			 !percpu_first_chunk_is_paged;
 
 	if (nmi) nmi_enter();
 

arch/powerpc/kvm/powerpc.c

@@ -1956,8 +1956,10 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
 			break;
 
 		r = -ENXIO;
-		if (!xive_enabled())
+		if (!xive_enabled()) {
+			fdput(f);
 			break;
+		}
 
 		r = -EPERM;
 		dev = kvm_device_from_filp(f.file);

arch/powerpc/sysdev/xics/icp-native.c

@@ -235,6 +235,8 @@ static int __init icp_native_map_one_cpu(int hw_id, unsigned long addr,
 	rname = kasprintf(GFP_KERNEL, "CPU %d [0x%x] Interrupt Presentation",
 			  cpu, hw_id);
 
+	if (!rname)
+		return -ENOMEM;
 	if (!request_mem_region(addr, size, rname)) {
 		pr_warn("icp_native: Could not reserve ICP MMIO for CPU %d, interrupt server #0x%x\n",
 			cpu, hw_id);

arch/powerpc/xmon/ppc-dis.c

@@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr)
   bool insn_is_short;
   ppc_cpu_t dialect;
 
-  dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON
+  dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON;
-            | PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_ALTIVEC;
 
-  if (cpu_has_feature(CPU_FTRS_POWER5))
+  if (IS_ENABLED(CONFIG_PPC64))
-    dialect |= PPC_OPCODE_POWER5;
+    dialect |= PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_CELL |
+	PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 | PPC_OPCODE_POWER8 |
+	PPC_OPCODE_POWER9;
 
-  if (cpu_has_feature(CPU_FTRS_CELL))
+  if (cpu_has_feature(CPU_FTR_TM))
-    dialect |= (PPC_OPCODE_CELL | PPC_OPCODE_ALTIVEC);
+    dialect |= PPC_OPCODE_HTM;
 
-  if (cpu_has_feature(CPU_FTRS_POWER6))
+  if (cpu_has_feature(CPU_FTR_ALTIVEC))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_ALTIVEC);
+    dialect |= PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2;
 
-  if (cpu_has_feature(CPU_FTRS_POWER7))
+  if (cpu_has_feature(CPU_FTR_VSX))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
+    dialect |= PPC_OPCODE_VSX | PPC_OPCODE_VSX3;
-                | PPC_OPCODE_ALTIVEC | PPC_OPCODE_VSX);
-
-  if (cpu_has_feature(CPU_FTRS_POWER8))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-		| PPC_OPCODE_POWER8 | PPC_OPCODE_HTM
-		| PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 | PPC_OPCODE_VSX);
-
-  if (cpu_has_feature(CPU_FTRS_POWER9))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-		| PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM
-		| PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2
-		| PPC_OPCODE_VSX | PPC_OPCODE_VSX3);
 
   /* Get the major opcode of the insn.  */
   opcode = NULL;

arch/riscv/mm/fault.c

@@ -39,26 +39,27 @@ static inline void no_context(struct pt_regs *regs, unsigned long addr)
 
 static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_fault_t fault)
 {
+	if (!user_mode(regs)) {
+		no_context(regs, addr);
+		return;
+	}
+
 	if (fault & VM_FAULT_OOM) {
 		/*
 		 * We ran out of memory, call the OOM killer, and return the userspace
 		 * (which will retry the fault, or kill us if we got oom-killed).
 		 */
-		if (!user_mode(regs)) {
-			no_context(regs, addr);
-			return;
-		}
 		pagefault_out_of_memory();
 		return;
 	} else if (fault & VM_FAULT_SIGBUS) {
 		/* Kernel mode? Handle exceptions or die */
-		if (!user_mode(regs)) {
-			no_context(regs, addr);
-			return;
-		}
 		do_trap(regs, SIGBUS, BUS_ADRERR, addr);
 		return;
+	} else if (fault & VM_FAULT_SIGSEGV) {
+		do_trap(regs, SIGSEGV, SEGV_MAPERR, addr);
+		return;
 	}
+
 	BUG();
 }
 

arch/s390/include/asm/uv.h

@@ -312,7 +312,10 @@ static inline int share(unsigned long addr, u16 cmd)
 
 	if (!uv_call(0, (u64)&uvcb))
 		return 0;
-	return -EINVAL;
+	pr_err("%s UVC failed (rc: 0x%x, rrc: 0x%x), possible hypervisor bug.\n",
+	       uvcb.header.cmd == UVC_CMD_SET_SHARED_ACCESS ? "Share" : "Unshare",
+	       uvcb.header.rc, uvcb.header.rrc);
+	panic("System security cannot be guaranteed unless the system panics now.\n");
 }
 
 /*

arch/s390/kernel/early.c

@@ -252,15 +252,9 @@ static inline void save_vector_registers(void)
 #endif
 }
 
-static inline void setup_control_registers(void)
+static inline void setup_low_address_protection(void)
 {
-	unsigned long reg;
+	__ctl_set_bit(0, 28);
-
-	__ctl_store(reg, 0, 0);
-	reg |= CR0_LOW_ADDRESS_PROTECTION;
-	reg |= CR0_EMERGENCY_SIGNAL_SUBMASK;
-	reg |= CR0_EXTERNAL_CALL_SUBMASK;
-	__ctl_load(reg, 0, 0);
 }
 
 static inline void setup_access_registers(void)
@@ -313,7 +307,7 @@ void __init startup_init(void)
 	save_vector_registers();
 	setup_topology();
 	sclp_early_detect();
-	setup_control_registers();
+	setup_low_address_protection();
 	setup_access_registers();
 	lockdep_on();
 }

arch/s390/kernel/smp.c

@@ -982,12 +982,12 @@ void __init smp_fill_possible_mask(void)
 
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
-	/* request the 0x1201 emergency signal external interrupt */
 	if (register_external_irq(EXT_IRQ_EMERGENCY_SIG, do_ext_call_interrupt))
 		panic("Couldn't request external interrupt 0x1201");
-	/* request the 0x1202 external call external interrupt */
+	ctl_set_bit(0, 14);
 	if (register_external_irq(EXT_IRQ_EXTERNAL_CALL, do_ext_call_interrupt))
 		panic("Couldn't request external interrupt 0x1202");
+	ctl_set_bit(0, 13);
 }
 
 void __init smp_prepare_boot_cpu(void)

arch/s390/kernel/vmlinux.lds.S

@@ -69,6 +69,15 @@ SECTIONS
 	. = ALIGN(PAGE_SIZE);
 	__end_ro_after_init = .;
 
+	.data.rel.ro : {
+		*(.data.rel.ro .data.rel.ro.*)
+	}
+	.got : {
+		__got_start = .;
+		*(.got)
+		__got_end = .;
+	}
+
 	RW_DATA(0x100, PAGE_SIZE, THREAD_SIZE)
 	BOOT_DATA_PRESERVED
 

arch/sparc/include/asm/oplib_64.h

@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void);
 int prom_ihandle2path(int handle, char *buffer, int bufsize);
 
 /* Client interface level routines. */
+void prom_cif_init(void *cif_handler);
 void p1275_cmd_direct(unsigned long *);
 
 #endif /* !(__SPARC64_OPLIB_H) */

arch/sparc/prom/init_64.c

@@ -26,9 +26,6 @@ phandle prom_chosen_node;
  * routines in the prom library.
  * It gets passed the pointer to the PROM vector.
  */
-
-extern void prom_cif_init(void *);
-
 void __init prom_init(void *cif_handler)
 {
 	phandle node;

arch/sparc/prom/p1275.c

@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args)
 	local_irq_restore(flags);
 }
 
-void prom_cif_init(void *cif_handler, void *cif_stack)
+void prom_cif_init(void *cif_handler)
 {
 	p1275buf.prom_cif_handler = (void (*)(long *))cif_handler;
 }

arch/um/drivers/line.c

@@ -378,6 +378,7 @@ int setup_one_line(struct line *lines, int n, char *init,
 			parse_chan_pair(NULL, line, n, opts, error_out);
 			err = 0;
 		}
+		*error_out = "configured as 'none'";
 	} else {
 		char *new = kstrdup(init, GFP_KERNEL);
 		if (!new) {
@@ -401,6 +402,7 @@ int setup_one_line(struct line *lines, int n, char *init,
 			}
 		}
 		if (err) {
+			*error_out = "failed to parse channel pair";
 			line->init_str = NULL;
 			line->valid = 0;
 			kfree(new);

arch/um/kernel/time.c

@@ -756,9 +756,9 @@ int setup_time_travel_start(char *str)
 	return 1;
 }
 
-__setup("time-travel-start", setup_time_travel_start);
+__setup("time-travel-start=", setup_time_travel_start);
 __uml_help(setup_time_travel_start,
-"time-travel-start=<seconds>\n"
+"time-travel-start=<nanoseconds>\n"
 "Configure the UML instance's wall clock to start at this value rather than\n"
 "the host's wall clock at the time of UML boot.\n");
 #endif

arch/x86/events/intel/pt.c

@@ -861,7 +861,7 @@ static void pt_update_head(struct pt *pt)
  */
 static void *pt_buffer_region(struct pt_buffer *buf)
 {
-	return phys_to_virt(TOPA_ENTRY(buf->cur, buf->cur_idx)->base << TOPA_SHIFT);
+	return phys_to_virt((phys_addr_t)TOPA_ENTRY(buf->cur, buf->cur_idx)->base << TOPA_SHIFT);
 }
 
 /**
@@ -973,7 +973,7 @@ pt_topa_entry_for_page(struct pt_buffer *buf, unsigned int pg)
 	 * order allocations, there shouldn't be many of these.
 	 */
 	list_for_each_entry(topa, &buf->tables, list) {
-		if (topa->offset + topa->size > pg << PAGE_SHIFT)
+		if (topa->offset + topa->size > (unsigned long)pg << PAGE_SHIFT)
 			goto found;
 	}
 

arch/x86/events/intel/pt.h

@@ -33,8 +33,8 @@ struct topa_entry {
 	u64	rsvd2	: 1;
 	u64	size	: 4;
 	u64	rsvd3	: 2;
-	u64	base	: 36;
+	u64	base	: 40;
-	u64	rsvd4	: 16;
+	u64	rsvd4	: 12;
 };
 
 /* TSC to Core Crystal Clock Ratio */

arch/x86/kernel/cpu/mtrr/mtrr.c

@@ -817,7 +817,7 @@ void mtrr_save_state(void)
 {
 	int first_cpu;
 
-	if (!mtrr_enabled())
+	if (!mtrr_enabled() || !mtrr_state.have_fixed)
 		return;
 
 	first_cpu = cpumask_first(cpu_online_mask);

arch/x86/kernel/devicetree.c

@@ -92,7 +92,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev)
 
 	ret = pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
 	if (ret)
-		return ret;
+		return pcibios_err_to_errno(ret);
 	if (!pin)
 		return 0;
 

arch/x86/kernel/process.c

@@ -926,7 +926,10 @@ unsigned long arch_align_stack(unsigned long sp)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	return randomize_page(mm->brk, 0x02000000);
+	if (mmap_is_ia32())
+		return randomize_page(mm->brk, SZ_32M);
+
+	return randomize_page(mm->brk, SZ_1G);
 }
 
 /*

arch/x86/kvm/vmx/vmx.c

@@ -4738,14 +4738,19 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu, bool for_injection)
 	return !vmx_nmi_blocked(vcpu);
 }
 
+bool __vmx_interrupt_blocked(struct kvm_vcpu *vcpu)
+{
+	return !(vmx_get_rflags(vcpu) & X86_EFLAGS_IF) ||
+	       (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+		(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
+}
+
 bool vmx_interrupt_blocked(struct kvm_vcpu *vcpu)
 {
 	if (is_guest_mode(vcpu) && nested_exit_on_intr(vcpu))
 		return false;
 
-	return !(vmx_get_rflags(vcpu) & X86_EFLAGS_IF) ||
+	return __vmx_interrupt_blocked(vcpu);
-	       (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
-		(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
 }
 
 static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection)

arch/x86/kvm/vmx/vmx.h

@@ -359,6 +359,7 @@ bool vmx_guest_inject_ac(struct kvm_vcpu *vcpu);
 void update_exception_bitmap(struct kvm_vcpu *vcpu);
 void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu);
 bool vmx_nmi_blocked(struct kvm_vcpu *vcpu);
+bool __vmx_interrupt_blocked(struct kvm_vcpu *vcpu);
 bool vmx_interrupt_blocked(struct kvm_vcpu *vcpu);
 bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
 void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);

arch/x86/mm/pti.c

@@ -241,7 +241,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
  *
  * Returns a pointer to a PTE on success, or NULL on failure.
  */
-static pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+static pte_t *pti_user_pagetable_walk_pte(unsigned long address, bool late_text)
 {
 	gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
 	pmd_t *pmd;
@@ -251,10 +251,15 @@ static pte_t *pti_user_pagetable_walk_pte(unsigned long address)
 	if (!pmd)
 		return NULL;
 
-	/* We can't do anything sensible if we hit a large mapping. */
+	/* Large PMD mapping found */
 	if (pmd_large(*pmd)) {
-		WARN_ON(1);
+		/* Clear the PMD if we hit a large mapping from the first round */
-		return NULL;
+		if (late_text) {
+			set_pmd(pmd, __pmd(0));
+		} else {
+			WARN_ON_ONCE(1);
+			return NULL;
+		}
 	}
 
 	if (pmd_none(*pmd)) {
@@ -283,7 +288,7 @@ static void __init pti_setup_vsyscall(void)
 	if (!pte || WARN_ON(level != PG_LEVEL_4K) || pte_none(*pte))
 		return;
 
-	target_pte = pti_user_pagetable_walk_pte(VSYSCALL_ADDR);
+	target_pte = pti_user_pagetable_walk_pte(VSYSCALL_ADDR, false);
 	if (WARN_ON(!target_pte))
 		return;
 
@@ -301,7 +306,7 @@ enum pti_clone_level {
 
 static void
 pti_clone_pgtable(unsigned long start, unsigned long end,
-		  enum pti_clone_level level)
+		  enum pti_clone_level level, bool late_text)
 {
 	unsigned long addr;
 
@@ -374,14 +379,14 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
 			 */
 			*target_pmd = *pmd;
 
-			addr += PMD_SIZE;
+			addr = round_up(addr + 1, PMD_SIZE);
 
 		} else if (level == PTI_CLONE_PTE) {
 
 			/* Walk the page-table down to the pte level */
 			pte = pte_offset_kernel(pmd, addr);
 			if (pte_none(*pte)) {
-				addr += PAGE_SIZE;
+				addr = round_up(addr + 1, PAGE_SIZE);
 				continue;
 			}
 
@@ -390,7 +395,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
 				return;
 
 			/* Allocate PTE in the user page-table */
-			target_pte = pti_user_pagetable_walk_pte(addr);
+			target_pte = pti_user_pagetable_walk_pte(addr, late_text);
 			if (WARN_ON(!target_pte))
 				return;
 
@@ -401,7 +406,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
 			/* Clone the PTE */
 			*target_pte = *pte;
 
-			addr += PAGE_SIZE;
+			addr = round_up(addr + 1, PAGE_SIZE);
 
 		} else {
 			BUG();
@@ -453,7 +458,7 @@ static void __init pti_clone_user_shared(void)
 		phys_addr_t pa = per_cpu_ptr_to_phys((void *)va);
 		pte_t *target_pte;
 
-		target_pte = pti_user_pagetable_walk_pte(va);
+		target_pte = pti_user_pagetable_walk_pte(va, false);
 		if (WARN_ON(!target_pte))
 			return;
 
@@ -476,7 +481,7 @@ static void __init pti_clone_user_shared(void)
 	start = CPU_ENTRY_AREA_BASE;
 	end   = start + (PAGE_SIZE * CPU_ENTRY_AREA_PAGES);
 
-	pti_clone_pgtable(start, end, PTI_CLONE_PMD);
+	pti_clone_pgtable(start, end, PTI_CLONE_PMD, false);
 }
 #endif /* CONFIG_X86_64 */
 
@@ -493,11 +498,11 @@ static void __init pti_setup_espfix64(void)
 /*
  * Clone the populated PMDs of the entry text and force it RO.
  */
-static void pti_clone_entry_text(void)
+static void pti_clone_entry_text(bool late)
 {
 	pti_clone_pgtable((unsigned long) __entry_text_start,
 			  (unsigned long) __entry_text_end,
-			  PTI_CLONE_PMD);
+			  PTI_LEVEL_KERNEL_IMAGE, late);
 
 	/*
 	 * If CFI is enabled, also map jump tables, so the entry code can
@@ -506,7 +511,7 @@ static void pti_clone_entry_text(void)
 	if (IS_ENABLED(CONFIG_CFI_CLANG))
 		pti_clone_pgtable((unsigned long) __cfi_jt_start,
 				  (unsigned long) __cfi_jt_end,
-				  PTI_CLONE_PMD);
+				  PTI_CLONE_PMD, late);
 }
 
 /*
@@ -581,7 +586,7 @@ static void pti_clone_kernel_text(void)
 	 * pti_set_kernel_image_nonglobal() did to clear the
 	 * global bit.
 	 */
-	pti_clone_pgtable(start, end_clone, PTI_LEVEL_KERNEL_IMAGE);
+	pti_clone_pgtable(start, end_clone, PTI_LEVEL_KERNEL_IMAGE, false);
 
 	/*
 	 * pti_clone_pgtable() will set the global bit in any PMDs
@@ -648,8 +653,15 @@ void __init pti_init(void)
 
 	/* Undo all global bits from the init pagetables in head_64.S: */
 	pti_set_kernel_image_nonglobal();
+
 	/* Replace some of the global bits just for shared entry text: */
-	pti_clone_entry_text();
+	/*
+	 * This is very early in boot. Device and Late initcalls can do
+	 * modprobe before free_initmem() and mark_readonly(). This
+	 * pti_clone_entry_text() allows those user-mode-helpers to function,
+	 * but notably the text is still RW.
+	 */
+	pti_clone_entry_text(false);
 	pti_setup_espfix64();
 	pti_setup_vsyscall();
 }
@@ -666,10 +678,11 @@ void pti_finalize(void)
 	if (!boot_cpu_has(X86_FEATURE_PTI))
 		return;
 	/*
-	 * We need to clone everything (again) that maps parts of the
+	 * This is after free_initmem() (all initcalls are done) and we've done
-	 * kernel image.
+	 * mark_readonly(). Text is now NX which might've split some PMDs
+	 * relative to the early clone.
 	 */
-	pti_clone_entry_text();
+	pti_clone_entry_text(true);
 	pti_clone_kernel_text();
 
 	debug_checkwx_user();

arch/x86/pci/intel_mid_pci.c

@@ -223,9 +223,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
 		return 0;
 
 	ret = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi);
-	if (ret < 0) {
+	if (ret) {
 		dev_warn(&dev->dev, "Failed to read interrupt line: %d\n", ret);
-		return ret;
+		return pcibios_err_to_errno(ret);
 	}
 
 	switch (intel_mid_identify_cpu()) {

arch/x86/pci/xen.c

@@ -37,10 +37,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev)
 	u8 gsi;
 
 	rc = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi);
-	if (rc < 0) {
+	if (rc) {
 		dev_warn(&dev->dev, "Xen PCI: failed to read interrupt line: %d\n",
 			 rc);
-		return rc;
+		return pcibios_err_to_errno(rc);
 	}
 	/* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/
 	pirq = gsi;

arch/x86/platform/intel/iosf_mbi.c

@@ -62,7 +62,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr)
 
 fail_read:
 	dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result);
-	return result;
+	return pcibios_err_to_errno(result);
 }
 
 static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr)
@@ -91,7 +91,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr)
 
 fail_write:
 	dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result);
-	return result;
+	return pcibios_err_to_errno(result);
 }
 
 int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr)

arch/x86/xen/p2m.c

@@ -736,7 +736,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 		 * immediate unmapping.
 		 */
 		map_ops[i].status = GNTST_general_error;
-		unmap[0].host_addr = map_ops[i].host_addr,
+		unmap[0].host_addr = map_ops[i].host_addr;
 		unmap[0].handle = map_ops[i].handle;
 		map_ops[i].handle = ~0;
 		if (map_ops[i].flags & GNTMAP_device_map)
@@ -746,7 +746,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 
 		if (kmap_ops) {
 			kmap_ops[i].status = GNTST_general_error;
-			unmap[1].host_addr = kmap_ops[i].host_addr,
+			unmap[1].host_addr = kmap_ops[i].host_addr;
 			unmap[1].handle = kmap_ops[i].handle;
 			kmap_ops[i].handle = ~0;
 			if (kmap_ops[i].flags & GNTMAP_device_map)

block/bio-integrity.c

@@ -216,6 +216,7 @@ bool bio_integrity_prep(struct bio *bio)
 	unsigned int bytes, offset, i;
 	unsigned int intervals;
 	blk_status_t status;
+	gfp_t gfp = GFP_NOIO;
 
 	if (!bi)
 		return true;
@@ -238,12 +239,20 @@ bool bio_integrity_prep(struct bio *bio)
 		if (!bi->profile->generate_fn ||
 		    !(bi->flags & BLK_INTEGRITY_GENERATE))
 			return true;
+
+		/*
+		 * Zero the memory allocated to not leak uninitialized kernel
+		 * memory to disk.  For PI this only affects the app tag, but
+		 * for non-integrity metadata it affects the entire metadata
+		 * buffer.
+		 */
+		gfp |= __GFP_ZERO;
 	}
 	intervals = bio_integrity_intervals(bi, bio_sectors(bio));
 
 	/* Allocate kernel buffer for protection data */
 	len = intervals * bi->tuple_size;
-	buf = kmalloc(len, GFP_NOIO | q->bounce_gfp);
+	buf = kmalloc(len, gfp | q->bounce_gfp);
 	status = BLK_STS_RESOURCE;
 	if (unlikely(buf == NULL)) {
 		printk(KERN_ERR "could not allocate integrity buffer\n");

block/blk-integrity.c

@@ -431,8 +431,6 @@ void blk_integrity_unregister(struct gendisk *disk)
 	if (!bi->profile)
 		return;
 
-	/* ensure all bios are off the integrity workqueue */
-	blk_flush_integrity();
 	blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue);
 	memset(bi, 0, sizeof(*bi));
 }

drivers/acpi/acpi_processor.c

@@ -387,7 +387,7 @@ static int acpi_processor_add(struct acpi_device *device,
 
 	result = acpi_processor_get_info(device);
 	if (result) /* Processor is not physically present or unavailable */
-		return 0;
+		goto err_clear_driver_data;
 
 	BUG_ON(pr->id >= nr_cpu_ids);
 
@@ -402,7 +402,7 @@ static int acpi_processor_add(struct acpi_device *device,
 			"BIOS reported wrong ACPI id %d for the processor\n",
 			pr->id);
 		/* Give up, but do not abort the namespace scan. */
-		goto err;
+		goto err_clear_driver_data;
 	}
 	/*
 	 * processor_device_array is not cleared on errors to allow buggy BIOS
@@ -414,12 +414,12 @@ static int acpi_processor_add(struct acpi_device *device,
 	dev = get_cpu_device(pr->id);
 	if (!dev) {
 		result = -ENODEV;
-		goto err;
+		goto err_clear_per_cpu;
 	}
 
 	result = acpi_bind_one(dev, device);
 	if (result)
-		goto err;
+		goto err_clear_per_cpu;
 
 	pr->dev = dev;
 
@@ -430,10 +430,11 @@ static int acpi_processor_add(struct acpi_device *device,
 	dev_err(dev, "Processor driver could not be attached\n");
 	acpi_unbind_one(dev);
 
- err:
+ err_clear_per_cpu:
-	free_cpumask_var(pr->throttling.shared_cpu_map);
-	device->driver_data = NULL;
 	per_cpu(processors, pr->id) = NULL;
+ err_clear_driver_data:
+	device->driver_data = NULL;
+	free_cpumask_var(pr->throttling.shared_cpu_map);
  err_free_pr:
 	kfree(pr);
 	return result;

drivers/acpi/battery.c

@@ -670,12 +670,18 @@ static ssize_t acpi_battery_alarm_store(struct device *dev,
 	return count;
 }
 
-static const struct device_attribute alarm_attr = {
+static struct device_attribute alarm_attr = {
 	.attr = {.name = "alarm", .mode = 0644},
 	.show = acpi_battery_alarm_show,
 	.store = acpi_battery_alarm_store,
 };
 
+static struct attribute *acpi_battery_attrs[] = {
+	&alarm_attr.attr,
+	NULL
+};
+ATTRIBUTE_GROUPS(acpi_battery);
+
 /*
  * The Battery Hooking API
  *
@@ -812,7 +818,10 @@ static void __exit battery_hook_exit(void)
 
 static int sysfs_add_battery(struct acpi_battery *battery)
 {
-	struct power_supply_config psy_cfg = { .drv_data = battery, };
+	struct power_supply_config psy_cfg = {
+		.drv_data = battery,
+		.attr_grp = acpi_battery_groups,
+	};
 	bool full_cap_broken = false;
 
 	if (!ACPI_BATTERY_CAPACITY_VALID(battery->full_charge_capacity) &&
@@ -857,7 +866,7 @@ static int sysfs_add_battery(struct acpi_battery *battery)
 		return result;
 	}
 	battery_hook_add_battery(battery);
-	return device_create_file(&battery->bat->dev, &alarm_attr);
+	return 0;
 }
 
 static void sysfs_remove_battery(struct acpi_battery *battery)
@@ -868,7 +877,6 @@ static void sysfs_remove_battery(struct acpi_battery *battery)
 		return;
 	}
 	battery_hook_remove_battery(battery);
-	device_remove_file(&battery->bat->dev, &alarm_attr);
 	power_supply_unregister(battery->bat);
 	battery->bat = NULL;
 	mutex_unlock(&battery->sysfs_lock);

drivers/acpi/sbs.c

@@ -77,7 +77,6 @@ struct acpi_battery {
 	u16 spec;
 	u8 id;
 	u8 present:1;
-	u8 have_sysfs_alarm:1;
 };
 
 #define to_acpi_battery(x) power_supply_get_drvdata(x)
@@ -462,12 +461,18 @@ static ssize_t acpi_battery_alarm_store(struct device *dev,
 	return count;
 }
 
-static const struct device_attribute alarm_attr = {
+static struct device_attribute alarm_attr = {
 	.attr = {.name = "alarm", .mode = 0644},
 	.show = acpi_battery_alarm_show,
 	.store = acpi_battery_alarm_store,
 };
 
+static struct attribute *acpi_battery_attrs[] = {
+	&alarm_attr.attr,
+	NULL
+};
+ATTRIBUTE_GROUPS(acpi_battery);
+
 /* --------------------------------------------------------------------------
                                  Driver Interface
    -------------------------------------------------------------------------- */
@@ -509,7 +514,10 @@ static int acpi_battery_read(struct acpi_battery *battery)
 static int acpi_battery_add(struct acpi_sbs *sbs, int id)
 {
 	struct acpi_battery *battery = &sbs->battery[id];
-	struct power_supply_config psy_cfg = { .drv_data = battery, };
+	struct power_supply_config psy_cfg = {
+		.drv_data = battery,
+		.attr_grp = acpi_battery_groups,
+	};
 	int result;
 
 	battery->id = id;
@@ -539,10 +547,6 @@ static int acpi_battery_add(struct acpi_sbs *sbs, int id)
 		goto end;
 	}
 
-	result = device_create_file(&battery->bat->dev, &alarm_attr);
-	if (result)
-		goto end;
-	battery->have_sysfs_alarm = 1;
       end:
 	printk(KERN_INFO PREFIX "%s [%s]: Battery Slot [%s] (battery %s)\n",
 	       ACPI_SBS_DEVICE_NAME, acpi_device_bid(sbs->device),
@@ -554,11 +558,8 @@ static void acpi_battery_remove(struct acpi_sbs *sbs, int id)
 {
 	struct acpi_battery *battery = &sbs->battery[id];
 
-	if (battery->bat) {
+	if (battery->bat)
-		if (battery->have_sysfs_alarm)
-			device_remove_file(&battery->bat->dev, &alarm_attr);
 		power_supply_unregister(battery->bat);
-	}
 }
 
 static int acpi_charger_add(struct acpi_sbs *sbs)

drivers/android/binder.c

@@ -550,9 +550,7 @@ static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
 static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
 {
 	return !thread->transaction_stack &&
-		binder_worklist_empty_ilocked(&thread->todo) &&
+		binder_worklist_empty_ilocked(&thread->todo);
-		(thread->looper & (BINDER_LOOPER_STATE_ENTERED |
-				   BINDER_LOOPER_STATE_REGISTERED));
 }
 
 static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,

drivers/ata/libata-core.c

@@ -5366,6 +5366,9 @@ static void ata_host_release(struct kref *kref)
 	for (i = 0; i < host->n_ports; i++) {
 		struct ata_port *ap = host->ports[i];
 
+		if (!ap)
+			continue;
+
 		kfree(ap->pmp_link);
 		kfree(ap->slave_link);
 		kfree(ap);
@@ -5426,8 +5429,10 @@ struct ata_host *ata_host_alloc(struct device *dev, int max_ports)
 	}
 
 	dr = devres_alloc(ata_devres_release, 0, GFP_KERNEL);
-	if (!dr)
+	if (!dr) {
+		kfree(host);
 		goto err_out;
+	}
 
 	devres_add(dev, dr);
 	dev_set_drvdata(dev, host);

drivers/ata/pata_macio.c

@@ -540,7 +540,8 @@ static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
 
 		while (sg_len) {
 			/* table overflow should never happen */
-			BUG_ON (pi++ >= MAX_DCMDS);
+			if (WARN_ON_ONCE(pi >= MAX_DCMDS))
+				return AC_ERR_SYSTEM;
 
 			len = (sg_len < MAX_DBDMA_SEG) ? sg_len : MAX_DBDMA_SEG;
 			table->command = cpu_to_le16(write ? OUTPUT_MORE: INPUT_MORE);
@@ -552,11 +553,13 @@ static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
 			addr += len;
 			sg_len -= len;
 			++table;
+			++pi;
 		}
 	}
 
 	/* Should never happen according to Tejun */
-	BUG_ON(!pi);
+	if (WARN_ON_ONCE(!pi))
+		return AC_ERR_SYSTEM;
 
 	/* Convert the last command to an input/output */
 	table--;

drivers/atm/idt77252.c

@@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 	rpp->len += skb->len;
 
 	if (stat & SAR_RSQE_EPDU) {
+		unsigned int len, truesize;
 		unsigned char *l1l2;
-		unsigned int len;
 
 		l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
 
@@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 		ATM_SKB(skb)->vcc = vcc;
 		__net_timestamp(skb);
 
+		truesize = skb->truesize;
 		vcc->push(vcc, skb);
 		atomic_inc(&vcc->stats->rx);
 
-		if (skb->truesize > SAR_FB_SIZE_3)
+		if (truesize > SAR_FB_SIZE_3)
 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-		else if (skb->truesize > SAR_FB_SIZE_2)
+		else if (truesize > SAR_FB_SIZE_2)
 			add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);
-		else if (skb->truesize > SAR_FB_SIZE_1)
+		else if (truesize > SAR_FB_SIZE_1)
 			add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);
 		else
 			add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);

drivers/base/core.c

@@ -25,6 +25,7 @@
 #include <linux/mutex.h>
 #include <linux/pm_runtime.h>
 #include <linux/netdevice.h>
+#include <linux/rcupdate.h>
 #include <linux/sched/signal.h>
 #include <linux/sched/mm.h>
 #include <linux/sysfs.h>
@@ -2194,6 +2195,7 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj,
 		      struct kobj_uevent_env *env)
 {
 	struct device *dev = kobj_to_dev(kobj);
+	struct device_driver *driver;
 	int retval = 0;
 
 	/* add device node properties if present */
@@ -2222,8 +2224,12 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj,
 	if (dev->type && dev->type->name)
 		add_uevent_var(env, "DEVTYPE=%s", dev->type->name);
 
-	if (dev->driver)
+	/* Synchronize with module_remove_driver() */
-		add_uevent_var(env, "DRIVER=%s", dev->driver->name);
+	rcu_read_lock();
+	driver = READ_ONCE(dev->driver);
+	if (driver)
+		add_uevent_var(env, "DRIVER=%s", driver->name);
+	rcu_read_unlock();
 
 	/* Add common DT information about the device */
 	of_device_uevent(dev, env);
@@ -2293,11 +2299,8 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr,
 	if (!env)
 		return -ENOMEM;
 
-	/* Synchronize with really_probe() */
-	device_lock(dev);
 	/* let the kset specific function add its keys */
 	retval = kset->uevent_ops->uevent(kset, &dev->kobj, env);
-	device_unlock(dev);
 	if (retval)
 		goto out;
 

drivers/base/devres.c

@@ -577,6 +577,7 @@ void * devres_open_group(struct device *dev, void *id, gfp_t gfp)
 	grp->id = grp;
 	if (id)
 		grp->id = id;
+	grp->color = 0;
 
 	spin_lock_irqsave(&dev->devres_lock, flags);
 	add_dr(dev, &grp->node[0]);
@@ -901,9 +902,12 @@ void *devm_krealloc(struct device *dev, void *ptr, size_t new_size, gfp_t gfp)
 	/*
 	 * Otherwise: allocate new, larger chunk. We need to allocate before
 	 * taking the lock as most probably the caller uses GFP_KERNEL.
+	 * alloc_dr() will call check_dr_size() to reserve extra memory
+	 * for struct devres automatically, so size @new_size user request
+	 * is delivered to it directly as devm_kmalloc() does.
 	 */
 	new_dr = alloc_dr(devm_kmalloc_release,
-			  total_new_size, gfp, dev_to_node(dev));
+			  new_size, gfp, dev_to_node(dev));
 	if (!new_dr)
 		return NULL;
 
@@ -1227,7 +1231,11 @@ EXPORT_SYMBOL_GPL(__devm_alloc_percpu);
  */
 void devm_free_percpu(struct device *dev, void __percpu *pdata)
 {
-	WARN_ON(devres_destroy(dev, devm_percpu_release, devm_percpu_match,
+	/*
-			       (void *)pdata));
+	 * Use devres_release() to prevent memory leakage as
+	 * devm_free_pages() does.
+	 */
+	WARN_ON(devres_release(dev, devm_percpu_release, devm_percpu_match,
+			       (__force void *)pdata));
 }
 EXPORT_SYMBOL_GPL(devm_free_percpu);

drivers/base/module.c

@@ -7,6 +7,7 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <linux/rcupdate.h>
 #include "base.h"
 
 static char *make_driver_name(struct device_driver *drv)
@@ -77,6 +78,9 @@ void module_remove_driver(struct device_driver *drv)
 	if (!drv)
 		return;
 
+	/* Synchronize with dev_uevent() */
+	synchronize_rcu();
+
 	sysfs_remove_link(&drv->p->kobj, "module");
 
 	if (drv->owner)

drivers/block/rbd.c

@@ -362,7 +362,7 @@ enum rbd_watch_state {
 enum rbd_lock_state {
 	RBD_LOCK_STATE_UNLOCKED,
 	RBD_LOCK_STATE_LOCKED,
-	RBD_LOCK_STATE_RELEASING,
+	RBD_LOCK_STATE_QUIESCING,
 };
 
 /* WatchNotify::ClientId */
@@ -422,7 +422,7 @@ struct rbd_device {
 	struct list_head	running_list;
 	struct completion	acquire_wait;
 	int			acquire_err;
-	struct completion	releasing_wait;
+	struct completion	quiescing_wait;
 
 	spinlock_t		object_map_lock;
 	u8			*object_map;
@@ -525,7 +525,7 @@ static bool __rbd_is_lock_owner(struct rbd_device *rbd_dev)
 	lockdep_assert_held(&rbd_dev->lock_rwsem);
 
 	return rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED ||
-	       rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING;
+	       rbd_dev->lock_state == RBD_LOCK_STATE_QUIESCING;
 }
 
 static bool rbd_is_lock_owner(struct rbd_device *rbd_dev)
@@ -3522,13 +3522,14 @@ static void rbd_lock_del_request(struct rbd_img_request *img_req)
 	lockdep_assert_held(&rbd_dev->lock_rwsem);
 	spin_lock(&rbd_dev->lock_lists_lock);
 	if (!list_empty(&img_req->lock_item)) {
+		rbd_assert(!list_empty(&rbd_dev->running_list));
 		list_del_init(&img_req->lock_item);
-		need_wakeup = (rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING &&
+		need_wakeup = (rbd_dev->lock_state == RBD_LOCK_STATE_QUIESCING &&
 			       list_empty(&rbd_dev->running_list));
 	}
 	spin_unlock(&rbd_dev->lock_lists_lock);
 	if (need_wakeup)
-		complete(&rbd_dev->releasing_wait);
+		complete(&rbd_dev->quiescing_wait);
 }
 
 static int rbd_img_exclusive_lock(struct rbd_img_request *img_req)
@@ -3541,11 +3542,6 @@ static int rbd_img_exclusive_lock(struct rbd_img_request *img_req)
 	if (rbd_lock_add_request(img_req))
 		return 1;
 
-	if (rbd_dev->opts->exclusive) {
-		WARN_ON(1); /* lock got released? */
-		return -EROFS;
-	}
-
 	/*
 	 * Note the use of mod_delayed_work() in rbd_acquire_lock()
 	 * and cancel_delayed_work() in wake_lock_waiters().
@@ -4237,16 +4233,16 @@ static bool rbd_quiesce_lock(struct rbd_device *rbd_dev)
 	/*
 	 * Ensure that all in-flight IO is flushed.
 	 */
-	rbd_dev->lock_state = RBD_LOCK_STATE_RELEASING;
+	rbd_dev->lock_state = RBD_LOCK_STATE_QUIESCING;
-	rbd_assert(!completion_done(&rbd_dev->releasing_wait));
+	rbd_assert(!completion_done(&rbd_dev->quiescing_wait));
 	if (list_empty(&rbd_dev->running_list))
 		return true;
 
 	up_write(&rbd_dev->lock_rwsem);
-	wait_for_completion(&rbd_dev->releasing_wait);
+	wait_for_completion(&rbd_dev->quiescing_wait);
 
 	down_write(&rbd_dev->lock_rwsem);
-	if (rbd_dev->lock_state != RBD_LOCK_STATE_RELEASING)
+	if (rbd_dev->lock_state != RBD_LOCK_STATE_QUIESCING)
 		return false;
 
 	rbd_assert(list_empty(&rbd_dev->running_list));
@@ -4657,6 +4653,10 @@ static void rbd_reacquire_lock(struct rbd_device *rbd_dev)
 			rbd_warn(rbd_dev, "failed to update lock cookie: %d",
 				 ret);
 
+		if (rbd_dev->opts->exclusive)
+			rbd_warn(rbd_dev,
+			     "temporarily releasing lock on exclusive mapping");
+
 		/*
 		 * Lock cookie cannot be updated on older OSDs, so do
 		 * a manual release and queue an acquire.
@@ -5455,7 +5455,7 @@ static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec)
 	INIT_LIST_HEAD(&rbd_dev->acquiring_list);
 	INIT_LIST_HEAD(&rbd_dev->running_list);
 	init_completion(&rbd_dev->acquire_wait);
-	init_completion(&rbd_dev->releasing_wait);
+	init_completion(&rbd_dev->quiescing_wait);
 
 	spin_lock_init(&rbd_dev->object_map_lock);
 
@@ -6660,11 +6660,6 @@ static int rbd_add_acquire_lock(struct rbd_device *rbd_dev)
 	if (ret)
 		return ret;
 
-	/*
-	 * The lock may have been released by now, unless automatic lock
-	 * transitions are disabled.
-	 */
-	rbd_assert(!rbd_dev->opts->exclusive || rbd_is_lock_owner(rbd_dev));
 	return 0;
 }
 

drivers/bluetooth/btusb.c

@@ -428,6 +428,10 @@ static const struct usb_device_id blacklist_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),

drivers/bluetooth/hci_ldisc.c

@@ -768,7 +768,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
 		break;
 
 	case HCIUARTGETPROTO:
-		if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+		if (test_bit(HCI_UART_PROTO_SET, &hu->flags) &&
+		    test_bit(HCI_UART_PROTO_READY, &hu->flags))
 			err = hu->proto->id;
 		else
 			err = -EUNATCH;

drivers/char/hw_random/amd-rng.c

@@ -142,8 +142,10 @@ static int __init mod_init(void)
 
 found:
 	err = pci_read_config_dword(pdev, 0x58, &pmbase);
-	if (err)
+	if (err) {
+		err = pcibios_err_to_errno(err);
 		goto put_dev;
+	}
 
 	pmbase &= 0x0000FF00;
 	if (pmbase == 0) {

drivers/char/tpm/eventlog/common.c

@@ -47,6 +47,8 @@ static int tpm_bios_measurements_open(struct inode *inode,
 	if (!err) {
 		seq = file->private_data;
 		seq->private = chip;
+	} else {
+		put_device(&chip->dev);
 	}
 
 	return err;

drivers/clk/davinci/da8xx-cfgchip.c

@@ -505,7 +505,7 @@ da8xx_cfgchip_register_usb0_clk48(struct device *dev,
 	const char * const parent_names[] = { "usb_refclkin", "pll0_auxclk" };
 	struct clk *fck_clk;
 	struct da8xx_usb0_clk48 *usb0;
-	struct clk_init_data init;
+	struct clk_init_data init = {};
 	int ret;
 
 	fck_clk = devm_clk_get(dev, "fck");
@@ -580,7 +580,7 @@ da8xx_cfgchip_register_usb1_clk48(struct device *dev,
 {
 	const char * const parent_names[] = { "usb0_clk48", "usb_refclkin" };
 	struct da8xx_usb1_clk48 *usb1;
-	struct clk_init_data init;
+	struct clk_init_data init = {};
 	int ret;
 
 	usb1 = devm_kzalloc(dev, sizeof(*usb1), GFP_KERNEL);

drivers/clk/qcom/clk-alpha-pll.c

@@ -38,7 +38,7 @@
 
 #define PLL_USER_CTL(p)		((p)->offset + (p)->regs[PLL_OFF_USER_CTL])
 # define PLL_POST_DIV_SHIFT	8
-# define PLL_POST_DIV_MASK(p)	GENMASK((p)->width, 0)
+# define PLL_POST_DIV_MASK(p)	GENMASK((p)->width - 1, 0)
 # define PLL_ALPHA_EN		BIT(24)
 # define PLL_ALPHA_MODE		BIT(25)
 # define PLL_VCO_SHIFT		20
@@ -1321,8 +1321,8 @@ clk_trion_pll_postdiv_set_rate(struct clk_hw *hw, unsigned long rate,
 	}
 
 	return regmap_update_bits(regmap, PLL_USER_CTL(pll),
-				  PLL_POST_DIV_MASK(pll) << PLL_POST_DIV_SHIFT,
+				  PLL_POST_DIV_MASK(pll) << pll->post_div_shift,
-				  val << PLL_POST_DIV_SHIFT);
+				  val << pll->post_div_shift);
 }
 
 const struct clk_ops clk_alpha_pll_postdiv_trion_ops = {

drivers/clocksource/sh_cmt.c

@@ -530,6 +530,7 @@ static void sh_cmt_set_next(struct sh_cmt_channel *ch, unsigned long delta)
 static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
 {
 	struct sh_cmt_channel *ch = dev_id;
+	unsigned long flags;
 
 	/* clear flags */
 	sh_cmt_write_cmcsr(ch, sh_cmt_read_cmcsr(ch) &
@@ -560,6 +561,8 @@ static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
 
 	ch->flags &= ~FLAG_SKIPEVENT;
 
+	raw_spin_lock_irqsave(&ch->lock, flags);
+
 	if (ch->flags & FLAG_REPROGRAM) {
 		ch->flags &= ~FLAG_REPROGRAM;
 		sh_cmt_clock_event_program_verify(ch, 1);
@@ -572,6 +575,8 @@ static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
 
 	ch->flags &= ~FLAG_IRQCONTEXT;
 
+	raw_spin_unlock_irqrestore(&ch->lock, flags);
+
 	return IRQ_HANDLED;
 }
 
@@ -770,12 +775,18 @@ static int sh_cmt_clock_event_next(unsigned long delta,
 				   struct clock_event_device *ced)
 {
 	struct sh_cmt_channel *ch = ced_to_sh_cmt(ced);
+	unsigned long flags;
 
 	BUG_ON(!clockevent_state_oneshot(ced));
+
+	raw_spin_lock_irqsave(&ch->lock, flags);
+
 	if (likely(ch->flags & FLAG_IRQCONTEXT))
 		ch->next_match_value = delta - 1;
 	else
-		sh_cmt_set_next(ch, delta - 1);
+		__sh_cmt_set_next(ch, delta - 1);
+
+	raw_spin_unlock_irqrestore(&ch->lock, flags);
 
 	return 0;
 }

drivers/clocksource/timer-imx-tpm.c

@@ -83,20 +83,28 @@ static u64 notrace tpm_read_sched_clock(void)
 static int tpm_set_next_event(unsigned long delta,
 				struct clock_event_device *evt)
 {
-	unsigned long next, now;
+	unsigned long next, prev, now;
 
-	next = tpm_read_counter();
+	prev = tpm_read_counter();
-	next += delta;
+	next = prev + delta;
 	writel(next, timer_base + TPM_C0V);
 	now = tpm_read_counter();
 
+	/*
+	 * Need to wait CNT increase at least 1 cycle to make sure
+	 * the C0V has been updated into HW.
+	 */
+	if ((next & 0xffffffff) != readl(timer_base + TPM_C0V))
+		while (now == tpm_read_counter())
+			;
+
 	/*
 	 * NOTE: We observed in a very small probability, the bus fabric
 	 * contention between GPU and A7 may results a few cycles delay
 	 * of writing CNT registers which may cause the min_delta event got
 	 * missed, so we need add a ETIME check here in case it happened.
 	 */
-	return (int)(next - now) <= 0 ? -ETIME : 0;
+	return (now - prev) >= delta ? -ETIME : 0;
 }
 
 static int tpm_set_state_oneshot(struct clock_event_device *evt)

drivers/dma/dw/core.c

@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
+#include <linux/log2.h>
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -624,12 +625,10 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 	struct dw_desc		*prev;
 	struct dw_desc		*first;
 	u32			ctllo, ctlhi;
-	u8			m_master = dwc->dws.m_master;
+	u8			lms = DWC_LLP_LMS(dwc->dws.m_master);
-	u8			lms = DWC_LLP_LMS(m_master);
 	dma_addr_t		reg;
 	unsigned int		reg_width;
 	unsigned int		mem_width;
-	unsigned int		data_width = dw->pdata->data_width[m_master];
 	unsigned int		i;
 	struct scatterlist	*sg;
 	size_t			total_len = 0;
@@ -663,7 +662,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 			mem = sg_dma_address(sg);
 			len = sg_dma_len(sg);
 
-			mem_width = __ffs(data_width | mem | len);
+			mem_width = __ffs(sconfig->src_addr_width | mem | len);
 
 slave_sg_todev_fill_desc:
 			desc = dwc_desc_get(dwc);
@@ -723,7 +722,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 			lli_write(desc, sar, reg);
 			lli_write(desc, dar, mem);
 			lli_write(desc, ctlhi, ctlhi);
-			mem_width = __ffs(data_width | mem);
+			mem_width = __ffs(sconfig->dst_addr_width | mem);
 			lli_write(desc, ctllo, ctllo | DWC_CTLL_DST_WIDTH(mem_width));
 			desc->len = dlen;
 
@@ -783,17 +782,93 @@ bool dw_dma_filter(struct dma_chan *chan, void *param)
 }
 EXPORT_SYMBOL_GPL(dw_dma_filter);
 
+static int dwc_verify_p_buswidth(struct dma_chan *chan)
+{
+	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+	struct dw_dma *dw = to_dw_dma(chan->device);
+	u32 reg_width, max_width;
+
+	if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV)
+		reg_width = dwc->dma_sconfig.dst_addr_width;
+	else if (dwc->dma_sconfig.direction == DMA_DEV_TO_MEM)
+		reg_width = dwc->dma_sconfig.src_addr_width;
+	else /* DMA_MEM_TO_MEM */
+		return 0;
+
+	max_width = dw->pdata->data_width[dwc->dws.p_master];
+
+	/* Fall-back to 1-byte transfer width if undefined */
+	if (reg_width == DMA_SLAVE_BUSWIDTH_UNDEFINED)
+		reg_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+	else if (!is_power_of_2(reg_width) || reg_width > max_width)
+		return -EINVAL;
+	else /* bus width is valid */
+		return 0;
+
+	/* Update undefined addr width value */
+	if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV)
+		dwc->dma_sconfig.dst_addr_width = reg_width;
+	else /* DMA_DEV_TO_MEM */
+		dwc->dma_sconfig.src_addr_width = reg_width;
+
+	return 0;
+}
+
+static int dwc_verify_m_buswidth(struct dma_chan *chan)
+{
+	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+	struct dw_dma *dw = to_dw_dma(chan->device);
+	u32 reg_width, reg_burst, mem_width;
+
+	mem_width = dw->pdata->data_width[dwc->dws.m_master];
+
+	/*
+	 * It's possible to have a data portion locked in the DMA FIFO in case
+	 * of the channel suspension. Subsequent channel disabling will cause
+	 * that data silent loss. In order to prevent that maintain the src and
+	 * dst transfer widths coherency by means of the relation:
+	 * (CTLx.SRC_TR_WIDTH * CTLx.SRC_MSIZE >= CTLx.DST_TR_WIDTH)
+	 * Look for the details in the commit message that brings this change.
+	 *
+	 * Note the DMA configs utilized in the calculations below must have
+	 * been verified to have correct values by this method call.
+	 */
+	if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV) {
+		reg_width = dwc->dma_sconfig.dst_addr_width;
+		if (mem_width < reg_width)
+			return -EINVAL;
+
+		dwc->dma_sconfig.src_addr_width = mem_width;
+	} else if (dwc->dma_sconfig.direction == DMA_DEV_TO_MEM) {
+		reg_width = dwc->dma_sconfig.src_addr_width;
+		reg_burst = rounddown_pow_of_two(dwc->dma_sconfig.src_maxburst);
+
+		dwc->dma_sconfig.dst_addr_width = min(mem_width, reg_width * reg_burst);
+	}
+
+	return 0;
+}
+
 static int dwc_config(struct dma_chan *chan, struct dma_slave_config *sconfig)
 {
 	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
 	struct dw_dma *dw = to_dw_dma(chan->device);
+	int ret;
 
 	memcpy(&dwc->dma_sconfig, sconfig, sizeof(*sconfig));
 
 	dwc->dma_sconfig.src_maxburst =
-		clamp(dwc->dma_sconfig.src_maxburst, 0U, dwc->max_burst);
+		clamp(dwc->dma_sconfig.src_maxburst, 1U, dwc->max_burst);
 	dwc->dma_sconfig.dst_maxburst =
-		clamp(dwc->dma_sconfig.dst_maxburst, 0U, dwc->max_burst);
+		clamp(dwc->dma_sconfig.dst_maxburst, 1U, dwc->max_burst);
+
+	ret = dwc_verify_p_buswidth(chan);
+	if (ret)
+		return ret;
+
+	ret = dwc_verify_m_buswidth(chan);
+	if (ret)
+		return ret;
 
 	dw->encode_maxburst(dwc, &dwc->dma_sconfig.src_maxburst);
 	dw->encode_maxburst(dwc, &dwc->dma_sconfig.dst_maxburst);

drivers/edac/Makefile

@@ -58,11 +58,13 @@ obj-$(CONFIG_EDAC_MPC85XX)		+= mpc85xx_edac_mod.o
 layerscape_edac_mod-y			:= fsl_ddr_edac.o layerscape_edac.o
 obj-$(CONFIG_EDAC_LAYERSCAPE)		+= layerscape_edac_mod.o
 
-skx_edac-y				:= skx_common.o skx_base.o
+skx_edac_common-y			:= skx_common.o
-obj-$(CONFIG_EDAC_SKX)			+= skx_edac.o
 
-i10nm_edac-y				:= skx_common.o i10nm_base.o
+skx_edac-y				:= skx_base.o
-obj-$(CONFIG_EDAC_I10NM)		+= i10nm_edac.o
+obj-$(CONFIG_EDAC_SKX)			+= skx_edac.o skx_edac_common.o
+
+i10nm_edac-y				:= i10nm_base.o
+obj-$(CONFIG_EDAC_I10NM)		+= i10nm_edac.o skx_edac_common.o
 
 obj-$(CONFIG_EDAC_MV64X60)		+= mv64x60_edac.o
 obj-$(CONFIG_EDAC_CELL)			+= cell_edac.o

drivers/edac/skx_common.c

@@ -23,10 +23,13 @@
 #include "skx_common.h"
 
 static const char * const component_names[] = {
-	[INDEX_SOCKET]	= "ProcessorSocketId",
+	[INDEX_SOCKET]		= "ProcessorSocketId",
-	[INDEX_MEMCTRL]	= "MemoryControllerId",
+	[INDEX_MEMCTRL]		= "MemoryControllerId",
-	[INDEX_CHANNEL]	= "ChannelId",
+	[INDEX_CHANNEL]		= "ChannelId",
-	[INDEX_DIMM]	= "DimmSlotId",
+	[INDEX_DIMM]		= "DimmSlotId",
+	[INDEX_NM_MEMCTRL]	= "NmMemoryControllerId",
+	[INDEX_NM_CHANNEL]	= "NmChannelId",
+	[INDEX_NM_DIMM]		= "NmDimmSlotId",
 };
 
 static int component_indices[ARRAY_SIZE(component_names)];
@@ -34,14 +37,16 @@ static int adxl_component_count;
 static const char * const *adxl_component_names;
 static u64 *adxl_values;
 static char *adxl_msg;
+static unsigned long adxl_nm_bitmap;
 
 static char skx_msg[MSG_SIZE];
 static skx_decode_f skx_decode;
 static skx_show_retry_log_f skx_show_retry_rd_err_log;
 static u64 skx_tolm, skx_tohm;
 static LIST_HEAD(dev_edac_list);
+static bool skx_mem_cfg_2lm;
 
-int __init skx_adxl_get(void)
+int skx_adxl_get(void)
 {
 	const char * const *names;
 	int i, j;
@@ -56,14 +61,25 @@ int __init skx_adxl_get(void)
 		for (j = 0; names[j]; j++) {
 			if (!strcmp(component_names[i], names[j])) {
 				component_indices[i] = j;
+
+				if (i >= INDEX_NM_FIRST)
+					adxl_nm_bitmap |= 1 << i;
+
 				break;
 			}
 		}
 
-		if (!names[j])
+		if (!names[j] && i < INDEX_NM_FIRST)
 			goto err;
 	}
 
+	if (skx_mem_cfg_2lm) {
+		if (!adxl_nm_bitmap)
+			skx_printk(KERN_NOTICE, "Not enough ADXL components for 2-level memory.\n");
+		else
+			edac_dbg(2, "adxl_nm_bitmap: 0x%lx\n", adxl_nm_bitmap);
+	}
+
 	adxl_component_names = names;
 	while (*names++)
 		adxl_component_count++;
@@ -92,14 +108,16 @@ int __init skx_adxl_get(void)
 
 	return -ENODEV;
 }
+EXPORT_SYMBOL_GPL(skx_adxl_get);
 
-void __exit skx_adxl_put(void)
+void skx_adxl_put(void)
 {
 	kfree(adxl_values);
 	kfree(adxl_msg);
 }
+EXPORT_SYMBOL_GPL(skx_adxl_put);
 
-static bool skx_adxl_decode(struct decoded_addr *res)
+static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_mem)
 {
 	struct skx_dev *d;
 	int i, len = 0;
@@ -116,11 +134,20 @@ static bool skx_adxl_decode(struct decoded_addr *res)
 	}
 
 	res->socket  = (int)adxl_values[component_indices[INDEX_SOCKET]];
-	res->imc     = (int)adxl_values[component_indices[INDEX_MEMCTRL]];
+	if (error_in_1st_level_mem) {
-	res->channel = (int)adxl_values[component_indices[INDEX_CHANNEL]];
+		res->imc     = (adxl_nm_bitmap & BIT_NM_MEMCTRL) ?
-	res->dimm    = (int)adxl_values[component_indices[INDEX_DIMM]];
+			       (int)adxl_values[component_indices[INDEX_NM_MEMCTRL]] : -1;
+		res->channel = (adxl_nm_bitmap & BIT_NM_CHANNEL) ?
+			       (int)adxl_values[component_indices[INDEX_NM_CHANNEL]] : -1;
+		res->dimm    = (adxl_nm_bitmap & BIT_NM_DIMM) ?
+			       (int)adxl_values[component_indices[INDEX_NM_DIMM]] : -1;
+	} else {
+		res->imc     = (int)adxl_values[component_indices[INDEX_MEMCTRL]];
+		res->channel = (int)adxl_values[component_indices[INDEX_CHANNEL]];
+		res->dimm    = (int)adxl_values[component_indices[INDEX_DIMM]];
+	}
 
-	if (res->imc > NUM_IMC - 1) {
+	if (res->imc > NUM_IMC - 1 || res->imc < 0) {
 		skx_printk(KERN_ERR, "Bad imc %d\n", res->imc);
 		return false;
 	}
@@ -151,11 +178,18 @@ static bool skx_adxl_decode(struct decoded_addr *res)
 	return true;
 }
 
+void skx_set_mem_cfg(bool mem_cfg_2lm)
+{
+	skx_mem_cfg_2lm = mem_cfg_2lm;
+}
+EXPORT_SYMBOL_GPL(skx_set_mem_cfg);
+
 void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log)
 {
 	skx_decode = decode;
 	skx_show_retry_rd_err_log = show_retry_log;
 }
+EXPORT_SYMBOL_GPL(skx_set_decode);
 
 int skx_get_src_id(struct skx_dev *d, int off, u8 *id)
 {
@@ -169,6 +203,7 @@ int skx_get_src_id(struct skx_dev *d, int off, u8 *id)
 	*id = GET_BITFIELD(reg, 12, 14);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(skx_get_src_id);
 
 int skx_get_node_id(struct skx_dev *d, u8 *id)
 {
@@ -182,6 +217,7 @@ int skx_get_node_id(struct skx_dev *d, u8 *id)
 	*id = GET_BITFIELD(reg, 0, 2);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(skx_get_node_id);
 
 static int get_width(u32 mtr)
 {
@@ -247,6 +283,7 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list)
 		*list = &dev_edac_list;
 	return ndev;
 }
+EXPORT_SYMBOL_GPL(skx_get_all_bus_mappings);
 
 int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm)
 {
@@ -286,6 +323,7 @@ int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm)
 	pci_dev_put(pdev);
 	return -ENODEV;
 }
+EXPORT_SYMBOL_GPL(skx_get_hi_lo);
 
 static int skx_get_dimm_attr(u32 reg, int lobit, int hibit, int add,
 			     int minval, int maxval, const char *name)
@@ -339,6 +377,7 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm,
 
 	return 1;
 }
+EXPORT_SYMBOL_GPL(skx_get_dimm_info);
 
 int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc,
 			int chan, int dimmno, const char *mod_str)
@@ -387,6 +426,7 @@ int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc,
 
 	return (size == 0 || size == ~0ull) ? 0 : 1;
 }
+EXPORT_SYMBOL_GPL(skx_get_nvdimm_info);
 
 int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev,
 		     const char *ctl_name, const char *mod_str,
@@ -454,6 +494,7 @@ int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev,
 	imc->mci = NULL;
 	return rc;
 }
+EXPORT_SYMBOL_GPL(skx_register_mci);
 
 static void skx_unregister_mci(struct skx_imc *imc)
 {
@@ -565,6 +606,21 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
 			     optype, skx_msg);
 }
 
+static bool skx_error_in_1st_level_mem(const struct mce *m)
+{
+	u32 errcode;
+
+	if (!skx_mem_cfg_2lm)
+		return false;
+
+	errcode = GET_BITFIELD(m->status, 0, 15);
+
+	if ((errcode & 0xef80) != 0x280)
+		return false;
+
+	return true;
+}
+
 int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
 			void *data)
 {
@@ -584,7 +640,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
 	res.addr = mce->addr;
 
 	if (adxl_component_count) {
-		if (!skx_adxl_decode(&res))
+		if (!skx_adxl_decode(&res, skx_error_in_1st_level_mem(mce)))
 			return NOTIFY_DONE;
 	} else if (!skx_decode || !skx_decode(&res)) {
 		return NOTIFY_DONE;
@@ -618,6 +674,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
 	mce->kflags |= MCE_HANDLED_EDAC;
 	return NOTIFY_DONE;
 }
+EXPORT_SYMBOL_GPL(skx_mce_check_error);
 
 void skx_remove(void)
 {
@@ -653,3 +710,8 @@ void skx_remove(void)
 		kfree(d);
 	}
 }
+EXPORT_SYMBOL_GPL(skx_remove);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel server processors");

drivers/edac/skx_common.h

@@ -9,6 +9,8 @@
 #ifndef _SKX_COMM_EDAC_H
 #define _SKX_COMM_EDAC_H
 
+#include <linux/bits.h>
+
 #define MSG_SIZE		1024
 
 /*
@@ -90,9 +92,17 @@ enum {
 	INDEX_MEMCTRL,
 	INDEX_CHANNEL,
 	INDEX_DIMM,
+	INDEX_NM_FIRST,
+	INDEX_NM_MEMCTRL = INDEX_NM_FIRST,
+	INDEX_NM_CHANNEL,
+	INDEX_NM_DIMM,
 	INDEX_MAX
 };
 
+#define BIT_NM_MEMCTRL	BIT_ULL(INDEX_NM_MEMCTRL)
+#define BIT_NM_CHANNEL	BIT_ULL(INDEX_NM_CHANNEL)
+#define BIT_NM_DIMM	BIT_ULL(INDEX_NM_DIMM)
+
 struct decoded_addr {
 	struct skx_dev *dev;
 	u64	addr;
@@ -124,9 +134,10 @@ typedef int (*get_dimm_config_f)(struct mem_ctl_info *mci);
 typedef bool (*skx_decode_f)(struct decoded_addr *res);
 typedef void (*skx_show_retry_log_f)(struct decoded_addr *res, char *msg, int len);
 
-int __init skx_adxl_get(void);
+int skx_adxl_get(void);
-void __exit skx_adxl_put(void);
+void skx_adxl_put(void);
 void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log);
+void skx_set_mem_cfg(bool mem_cfg_2lm);
 
 int skx_get_src_id(struct skx_dev *d, int off, u8 *id);
 int skx_get_node_id(struct skx_dev *d, u8 *id);

drivers/firmware/turris-mox-rwtm.c

@@ -199,9 +199,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)
 	if (ret < 0)
 		return ret;
 
-	ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
+	if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
-	if (ret < 0)
+		return -ETIMEDOUT;
-		return ret;
 
 	ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval);
 	if (ret == -ENODATA) {
@@ -235,9 +234,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)
 	if (ret < 0)
 		return ret;
 
-	ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
+	if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
-	if (ret < 0)
+		return -ETIMEDOUT;
-		return ret;
 
 	ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval);
 	if (ret == -ENODATA) {
@@ -274,9 +272,8 @@ static int check_get_random_support(struct mox_rwtm *rwtm)
 	if (ret < 0)
 		return ret;
 
-	ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
+	if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
-	if (ret < 0)
+		return -ETIMEDOUT;
-		return ret;
 
 	return mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval);
 }
@@ -499,6 +496,7 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, rwtm);
 
 	mutex_init(&rwtm->busy);
+	init_completion(&rwtm->cmd_done);
 
 	rwtm->mbox_client.dev = dev;
 	rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
@@ -512,8 +510,6 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev)
 		goto remove_files;
 	}
 
-	init_completion(&rwtm->cmd_done);
-
 	ret = mox_get_board_info(rwtm);
 	if (ret < 0)
 		dev_warn(dev, "Cannot read board information: %i\n", ret);

drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c

@@ -100,6 +100,7 @@ struct amdgpu_afmt_acr amdgpu_afmt_acr(uint32_t clock)
 	amdgpu_afmt_calc_cts(clock, &res.cts_32khz, &res.n_32khz, 32000);
 	amdgpu_afmt_calc_cts(clock, &res.cts_44_1khz, &res.n_44_1khz, 44100);
 	amdgpu_afmt_calc_cts(clock, &res.cts_48khz, &res.n_48khz, 48000);
+	res.clock = clock;
 
 	return res;
 }

drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c

@@ -1626,6 +1626,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev,
 										(u32)le32_to_cpu(*((u32 *)reg_data + j));
 									j++;
 								} else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) {
+									if (i == 0)
+										continue;
 									reg_table->mc_reg_table_entry[num_ranges].mc_data[i] =
 										reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1];
 								}

drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c

@@ -213,6 +213,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
 		struct amdgpu_firmware_info *ucode;
 
 		id = fw_type_convert(cgs_device, type);
+		if (id >= AMDGPU_UCODE_ID_MAXIMUM)
+			return -EINVAL;
+
 		ucode = &adev->firmware.ucode[id];
 		if (ucode->fw == NULL)
 			return -EINVAL;