Merge android11-5.4.289(4c8fb32) into msm-5.4

* remotes/origin/tmp-4c8fb32: ANDROID: GKI: add Trimble symbol list UPSTREAM: selinux: ignore unknown extended permissions ANDROID: ABI: Update allowed list for galaxy Revert "netfilter: Replace zero-length array with flexible-array member" Revert "tracing: Constify string literal data member in struct trace_event_call" Revert "skb_expand_head() adjust skb->truesize incorrectly" Linux 5.4.289 ftrace: use preempt_enable/disable notrace macros to avoid double fault mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() drm: adv7511: Drop dsi single lane support net/sctp: Prevent autoclose integer overflow in sctp_association_init() sky2: Add device ID 11ab:4373 for Marvell 88E8075 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking RDMA/uverbs: Prevent integer overflow issue modpost: fix the missed iteration for the max bit in do_input() modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host ARC: build: Try to guess GCC variant of cross compiler irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base net: usb: qmi_wwan: add Telit FE910C04 compositions bpf: fix potential error return sound: usb: format: don't warn that raw DSD is unsupported wifi: mac80211: wake the queues in case of failure in resume ila: serialize calls to nf_register_net_hooks() af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK af_packet: fix vlan_get_tci() vs MSG_PEEK ALSA: usb-audio: US16x08: Initialize array before use net: llc: reset skb->transport_header netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext netfilter: Replace zero-length array with flexible-array member netrom: check buffer length before accessing it drm/bridge: adv7511_audio: Update Audio InfoFrame properly drm: bridge: adv7511: Enable SPDIF DAI RDMA/bnxt_re: Fix max_qp_wrs reported RDMA/bnxt_re: Fix reporting hw_ver in query_device RDMA/bnxt_re: Add check for path mtu in modify_qp RDMA/mlx5: Enforce same type port association for multiport RoCE net/mlx5: Make API mlx5_core_is_ecpf accept const pointer IB/mlx5: Introduce and use mlx5_core_is_vf() Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet selinux: ignore unknown extended permissions ipv6: prevent possible UAF in ip6_xmit() skb_expand_head() adjust skb->truesize incorrectly btrfs: avoid monopolizing a core when activating a swap file tracing: Constify string literal data member in struct trace_event_call bpf: fix recursive lock when verdict program return SK_PASS ipv6: fix possible UAF in ip6_finish_output2() ipv6: use skb_expand_head in ip6_xmit ipv6: use skb_expand_head in ip6_finish_output2 skbuff: introduce skb_expand_head() MIPS: Probe toolchain support of -msym32 epoll: Add synchronous wakeup support for ep_poll_callback virtio-blk: don't keep queue frozen during system suspend scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time platform/x86: asus-nb-wmi: Ignore unknown event 0xCF regmap: Use correct format specifier for logging range errors scsi: megaraid_sas: Fix for a potential deadlock scsi: qla1280: Fix hw revision numbering for ISP1020/1040 tracing/kprobe: Make trace_kprobe's module callback called after jump_label update mtd: rawnand: fix double free in atmel_pmecc_create_user() dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset dmaengine: mv_xor: fix child node refcount handling in early exit phy: core: Fix that API devm_phy_destroy() fails to destroy the phy phy: core: Fix that API devm_phy_put() fails to release the phy phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() phy: core: Fix an OF node refcount leakage in _of_phy_get() mtd: diskonchip: Cast an operand to prevent potential overflow nfsd: restore callback functionality for NFSv4.0 bpf: Check negative offsets in __bpf_skb_min_len() media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg of: Fix refcount leakage for OF node returned by __of_get_dma_parent() of: Fix error path in of_parse_phandle_with_args_map() udmabuf: also check for F_SEAL_FUTURE_WRITE nilfs2: prevent use of deleted inode of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() NFS/pnfs: Fix a live lock between recalled layouts and layoutget btrfs: tree-checker: reject inline extent items with 0 ref count zram: refuse to use zero sized block device as backing device sh: clk: Fix clk_enable() to return 0 on NULL clk USB: serial: option: add Telit FE910C04 rmnet compositions USB: serial: option: add MediaTek T7XX compositions USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready USB: serial: option: add MeiG Smart SLM770A USB: serial: option: add TCL IK512 MBIM & ECM efivarfs: Fix error on non-existent file i2c: riic: Always round-up when calculating bus period chelsio/chtls: prevent potential integer overflow on 32bit mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk netfilter: ipset: Fix for recursive locking warning net: ethernet: bgmac-platform: fix an OF node reference leak net: hinic: Fix cleanup in create_rxqs/txqs() ionic: use ee->offset when returning sprom data net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll erofs: fix incorrect symlink detection in fast symlink erofs: fix order >= MAX_ORDER warning due to crafted negative i_size drm/i915: Fix memory leak by correcting cache object name in error handler i2c: pnx: Fix timeout in wait functions PCI: Add ACS quirk for Broadcom BCM5760X NIC ALSA: usb: Fix UBSAN warning in parse_audio_unit() PCI/AER: Disable AER service on suspend usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled net: sched: fix ordering of qlen adjustment UPSTREAM: ALSA: usb-audio: Fix a DMA to stack memory bug Linux 5.4.288 ALSA: usb-audio: Fix a DMA to stack memory bug xen/netfront: fix crash when removing device tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe() KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status blk-iocost: Avoid using clamp() on inuse in __propagate_weights() blk-iocost: fix weight updates of inner active iocgs blk-iocost: clamp inuse and skip noops in __propagate_weights() ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired net/sched: netem: account for backlog updates from child qdisc qca_spi: Make driver probing reliable qca_spi: Fix clock speed for multiple QCA7000 ACPI: resource: Fix memory resource type union access net: lapb: increase LAPB_HEADER_LEN tipc: fix NULL deref in cleanup_bearer() batman-adv: Do not let TT changes list grows indefinitely batman-adv: Remove uninitialized data in full table TT response batman-adv: Do not send uninitialized TT changes bpf, sockmap: Fix update element with same xfs: don't drop errno values when we fail to ficlone the entire range usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer usb: ehci-hcd: fix call balance of clocks handling routines usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() usb: host: max3421-hcd: Correctly abort a USB request. UPSTREAM: ALSA: usb-audio: Fix out of bounds reads when finding clock sources UPSTREAM: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Revert "cgroup: Make operations on the cgroup root_list RCU safe" Revert "cgroup: Move rcu_head up near the top of cgroup_root" Linux 5.4.287 bpf, xdp: Update devmap comments to reflect napi/rcu usage ALSA: usb-audio: Fix out of bounds reads when finding clock sources PCI: rockchip-ep: Fix address translation unit programming Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()" modpost: Add .irqentry.text to OTHER_SECTIONS ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" jffs2: Fix rtime decompressor jffs2: Prevent rtime decompress memory corruption KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* perf/x86/intel/pt: Fix buffer full but size is 0 case Revert "unicode: Don't special case ignorable code points" bpf: fix OOB devmap writes when deleting elements xdp: Simplify devmap cleanup misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle powerpc/prom_init: Fixup missing powermac #size-cells usb: chipidea: udc: handle USB Error Interrupt if IOC not set i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock PCI: Add ACS quirk for Wangxun FF5xxx NICs PCI: Add 'reset_subordinate' to reset hierarchy below bridge f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. nvdimm: rectify the illogical code within nd_dax_probe() pinctrl: qcom-pmic-gpio: add support for PM8937 scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset scsi: st: Don't modify unknown block number in MTIOCGET leds: class: Protect brightness_show() with led_cdev->led_access mutex tracing: Use atomic64_inc_return() in trace_clock_counter() netpoll: Use rcu_access_pointer() in __netpoll_setup net/neighbor: clear error in case strict check is not set rocker: fix link status detection in rocker_carrier_init() ASoC: hdmi-codec: reorder channel allocation list Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() wifi: ipw2x00: libipw_rx_any(): fix bad alignment drm/amdgpu: set the right AMDGPU sg segment limitation jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree jfs: fix array-index-out-of-bounds in jfs_readdir jfs: fix shift-out-of-bounds in dbSplit jfs: array-index-out-of-bounds fix in dtReadFirst wifi: ath5k: add PCI ID for Arcadyan devices wifi: ath5k: add PCI ID for SX76X net: inet6: do not leave a dangling sk pointer in inet6_create() net: inet: do not leave a dangling sk pointer in inet_create() net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() net: af_can: do not leave a dangling sk pointer in can_create() Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() af_packet: avoid erroring out after sock_init_data() in packet_create() net/sched: cbs: Fix integer overflow in cbs_set_port_rate() net: ethernet: fs_enet: Use %pa to format resource_size_t net: fec_mpc52xx_phy: Use %pa to format resource_size_t samples/bpf: Fix a resource leak drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() drm/mcde: Enable module autoloading drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera s390/cpum_sf: Handle CPU hotplug remove during sampling mmc: core: Further prevent card detect during shutdown regmap: detach regmap from dev on regmap_exit dma-buf: fix dma_fence_array_signaled v4 bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt scsi: qla2xxx: Supported speed displayed incorrectly for VPorts scsi: qla2xxx: Fix NVMe and NPIV connect issue ocfs2: update seq_file index in ocfs2_dlm_seq_next tracing: Fix cmp_entries_dup() to respect sort() comparison rules HID: wacom: fix when get product name maybe null pointer bpf: Fix exact match conditions in trie_get_next_key() bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie ocfs2: free inode when ocfs2_get_init_inode() fails spi: mpc52xx: Add cancel_work_sync before module remove tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg drm/sti: Add __iomem for mixer_dbg_mxn's parameter gpio: grgpio: Add NULL check in grgpio_probe gpio: grgpio: use a helper variable to store the address of ofdev->dev crypto: x86/aegis128 - access 32-bit arguments as 32-bit x86/asm: Reorder early variables xen: Fix the issue of resource not being properly released in xenbus_dev_probe() xen/xenbus: fix locking xenbus/backend: Protect xenbus callback with lock xenbus/backend: Add memory pressure handler callback xen/xenbus: reference count registered modules netfilter: nft_set_hash: skip duplicated elements pending gc run netfilter: ipset: Hold module reference while requesting a module igb: Fix potential invalid memory access in igb_init_module() net/qed: allow old cards not supporting "num_images" to work tipc: Fix use-after-free of kernel socket in cleanup_bearer(). tipc: add new AEAD key structure for user API tipc: enable creating a "preliminary" node tipc: add reference counter to bearer dccp: Fix memory leak in dccp_feat_change_recv net/ipv6: release expired exception dst cached in socket can: j1939: j1939_session_new(): fix skb reference counting net/sched: tbf: correct backlog statistic for GSO packets netfilter: x_tables: fix LED ID check in led_tg_check() ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call drm/etnaviv: flush shader L1 cache after user commandstream nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur nfsd: make sure exp active before svc_export_show dm thin: Add missing destroy_work_on_stack() i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() util_macros.h: fix/rework find_closest() macros ad7780: fix division by zero in ad7780_write_raw() clk: qcom: gcc-qcs404: fix initial rate of GPLL3 ftrace: Fix regression with module command in stack_trace_filter ovl: Filter invalid inodes with missing lookup function media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled media: ts2020: fix null-ptr-deref in ts2020_probe() media: i2c: tc358743: Fix crash in the probe error path when using polling btrfs: ref-verify: fix use-after-free after invalid ref action quota: flush quota_release_work upon quota writeback ASoC: fsl_micfil: fix the naming style for mask definition sh: intc: Fix use-after-free bug in register_intc_controller() sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE SUNRPC: correct error code comment in xs_tcp_setup_socket() modpost: remove incorrect code in do_eisa_entry() rtc: ab-eoz9: don't fail temperature reads on undervoltage notification 9p/xen: fix release of IRQ 9p/xen: fix init sequence block: return unsigned int from bdev_io_min jffs2: fix use of uninitialized variable ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit ubi: fastmap: Fix duplicate slab cache names while attaching ubifs: Correct the total block count by deducting journal reservation rtc: check if __rtc_read_time was successful in rtc_timer_do_work() rtc: abx80x: Fix WDT bit position of the status register rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() NFSv4.0: Fix a use-after-free problem in the asynchronous open() um: Always dump trace for specified task in show_stack um: Clean up stacktrace dump um: add show_stack_loglvl() um/sysrq: remove needless variable sp um: Fix the return value of elf_core_copy_task_fpregs um: Fix potential integer overflow during physmem setup rpmsg: glink: Propagate TX failures in intentless mode as well SUNRPC: make sure cache entry active before cache_show NFSD: Prevent a potential integer overflow lib: string_helpers: silence snprintf() output truncation warning usb: dwc3: gadget: Fix checking for number of TRBs left ALSA: hda/realtek: Apply quirk for Medion E15433 ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max ALSA: hda/realtek: Set PCBeep to default value for ALC274 ALSA: hda/realtek: Update ALC225 depop procedure media: wl128x: Fix atomicity violation in fmc_send_cmd() HID: wacom: Interpret tilt data from Intuos Pro BT as signed values block: fix ordering between checking BLK_MQ_S_STOPPED request adding arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK um: vector: Do not use drvdata in release serial: 8250: omap: Move pm_runtime_get_sync um: net: Do not use drvdata in release um: ubd: Do not use drvdata in release ubi: wl: Put source PEB into correct list if trying locking LEB failed spi: Fix acpi deferred irq probe netfilter: ipset: add missing range check in bitmap_ip_uadt Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" serial: sh-sci: Clean sci_ports[0] after at earlycon exit Revert "usb: gadget: composite: fix OS descriptors w_value logic" Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler comedi: Flush partial mappings in error case PCI: Fix use-after-free of slot->bus on hot remove ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() jfs: xattr: check invalid xattr size more strictly ext4: fix FS_IOC_GETFSMAP handling ext4: supress data-race warnings in ext4_free_inodes_{count,set}() ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() cgroup: Move rcu_head up near the top of cgroup_root cgroup: Make operations on the cgroup root_list RCU safe usb: ehci-spear: fix call balance of sehci clk handling routines apparmor: fix 'Do simple duplicate message elimination' staging: greybus: uart: clean up TIOCGSERIAL misc: apds990x: Fix missing pm_runtime_disable() USB: chaoskey: Fix possible deadlock chaoskey_list_lock USB: chaoskey: fail open after removal usb: yurex: make waiting on yurex_write interruptible usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() ipmr: fix tables suspicious RCU usage ipmr: convert /proc handlers to rcu_read_lock() net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken marvell: pxa168_eth: fix call balance of pep->clk handling routines net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device power: supply: core: Remove might_sleep() from power_supply_put() vfio/pci: Properly hide first-in-list PCIe extended capability NFSD: Fix nfsd4_shutdown_copy() NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() NFSD: Prevent NULL dereference in nfsd4_process_cb_update() rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length rpmsg: glink: Fix GLINK command prefix rpmsg: glink: Send READ_NOTIFY command in FIFO full case rpmsg: glink: Add TX_DATA_CONT command while sending perf trace: Avoid garbage when not printing a syscall's arguments perf trace: Do not lose last events in a race m68k: coldfire/device.c: only build FEC when HW macros are defined m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x PCI: cpqphp: Fix PCIBIOS_* return value confusion PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads perf probe: Correct demangled symbols in C++ program perf cs-etm: Don't flush when packet_queue fills up clk: clk-axi-clkgen: make sure to enable the AXI bus clock clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand dt-bindings: clock: axi-clkgen: include AXI clk dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() fbdev/sh7760fb: Alloc DMA memory from hardware device powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static ocfs2: fix uninitialized value in ocfs2_file_read_iter() scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() scsi: fusion: Remove unused variable 'rc' scsi: bfa: Fix use-after-free in bfad_im_module_exit() mfd: rt5033: Fix missing regmap_del_irq_chip() RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey mtd: rawnand: atmel: Fix possible memory leak cpufreq: loongson2: Unregister platform_driver on failure mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use dev_err_probe() mfd: da9052-spi: Change read-mask to write-mask mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race powerpc/vdso: Flag VDSO64 entry points as functions trace/trace_event_perf: remove duplicate samples on the first tracepoint event netpoll: Use rcu_access_pointer() in netpoll_poll_lock ALSA: 6fire: Release resources at card release ALSA: caiaq: Use snd_card_free_when_closed() at disconnection ALSA: us122l: Use snd_card_free_when_closed() at disconnection net: rfkill: gpio: Add check for clk_enable() selftests: net: really check for bg process completion bpf, sockmap: Fix sk_msg_reset_curr bpf, sockmap: Several fixes to bpf_msg_pop_data bpf, sockmap: Several fixes to bpf_msg_push_data drm/etnaviv: hold GPU lock across perfmon sampling drm/etnaviv: fix power register offset on GC300 drm/etnaviv: dump: fix sparse warnings drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() drm/panfrost: Remove unused id_mask from struct panfrost_model wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() bpf: Fix the xdp_adjust_tail sample prog issue ASoC: fsl_micfil: fix regmap_write_bits usage ASoC: fsl_micfil: use GENMASK to define register bit fields ASoC: fsl_micfil: do not define SHIFT/MASK for single bits ASoC: fsl_micfil: Drop unnecessary register read dt-bindings: vendor-prefixes: Add NeoFidelity, Inc drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() drm/omap: Fix locking in omap_gem_new_dmabuf() wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused firmware: arm_scpi: Check the DVFS OPP count returned by the firmware regmap: irq: Set lockdep class for hierarchical IRQ domains ARM: dts: cubieboard4: Fix DCDC5 regulator constraints tpm: fix signed/unsigned bug when checking event logs efi/tpm: Pass correct address to memblock_reserve mmc: mmc_spi: drop buggy snprintf() soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() time: Fix references to _msecs_to_jiffies() handling of values crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() crypto: bcm - add error check in the ahash_hmac_init function crypto: cavium - Fix the if condition to exit loop after timeout crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY EDAC/fsl_ddr: Fix bad bit shift operations EDAC/bluefield: Fix potential integer overflow firmware: google: Unregister driver_info on failure firmware: google: Unregister driver_info on failure and exit in gsmi hfsplus: don't query the device logical block size multiple times s390/syscalls: Avoid creation of arch/arch/ directory acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() m68k: mvme147: Reinstate early console m68k: mvme16x: Add and use "mvme16x.h" m68k: mvme147: Fix SCSI controller IRQ numbers nvme-pci: fix freeing of the HMB descriptor table initramfs: avoid filename buffer overrun mips: asm: fix warning when disabling MIPS_FP_SUPPORT x86/xen/pvh: Annotate indirect branch as safe nvme: fix metadata handling in nvme-passthrough NFSD: Force all NFSv4.2 COPY requests to be synchronous cifs: Fix buffer overflow when parsing NFS reparse points ipmr: Fix access to mfc_cache_list without lock held proc/softirqs: replace seq_printf with seq_put_decimal_ull_width ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate() regulator: rk808: Add apply_bit for BUCK3 on RK809 soc: qcom: Add check devm_kasprintf() returned value net: usb: qmi_wwan: add Quectel RG650V x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13 selftests/watchdog-test: Fix system accidentally reset after watchdog-test mac80211: fix user-power when emulating chanctx ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet mm: revert "mm: shmem: fix data-race in shmem_getattr()" kbuild: Use uname for LINUX_COMPILE_HOST detection media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint ocfs2: fix UBSAN warning in ocfs2_verify_volume() nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN ocfs2: uncache inode which has failed entering the group net/mlx5e: kTLS, Fix incorrect page refcounting net/mlx5: fs, lock FTE when checking if active netlink: terminate outstanding dump on socket close Revert "UPSTREAM: unicode: Don't special case ignorable code points" Reapply "UPSTREAM: unicode: Don't special case ignorable code points" Revert "UPSTREAM: unicode: Don't special case ignorable code points" UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT ANDROID: add file for recording allowed ABI breaks Revert "spi: Fix deadlock when adding SPI controllers on SPI buses" Revert "spi: fix use-after-free of the add_lock mutex" ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics UPSTREAM: x86/percpu: Clean up percpu_add_op() UPSTREAM: x86/percpu: Clean up percpu_from_op() UPSTREAM: x86/percpu: Clean up percpu_to_op() UPSTREAM: x86/percpu: Introduce size abstraction macros BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze FROMGIT: binder: allow freeze notification for dead nodes FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work() FROMGIT: binder: fix OOB in binder_add_freeze_work() FROMGIT: binder: fix node UAF in binder_add_freeze_work() Linux 5.4.286 mm: avoid leaving partial pfn mappings around in error case 9p: fix slab cache name creation for real mm: add remap_pfn_range_notrack mm/memory.c: make remap_pfn_range() reject unaligned addr mm: fix ambiguous comments for better code readability mm: clarify a confusing comment for remap_pfn_range() md/raid10: improve code of mrdev in raid10_sync_request net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition fs: Fix uninitialized value issue in from_kuid and from_kgid powerpc/powernv: Free name on error in opal_event_init() sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML bpf: use kvzmalloc to allocate BPF verifier environment HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad 9p: Avoid creating multiple slab caches with the same name ALSA: usb-audio: Add endianness annotations vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer ftrace: Fix possible use-after-free issue in ftrace_location() NFSD: Fix NFSv4's PUTPUBFH operation ALSA: usb-audio: Add quirks for Dell WD19 dock ALSA: usb-audio: Support jack detection on Dell dock ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() irqchip/gic-v3: Force propagation of the active state with a read-back USB: serial: option: add Quectel RG650V USB: serial: option: add Fibocom FG132 0x0112 composition USB: serial: qcserial: add support for Sierra Wireless EM86xx USB: serial: io_edgeport: fix use after free in debug printk usb: musb: sunxi: Fix accessing an released usb phy fs/proc: fix compile warning about variable 'vmcore_mmap_ops' media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format net: bridge: xmit: make sure we have at least eth header len bytes spi: fix use-after-free of the add_lock mutex spi: Fix deadlock when adding SPI controllers on SPI buses mtd: rawnand: protect access to rawnand devices while in suspend btrfs: reinitialize delayed ref list after deleting it from the list nfs: Fix KMSAN warning in decode_getfattr_attrs() dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow dm cache: fix potential out-of-bounds access on the first resume dm cache: optimize dirty bit checking with find_next_bit when resizing dm cache: fix out-of-bounds access to the dirty bitset when resizing dm cache: correct the number of origin blocks to match the target length drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() pwm: imx-tpm: Use correct MODULO value for EPWM mode media: v4l2-tpg: prevent the risk of a division by zero media: cx24116: prevent overflows on SNR calculus media: s5p-jpeg: prevent buffer overflows ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() media: adv7604: prevent underflow condition when reporting colorspace media: dvb_frontend: don't play tricks with underflow values media: dvbdev: prevent the risk of out of memory access media: stb0899_algo: initialize cfr before using it net: hns3: fix kernel crash when uninstalling driver can: c_can: fix {rx,tx}_errors statistics sctp: properly validate chunk size in sctp_sf_ootb() net: enetc: set MAC address to the VF net_device enetc: simplify the return expression of enetc_vf_set_mac_addr() security/keys: fix slab-out-of-bounds in key_task_permission HID: core: zero-initialize the report buffer ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin ARM: dts: rockchip: Fix the spi controller on rk3036 ARM: dts: rockchip: drop grf reference from rk3036 hdmi ARM: dts: rockchip: fix rk3036 acodec node arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator ANDROID: GKI: Enable SERIAL_8250_DW UPSTREAM: USB: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Revert "genetlink: hold RCU in genlmsg_mcast()" Revert "arm64: probes: Fix uprobes for big-endian kernels" Revert "arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning" Revert "inet: inet_defrag: prevent sk release while still in use" Linux 5.4.285 mm: krealloc: Fix MTE false alarm in __do_krealloc mac80211: always have ieee80211_sta_restart() vt: prevent kernel-infoleak in con_font_get() Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device" mm: shmem: fix data-race in shmem_getattr() nilfs2: fix kernel bug due to missing clearing of checked flag ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow riscv: Remove unused GENERATING_ASM_OFFSETS nilfs2: fix potential deadlock with newly created symlinks staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() wifi: iwlegacy: Clear stale interrupts before resuming device wifi: ath10k: Fix memory leak in management tx wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Revert "driver core: Fix uevent_show() vs driver detach race" xhci: Fix Link TRB DMA in command ring stopped completion event usb: phy: Fix API devm_usb_put_phy() can not release the phy usbip: tools: Fix detach_port() invalid port error path misc: sgi-gru: Don't disable preemption in GRU driver net: amd: mvme147: Fix probe banner message firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() drivers/misc: ti-st: Remove unneeded variable in st_tty_open netfilter: nft_payload: sanitize offset and length before calling skb_checksum() net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension net: support ip generic csum processing in skb_csum_hwoffload_help bpf: Fix out-of-bounds write in trie_get_next_key() net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT gtp: allow -1 to be specified as file description from userspace gtp: simplify error handling code in 'gtp_encap_enable()' dt-bindings: gpu: Convert Samsung Image Rotator to dt-schema ASoC: cs42l51: Fix some error handling paths in cs42l51_probe() wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() wifi: iwlwifi: mvm: disconnect station vifs if recovery failed mac80211: Add support to trigger sta disconnect on hardware restart mac80211: do drv_reconfig_complete() before restarting all wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys cgroup: Fix potential overflow issue when checking max_depth xfrm: validate new SA's prefixlen using SA family when sel.family is unset arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning selinux: improve error checking in sel_write_load() hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 nilfs2: fix kernel bug due to missing clearing of buffer delay flag ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] drm/amd: Guard against bad data for ATIF ACPI method ALSA: hda/realtek: Update default depop procedure ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() r8169: avoid unsolicited interrupts net: sched: fix use-after-free in taprio_change() net: usb: usbnet: fix name regression be2net: fix potential memory leak in be_xmit() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() tracing: Consider the NULL character when validating the event length jfs: Fix sanity check in dbMount udf: fix uninit-value use in udf_get_fileshortad drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA KVM: s390: gaccess: Check if guest address is in memslot KVM: s390: gaccess: Cleanup access to guest pages KVM: s390: gaccess: Refactor access address range check KVM: s390: gaccess: Refactor gpa and length calculation arm64: probes: Fix uprobes for big-endian kernels arm64:uprobe fix the uprobe SWBP_INSN in big-endian Bluetooth: bnep: fix wild-memory-access in proto_unregister usb: typec: altmode should keep reference to parent smb: client: fix OOBs when building SMB2_IOCTL request genetlink: hold RCU in genlmsg_mcast() net: systemport: fix potential memory leak in bcm_sysport_xmit() net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() macsec: don't increment counters for an unrelated SA drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation RDMA/bnxt_re: Return more meaningful error ipv4: give an IPv4 dev to blackhole_netdev RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin RDMA/bnxt_re: Fix incorrect AVID type in WQE structure mac80211: Fix NULL ptr deref for injected rate info erofs: fix lz4 inplace decompression nilfs2: propagate directory read errors from nilfs_find_entry() x86/apic: Always explicitly disarm TSC-deadline timer x86/resctrl: Annotate get_mem_config() functions as __init parport: Proper fix for array out-of-bounds access USB: serial: option: add Telit FN920C04 MBIM compositions USB: serial: option: add support for Quectel EG916Q-GL xhci: Fix incorrect stream context type macro Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Bluetooth: Remove debugfs directory on module init failure iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: opt3001: add missing full-scale range value iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig drm/vmwgfx: Handle surface check failure correctly blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET KVM: s390: Change virtual to physical address access in diag 0x258 handler s390/sclp_vt220: Convert newlines to CRLF instead of LFCR KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() wifi: mac80211: fix potential key use-after-free mm/swapfile: skip HugeTLB pages for unuse_vma fat: fix uninitialized variable PCI: Add function 0 DMA alias quirk for Glenfly Arise chip tracing/kprobes: Fix symbol counting logic by looking at modules as well tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols arm64: probes: Fix simulate_ldr*_literal() arm64: probes: Remove broken LDR (literal) uprobe support posix-clock: Fix missing timespec64 check in pc_clock_settime() nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error net: Fix an unsafe loop on the list hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip usb: xhci: Fix problem with xhci resume from suspend usb: dwc3: core: Stop processing of pending events if controller is halted Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" HID: plantronics: Workaround for an unexcepted opposite volume key CDC-NCM: avoid overflow in sanity checking resource: fix region_intersects() vs add_memory_driver_managed() lockdep: fix deadlock issue between lockdep and rcu locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Rework lockdep_lock locking/lockdep: Fix bad recursion pattern slip: make slhc_remember() more robust against malicious packets ppp: fix ppp_async_encode() illegal access sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start net: annotate lockless accesses to sk->sk_max_ack_backlog net: annotate lockless accesses to sk->sk_ack_backlog net: ibm: emac: mal: fix wrong goto net/sched: accept TCA_STAB only for root qdisc igb: Do not bring the device up after non-fatal error gpio: aspeed: Use devm_clk api to manage clock source gpio: aspeed: Add the flush write to ensure the write complete. Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change netfilter: br_netfilter: fix panic with metadata_dst skb tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe tcp: fix to allow timestamp undo if no retransmits were sent SUNRPC: Fix integer overflow in decode_rc_list() ice: fix VLAN replay after reset RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt fbdev: sisfb: Fix strbuf array overflow driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute tools/iio: Add memory allocation failure check for trigger_name virtio_pmem: Check device status before requesting flush usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario usb: chipidea: udc: enable suspend interrupt after usb reset media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition PCI: Mark Creative Labs EMU20k2 INTx masking as broken i2c: i801: Use a different adapter-name for IDF adapters PCI: Add ACS quirk for Qualcomm SA8775P clk: bcm: bcm53573: fix OF node leak in init ktest.pl: Avoid false positives with grub2 skip regex s390/cpum_sf: Remove WARN_ON_ONCE statements ext4: nested locking for xattr inode s390/mm: Add cond_resched() to cmm_alloc/free_pages() s390/facility: Disable compile time optimization for decompressor code bpf: Check percpu map value size first Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal virtio_console: fix misc probe bugs tracing: Have saved_cmdlines arrays all in one allocation drm/crtc: fix uninitialized variable use even harder tracing: Remove precision vsnprintf() check from print event net: ethernet: cortina: Drop TSO support unicode: Don't special case ignorable code points ext4: fix inode tree inconsistency caused by ENOMEM ACPI: battery: Fix possible crash when unregistering a battery hook ACPI: battery: Simplify battery hook locking r8169: add tally counter fields added with RTL8125 r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun" clk: qcom: clk-rpmh: Fix overflow in BCM vote clk: qcom: rpmh: Simplify clk_rpmh_bcm_send_cmd() nfsd: fix delegation_blocked() to block correctly for at least 30 seconds nfsd: use ktime_get_seconds() for timestamps uprobes: fix kernel info leak via "[uprobes]" vma arm64: errata: Expand speculative SSBS workaround once more arm64: cputype: Add Neoverse-N3 definitions arm64: Add Cortex-715 CPU part definition i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() i2c: qcom-geni: Grow a dev pointer to simplify code i2c: qcom-geni: Let firmware specify irq trigger flags gpio: davinci: fix lazy disable btrfs: wait for fixup workers before stopping cleaner kthread during umount btrfs: fix a NULL pointer dereference when failed to start a new trasacntion ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[] ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[] Input: adp5589-keys - fix adp5589_gpio_get_value() rtc: at91sam9: fix OF node leak in probe() error path tomoyo: fallback to realpath if symlink's pathname does not exist iio: magnetometer: ak8975: Fix reading for ak099xx sensors media: venus: fix use after free bug in venus_remove due to race condition media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags media: sun4i_csi: Implement link validate for sun4i_csi subdev clk: rockchip: fix error for unknown clocks aoe: fix the potential use-after-free problem in more places riscv: define ILLEGAL_POINTER_VALUE for 64bit ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate ocfs2: fix null-ptr-deref when journal load failed. ocfs2: remove unreasonable unlock in ocfs2_read_blocks ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2: reserve space for inline xattr before attaching reflink tree ocfs2: fix uninit-value in ocfs2_get_block() ocfs2: fix the la space leak when unmounting an ocfs2 volume mm: krealloc: consider spare memory for __GFP_ZERO jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error drm: omapdrm: Add missing check for alloc_ordered_workqueue of/irq: Support #msi-cells=<0> in of_msi_get_domain parisc: Fix stack start for ADDR_NO_RANDOMIZE personality parisc: Fix 64-bit userspace syscall path ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() ext4: fix double brelse() the buffer of the extents path ext4: aovid use-after-free in ext4_ext_insert_extent() ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() ext4: propagate errors from ext4_find_extent() in ext4_insert_range() ext4: no need to continue when the number of entries is 1 ALSA: core: add isascii() check to card ID generator drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS parisc: Fix itlb miss handler for 64-bit programs perf/core: Fix small negative period being ignored spi: bcm63xx: Fix module autoloading firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() i2c: xiic: Wait for TX empty to avoid missed TX NAKs i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume selftests: vDSO: fix vDSO symbols lookup for powerpc64 selftests: breakpoints: use remaining time to check if suspend succeed spi: s3c64xx: fix timeout counters in flush_fifo ext4: fix i_data_sem unlock order in ext4_ind_migrate() ext4: ext4_search_dir should return a proper error of/irq: Refer to actual buffer size in of_irq_parse_one() drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() scsi: aacraid: Rearrange order of struct aac_srb_unit drm/printer: Allow NULL data in devcoredump printer drm/amd/display: Initialize get_bytes_per_element's default to 1 drm/amd/display: Fix index out of bounds in degamma hardware format translation drm/amd/display: Check stream before comparing them jfs: Fix uninit-value access of new_ea in ea_buffer jfs: check if leafidx greater than num leaves per dmap tree jfs: Fix uaf in dbFreeBits jfs: UBSAN: shift-out-of-bounds in dbFindBits ata: sata_sil: Rename sil_blacklist to sil_quirks power: reset: brcmstb: Do not go into infinite loop if reset fails fbdev: pxafb: Fix possible use after free in pxafb_task() x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments() ALSA: hdsp: Break infinite MIDI input flush loop ALSA: asihpi: Fix potential OOB array access signal: Replace BUG_ON()s nfp: Use IRQF_NO_AUTOEN flag in request_irq() wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() proc: add config & param to block forcing mem writes ACPICA: iasl: handle empty connection_node tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). net: mvpp2: Increase size of queue_name buffer tipc: guard against string buffer overrun ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() ACPI: EC: Do not release locks during operation region accesses wifi: rtw88: select WANT_DEV_COREDUMP net: sched: consistently use rcu_replace_pointer() in taprio_change() ACPICA: Fix memory leak if acpi_ps_get_next_field() fails ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails net: hisilicon: hns_mdio: fix OF node leak in probe() net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() net: hisilicon: hip04: fix OF node leak in probe() ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node() wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() f2fs: Require FMODE_WRITE for atomic write ioctls ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs ALSA: hda/realtek: Fix the push button function for the ALC257 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start ipv4: ip_gre: Fix drops of small packets in ipgre_xmit net: add more sanity checks to qdisc_pkt_len_init() net: avoid potential underflow in qdisc_pkt_len_init() with UFO net: ethernet: lantiq_etop: fix memory disclosure Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() Bluetooth: btmrvl_sdio: Refactor irq wakeup netfilter: nf_tables: prevent nf_skb_duplicated corruption net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq() netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED net/mlx5: Added cond_resched() to crdump collection ieee802154: Fix build error drivers: net: Fix Kconfig indentation, continued Minor fixes to the CAIF Transport drivers Kconfig file ceph: remove the incorrect Fw reference check when dirtying pages mailbox: bcm2835: Fix timeout during suspend mode mailbox: rockchip: fix a typo in module autoloading usb: yurex: Fix inconsistent locking bug in yurex_read() i2c: isch: Add missed 'else' i2c: aspeed: Update the stop sw state when the bus recovery occurs mm: only enforce minimum stack gap size if it's sensible pps: add an error check in parport_attach pps: remove usage of the deprecated ida_simple_xx() API USB: misc: yurex: fix race between read and write usb: yurex: Replace snprintf() with the safer scnprintf() variant soc: versatile: realview: fix soc_dev leak during device remove soc: versatile: realview: fix memory leak during device remove PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() ASoC: meson: axg-card: fix 'use-after-free' ASoC: meson: axg: extract sound card utils nfs: fix memory leak in error path of nfs4_do_reclaim fs: Fix file_set_fowner LSM hook inconsistencies vfs: fix race between evice_inodes() and find_inode()&iput() hwrng: mtk - Use devm_pm_runtime_enable f2fs: avoid potential int overflow in sanity_check_area_boundary() f2fs: prevent possible int overflow in dir_block_index() debugobjects: Fix conditions in fill_pool() wifi: rtw88: 8822c: Fix reported RX band width ACPI: resource: Add another DMI match for the TongFang GMxXGxx ACPI: sysfs: validate return type of _STR method drbd: Add NULL check for net_conf to prevent dereference in state validation drbd: Fix atomicity violation in drbd_uuid_set_bm() tty: rp2: Fix reset with non forgiving PCIe host bridges firmware_loader: Block path traversal USB: class: CDC-ACM: fix race between get_serial and set_serial USB: misc: cypress_cy7c63: check for short transfer USB: appledisplay: close race between probe and completion handler drm/amd/display: Round calculated vtotal soc: versatile: integrator: fix OF node leak in probe() error path Remove *.orig pattern from .gitignore crypto: aead,cipher - zeroize key buffer after use netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS net: qrtr: Update packets cloning when broadcasting tcp: check skb is non-NULL in tcp_rto_delta_us() net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() coresight: tmc: sg: Do not leak sg_table iio: adc: ad7606: fix standby gpio state to match the documentation iio: adc: ad7606: fix oversampling gpio array f2fs: reduce expensive checkpoint trigger frequency f2fs: remove unneeded check condition in __f2fs_setxattr() f2fs: fix to update i_ctime in __f2fs_setxattr() f2fs: fix typo f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() nfsd: return -EINVAL when namelen is 0 nfsd: call cache_put if xdr_reserve_space returns NULL ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() RDMA/cxgb4: Added NULL check for lookup_atid riscv: Fix fp alignment bug in perf_callchain_user() RDMA/hns: Optimize hem allocation performance watchdog: imx_sc_wdt: Don't disable WDT in suspend pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function clk: ti: dra7-atl: Fix leak of of_nodes pinctrl: single: fix missing error code in pcs_probe() RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency PCI: xilinx-nwl: Fix register misspelling PCI: keystone: Fix if-statement expression in ks_pcie_quirk() drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 perf time-utils: Fix 32-bit nsec parsing perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time perf sched timehist: Fix missing free of session in perf_sched__timehist() bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit nilfs2: fix potential oob read in nilfs_btree_check_delete() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() ext4: avoid OOB when system.data xattr changes underneath the filesystem ext4: return error on ext4_find_inline_entry ext4: avoid negative min_clusters in find_group_orlov() smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() kthread: fix task state in kthread worker if being frozen kthread: add kthread_work tracepoints xz: cleanup CRC32 edits from 2018 selftests/bpf: Fix error compiling test_lru_map.c selftests/bpf: Fix compiling tcp_rtt.c with musl-libc selftests/bpf: Fix compiling flow_dissector.c with musl-libc selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c tpm: Clean up TPM space after command failure xen/swiotlb: add alignment check for dma buffers xen: use correct end address of kernel for conflict checking drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() drm/msm: fix %s null argument error ipmi: docs: don't advertise deprecated sysfs entries drm/msm/a5xx: fix races in preemption evaluation stage drm/msm/a5xx: properly clear preemption records on resume drm/msm/a5xx: disable preemption in submits by default drm/msm: Fix incorrect file name output in adreno_request_fw() jfs: fix out-of-bounds in dbNextAG() and diAlloc() drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode drm/rockchip: vop: Allow 4096px width scaling drm/radeon: properly handle vbios fake edid sizing drm/radeon: Replace one-element array with flexible-array member drm/amdgpu: properly handle vbios fake edid sizing drm/amdgpu: Replace one-element array with flexible-array member drm/stm: Fix an error handling path in stm_drm_platform_probe() mtd: powernv: Add check devm_kasprintf() returned value fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense power: supply: axp20x_battery: Remove design from min and max voltage power: supply: axp20x_battery: allow disabling battery charging hwmon: (ntc_thermistor) fix module autoloading mtd: slram: insert break after errors in parsing the map hwmon: (max16065) Fix overflows seen when writing limits clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() reset: berlin: fix OF node leak in probe() error path ARM: versatile: fix OF node leak in CPUs prepare ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ spi: ppc4xx: handle irq_of_parse_and_map() errors block, bfq: don't break merge chain in bfq_split_bfqq() block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: fix possible UAF for bfqq->bic with merge chain net: tipc: avoid possible garbage value Bluetooth: btusb: Fix not handling ZPL/short-transfer can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). sock_map: Add a cond_resched() in sock_hash_free() wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() mac80211: parse radiotap header when selecting Tx queue wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() netfilter: nf_tables: reject expiration higher than timeout netfilter: nf_tables: reject element expiration with no timeout netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire can: j1939: use correct function name in comment mount: handle OOM on mnt_warn_timestamp_expiry fs/namespace: fnic: Switch to use %ptTd mount: warn only once about timestamp range expiration fs: explicitly unregister per-superblock BDIs wifi: ath9k: Remove error checks when creating debugfs entries wifi: ath9k: fix parameter check in ath9k_init_debug() ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() USB: usbtmc: prevent kernel-usb-infoleak USB: serial: pl2303: add device id for Macrosilicon MS3020 bpf: Fix DEVMAP_HASH overflow check on 32-bit arches inet: inet_defrag: prevent sk release while still in use gpio: prevent potential speculation leaks in gpio_device_get_desc() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() ocfs2: add bounds checking to ocfs2_xattr_find_entry() x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency spi: bcm63xx: Enable module autoloading drm: komeda: Fix an issue related to normalized zpos ASoC: tda7419: fix module autoloading wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() net: ftgmac100: Ensure tx descriptor updates are visible microblaze: don't treat zero reserved memory regions as error pinctrl: at91: make it work with current gpiolib ALSA: hda/realtek - FIxed ALC285 headphone no sound ALSA: hda/realtek - Fixed ALC256 headphone no sound ASoC: allow module autoloading for table db1200_pids selftests: breakpoints: Fix a typo of function name soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" spi: nxp-fspi: fix the KASAN report out-of-bounds bug net: dpaa: Pad packets to ETH_ZLEN net: ftgmac100: Enable TX interrupt to avoid TX timeout net/mlx5e: Add missing link modes to ptys2ethtool_map ice: fix accounting for filters shared by multiple VSIs arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma scripts: kconfig: merge_config: config files: add a trailing newline net: phy: vitesse: repair vsc73xx autonegotiation net: ethernet: use ip_hdrlen() instead of bit shift usbnet: ipheth: fix carrier detection in modes 1 and 4 UPSTREAM: unicode: Don't special case ignorable code points ANDROID: 16K: Fixup padding vm_flags bits on VMA splits ANDROID: 16K: Introduce pgsize_migration_inline.h Revert "clocksource/drivers/timer-of: Remove percpu irq related code" Linux 5.4.284 Revert "parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367" cx82310_eth: fix error return code in cx82310_bind() net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket rtmutex: Drop rt_mutex::wait_lock before scheduling drm/i915/fence: Mark debug_fence_free() with __maybe_unused drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused nvmet-tcp: fix kernel crash if commands allocation fails arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry arm64: acpi: Move get_cpu_for_acpi_id() to a header ACPI: processor: Fix memory leaks in error paths of processor_add() ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() nilfs2: protect references to superblock parameters exposed in sysfs nilfs2: replace snprintf in show functions with sysfs_emit tracing: Avoid possible softlockup in tracing_iter_reset() ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance() uprobes: Use kzalloc to allocate xol area clocksource/drivers/timer-of: Remove percpu irq related code clocksource/drivers/imx-tpm: Fix next event not taking effect sometime clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX VMCI: Fix use-after-free when removing resource in vmci_resource_remove() Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc binder: fix UAF caused by offsets overwrite iio: fix scale application in iio_convert_raw_to_processed_unlocked iio: buffer-dmaengine: fix releasing dma channel on error staging: iio: frequency: ad9834: Validate frequency parameter value NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations ata: pata_macio: Use WARN instead of BUG lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() of/irq: Prevent device address out-of-bounds read in interrupt map walk Squashfs: sanity check symbolic link size usbnet: ipheth: race between ipheth_close and error handling Input: uinput - reject requests with unreasonable number of slots HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() PCI: Add missing bridge lock to pci_bus_lock() btrfs: clean up our handling of refs == 0 in snapshot delete btrfs: replace BUG_ON with ASSERT in walk_down_proc() smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() libbpf: Add NULL checks to bpf_object__{prev_map,next_map} hwmon: (w83627ehf) Fix underflows seen when writing limit attributes hwmon: (nct6775-core) Fix underflows seen when writing limit attributes hwmon: (lm95234) Fix underflows seen when writing limit attributes hwmon: (adc128d818) Fix underflows seen when writing limit attributes pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv devres: Initialize an uninitialized struct member um: line: always fill *error_out in setup_one_line() cgroup: Protect css->cgroup write under css_set_lock iommu/vt-d: Handle volatile descriptor status read dm init: Handle minors larger than 255 ASoC: topology: Properly initialize soc_enum values net: dsa: vsc73xx: fix possible subblocks range of CAPT block net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN net: bridge: fdb: convert added_by_external_learn to use bitops net: bridge: fdb: convert added_by_user to bitops net: bridge: fdb: convert is_sticky to bitops net: bridge: fdb: convert is_static to bitops net: bridge: fdb: convert is_local to bitops usbnet: modern method to get random MAC net: usb: don't write directly to netdev->dev_addr drivers/net/usb: Remove all strcpy() uses cx82310_eth: re-enable ethernet mode after router reboot tcp_bpf: fix return value of tcp_bpf_sendmsg() platform/x86: dell-smbios: Fix error path in dell_smbios_init() igb: Fix not clearing TimeSync interrupts for 82580 can: bcm: Remove proc entry when dev is unregistered. pcmcia: Use resource_size function on resource object media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) usb: uas: set host status byte on data completion error wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 udf: Avoid excessive partition lengths netfilter: nf_conncount: fix wrong variable type af_unix: Remove put_pid()/put_cred() in copy_peercred(). irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 smack: unix sockets: fix accept()ed socket label ALSA: hda: Add input value sanity checks to HDMI channel map controls nilfs2: fix state management in error path of log writing function nilfs2: fix missing cleanup on rollforward recovery error sched: sch_cake: fix bulk flow accounting logic for host fairness ila: call nf_unregister_net_hooks() sooner clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API clk: qcom: clk-alpha-pll: Fix the pll post div mask clk: hi6220: use CLK_OF_DECLARE_DRIVER reset: hi6220: Add support for AO reset controller fuse: use unsigned type for getxattr/listxattr size truncation fuse: update stats for pages in dropped aux writeback list mmc: sdhci-of-aspeed: fix module autoloading mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() ata: libata: Fix memory leak for error path in ata_host_alloc() ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object sch/netem: fix use after free in netem_dequeue i2c: Use IS_REACHABLE() for substituting empty ACPI functions udf: Limit file size to 4TB virtio_net: Fix napi_skb_cache_put warning net: set SOCK_RCU_FREE before inserting socket into hashtable block: initialize integrity buffer to zero before writing it to media media: uvcvideo: Enforce alignment of frame and interval drm/amd/display: Skip wbscl_set_scaler_filter if filter is null wifi: cfg80211: make hash table duplicates more survivable smack: tcp: ipv4, fix incorrect labeling usb: typec: ucsi: Fix null pointer dereference in trace usbip: Don't submit special requests twice ionic: fix potential irq name truncation apparmor: fix possible NULL pointer dereference drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device drm/amdgpu: fix mc_data out-of-bounds read warning drm/amdgpu: fix ucode out-of-bounds read warning drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 drm/amd/display: Check gpio_id before used as array index drm/amdgpu: fix overflowed array index read warning drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr net: usb: qmi_wwan: add MeiG Smart SRM825L i2c: Fix conditional for substituting empty ACPI functions drm: panel-orientation-quirks: Add quirk for OrangePi Neo Linux 5.4.283 scsi: aacraid: Fix double-free on probe failure net: dsa: mv8e6xxx: Fix stub function parameters usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() usb: dwc3: st: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: omap: add missing depopulate in probe error path USB: serial: option: add MeiG Smart SRM825L cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller soc: qcom: cmd-db: Map shared memory as WC, not WB nfc: pn533: Add poll mod list filling check nfc: pn533: Add autopoll capability nfc: pn533: Add dev_up/dev_down hooks to phy_ops net: busy-poll: use ktime_get_ns() instead of local_clock() gtp: fix a potential NULL pointer dereference ethtool: check device is present when getting link settings r8152: Factor out OOB link list waits soundwire: stream: fix programming slave ports for non-continous port maps net:rds: Fix possible deadlock in rds_message_put cgroup/cpuset: Prevent UAF in proc_cpuset_show() ata: libata-core: Fix null pointer dereference on error media: uvcvideo: Fix integer overflow calculating timestamp filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages ipc: replace costly bailout check in sysvipc_find_ipc() wifi: mwifiex: duplicate static structs used in driver instances pinctrl: single: fix potential NULL dereference in pcs_get_function() drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc tools: move alignment-related macros to new <linux/align.h> Input: MT - limit max slots Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO ALSA: timer: Relax start tick time check for slave timer elements mmc: dw_mmc: allow biu and ciu clocks to defer cxgb4: add forgotten u64 ivlan cast before shift HID: microsoft: Add rumble support to latest xbox controllers HID: wacom: Defer calculation of resolution until resolution_code is known Bluetooth: MGMT: Add error handling to pair_device() mmc: mmc_test: Fix NULL dereference on allocation failure drm/msm/dpu: don't play tricks with debug macros drm/msm: use drm_debug_enabled() to check for debug categories net: xilinx: axienet: Fix dangling multicast addresses net: xilinx: axienet: Always disable promiscuous mode ipv6: prevent UAF in ip6_send_skb() netem: fix return value if duplicate enqueue fails net: dsa: mv88e6xxx: Fix out-of-bound access net: dsa: mv88e6xxx: replace ATU violation prints with trace points net: dsa: mv88e6xxx: read FID when handling ATU violations net: dsa: mv88e6xxx: global1_atu: Add helper for get next net: dsa: mv88e6xxx: global2: Expose ATU stats register netfilter: nft_counter: Synchronize nft_counter_reset() against reader. kcm: Serialise kcm_sendmsg() for the same socket. tc-testing: don't access non-existent variable on exception Bluetooth: hci_core: Fix LE quote calculation Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: Make use of __check_timeout on hci_sched_le dm suspend: return -ERESTARTSYS instead of -EINTR dm: do not use waitqueue for request-based DM dm mpath: pass IO start time to path selector media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) block: use "unsigned long" for blk_validate_block_size(). gtp: pull network headers in gtp_dev_xmit() hrtimer: Prevent queuing of hrtimer without a function callback nvmet-rdma: fix possible bad dereference when freeing rsps ext4: set the type of max_zeroout to unsigned int to avoid overflow irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc usb: dwc3: core: Skip setting event buffers for host only controllers s390/iucv: fix receive buffer virtual vs physical address confusion openrisc: Call setup_memory() earlier in the init sequence NFS: avoid infinite loop in pnfs_update_layout. nvmet-tcp: do not continue for invalid icreq Bluetooth: bnep: Fix out-of-bound access nvme: clear caller pointer on identify failure usb: gadget: fsl: Increase size of name buffer for endpoints f2fs: fix to do sanity check in update_sit_entry btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: change BUG_ON to assertion when checking for delayed_node root powerpc/boot: Only free if realloc() succeeds powerpc/boot: Handle allocation failure in simple_realloc() parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 x86: Increase brk randomness entropy for 64-bit systems md: clean up invalid BUG_ON in md_ioctl virtiofs: forbid newlines in tags drm/lima: set gp bus_stop bit before hard reset net/sun3_82586: Avoid reading past buffer in debug output scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() fs: binfmt_elf_efpic: don't use missing interpreter's properties media: pci: cx23885: check cx23885_vdev_init() return quota: Remove BUG_ON from dqget() ext4: do not trim the group with corrupted block bitmap nvmet-trace: avoid dereferencing pointer too early powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock wifi: iwlwifi: abort scan when rfkill on but device enabled gfs2: setattr_chown: Add missing initialization scsi: spi: Fix sshdr use binfmt_misc: cleanup on filesystem umount staging: ks7010: disable bh on tx_dev_lock media: radio-isa: use dev_name to fill in bus_info i2c: riic: avoid potential division by zero wifi: cw1200: Avoid processing an invalid TIM IE ssb: Fix division by zero issue in ssb_calc_clock_rate ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 net: hns3: fix a deadlock problem when config TC during resetting net: dsa: vsc73xx: pass value in phy_write operation net: axienet: Fix register defines comment description net: axienet: Autodetect 64-bit DMA capability net: axienet: Upgrade descriptors to hold 64-bit addresses net: axienet: Wrap DMA pointer writes to prepare for 64 bit net: axienet: Drop MDIO interrupt registers from ethtools dump net: axienet: Check for DMA mapping errors net: axienet: Factor out TX descriptor chain cleanup net: axienet: Improve DMA error handling net: axienet: Fix DMA descriptor cleanup path atm: idt77252: prevent use after free in dequeue_rx() net/mlx5e: Correctly report errors for ethtool rx flows s390/uv: Panic for set and remove shared access UVC errors btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() s390/cio: rename bitmap_size() -> idset_bitmap_size() overflow: Implement size_t saturating arithmetic helpers overflow.h: Add flex_array_size() helper memcg_write_event_control(): fix a user-triggerable oops drm/amdgpu: Actually check flags for all context ops. selinux: fix potential counting error in avc_add_xperms_decision() fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE bitmap: introduce generic optimized bitmap_size() vfs: Don't evict inode under the inode lru traversing context dm persistent data: fix memory allocation failure dm resume: don't return EINVAL when signalled arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE s390/dasd: fix error recovery leading to data corruption on ESE devices xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration ALSA: usb-audio: Support Yamaha P-125 quirk entry fuse: Initialize beyond-EOF page contents before setting uptodate Revert "genirq: Allow the PM device to originate from irq domain" Revert "genirq: Allow irq_chip registration functions to take a const irq_chip" Revert "irqchip/imx-irqsteer: Constify irq_chip struct" Revert "irqchip/imx-irqsteer: Add runtime PM support" Revert "irqchip/imx-irqsteer: Handle runtime power management correctly" Linux 5.4.282 media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode nvme/pci: Add APST quirk for Lenovo N60z laptop exec: Fix ToCToU between perm check and set-uid/gid usage media: uvcvideo: Use entity get_cur in uvc_ctrl_set arm64: cpufeature: Fix the visibility of compat hwcaps drm/i915/gem: Fix Virtual Memory mapping boundaries calculation netfilter: nf_tables: prefer nft_chain_validate netfilter: nf_tables: use timestamp to check for set element timeout netfilter: nf_tables: set element extended ACK reporting support kbuild: Fix '-S -c' in x86 stack protector scripts Fix gcc 4.9 build issue in 5.4.y drm/mgag200: Set DDC timeout in milliseconds drm/bridge: analogix_dp: properly handle zero sized AUX transactions x86/mtrr: Check if fixed MTRRs exist before saving them tracing: Fix overflow in get_free_elt() power: supply: axp288_charger: Round constant_charge_voltage writes down power: supply: axp288_charger: Fix constant_charge_voltage writes genirq/irqdesc: Honor caller provided affinity in alloc_desc() serial: core: check uartclk for zero to avoid divide by zero scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES scsi: mpt3sas: Remove scsi_dma_map() error messages ntp: Safeguard against time_constant overflow driver core: Fix uevent_show() vs driver detach race ntp: Clamp maxerror and esterror to operating range tick/broadcast: Move per CPU pointer access into the atomic section scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic usb: gadget: core: Check for unset descriptor USB: serial: debug: do not echo input by default usb: vhci-hcd: Do not drop references before new references are gained ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list ALSA: line6: Fix racy access to midibuf drm/client: fix null pointer dereference in drm_client_modeset_probe spi: spi-fsl-lpspi: Fix scldiv calculation spi: fsl-lpspi: remove unneeded array bpf: kprobe: remove unused declaring of bpf_kprobe_override i2c: smbus: Send alert notifications to all devices if source not found i2c: smbus: Improve handling of stuck alerts i2c: smbus: Don't filter out duplicate alerts arm64: errata: Expand speculative SSBS workaround (again) arm64: cputype: Add Cortex-A725 definitions arm64: cputype: Add Cortex-X1C definitions arm64: errata: Expand speculative SSBS workaround arm64: errata: Unify speculative SSBS errata logic arm64: cputype: Add Cortex-X925 definitions arm64: cputype: Add Cortex-A720 definitions arm64: cputype: Add Cortex-X3 definitions arm64: errata: Add workaround for Arm errata 3194386 and 3312417 arm64: cputype: Add Neoverse-V3 definitions arm64: cputype: Add Cortex-X4 definitions arm64: Add Neoverse-V2 part arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space ext4: fix wrong unit use in ext4_mb_find_by_goal SUNRPC: Fix a race to wake a sync task s390/sclp: Prevent release of buffer in I/O jbd2: avoid memleak in jbd2_journal_write_metadata_buffer media: uvcvideo: Fix the bandwdith quirk on USB 3.x media: uvcvideo: Ignore empty TS packets drm/amdgpu: Fix the null pointer dereference to ras_manager btrfs: fix bitmap leak when loading free space cache on duplicate entry wifi: nl80211: don't give key data to userspace udf: prevent integer overflow in udf_bitmap_free_blocks() PCI: Add Edimax Vendor ID to pci_ids.h selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT ACPI: SBS: manage alarm sysfs attribute through psy core ACPI: battery: create alarm sysfs attribute atomically clocksource/drivers/sh_cmt: Address race condition for clock events md/raid5: avoid BUG_ON() while continue reshape after reassembling net: fec: Stop PPS on driver remove Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() net: linkwatch: use system_unbound_wq net: usb: qmi_wwan: fix memory leak for not ip packets sctp: Fix null-ptr-deref in reuseport_add_sock(). sctp: move hlist_node and hashent out of sctp_ep_common x86/mm: Fix pti_clone_pgtable() alignment assumption irqchip/mbigen: Fix mbigen node address layout genirq: Allow irq_chip registration functions to take a const irq_chip netfilter: ipset: Add list flush to cancel_gc net: usb: sr9700: fix uninitialized variable use in sr_mdio_read ALSA: usb-audio: Correct surround channels in UAC1 channel map protect the fetch of ->fd[fd] in do_dup2() from mispredictions HID: wacom: Modify pen IDs ipv6: fix ndisc_is_useropt() handling for PIO net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys net/iucv: fix use after free in iucv_sock_close() drm/vmwgfx: Fix overlay when using Screen Targets drm/nouveau: prime: fix refcount underflow remoteproc: imx_rproc: Skip over memory region when node value is NULL remoteproc: imx_rproc: Fix ignoring mapping vdev regions remoteproc: imx_rproc: ignore mapping vdev regions irqchip/imx-irqsteer: Handle runtime power management correctly irqchip/imx-irqsteer: Add runtime PM support irqchip/imx-irqsteer: Constify irq_chip struct genirq: Allow the PM device to originate from irq domain devres: Fix memory leakage caused by driver API devm_free_percpu() driver core: Cast to (void *) with __force for __percpu pointer dev/parport: fix the array out-of-bounds risk parport: Standardize use of printmode parport: Convert printk(KERN_<LEVEL> to pr_<level>( PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio PCI: rockchip: Make 'ep-gpios' DT property optional mm: avoid overflows in dirty throttling logic nvme-pci: add missing condition check for existence of mapped data ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header ASoC: Intel: Convert to new X86 CPU match macros powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() apparmor: Fix null pointer deref when receiving skb during sock creation mISDN: Fix a use after free in hfcmulti_tx() bpf: Fix a segment issue when downgrading gso_size net: nexthop: Initialize all fields in dumped nexthops tipc: Return non-zero value from tipc_udp_addr2str() on error net: bonding: correctly annotate RCU in bond_should_notify_peers() ipv4: Fix incorrect source address in Record Route option MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later dma: fix call order in dmam_free_coherent libbpf: Fix no-args func prototype BTF dumping syntax um: time-travel: fix time-travel-start option jfs: Fix array-index-out-of-bounds in diFree kdb: Use the passed prompt in kdb_position_cursor() kdb: address -Wformat-security warnings nilfs2: handle inconsistent state in nilfs_btnode_create_block() Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait drm/panfrost: Mark simple_ondemand governor as softdep rbd: don't assume rbd_is_lock_owner() for exclusive mappings selftests/sigaltstack: Fix ppc64 GCC build RDMA/iwcm: Fix a use-after-free related to destroying CM IDs platform: mips: cpu_hwmon: Disable driver on unsupported hardware watchdog/perf: properly initialize the turbo mode timestamp and rearm counter rtc: isl1208: Fix return value of nvmem callbacks perf/x86/intel/pt: Fix a topa_entry base address calculation perf/x86/intel/pt: Fix topa_entry base length scsi: qla2xxx: validate nvme_local_port correctly scsi: qla2xxx: Complete command early within lock scsi: qla2xxx: Fix for possible memory corruption scsi: qla2xxx: During vport delete send async logout explicitly rtc: cmos: Fix return value of nvmem callbacks kobject_uevent: Fix OOB access within zap_modalias_env() decompress_bunzip2: fix rare decompression failure ubi: eba: properly rollback inside self_check_eba clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use f2fs: fix to don't dirty inode for readonly filesystem scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds binder: fix hang of unregistered readers PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN hwrng: amd - Convert PCIBIOS_* return codes to errnos tools/memory-model: Fix bug in lock.cat leds: ss4200: Convert PCIBIOS_* return codes to errnos wifi: mwifiex: Fix interface type change ext4: make sure the first directory block is not a hole ext4: check dot and dotdot of dx_root before making dir indexed m68k: amiga: Turn off Warp1260 interrupts during boot udf: Avoid using corrupted block bitmap buffer drm/amd/display: Check for NULL pointer drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() media: venus: fix use after free in vdec_close char: tpm: Fix possible memory leak in tpm_bios_measurements_open() ipv6: take care of scope when choosing the src addr af_packet: Handle outgoing VLAN packets without hardware offloading net: netconsole: Disable target before netpoll cleanup tick/broadcast: Make takeover of broadcast hrtimer reliable rtc: interface: Add RTC offset to alarm after fix-up nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro fs/nilfs2: remove some unused macros to tame gcc pinctrl: freescale: mxs: Fix refcount of child pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails pinctrl: ti: ti-iodelay: Drop if block with always false condition pinctrl: single: fix possible memory leak when pinctrl_enable() fails pinctrl: core: fix possible memory leak when pinctrl_enable() fails netfilter: ctnetlink: use helper function to calculate expect ID bnxt_re: Fix imm_data endianness macintosh/therm_windtunnel: fix module unload. powerpc/xmon: Fix disassembly CPU feature checks MIPS: Octeron: remove source file executable bit Input: elan_i2c - do not leave interrupt disabled on suspend failure RDMA/device: Return error earlier if port in not valid mtd: make mtd_test.c a separate module ASoC: max98088: Check for clk_prepare_enable() error RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs RDMA/mlx4: Fix truncated output warning in alias_GUID.c RDMA/mlx4: Fix truncated output warning in mad.c Input: qt1050 - handle CHIP_ID reading error PCI: Fix resource double counting on remove & rescan SUNRPC: Fixup gss_status tracepoint error output sparc64: Fix incorrect function signature and add prototype for prom_cif_init ext4: avoid writing unitialized memory to disk in EA inodes SUNRPC: avoid soft lockup when transmitting UDP to reachable server. mfd: omap-usb-tll: Use struct_size to allocate tll drm/qxl: Add check for drm_cvt_mode drm/etnaviv: fix DMA direction handling for cached RW buffers perf report: Fix condition in sort__sym_cmp() leds: trigger: Unregister sysfs attributes before calling deactivate() media: renesas: vsp1: Store RPF partition configuration per RPF instance media: renesas: vsp1: Fix _irqsave and _irq mix media: uvcvideo: Override default flags media: uvcvideo: Allow entity-defined get_info and get_cur saa7134: Unchecked i2c_transfer function result fixed media: imon: Fix race getting ictx->lock media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() USB: move snd_usb_pipe_sanity_check into the USB core selftests: forwarding: devlink_lib: Wait for udev events after reloading bna: adjust 'name' buf size of bna_tcb and bna_ccb structures wifi: virt_wifi: don't use strlen() in const context gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey wifi: virt_wifi: avoid reporting connection success with wrong SSID qed: Improve the stack space of filter_config() perf: Prevent passing zero nr_pages to rb_alloc_aux() perf: Fix perf_aux_size() for greater-than 32-bit size perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation netfilter: nf_tables: rise cap on SELinux secmark context ipvs: Avoid unnecessary calls to skb_is_gso_sctp net: fec: Fix FEC_ECR_EN1588 being cleared on link-down net: fec: Refactor: #define magic constants wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() mlxsw: spectrum_acl_erp: Fix object nesting warning lib: objagg: Fix general protection fault selftests/bpf: Check length of recv in test_sockmap net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined net/smc: Allow SMC-D 1MB DMB allocations wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device firmware: turris-mox-rwtm: Initialize completion before mailbox firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout() m68k: cmpxchg: Fix return value for default case in __arch_xchg() x86/xen: Convert comma to semicolon m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages arm64: dts: amlogic: gx: correct hdmi clocks arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity ARM: dts: imx6qdl-kontron-samx6i: fix board reset ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node arm64: dts: rockchip: Increase VOP clk rate on RK3328 arm64: dts: qcom: msm8996: specify UFS core_clk frequencies arm64: dts: qcom: sdm845: add power-domain to UFS PHY hwmon: (max6697) Fix swapped temp{1,8} critical alarms hwmon: (max6697) Fix underflow when writing limit attributes pwm: stm32: Always do lazy disabling hwmon: (adt7475) Fix default duty on fan is disabled x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos x86/pci/xen: Fix PCIBIOS_* return code handling x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling x86/of: Return consistent error type from x86_of_pci_irq_enable() hfsplus: fix to avoid false alarm of circular locking platform/chrome: cros_ec_debugfs: fix wrong EC message version EDAC, i10nm: make skx_common.o a separate module EDAC/skx_common: Add new ADXL components for 2-level memory EDAC, skx: Retrieve and print retry_rd_err_log registers EDAC, skx_common: Refactor so that we initialize "dev" in result of adxl decode. Conflicts: Documentation/devicetree/bindings Documentation/devicetree/bindings/vendor-prefixes.yaml drivers/clk/qcom/clk-rpmh.c drivers/rpmsg/qcom_glink_native.c drivers/soc/qcom/socinfo.c drivers/usb/dwc3/core.c fs/userfaultfd.c mm/madvise.c net/qrtr/qrtr.c Change-Id: I5064cb8c11d2c104b445035a948867f10c88da1b Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>
2026-10-05 19:31:57 -04:00 · 2025-01-27 15:58:03 +05:30 · 2025-01-27 15:58:03 +05:30 · f2c008f940
commit f2c008f940
parent eeafe4140a 4c8fb32758
1215 changed files with 58700 additions and 53066 deletions
--- a/.gitignore
+++ b/.gitignore
@ -120,7 +120,6 @@ GTAGS
 # id-utils files
 ID

-*.orig
 *~
 \#*#

--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@ -125,6 +125,17 @@ Description:
 		will be present in sysfs.  Writing 1 to this file
 		will perform reset.

+What:		/sys/bus/pci/devices/.../reset_subordinate
+Date:		October 2024
+Contact:	linux-pci@vger.kernel.org
+Description:
+		This is visible only for bridge devices. If you want to reset
+		all devices attached through the subordinate bus of a specific
+		bridge device, writing 1 to this will try to do it.  This will
+		affect all devices attached to the system through this bridge
+		similiar to writing 1 to their individual "reset" file, so use
+		with caution.
+
 What:		/sys/bus/pci/devices/.../vpd
 Date:		February 2008
 Contact:	Ben Hutchings <bwh@kernel.org>
--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@ -518,7 +518,7 @@ at module load time (for a module) with::
 	[dbg_probe=1]

 The addresses are normal I2C addresses.  The adapter is the string
-name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name.
+name of the adapter, as shown in /sys/bus/i2c/devices/i2c-<n>/name.
 It is *NOT* i2c-<n> itself.  Also, the comparison is done ignoring
 spaces, so if the name is "This is an I2C chip" you can say
 adapter_name=ThisisanI2cchip.  This is because it's hard to pass in
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@ -3827,6 +3827,16 @@
 	printk.time=	Show timing data prefixed to each printk message line
 			Format: <bool>  (1/Y/y=enable, 0/N/n=disable)

+	proc_mem.force_override= [KNL]
+			Format: {always | ptrace | never}
+			Traditionally /proc/pid/mem allows memory permissions to be
+			overridden without restrictions. This option may be set to
+			restrict that. Can be one of:
+			- 'always': traditional behavior always allows mem overrides.
+			- 'ptrace': only allow mem overrides for active ptracers.
+			- 'never':  never allow mem overrides.
+			If not specified, default is the CONFIG_PROC_MEM_* choice.
+
 	processor.max_cstate=	[HW,ACPI]
 			Limit processor to maximum C-state
 			max_cstate=9 overrides any DMI blacklist limit.
--- a/Documentation/arm64/cpu-feature-registers.rst
+++ b/Documentation/arm64/cpu-feature-registers.rst
@ -92,7 +92,7 @@ operation if the source belongs to the supported system register space.

 The infrastructure emulates only the following system register space::

-	Op0=3, Op1=0, CRn=0, CRm=0,4,5,6,7
+	Op0=3, Op1=0, CRn=0, CRm=0,2,3,4,5,6,7

 (See Table C5-6 'System instruction encodings for non-Debug System
 register accesses' in ARMv8 ARM DDI 0487A.h, for the list of
@ -167,6 +167,42 @@ infrastructure:
     | EL0                          | [3-0]   |    n    |
     +------------------------------+---------+---------+

+  10) MVFR0_EL1 - AArch32 Media and VFP Feature Register 0
+
+     +------------------------------+---------+---------+
+     | Name                         |  bits   | visible |
+     +------------------------------+---------+---------+
+     | FPDP                         | [11-8]  |    y    |
+     +------------------------------+---------+---------+
+
+  11) MVFR1_EL1 - AArch32 Media and VFP Feature Register 1
+
+     +------------------------------+---------+---------+
+     | Name                         |  bits   | visible |
+     +------------------------------+---------+---------+
+     | SIMDFMAC                     | [31-28] |    y    |
+     +------------------------------+---------+---------+
+     | SIMDSP                       | [19-16] |    y    |
+     +------------------------------+---------+---------+
+     | SIMDInt                      | [15-12] |    y    |
+     +------------------------------+---------+---------+
+     | SIMDLS                       | [11-8]  |    y    |
+     +------------------------------+---------+---------+
+
+  12) ID_ISAR5_EL1 - AArch32 Instruction Set Attribute Register 5
+
+     +------------------------------+---------+---------+
+     | Name                         |  bits   | visible |
+     +------------------------------+---------+---------+
+     | CRC32                        | [19-16] |    y    |
+     +------------------------------+---------+---------+
+     | SHA2                         | [15-12] |    y    |
+     +------------------------------+---------+---------+
+     | SHA1                         | [11-8]  |    y    |
+     +------------------------------+---------+---------+
+     | AES                          | [7-4]   |    y    |
+     +------------------------------+---------+---------+
+

  3) MIDR_EL1 - Main ID Register

--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@ -88,12 +88,52 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A76      | #1463225        | ARM64_ERRATUM_1463225       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A76      | #3324349        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A77      | #3324348        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A78      | #3324344        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A78C     | #3324346,3324347| ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A710     | #3324338        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A715     | #3456084        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A720     | #3456091        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A725     | #3456106        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X1       | #3324344        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X1C      | #3324346        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X2       | #3324338        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X3       | #3324335        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X4       | #3194386        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X925     | #3324334        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1188873,1418040| ARM64_ERRATUM_1418040       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1349291        | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1542419        | ARM64_ERRATUM_1542419       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N1     | #3324349        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N2     | #3324339        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N3     | #3456111        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V1     | #3324341        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V2     | #3324336        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V3     | #3312417        | ARM64_ERRATUM_3194386       |
+----------------+-----------------+-----------------+-----------------------------+
 | ARM            | MMU-500         | #841119,826419  | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
--- a/Documentation/process/deprecated.rst
+++ b/Documentation/process/deprecated.rst
@ -48,6 +48,9 @@ Instead, the 2-factor form of the allocator should be used::

 	foo = kmalloc_array(count, size, GFP_KERNEL);

+Specifically, kmalloc() can be replaced with kmalloc_array(), and
+kzalloc() can be replaced with kcalloc().
+
 If no 2-factor form is available, the saturate-on-overflow helpers should
 be used::

@ -63,9 +66,20 @@ Instead, use the helper::

 	header = kzalloc(struct_size(header, item, count), GFP_KERNEL);

-See :c:func:`array_size`, :c:func:`array3_size`, and :c:func:`struct_size`,
-for more details as well as the related :c:func:`check_add_overflow` and
-:c:func:`check_mul_overflow` family of functions.
+For other calculations, please compose the use of the size_mul(),
+size_add(), and size_sub() helpers. For example, in the case of::
+
+	foo = krealloc(current_size + chunk_size * (count - 3), GFP_KERNEL);
+
+Instead, use the helpers::
+
+	foo = krealloc(size_add(current_size,
+				size_mul(chunk_size,
+					 size_sub(count, 3))), GFP_KERNEL);
+
+For more details, also see array3_size() and flex_array_size(),
+as well as the related check_mul_overflow(), check_add_overflow(),
+check_sub_overflow(), and check_shl_overflow() family of functions.

 simple_strtol(), simple_strtoll(), simple_strtoul(), simple_strtoull()
 ----------------------------------------------------------------------
--- a/2
+++ b/2
@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 281
+SUBLEVEL = 289
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus

--- a/android/GKI_VERSION
+++ b/android/GKI_VERSION
@ -1 +1 @@
-LTS_5.4.281_d62984adb112
+LTS_5.4.289_4c8fb3275889
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
--- a/android/abi_gki_aarch64.xml.allowed_breaks
+++ b/android/abi_gki_aarch64.xml.allowed_breaks
@ -0,0 +1,98 @@
+# How to use this file: http://go/approve-abi-break
+# ABI freeze commit: ae37e86392ba5e33dc178c5ca16096029a2a3fe1
+
+11 function symbol(s) removed
+  'struct phy_device* of_phy_find_device(struct device_node*)'
+  'int reset_control_status(struct reset_control*)'
+  'void rproc_add_carveout(struct rproc*, struct rproc_mem_entry*)'
+  'void* rproc_da_to_va(struct rproc*, u64, int)'
+  'struct resource_table* rproc_elf_find_loaded_rsc_table(struct rproc*, const struct firmware*)'
+  'int rproc_elf_load_rsc_table(struct rproc*, const struct firmware*)'
+  'int rproc_elf_load_segments(struct rproc*, const struct firmware*)'
+  'int rproc_elf_sanity_check(struct rproc*, const struct firmware*)'
+  'struct rproc_mem_entry* rproc_mem_entry_init(struct device*, void*, dma_addr_t, int, u32, int(*)(struct rproc*, struct rproc_mem_entry*), int(*)(struct rproc*, struct rproc_mem_entry*), const char*, ...)'
+  'struct rproc_mem_entry* rproc_of_resm_mem_entry_init(struct device*, u32, int, u32, const char*, ...)'
+  'irqreturn_t rproc_vq_interrupt(struct rproc*, int)'
+
+type 'struct elevator_mq_ops' changed
+  member changed from 'bool(* bio_merge)(struct blk_mq_hw_ctx*, struct bio*, unsigned int)' to 'bool(* bio_merge)(struct request_queue*, struct bio*, unsigned int)'
+    type changed from 'bool(*)(struct blk_mq_hw_ctx*, struct bio*, unsigned int)' to 'bool(*)(struct request_queue*, struct bio*, unsigned int)'
+      pointed-to type changed from 'bool(struct blk_mq_hw_ctx*, struct bio*, unsigned int)' to 'bool(struct request_queue*, struct bio*, unsigned int)'
+        parameter 1 type changed from 'struct blk_mq_hw_ctx*' to 'struct request_queue*'
+          pointed-to type changed from 'struct blk_mq_hw_ctx' to 'struct request_queue'
+
+type 'struct usbnet' changed
+  member 'u64 android_kabi_reserved1' was removed
+  member 'union { struct { u32 rx_speed; u32 tx_speed; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
+
+type 'struct inet_connection_sock' changed
+  member changed from 'struct { int enabled; int search_high; int search_low; int probe_size; u32 probe_timestamp; } icsk_mtup' to 'struct { int search_high; int search_low; int enabled; int probe_size; u32 probe_timestamp; } icsk_mtup'
+    type changed from 'struct { int enabled; int search_high; int search_low; int probe_size; u32 probe_timestamp; }' to 'struct { int search_high; int search_low; int enabled; int probe_size; u32 probe_timestamp; }'
+      byte size changed from 20 to 16
+      2 members ('int search_high' .. 'int search_low') changed
+        offset changed by -32
+      member 'int probe_size' changed
+        offset changed by -95
+      member 'u32 probe_timestamp' changed
+        offset changed by -32
+  member 'u32 icsk_probes_tstamp' was added
+
+type 'struct usbnet' changed
+  member changed from 'union { struct { u32 rx_speed; u32 tx_speed; }; struct { u64 android_kabi_reserved1; } __UNIQUE_ID_android_kabi_hide213; union { }; }' to 'union { struct { u32 rx_speed; u32 tx_speed; }; struct { u64 android_kabi_reserved1; }; union { }; }'
+    type changed from 'union { struct { u32 rx_speed; u32 tx_speed; }; struct { u64 android_kabi_reserved1; } __UNIQUE_ID_android_kabi_hide213; union { }; }' to 'union { struct { u32 rx_speed; u32 tx_speed; }; struct { u64 android_kabi_reserved1; }; union { }; }'
+      member 'struct { u64 android_kabi_reserved1; } __UNIQUE_ID_android_kabi_hide213' was removed
+      member 'struct { u64 android_kabi_reserved1; }' was added
+
+type 'struct sock' changed
+  member 'u64 android_kabi_reserved1' was removed
+  member 'union { spinlock_t sk_peer_lock; struct { u64 android_kabi_reserved1; }; union { }; }' was added
+
+type 'struct fib_rules_ops' changed
+  member changed from 'bool(* suppress)(struct fib_rule*, struct fib_lookup_arg*)' to 'bool(* suppress)(struct fib_rule*, int, struct fib_lookup_arg*)'
+    type changed from 'bool(*)(struct fib_rule*, struct fib_lookup_arg*)' to 'bool(*)(struct fib_rule*, int, struct fib_lookup_arg*)'
+      pointed-to type changed from 'bool(struct fib_rule*, struct fib_lookup_arg*)' to 'bool(struct fib_rule*, int, struct fib_lookup_arg*)'
+        parameter 2 type changed from 'struct fib_lookup_arg*' to 'int'
+        parameter 3 of type 'struct fib_lookup_arg*' was added
+
+type 'struct snd_pcm_runtime' changed
+  byte size changed from 760 to 800
+  member 'struct mutex buffer_mutex' was added
+  member 'atomic_t buffer_accessing' was added
+
+type 'struct snd_pcm_runtime' changed
+  byte size changed from 792 to 800
+  member 'atomic_t buffer_accessing' was added
+
+function symbol changed from 'int hex_to_bin(char)' to 'int hex_to_bin(unsigned char)'
+  type changed from 'int(char)' to 'int(unsigned char)'
+    parameter 1 type changed from 'char' to 'unsigned char'
+
+type 'struct tcp_sock' changed
+  member 'u8 unused' was removed
+  member 'u8 fastopen_client_fail' was added
+  member 'u32 max_packets_seq' was removed
+  member 'u32 cwnd_usage_seq' was added
+
+type 'struct sk_buff' changed
+  member 'u64 android_kabi_reserved1' was removed
+  member 'union { struct { __u8 scm_io_uring; __u8 android_kabi_reserved1_padding1; __u16 android_kabi_reserved1_padding2; __u32 android_kabi_reserved1_padding3; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
+
+type 'struct anon_vma' changed
+  byte size changed from 88 to 104
+  member 'unsigned long int num_children' was added
+  member 'unsigned long int num_active_vmas' was added
+
+function symbol changed from 'struct irq_domain* __irq_domain_add(struct fwnode_handle*, int, irq_hw_number_t, int, const struct irq_domain_ops*, void*)' to 'struct irq_domain* __irq_domain_add(struct fwnode_handle*, unsigned int, irq_hw_number_t, int, const struct irq_domain_ops*, void*)'
+  type changed from 'struct irq_domain*(struct fwnode_handle*, int, irq_hw_number_t, int, const struct irq_domain_ops*, void*)' to 'struct irq_domain*(struct fwnode_handle*, unsigned int, irq_hw_number_t, int, const struct irq_domain_ops*, void*)'
+    parameter 2 type changed from 'int' to 'unsigned int'
+
+type 'struct perf_event' changed
+  member 'unsigned int group_generation' was added
+
+type 'struct usb_role_switch' changed
+  member 'bool registered' was added
+
+type 'struct tcp_sock' changed
+  member 'u8 unused' was removed
+  member 'u8 fastopen_client_fail' was added
+
--- a/android/abi_gki_aarch64_4c8fb3275889.xml
+++ b/android/abi_gki_aarch64_4c8fb3275889.xml
--- a/android/abi_gki_aarch64_galaxy
+++ b/android/abi_gki_aarch64_galaxy
@ -2604,6 +2604,7 @@
  usb_disabled
  usb_driver_claim_interface
  usb_driver_release_interface
+  usb_driver_set_configuration
  usb_enable_autosuspend
  usb_enable_intel_xhci_ports
  usb_ep_alloc_request
--- a/android/abi_gki_aarch64_trimble
+++ b/android/abi_gki_aarch64_trimble
@ -0,0 +1,6 @@
+[abi_symbol_list]
+# required by cdc_mbim.ko
+  in6_dev_finish_destroy
+# required by qmi_wwan.ko
+  netdev_stats_to_stats64
+  netdev_upper_get_next_dev_rcu
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@ -6,7 +6,7 @@
 KBUILD_DEFCONFIG := nsim_hs_defconfig

 ifeq ($(CROSS_COMPILE),)
-CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-)
+CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux- arc-linux-gnu-)
 endif

 cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
--- a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts
@ -77,7 +77,7 @@
 };

 &hdmi {
-	hpd-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
 	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
 	status = "okay";
 };
--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
@ -259,8 +259,20 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
-	phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+	phy-connection-type = "rgmii-id";
+	phy-handle = <&ethphy>;
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		ethphy: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+			reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <1000>;
+		};
+	};
 };

 &i2c_intern {
@ -500,7 +512,7 @@
 			MX6QDL_PAD_ENET_MDIO__ENET_MDIO       0x1b0b0
 			MX6QDL_PAD_ENET_MDC__ENET_MDC         0x1b0b0
 			MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK  0x1b0b0
-			MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25    0x1b0b0 /* RST_GBE0_PHY# */
+			MX6QDL_PAD_NANDF_D1__GPIO2_IO01       0x1b0b0 /* RST_GBE0_PHY# */
 		>;
 	};

@ -713,7 +725,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_pcie>;
 	wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>;
-	reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>;
+	reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>;
 };

 /* LCD_BKLT_PWM */
@ -801,5 +813,6 @@
 	/* CPLD is feeded by watchdog (hardwired) */
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_wdog1>;
+	fsl,ext-reset-output;
 	status = "okay";
 };
--- a/arch/arm/boot/dts/imx7d-zii-rmu2.dts
+++ b/arch/arm/boot/dts/imx7d-zii-rmu2.dts
@ -350,7 +350,7 @@

 &iomuxc_lpsr {
 	pinctrl_enet1_phy_interrupt: enet1phyinterruptgrp {
-		fsl,phy = <
+		fsl,pins = <
 			MX7D_PAD_LPSR_GPIO1_IO02__GPIO1_IO2	0x08
 		>;
 	};
--- a/arch/arm/boot/dts/rk3036-kylin.dts
+++ b/arch/arm/boot/dts/rk3036-kylin.dts
@ -300,8 +300,8 @@
 &i2c2 {
 	status = "okay";

-	rt5616: rt5616@1b {
-		compatible = "rt5616";
+	rt5616: audio-codec@1b {
+		compatible = "realtek,rt5616";
 		reg = <0x1b>;
 		clocks = <&cru SCLK_I2S_OUT>;
 		clock-names = "mclk";
--- a/arch/arm/boot/dts/rk3036.dtsi
+++ b/arch/arm/boot/dts/rk3036.dtsi
@ -317,12 +317,13 @@
 		};
 	};

-	acodec: acodec-ana@20030000 {
-		compatible = "rk3036-codec";
+	acodec: audio-codec@20030000 {
+		compatible = "rockchip,rk3036-codec";
 		reg = <0x20030000 0x4000>;
-		rockchip,grf = <&grf>;
 		clock-names = "acodec_pclk";
 		clocks = <&cru PCLK_ACODEC>;
+		rockchip,grf = <&grf>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 	};

@ -332,7 +333,6 @@
 		interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cru  PCLK_HDMI>;
 		clock-names = "pclk";
-		rockchip,grf = <&grf>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&hdmi_ctl>;
 		status = "disabled";
@ -489,11 +489,11 @@
 	};

 	spi: spi@20074000 {
-		compatible = "rockchip,rockchip-spi";
+		compatible = "rockchip,rk3036-spi";
 		reg = <0x20074000 0x1000>;
 		interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
-		clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>;
-		clock-names = "apb-pclk","spi_pclk";
+		clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>;
+		clock-names = "spiclk", "apb_pclk";
 		dmas = <&pdma 8>, <&pdma 9>;
 		dma-names = "tx", "rx";
 		pinctrl-names = "default";
--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
@ -280,8 +280,8 @@

 			reg_dcdc5: dcdc5 {
 				regulator-always-on;
-				regulator-min-microvolt = <1425000>;
-				regulator-max-microvolt = <1575000>;
+				regulator-min-microvolt = <1450000>;
+				regulator-max-microvolt = <1550000>;
 				regulator-name = "vcc-dram";
 			};

--- a/arch/arm/mach-realview/platsmp-dt.c
+++ b/arch/arm/mach-realview/platsmp-dt.c
@ -66,6 +66,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)
 		return;
 	}
 	map = syscon_node_to_regmap(np);
+	of_node_put(np);
 	if (IS_ERR(map)) {
 		pr_err("PLATSMP: No syscon regmap\n");
 		return;
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@ -611,6 +611,46 @@ config ARM64_ERRATUM_1742098

 	  If unsure, say Y.

+config ARM64_ERRATUM_3194386
+	bool "Cortex-*/Neoverse-*: workaround for MSR SSBS not self-synchronizing"
+	default y
+	help
+	  This option adds the workaround for the following errata:
+
+	  * ARM Cortex-A76 erratum 3324349
+	  * ARM Cortex-A77 erratum 3324348
+	  * ARM Cortex-A78 erratum 3324344
+	  * ARM Cortex-A78C erratum 3324346
+	  * ARM Cortex-A78C erratum 3324347
+	  * ARM Cortex-A710 erratam 3324338
+	  * ARM Cortex-A715 errartum 3456084
+	  * ARM Cortex-A720 erratum 3456091
+	  * ARM Cortex-A725 erratum 3456106
+	  * ARM Cortex-X1 erratum 3324344
+	  * ARM Cortex-X1C erratum 3324346
+	  * ARM Cortex-X2 erratum 3324338
+	  * ARM Cortex-X3 erratum 3324335
+	  * ARM Cortex-X4 erratum 3194386
+	  * ARM Cortex-X925 erratum 3324334
+	  * ARM Neoverse-N1 erratum 3324349
+	  * ARM Neoverse N2 erratum 3324339
+	  * ARM Neoverse-N3 erratum 3456111
+	  * ARM Neoverse-V1 erratum 3324341
+	  * ARM Neoverse V2 erratum 3324336
+	  * ARM Neoverse-V3 erratum 3312417
+
+	  On affected cores "MSR SSBS, #0" instructions may not affect
+	  subsequent speculative instructions, which may permit unexepected
+	  speculative store bypassing.
+
+	  Work around this problem by placing a Speculation Barrier (SB) or
+	  Instruction Synchronization Barrier (ISB) after kernel changes to
+	  SSBS. The presence of the SSBS special-purpose register is hidden
+	  from hwcaps and EL0 reads of ID_AA64PFR1_EL1, such that userspace
+	  will use the PR_SPEC_STORE_BYPASS prctl to change SSBS.
+
+	  If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
 	bool "Cavium erratum 22375, 24313"
 	default y
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@ -326,8 +326,8 @@
 		 <&reset RESET_HDMI_SYSTEM_RESET>,
 		 <&reset RESET_HDMI_TX>;
 	reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy";
-	clocks = <&clkc CLKID_HDMI_PCLK>,
-		 <&clkc CLKID_CLK81>,
+	clocks = <&clkc CLKID_HDMI>,
+		 <&clkc CLKID_HDMI_PCLK>,
 		 <&clkc CLKID_GCLK_VENCI_INT0>;
 	clock-names = "isfr", "iahb", "venci";
 };
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@ -273,8 +273,8 @@
 		 <&reset RESET_HDMI_SYSTEM_RESET>,
 		 <&reset RESET_HDMI_TX>;
 	reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy";
-	clocks = <&clkc CLKID_HDMI_PCLK>,
-		 <&clkc CLKID_CLK81>,
+	clocks = <&clkc CLKID_HDMI>,
+		 <&clkc CLKID_HDMI_PCLK>,
 		 <&clkc CLKID_GCLK_VENCI_INT0>;
 	clock-names = "isfr", "iahb", "venci";
 };
--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
@ -235,8 +235,8 @@
 	/* eMMC is shared pin with parallel NAND */
 	emmc_pins_default: emmc-pins-default {
 		mux {
-			function = "emmc", "emmc_rst";
-			groups = "emmc";
+			function = "emmc";
+			groups = "emmc", "emmc_rst";
 		};

 		/* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
@ -198,8 +198,8 @@
 	/* eMMC is shared pin with parallel NAND */
 	emmc_pins_default: emmc-pins-default {
 		mux {
-			function = "emmc", "emmc_rst";
-			groups = "emmc";
+			function = "emmc";
+			groups = "emmc", "emmc_rst";
 		};

 		/* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@ -1386,7 +1386,7 @@
 				<&gcc GCC_UFS_RX_SYMBOL_0_CLK>;
 			freq-table-hz =
 				<100000000 200000000>,
-				<0 0>,
+				<100000000 200000000>,
 				<0 0>,
 				<0 0>,
 				<0 0>,
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@ -1635,6 +1635,8 @@
 			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
 				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;

+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 			status = "disabled";
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@ -667,8 +667,7 @@
 		compatible = "rockchip,rk3328-dw-hdmi";
 		reg = <0x0 0xff3c0000 0x0 0x20000>;
 		reg-io-width = <4>;
-		interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
-			     <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cru PCLK_HDMI>,
 			 <&cru SCLK_HDMI_SFC>,
 			 <&cru SCLK_RTC32K>;
@ -763,8 +762,8 @@
 			<0>, <24000000>,
 			<24000000>, <24000000>,
 			<15000000>, <15000000>,
-			<100000000>, <100000000>,
-			<100000000>, <100000000>,
+			<300000000>, <100000000>,
+			<400000000>, <100000000>,
 			<50000000>, <100000000>,
 			<100000000>, <100000000>,
 			<50000000>, <50000000>,
--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
@ -56,7 +56,6 @@
 			fan: fan@18 {
 				compatible = "ti,amc6821";
 				reg = <0x18>;
-				#cooling-cells = <2>;
 			};

 			rtc_twi: rtc@6f {
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
@ -148,6 +148,22 @@
 	drive-impedance-ohm = <33>;
 };

+&gpio3 {
+	/*
+	 * The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module
+	 * eMMC and SPI flash powered-down initially (in fact it keeps the
+	 * reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override
+	 * that signal so that eMMC and SPI can be used regardless of the state
+	 * of the signal.
+	 */
+	bios-disable-override-hog {
+		gpios = <RK_PD5 GPIO_ACTIVE_LOW>;
+		gpio-hog;
+		line-name = "bios_disable_override";
+		output-high;
+	};
+};
+
 &gmac {
 	assigned-clocks = <&cru SCLK_RMII_SRC>;
 	assigned-clock-parents = <&clkin_gmac>;
@ -432,9 +448,14 @@

 &pinctrl {
 	pinctrl-names = "default";
-	pinctrl-0 = <&q7_thermal_pin>;
+	pinctrl-0 = <&q7_thermal_pin &bios_disable_override_hog_pin>;

 	gpios {
+		bios_disable_override_hog_pin: bios-disable-override-hog-pin {
+			rockchip,pins =
+				<3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_down>;
+		};
+
 		q7_thermal_pin: q7-thermal-pin {
 			rockchip,pins =
 				<0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
@ -557,7 +557,7 @@
 	bluetooth {
 		compatible = "brcm,bcm43438-bt";
 		clocks = <&rk808 1>;
-		clock-names = "ext_clock";
+		clock-names = "txco";
 		device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>;
 		host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>;
 		shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>;
--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
@ -159,7 +159,7 @@
 	status = "okay";

 	rt5651: rt5651@1a {
-		compatible = "rockchip,rt5651";
+		compatible = "realtek,rt5651";
 		reg = <0x1a>;
 		clocks = <&cru SCLK_I2S_8CH_OUT>;
 		clock-names = "mclk";
--- a/arch/arm64/configs/gki_defconfig
+++ b/arch/arm64/configs/gki_defconfig
@ -317,6 +317,7 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 # CONFIG_SERIAL_8250_EXAR is not set
 CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_DW=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@ -110,6 +110,18 @@ static inline u32 get_acpi_id_for_cpu(unsigned int cpu)
 	return	acpi_cpu_get_madt_gicc(cpu)->uid;
 }

+static inline int get_cpu_for_acpi_id(u32 uid)
+{
+	int cpu;
+
+	for (cpu = 0; cpu < nr_cpu_ids; cpu++)
+		if (acpi_cpu_get_madt_gicc(cpu) &&
+		    uid == get_acpi_id_for_cpu(cpu))
+			return cpu;
+
+	return -EINVAL;
+}
+
 static inline void arch_fix_phys_package_id(int num, u32 slot) { }
 void __init acpi_init_cpus(void);
 int apei_claim_sea(struct pt_regs *regs);
--- a/arch/arm64/include/asm/cpucaps.h
+++ b/arch/arm64/include/asm/cpucaps.h
@ -58,6 +58,7 @@
 #define ARM64_HAS_AMU_EXTN			48
 #define ARM64_SPECTRE_BHB			49
 #define ARM64_WORKAROUND_1742098		50
+#define ARM64_WORKAROUND_SPECULATIVE_SSBS	51

 /* kabi: reserve 51 - 62 for future cpu capabilities */
 #define ARM64_NCAPS				62
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@ -78,9 +78,19 @@
 #define ARM_CPU_PART_CORTEX_A78		0xD41
 #define ARM_CPU_PART_CORTEX_X1		0xD44
 #define ARM_CPU_PART_CORTEX_A710	0xD47
+#define ARM_CPU_PART_CORTEX_A715	0xD4D
 #define ARM_CPU_PART_CORTEX_X2		0xD48
 #define ARM_CPU_PART_NEOVERSE_N2	0xD49
 #define ARM_CPU_PART_CORTEX_A78C	0xD4B
+#define ARM_CPU_PART_CORTEX_X1C		0xD4C
+#define ARM_CPU_PART_CORTEX_X3		0xD4E
+#define ARM_CPU_PART_NEOVERSE_V2	0xD4F
+#define ARM_CPU_PART_CORTEX_A720	0xD81
+#define ARM_CPU_PART_CORTEX_X4		0xD82
+#define ARM_CPU_PART_NEOVERSE_V3	0xD84
+#define ARM_CPU_PART_CORTEX_X925	0xD85
+#define ARM_CPU_PART_CORTEX_A725	0xD87
+#define ARM_CPU_PART_NEOVERSE_N3	0xD8E

 #define APM_CPU_PART_POTENZA		0x000

@ -120,9 +130,19 @@
 #define MIDR_CORTEX_A78	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78)
 #define MIDR_CORTEX_X1	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)
 #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710)
+#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715)
 #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)
 #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)
 #define MIDR_CORTEX_A78C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)
+#define MIDR_CORTEX_X1C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C)
+#define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3)
+#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2)
+#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720)
+#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4)
+#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)
+#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)
+#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
+#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
 #define MIDR_THUNDERX	MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
--- a/arch/arm64/include/asm/uprobes.h
+++ b/arch/arm64/include/asm/uprobes.h
@ -12,7 +12,7 @@

 #define MAX_UINSN_BYTES		AARCH64_INSN_SIZE

-#define UPROBE_SWBP_INSN	BRK64_OPCODE_UPROBES
+#define UPROBE_SWBP_INSN	cpu_to_le32(BRK64_OPCODE_UPROBES)
 #define UPROBE_SWBP_INSN_SIZE	AARCH64_INSN_SIZE
 #define UPROBE_XOL_SLOT_BYTES	MAX_UINSN_BYTES

--- a/arch/arm64/kernel/acpi_numa.c
+++ b/arch/arm64/kernel/acpi_numa.c
@ -27,24 +27,13 @@

 #include <asm/numa.h>

-static int acpi_early_node_map[NR_CPUS] __initdata = { NUMA_NO_NODE };
+static int acpi_early_node_map[NR_CPUS] __initdata = { [0 ... NR_CPUS - 1] = NUMA_NO_NODE };

 int __init acpi_numa_get_nid(unsigned int cpu)
 {
 	return acpi_early_node_map[cpu];
 }

-static inline int get_cpu_for_acpi_id(u32 uid)
-{
-	int cpu;
-
-	for (cpu = 0; cpu < nr_cpu_ids; cpu++)
-		if (uid == get_acpi_id_for_cpu(cpu))
-			return cpu;
-
-	return -EINVAL;
-}
-
 static int __init acpi_parse_gicc_pxm(union acpi_subtable_headers *header,
 				      const unsigned long end)
 {
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@ -372,6 +372,19 @@ void arm64_set_ssbd_mitigation(bool state)
 			asm volatile(SET_PSTATE_SSBS(0));
 		else
 			asm volatile(SET_PSTATE_SSBS(1));
+
+		/*
+		 * SSBS is self-synchronizing and is intended to affect
+		 * subsequent speculative instructions, but some CPUs can
+		 * speculate with a stale value of SSBS.
+		 *
+		 * Mitigate this with an unconditional speculation barrier, as
+		 * CPUs could mis-speculate branches and bypass a conditional
+		 * barrier.
+		 */
+		if (IS_ENABLED(CONFIG_ARM64_ERRATUM_3194386))
+			spec_bar();
+
 		return;
 	}

@ -828,6 +841,32 @@ static struct midr_range broken_aarch32_aes[] = {
 };
 #endif

+#ifdef CONFIG_ARM64_ERRATUM_3194386
+static const struct midr_range erratum_spec_ssbs_list[] = {
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A715),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A720),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A725),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N3),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+	{}
+};
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE
 	{
@ -1016,6 +1055,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 		CAP_MIDR_RANGE_LIST(broken_aarch32_aes),
 		.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
 	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_3194386
+	{
+		.desc = "SSBS not fully self-synchronizing",
+		.capability = ARM64_WORKAROUND_SPECULATIVE_SSBS,
+		ERRATA_MIDR_RANGE_LIST(erratum_spec_ssbs_list),
+	},
 #endif
 	{
 	}
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@ -293,6 +293,30 @@ static const struct arm64_ftr_bits ftr_id_aa64dfr0[] = {
 	ARM64_FTR_END,
 };

+static const struct arm64_ftr_bits ftr_mvfr0[] = {
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPROUND_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPSHVEC_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPSQRT_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPDIVIDE_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPTRAP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPDP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_FPSP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR0_SIMD_SHIFT, 4, 0),
+	ARM64_FTR_END,
+};
+
+static const struct arm64_ftr_bits ftr_mvfr1[] = {
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDFMAC_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_FPHP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDHP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDSP_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDINT_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_SIMDLS_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_FPDNAN_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, MVFR1_FPFTZ_SHIFT, 4, 0),
+	ARM64_FTR_END,
+};
+
 static const struct arm64_ftr_bits ftr_mvfr2[] = {
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 4, 4, 0),		/* FPMisc */
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 0, 4, 0),		/* SIMDMisc */
@ -308,10 +332,10 @@ static const struct arm64_ftr_bits ftr_dczid[] = {

 static const struct arm64_ftr_bits ftr_id_isar5[] = {
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_RDM_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_CRC32_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA2_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA1_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_AES_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_CRC32_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA2_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SHA1_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_AES_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_ISAR5_SEVL_SHIFT, 4, 0),
 	ARM64_FTR_END,
 };
@ -351,7 +375,7 @@ static const struct arm64_ftr_bits ftr_zcr[] = {
 * Common ftr bits for a 32bit register with all hidden, strict
 * attributes, with 4bit feature fields and a default safe value of
 * 0. Covers the following 32bit registers:
- * id_isar[0-4], id_mmfr[1-3], id_pfr1, mvfr[0-1]
+ * id_isar[1-3], id_mmfr[1-3]
 */
 static const struct arm64_ftr_bits ftr_generic_32bits[] = {
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 28, 4, 0),
@ -406,8 +430,8 @@ static const struct __ftr_reg_entry {
 	ARM64_FTR_REG(SYS_ID_MMFR4_EL1, ftr_id_mmfr4),

 	/* Op1 = 0, CRn = 0, CRm = 3 */
-	ARM64_FTR_REG(SYS_MVFR0_EL1, ftr_generic_32bits),
-	ARM64_FTR_REG(SYS_MVFR1_EL1, ftr_generic_32bits),
+	ARM64_FTR_REG(SYS_MVFR0_EL1, ftr_mvfr0),
+	ARM64_FTR_REG(SYS_MVFR1_EL1, ftr_mvfr1),
 	ARM64_FTR_REG(SYS_MVFR2_EL1, ftr_mvfr2),

 	/* Op1 = 0, CRn = 0, CRm = 4 */
@ -876,17 +900,39 @@ feature_matches(u64 reg, const struct arm64_cpu_capabilities *entry)
 	return val >= entry->min_field_value;
 }

+static u64
+read_scoped_sysreg(const struct arm64_cpu_capabilities *entry, int scope)
+{
+	WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible());
+	if (scope == SCOPE_SYSTEM)
+		return read_sanitised_ftr_reg(entry->sys_reg);
+	else
+		return __read_sysreg_by_encoding(entry->sys_reg);
+}
+
+static bool
+has_user_cpuid_feature(const struct arm64_cpu_capabilities *entry, int scope)
+{
+	int mask;
+	struct arm64_ftr_reg *regp;
+	u64 val = read_scoped_sysreg(entry, scope);
+
+	regp = get_arm64_ftr_reg(entry->sys_reg);
+	if (!regp)
+		return false;
+
+	mask = cpuid_feature_extract_unsigned_field(regp->user_mask,
+						    entry->field_pos);
+	if (!mask)
+		return false;
+
+	return feature_matches(val, entry);
+}
+
 static bool
 has_cpuid_feature(const struct arm64_cpu_capabilities *entry, int scope)
 {
-	u64 val;
-
-	WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible());
-	if (scope == SCOPE_SYSTEM)
-		val = read_sanitised_ftr_reg(entry->sys_reg);
-	else
-		val = __read_sysreg_by_encoding(entry->sys_reg);
-
+	u64 val = read_scoped_sysreg(entry, scope);
 	return feature_matches(val, entry);
 }

@ -1329,6 +1375,17 @@ static bool can_use_gic_priorities(const struct arm64_cpu_capabilities *entry,
 }
 #endif

+static void user_feature_fixup(void)
+{
+	if (cpus_have_cap(ARM64_WORKAROUND_SPECULATIVE_SSBS)) {
+		struct arm64_ftr_reg *regp;
+
+		regp = get_arm64_ftr_reg(SYS_ID_AA64PFR1_EL1);
+		if (regp)
+			regp->user_mask &= ~GENMASK(7, 4); /* SSBS */
+	}
+}
+
 static void elf_hwcap_fixup(void)
 {
 #ifdef CONFIG_ARM64_ERRATUM_1742098
@ -1659,7 +1716,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 };

 #define HWCAP_CPUID_MATCH(reg, field, s, min_value)				\
-		.matches = has_cpuid_feature,					\
+		.matches = has_user_cpuid_feature,				\
 		.sys_reg = reg,							\
 		.field_pos = field,						\
 		.sign = s,							\
@ -2176,6 +2233,7 @@ void __init setup_cpu_features(void)

 	setup_system_capabilities();
 	mark_const_caps_ready();
+	user_feature_fixup();
 	setup_elf_hwcaps(arm64_elf_hwcaps);

 	if (system_supports_32bit_el0()) {
@ -2214,7 +2272,7 @@ static void __maybe_unused cpu_enable_cnp(struct arm64_cpu_capabilities const *c

 /*
 * We emulate only the following system register space.
- * Op0 = 0x3, CRn = 0x0, Op1 = 0x0, CRm = [0, 4 - 7]
+ * Op0 = 0x3, CRn = 0x0, Op1 = 0x0, CRm = [0, 2 - 7]
 * See Table C5-6 System instruction encodings for System register accesses,
 * ARMv8 ARM(ARM DDI 0487A.f) for more details.
 */
@ -2224,7 +2282,7 @@ static inline bool __attribute_const__ is_emulated(u32 id)
 		sys_reg_CRn(id) == 0x0 &&
 		sys_reg_Op1(id) == 0x0 &&
 		(sys_reg_CRm(id) == 0 ||
-		 ((sys_reg_CRm(id) >= 4) && (sys_reg_CRm(id) <= 7))));
+		 ((sys_reg_CRm(id) >= 2) && (sys_reg_CRm(id) <= 7))));
 }

 /*
--- a/arch/arm64/kernel/probes/decode-insn.c
+++ b/arch/arm64/kernel/probes/decode-insn.c
@ -96,10 +96,6 @@ arm_probe_decode_insn(probe_opcode_t insn, struct arch_probe_insn *api)
 	    aarch64_insn_is_blr(insn) ||
 	    aarch64_insn_is_ret(insn)) {
 		api->handler = simulate_br_blr_ret;
-	} else if (aarch64_insn_is_ldr_lit(insn)) {
-		api->handler = simulate_ldr_literal;
-	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
-		api->handler = simulate_ldrsw_literal;
 	} else {
 		/*
 		 * Instruction cannot be stepped out-of-line and we don't
@ -137,6 +133,17 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
 	probe_opcode_t insn = le32_to_cpu(*addr);
 	probe_opcode_t *scan_end = NULL;
 	unsigned long size = 0, offset = 0;
+	struct arch_probe_insn *api = &asi->api;
+
+	if (aarch64_insn_is_ldr_lit(insn)) {
+		api->handler = simulate_ldr_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
+		api->handler = simulate_ldrsw_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else {
+		decoded = arm_probe_decode_insn(insn, &asi->api);
+	}

 	/*
 	 * If there's a symbol defined in front of and near enough to
@ -154,7 +161,6 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
 		else
 			scan_end = addr - MAX_ATOMIC_CONTEXT_SIZE;
 	}
-	decoded = arm_probe_decode_insn(insn, &asi->api);

 	if (decoded != INSN_REJECTED && scan_end)
 		if (is_probed_address_atomic(addr - 1, scan_end))
--- a/arch/arm64/kernel/probes/simulate-insn.c
+++ b/arch/arm64/kernel/probes/simulate-insn.c
@ -170,17 +170,15 @@ simulate_tbz_tbnz(u32 opcode, long addr, struct pt_regs *regs)
 void __kprobes
 simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	u64 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;

-	disp = ldr_displacement(opcode);
-	load_addr = (u64 *) (addr + disp);
+	load_addr = addr + ldr_displacement(opcode);

 	if (opcode & (1 << 30))	/* x0-x30 */
-		set_x_reg(regs, xn, *load_addr);
+		set_x_reg(regs, xn, READ_ONCE(*(u64 *)load_addr));
 	else			/* w0-w30 */
-		set_w_reg(regs, xn, *load_addr);
+		set_w_reg(regs, xn, READ_ONCE(*(u32 *)load_addr));

 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
@ -188,14 +186,12 @@ simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 void __kprobes
 simulate_ldrsw_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	s32 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;

-	disp = ldr_displacement(opcode);
-	load_addr = (s32 *) (addr + disp);
+	load_addr = addr + ldr_displacement(opcode);

-	set_x_reg(regs, xn, *load_addr);
+	set_x_reg(regs, xn, READ_ONCE(*(s32 *)load_addr));

 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@ -443,7 +443,7 @@ static void tls_thread_switch(struct task_struct *next)

 	if (is_compat_thread(task_thread_info(next)))
 		write_sysreg(next->thread.uw.tp_value, tpidrro_el0);
-	else if (!arm64_kernel_unmapped_at_el0())
+	else
 		write_sysreg(0, tpidrro_el0);

 	write_sysreg(*task_user_tls(next), tpidr_el0);
--- a/arch/m68k/amiga/config.c
+++ b/arch/m68k/amiga/config.c
@ -180,6 +180,15 @@ int __init amiga_parse_bootinfo(const struct bi_record *record)
 			dev->slotsize = be16_to_cpu(cd->cd_SlotSize);
 			dev->boardaddr = be32_to_cpu(cd->cd_BoardAddr);
 			dev->boardsize = be32_to_cpu(cd->cd_BoardSize);
+
+			/* CS-LAB Warp 1260 workaround */
+			if (be16_to_cpu(dev->rom.er_Manufacturer) == ZORRO_MANUF(ZORRO_PROD_CSLAB_WARP_1260) &&
+			    dev->rom.er_Product == ZORRO_PROD(ZORRO_PROD_CSLAB_WARP_1260)) {
+
+				/* turn off all interrupts */
+				pr_info("Warp 1260 card detected: applying interrupt storm workaround\n");
+				*(uint32_t *)(dev->boardaddr + 0x1000) = 0xfff;
+			}
 		} else
 			pr_warn("amiga_parse_bootinfo: too many AutoConfig devices\n");
 #endif /* CONFIG_ZORRO */
--- a/arch/m68k/atari/ataints.c
+++ b/arch/m68k/atari/ataints.c
@ -302,11 +302,7 @@ void __init atari_init_IRQ(void)

 	if (ATARIHW_PRESENT(SCU)) {
 		/* init the SCU if present */
-		tt_scu.sys_mask = 0x10;		/* enable VBL (for the cursor) and
-									 * disable HSYNC interrupts (who
-									 * needs them?)  MFP and SCC are
-									 * enabled in VME mask
-									 */
+		tt_scu.sys_mask = 0x0;		/* disable all interrupts */
 		tt_scu.vme_mask = 0x60;		/* enable MFP and SCC ints */
 	} else {
 		/* If no SCU and no Hades, the HSYNC interrupt needs to be
--- a/arch/m68k/coldfire/device.c
+++ b/arch/m68k/coldfire/device.c
@ -92,7 +92,7 @@ static struct platform_device mcf_uart = {
 	.dev.platform_data	= mcf_uart_platform_data,
 };

-#if IS_ENABLED(CONFIG_FEC)
+#ifdef MCFFEC_BASE0

 #ifdef CONFIG_M5441x
 #define FEC_NAME	"enet-fec"
@ -144,6 +144,7 @@ static struct platform_device mcf_fec0 = {
 		.platform_data		= FEC_PDATA,
 	}
 };
+#endif /* MCFFEC_BASE0 */

 #ifdef MCFFEC_BASE1
 static struct resource mcf_fec1_resources[] = {
@ -181,7 +182,6 @@ static struct platform_device mcf_fec1 = {
 	}
 };
 #endif /* MCFFEC_BASE1 */
-#endif /* CONFIG_FEC */

 #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 /*
@ -556,12 +556,12 @@ static struct platform_device mcf_edma = {

 static struct platform_device *mcf_devices[] __initdata = {
 	&mcf_uart,
-#if IS_ENABLED(CONFIG_FEC)
+#ifdef MCFFEC_BASE0
 	&mcf_fec0,
+#endif
 #ifdef MCFFEC_BASE1
 	&mcf_fec1,
 #endif
-#endif
 #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 	&mcf_qspi,
 #endif
--- a/arch/m68k/include/asm/cmpxchg.h
+++ b/arch/m68k/include/asm/cmpxchg.h
@ -33,7 +33,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
 		x = tmp;
 		break;
 	default:
-		tmp = __invalid_xchg_size(x, ptr, size);
+		x = __invalid_xchg_size(x, ptr, size);
 		break;
 	}

--- a/arch/m68k/include/asm/mcfgpio.h
+++ b/arch/m68k/include/asm/mcfgpio.h
@ -144,7 +144,7 @@ static inline void gpio_free(unsigned gpio)
 * read-modify-write as well as those controlled by the EPORT and GPIO modules.
 */
 #define MCFGPIO_SCR_START		40
-#elif defined(CONFIGM5441x)
+#elif defined(CONFIG_M5441x)
 /* The m5441x EPORT doesn't have its own GPIO port, uses PORT C */
 #define MCFGPIO_SCR_START		0
 #else
--- a/arch/m68k/include/asm/mvme147hw.h
+++ b/arch/m68k/include/asm/mvme147hw.h
@ -93,8 +93,8 @@ struct pcc_regs {
 #define M147_SCC_B_ADDR		0xfffe3000
 #define M147_SCC_PCLK		5000000

-#define MVME147_IRQ_SCSI_PORT	(IRQ_USER+0x45)
-#define MVME147_IRQ_SCSI_DMA	(IRQ_USER+0x46)
+#define MVME147_IRQ_SCSI_PORT	(IRQ_USER + 5)
+#define MVME147_IRQ_SCSI_DMA	(IRQ_USER + 6)

 /* SCC interrupts, for MVME147 */

--- a/arch/m68k/kernel/early_printk.c
+++ b/arch/m68k/kernel/early_printk.c
@ -12,8 +12,9 @@
 #include <linux/string.h>
 #include <asm/setup.h>

-extern void mvme16x_cons_write(struct console *co,
-			       const char *str, unsigned count);
+
+#include "../mvme147/mvme147.h"
+#include "../mvme16x/mvme16x.h"

 asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);

@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c,
 {
 #if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
      defined(CONFIG_COLDFIRE))
-	if (MACH_IS_MVME16x)
+	if (MACH_IS_MVME147)
+		mvme147_scc_write(c, s, n);
+	else if (MACH_IS_MVME16x)
 		mvme16x_cons_write(c, s, n);
 	else
 		debug_cons_nputs(s, n);
--- a/arch/m68k/mvme147/config.c
+++ b/arch/m68k/mvme147/config.c
@ -36,6 +36,7 @@
 #include <asm/machdep.h>
 #include <asm/mvme147hw.h>

+#include "mvme147.h"

 static void mvme147_get_model(char *model);
 extern void mvme147_sched_init(irq_handler_t handler);
@ -189,3 +190,32 @@ int mvme147_hwclk(int op, struct rtc_time *t)
 	}
 	return 0;
 }
+
+static void scc_delay(void)
+{
+	__asm__ __volatile__ ("nop; nop;");
+}
+
+static void scc_write(char ch)
+{
+	do {
+		scc_delay();
+	} while (!(in_8(M147_SCC_A_ADDR) & BIT(2)));
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, 8);
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, ch);
+}
+
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	while (count--)	{
+		if (*str == '\n')
+			scc_write('\r');
+		scc_write(*str++);
+	}
+	local_irq_restore(flags);
+}
--- a/arch/m68k/mvme147/mvme147.h
+++ b/arch/m68k/mvme147/mvme147.h
@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+struct console;
+
+/* config.c */
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count);
--- a/arch/m68k/mvme16x/config.c
+++ b/arch/m68k/mvme16x/config.c
@ -39,6 +39,8 @@
 #include <asm/machdep.h>
 #include <asm/mvme16xhw.h>

+#include "mvme16x.h"
+
 extern t_bdid mvme_bdid;

 static MK48T08ptr_t volatile rtc = (MK48T08ptr_t)MVME_RTC_BASE;
--- a/arch/m68k/mvme16x/mvme16x.h
+++ b/arch/m68k/mvme16x/mvme16x.h
@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+struct console;
+
+/* config.c */
+void mvme16x_cons_write(struct console *co, const char *str, unsigned count);
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@ -276,11 +276,6 @@ asmlinkage void __init mmu_init(void)
 {
 	unsigned int kstart, ksize;

-	if (!memblock.reserved.cnt) {
-		pr_emerg("Error memory count\n");
-		machine_restart(NULL);
-	}
-
 	if ((u32) memblock.memory.regions[0].size < 0x400000) {
 		pr_emerg("Memory must be greater than 4MB\n");
 		machine_restart(NULL);
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@ -272,7 +272,7 @@ drivers-$(CONFIG_PCI)		+= arch/mips/pci/
 ifdef CONFIG_64BIT
  ifndef KBUILD_SYM32
    ifeq ($(shell expr $(load-y) \< 0xffffffff80000000), 0)
-      KBUILD_SYM32 = y
+      KBUILD_SYM32 = $(call cc-option-yn, -msym32)
    endif
  endif

--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@ -228,6 +228,10 @@ GCR_ACCESSOR_RO(32, 0x0d0, gic_status)
 GCR_ACCESSOR_RO(32, 0x0f0, cpc_status)
 #define CM_GCR_CPC_STATUS_EX			BIT(0)

+/* GCR_ACCESS - Controls core/IOCU access to GCRs */
+GCR_ACCESSOR_RW(32, 0x120, access_cm3)
+#define CM_GCR_ACCESS_ACCESSEN			GENMASK(7, 0)
+
 /* GCR_L2_CONFIG - Indicates L2 cache configuration when Config5.L2C=1 */
 GCR_ACCESSOR_RW(32, 0x130, l2_config)
 #define CM_GCR_L2_CONFIG_BYPASS			BIT(20)
--- a/arch/mips/include/asm/switch_to.h
+++ b/arch/mips/include/asm/switch_to.h
@ -97,7 +97,7 @@ do {									\
 	}								\
 } while (0)
 #else
-# define __sanitize_fcr31(next)
+# define __sanitize_fcr31(next) do { (void) (next); } while (0)
 #endif

 /*
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@ -229,7 +229,10 @@ static void boot_core(unsigned int core, unsigned int vpe_id)
 	write_gcr_co_reset_ext_base(CM_GCR_Cx_RESET_EXT_BASE_UEB);

 	/* Ensure the core can access the GCRs */
-	set_gcr_access(1 << core);
+	if (mips_cm_revision() < CM_REV_CM3)
+		set_gcr_access(1 << core);
+	else
+		set_gcr_access_cm3(1 << core);

 	if (mips_cpc_present()) {
 		/* Reset the core */
--- a/arch/mips/pci/pcie-octeon.c
+++ b/arch/mips/pci/pcie-octeon.c
--- a/arch/openrisc/kernel/setup.c
+++ b/arch/openrisc/kernel/setup.c
@ -280,6 +280,9 @@ void calibrate_delay(void)

 void __init setup_arch(char **cmdline_p)
 {
+	/* setup memblock allocator */
+	setup_memory();
+
 	unflatten_and_copy_device_tree();

 	setup_cpuinfo();
@ -304,9 +307,6 @@ void __init setup_arch(char **cmdline_p)
 	initrd_below_start_ok = 1;
 #endif

-	/* setup memblock allocator */
-	setup_memory();
-
 	/* paging_init() sets up the MMU and marks all pages as reserved */
 	paging_init();

--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@ -1078,8 +1078,7 @@ ENTRY_CFI(intr_save)		/* for os_hpmc */
 	STREG           %r16, PT_ISR(%r29)
 	STREG           %r17, PT_IOR(%r29)

-#if 0 && defined(CONFIG_64BIT)
-	/* Revisit when we have 64-bit code above 4Gb */
+#if defined(CONFIG_64BIT)
 	b,n		intr_save2

 skip_save_ior:
@ -1087,8 +1086,7 @@ skip_save_ior:
 	 * need to adjust iasq/iaoq here in the same way we adjusted isr/ior
 	 * above.
 	 */
-	extrd,u,*	%r8,PSW_W_BIT,1,%r1
-	cmpib,COND(=),n	1,%r1,intr_save2
+	bb,COND(>=),n	%r8,PSW_W_BIT,intr_save2
 	LDREG		PT_IASQ0(%r29), %r16
 	LDREG		PT_IAOQ0(%r29), %r17
 	/* adjust iasq/iaoq */
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@ -217,10 +217,10 @@ linux_gateway_entry:

 #ifdef CONFIG_64BIT
 	ldil	L%sys_call_table, %r1
-	or,=	%r2,%r2,%r2
-	addil	L%(sys_call_table64-sys_call_table), %r1
+	or,ev	%r2,%r2,%r2
+	ldil	L%sys_call_table64, %r1
 	ldo	R%sys_call_table(%r1), %r19
-	or,=	%r2,%r2,%r2
+	or,ev	%r2,%r2,%r2
 	ldo	R%sys_call_table64(%r1), %r19
 #else
 	load32	sys_call_table, %r19
@ -355,10 +355,10 @@ tracesys_next:
 	extrd,u	%r19,63,1,%r2			/* W hidden in bottom bit */

 	ldil	L%sys_call_table, %r1
-	or,=	%r2,%r2,%r2
-	addil	L%(sys_call_table64-sys_call_table), %r1
+	or,ev	%r2,%r2,%r2
+	ldil	L%sys_call_table64, %r1
 	ldo	R%sys_call_table(%r1), %r19
-	or,=	%r2,%r2,%r2
+	or,ev	%r2,%r2,%r2
 	ldo	R%sys_call_table64(%r1), %r19
 #else
 	load32	sys_call_table, %r19
@ -931,6 +931,8 @@ ENTRY(sys_call_table)
 END(sys_call_table)

 #ifdef CONFIG_64BIT
+#undef __SYSCALL_WITH_COMPAT
+#define __SYSCALL_WITH_COMPAT(nr, native, compat)	__SYSCALL(nr, native)
 	.align 8
 ENTRY(sys_call_table64)
 #include <asm/syscall_table_64.h>    /* 64-bit native syscalls */
--- a/arch/powerpc/boot/simple_alloc.c
+++ b/arch/powerpc/boot/simple_alloc.c
@ -114,8 +114,11 @@ static void *simple_realloc(void *ptr, unsigned long size)
 		return ptr;

 	new = simple_malloc(size);
-	memcpy(new, ptr, p->size);
-	simple_free(ptr);
+	if (new) {
+		memcpy(new, ptr, p->size);
+		simple_free(ptr);
+	}
+
 	return new;
 }

--- a/arch/powerpc/include/asm/sstep.h
+++ b/arch/powerpc/include/asm/sstep.h
@ -160,9 +160,4 @@ extern int emulate_step(struct pt_regs *regs, unsigned int instr);
 */
 extern int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op);

-extern void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
-			     const void *mem, bool cross_endian);
-extern void emulate_vsx_store(struct instruction_op *op,
-			      const union vsx_reg *reg, void *mem,
-			      bool cross_endian);
 extern int emulate_dcbz(unsigned long ea, struct pt_regs *regs);
--- a/arch/powerpc/include/asm/vdso.h
+++ b/arch/powerpc/include/asm/vdso.h
@ -49,6 +49,7 @@ int vdso_getcpu_init(void);

 #define V_FUNCTION_BEGIN(name)		\
 	.globl name;			\
+	.type name,@function; 		\
 	name:				\

 #define V_FUNCTION_END(name)		\
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@ -2856,7 +2856,7 @@ static void __init fixup_device_tree_chrp(void)
 #endif

 #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC)
-static void __init fixup_device_tree_pmac(void)
+static void __init fixup_device_tree_pmac64(void)
 {
 	phandle u3, i2c, mpic;
 	u32 u3_rev;
@ -2896,7 +2896,31 @@ static void __init fixup_device_tree_pmac(void)
 		     &parent, sizeof(parent));
 }
 #else
-#define fixup_device_tree_pmac()
+#define fixup_device_tree_pmac64()
+#endif
+
+#ifdef CONFIG_PPC_PMAC
+static void __init fixup_device_tree_pmac(void)
+{
+	__be32 val = 1;
+	char type[8];
+	phandle node;
+
+	// Some pmacs are missing #size-cells on escc nodes
+	for (node = 0; prom_next_node(&node); ) {
+		type[0] = '\0';
+		prom_getprop(node, "device_type", type, sizeof(type));
+		if (prom_strcmp(type, "escc"))
+			continue;
+
+		if (prom_getproplen(node, "#size-cells") != PROM_ERROR)
+			continue;
+
+		prom_setprop(node, NULL, "#size-cells", &val, sizeof(val));
+	}
+}
+#else
+static inline void fixup_device_tree_pmac(void) { }
 #endif

 #ifdef CONFIG_PPC_EFIKA
@ -3121,6 +3145,7 @@ static void __init fixup_device_tree(void)
 	fixup_device_tree_maple_memory_controller();
 	fixup_device_tree_chrp();
 	fixup_device_tree_pmac();
+	fixup_device_tree_pmac64();
 	fixup_device_tree_efika();
 	fixup_device_tree_pasemi();
 }
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@ -1950,8 +1950,10 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
 			break;

 		r = -ENXIO;
-		if (!xive_enabled())
+		if (!xive_enabled()) {
+			fdput(f);
 			break;
+		}

 		r = -EPERM;
 		dev = kvm_device_from_filp(f.file);
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@ -663,8 +663,8 @@ static nokprobe_inline int emulate_stq(struct pt_regs *regs, unsigned long ea,
 #endif /* __powerpc64 */

 #ifdef CONFIG_VSX
-void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
-		      const void *mem, bool rev)
+static nokprobe_inline void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
+					     const void *mem, bool rev)
 {
 	int size, read_size;
 	int i, j;
@ -744,11 +744,9 @@ void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
 		break;
 	}
 }
-EXPORT_SYMBOL_GPL(emulate_vsx_load);
-NOKPROBE_SYMBOL(emulate_vsx_load);

-void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
-		       void *mem, bool rev)
+static nokprobe_inline void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
+					      void *mem, bool rev)
 {
 	int size, write_size;
 	int i, j;
@ -820,8 +818,6 @@ void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
 		break;
 	}
 }
-EXPORT_SYMBOL_GPL(emulate_vsx_store);
-NOKPROBE_SYMBOL(emulate_vsx_store);

 static nokprobe_inline int do_vsx_load(struct instruction_op *op,
 				       unsigned long ea, struct pt_regs *regs,
--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
@ -285,6 +285,7 @@ int __init opal_event_init(void)
 				 name, NULL);
 		if (rc) {
 			pr_warn("Error %d requesting OPAL irq %d\n", rc, (int)r->start);
+			kfree(name);
 			continue;
 		}
 	}
--- a/arch/powerpc/sysdev/xics/icp-native.c
+++ b/arch/powerpc/sysdev/xics/icp-native.c
@ -235,6 +235,8 @@ static int __init icp_native_map_one_cpu(int hw_id, unsigned long addr,
 	rname = kasprintf(GFP_KERNEL, "CPU %d [0x%x] Interrupt Presentation",
 			  cpu, hw_id);

+	if (!rname)
+		return -ENOMEM;
 	if (!request_mem_region(addr, size, rname)) {
 		pr_warn("icp_native: Could not reserve ICP MMIO for CPU %d, interrupt server #0x%x\n",
 			cpu, hw_id);
--- a/arch/powerpc/xmon/ppc-dis.c
+++ b/arch/powerpc/xmon/ppc-dis.c
@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr)
  bool insn_is_short;
  ppc_cpu_t dialect;

-  dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON
-            | PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_ALTIVEC;
+  dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON;

-  if (cpu_has_feature(CPU_FTRS_POWER5))
-    dialect |= PPC_OPCODE_POWER5;
+  if (IS_ENABLED(CONFIG_PPC64))
+    dialect |= PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_CELL |
+	PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 | PPC_OPCODE_POWER8 |
+	PPC_OPCODE_POWER9;

-  if (cpu_has_feature(CPU_FTRS_CELL))
-    dialect |= (PPC_OPCODE_CELL | PPC_OPCODE_ALTIVEC);
+  if (cpu_has_feature(CPU_FTR_TM))
+    dialect |= PPC_OPCODE_HTM;

-  if (cpu_has_feature(CPU_FTRS_POWER6))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_ALTIVEC);
+  if (cpu_has_feature(CPU_FTR_ALTIVEC))
+    dialect |= PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2;

-  if (cpu_has_feature(CPU_FTRS_POWER7))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-                | PPC_OPCODE_ALTIVEC | PPC_OPCODE_VSX);
-
-  if (cpu_has_feature(CPU_FTRS_POWER8))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-		| PPC_OPCODE_POWER8 | PPC_OPCODE_HTM
-		| PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 | PPC_OPCODE_VSX);
-
-  if (cpu_has_feature(CPU_FTRS_POWER9))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-		| PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM
-		| PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2
-		| PPC_OPCODE_VSX | PPC_OPCODE_VSX3);
+  if (cpu_has_feature(CPU_FTR_VSX))
+    dialect |= PPC_OPCODE_VSX | PPC_OPCODE_VSX3;

  /* Get the major opcode of the insn.  */
  opcode = NULL;
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@ -139,6 +139,11 @@ config GENERIC_HWEIGHT
 config FIX_EARLYCON_MEM
 	def_bool y

+config ILLEGAL_POINTER_VALUE
+	hex
+	default 0 if 32BIT
+	default 0xdead000000000000 if 64BIT
+
 config PGTABLE_LEVELS
 	int
 	default 3 if 64BIT
--- a/arch/riscv/include/asm/current.h
+++ b/arch/riscv/include/asm/current.h
@ -17,6 +17,8 @@

 struct task_struct;

+register struct task_struct *riscv_current_is_tp __asm__("tp");
+
 /*
 * This only works because "struct thread_info" is at offset 0 from "struct
 * task_struct".  This constraint seems to be necessary on other architectures
@ -26,8 +28,7 @@ struct task_struct;
 */
 static __always_inline struct task_struct *get_current(void)
 {
-	register struct task_struct *tp __asm__("tp");
-	return tp;
+	return riscv_current_is_tp;
 }

 #define current get_current()
--- a/arch/riscv/kernel/asm-offsets.c
+++ b/arch/riscv/kernel/asm-offsets.c
@ -4,8 +4,6 @@
 * Copyright (C) 2017 SiFive
 */

-#define GENERATING_ASM_OFFSETS
-
 #include <linux/kbuild.h>
 #include <linux/sched.h>
 #include <asm/thread_info.h>
--- a/arch/riscv/kernel/perf_callchain.c
+++ b/arch/riscv/kernel/perf_callchain.c
@ -71,7 +71,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
 	perf_callchain_store(entry, regs->sepc);

 	fp = user_backtrace(entry, fp, regs->ra);
-	while (fp && !(fp & 0x3) && entry->nr < entry->max_stack)
+	while (fp && !(fp & 0x7) && entry->nr < entry->max_stack)
 		fp = user_backtrace(entry, fp, 0);
 }

--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@ -22,6 +22,8 @@
 #include <asm/switch_to.h>
 #include <asm/thread_info.h>

+unsigned long gp_in_global __asm__("gp");
+
 extern asmlinkage void ret_from_fork(void);
 extern asmlinkage void ret_from_kernel_thread(void);

@ -109,9 +111,8 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
 	/* p->thread holds context to be restored by __switch_to() */
 	if (unlikely(p->flags & PF_KTHREAD)) {
 		/* Kernel thread */
-		const register unsigned long gp __asm__ ("gp");
 		memset(childregs, 0, sizeof(struct pt_regs));
-		childregs->gp = gp;
+		childregs->gp = gp_in_global;
 		childregs->sstatus = SR_SPP | SR_SPIE; /* Supervisor, irqs on */

 		p->thread.ra = (unsigned long)ret_from_kernel_thread;
--- a/arch/riscv/kernel/stacktrace.c
+++ b/arch/riscv/kernel/stacktrace.c
@ -12,6 +12,8 @@
 #include <linux/stacktrace.h>
 #include <linux/ftrace.h>

+register unsigned long sp_in_global __asm__("sp");
+
 #ifdef CONFIG_FRAME_POINTER

 struct stackframe {
@ -29,7 +31,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
 		sp = user_stack_pointer(regs);
 		pc = instruction_pointer(regs);
 	} else if (task == NULL || task == current) {
-		const register unsigned long current_sp __asm__ ("sp");
+		const register unsigned long current_sp = sp_in_global;
 		fp = (unsigned long)__builtin_frame_address(0);
 		sp = current_sp;
 		pc = (unsigned long)walk_stackframe;
@ -73,8 +75,7 @@ void notrace walk_stackframe(struct task_struct *task,
 		sp = user_stack_pointer(regs);
 		pc = instruction_pointer(regs);
 	} else if (task == NULL || task == current) {
-		const register unsigned long current_sp __asm__ ("sp");
-		sp = current_sp;
+		sp = sp_in_global;
 		pc = (unsigned long)walk_stackframe;
 	} else {
 		/* task blocked in __switch_to */
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@ -53,8 +53,10 @@ static inline int test_facility(unsigned long nr)
 	unsigned long facilities_als[] = { FACILITIES_ALS };

 	if (__builtin_constant_p(nr) && nr < sizeof(facilities_als) * 8) {
-		if (__test_facility(nr, &facilities_als))
-			return 1;
+		if (__test_facility(nr, &facilities_als)) {
+			if (!__is_defined(__DECOMPRESSOR))
+				return 1;
+		}
 	}
 	return __test_facility(nr, &S390_lowcore.stfle_fac_list);
 }
--- a/arch/s390/include/asm/uv.h
+++ b/arch/s390/include/asm/uv.h
@ -97,7 +97,10 @@ static inline int share(unsigned long addr, u16 cmd)

 	if (!uv_call(0, (u64)&uvcb))
 		return 0;
-	return -EINVAL;
+	pr_err("%s UVC failed (rc: 0x%x, rrc: 0x%x), possible hypervisor bug.\n",
+	       uvcb.header.cmd == UVC_CMD_SET_SHARED_ACCESS ? "Share" : "Unshare",
+	       uvcb.header.rc, uvcb.header.rrc);
+	panic("System security cannot be guaranteed unless the system panics now.\n");
 }

 /*
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@ -1412,7 +1412,7 @@ static int aux_output_begin(struct perf_output_handle *handle,
 	unsigned long head, base, offset;
 	struct hws_trailer_entry *te;

-	if (WARN_ON_ONCE(handle->head & ~PAGE_MASK))
+	if (handle->head & ~PAGE_MASK)
 		return -EINVAL;

 	aux->head = handle->head >> PAGE_SHIFT;
@ -1580,7 +1580,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
 	unsigned long num_sdb;

 	aux = perf_get_aux(handle);
-	if (WARN_ON_ONCE(!aux))
+	if (!aux)
 		return;

 	/* Inform user space new data arrived */
@ -1599,7 +1599,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
 			debug_sprintf_event(sfdbg, 1, "AUX buffer used up\n");
 			break;
 		}
-		if (WARN_ON_ONCE(!aux))
+		if (!aux)
 			return;

 		/* Update head and alert_mark to new position */
@ -1836,12 +1836,8 @@ static void cpumsf_pmu_start(struct perf_event *event, int flags)
 {
 	struct cpu_hw_sf *cpuhw = this_cpu_ptr(&cpu_hw_sf);

-	if (WARN_ON_ONCE(!(event->hw.state & PERF_HES_STOPPED)))
+	if (!(event->hw.state & PERF_HES_STOPPED))
 		return;
-
-	if (flags & PERF_EF_RELOAD)
-		WARN_ON_ONCE(!(event->hw.state & PERF_HES_UPTODATE));
-
 	perf_pmu_disable(event->pmu);
 	event->hw.state = 0;
 	cpuhw->lsctl.cs = 1;
@ -1866,7 +1862,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags)
 	event->hw.state |= PERF_HES_STOPPED;

 	if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) {
-		hw_perf_event_update(event, 1);
+		/* CPU hotplug off removes SDBs. No samples to extract. */
+		if (cpuhw->flags & PMU_F_RESERVED)
+			hw_perf_event_update(event, 1);
 		event->hw.state |= PERF_HES_UPTODATE;
 	}
 	perf_pmu_enable(event->pmu);
--- a/arch/s390/kernel/syscalls/Makefile
+++ b/arch/s390/kernel/syscalls/Makefile
@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h
 uapi-hdrs-y := $(uapi)/unistd_32.h
 uapi-hdrs-y += $(uapi)/unistd_64.h

-targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))
+targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))

 PHONY += kapi uapi

--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@ -78,7 +78,7 @@ static int __diag_page_ref_service(struct kvm_vcpu *vcpu)
 	vcpu->stat.diagnose_258++;
 	if (vcpu->run->s.regs.gprs[rx] & 7)
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-	rc = read_guest(vcpu, vcpu->run->s.regs.gprs[rx], rx, &parm, sizeof(parm));
+	rc = read_guest_real(vcpu, vcpu->run->s.regs.gprs[rx], &parm, sizeof(parm));
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
 	if (parm.parm_version != 2 || parm.parm_len < 5 || parm.code != 0x258)
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@ -794,46 +794,102 @@ static int low_address_protection_enabled(struct kvm_vcpu *vcpu,
 	return 1;
 }

-static int guest_page_range(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
-			    unsigned long *pages, unsigned long nr_pages,
-			    const union asce asce, enum gacc_mode mode)
+/**
+ * guest_range_to_gpas() - Calculate guest physical addresses of page fragments
+ * covering a logical range
+ * @vcpu: virtual cpu
+ * @ga: guest address, start of range
+ * @ar: access register
+ * @gpas: output argument, may be NULL
+ * @len: length of range in bytes
+ * @asce: address-space-control element to use for translation
+ * @mode: access mode
+ *
+ * Translate a logical range to a series of guest absolute addresses,
+ * such that the concatenation of page fragments starting at each gpa make up
+ * the whole range.
+ * The translation is performed as if done by the cpu for the given @asce, @ar,
+ * @mode and state of the @vcpu.
+ * If the translation causes an exception, its program interruption code is
+ * returned and the &struct kvm_s390_pgm_info pgm member of @vcpu is modified
+ * such that a subsequent call to kvm_s390_inject_prog_vcpu() will inject
+ * a correct exception into the guest.
+ * The resulting gpas are stored into @gpas, unless it is NULL.
+ *
+ * Note: All fragments except the first one start at the beginning of a page.
+ *	 When deriving the boundaries of a fragment from a gpa, all but the last
+ *	 fragment end at the end of the page.
+ *
+ * Return:
+ * * 0		- success
+ * * <0		- translation could not be performed, for example if  guest
+ *		  memory could not be accessed
+ * * >0		- an access exception occurred. In this case the returned value
+ *		  is the program interruption code and the contents of pgm may
+ *		  be used to inject an exception into the guest.
+ */
+static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
+			       unsigned long *gpas, unsigned long len,
+			       const union asce asce, enum gacc_mode mode)
 {
 	psw_t *psw = &vcpu->arch.sie_block->gpsw;
+	unsigned int offset = offset_in_page(ga);
+	unsigned int fragment_len;
 	int lap_enabled, rc = 0;
 	enum prot_type prot;
+	unsigned long gpa;

 	lap_enabled = low_address_protection_enabled(vcpu, asce);
-	while (nr_pages) {
+	while (min(PAGE_SIZE - offset, len) > 0) {
+		fragment_len = min(PAGE_SIZE - offset, len);
 		ga = kvm_s390_logical_to_effective(vcpu, ga);
 		if (mode == GACC_STORE && lap_enabled && is_low_address(ga))
 			return trans_exc(vcpu, PGM_PROTECTION, ga, ar, mode,
 					 PROT_TYPE_LA);
-		ga &= PAGE_MASK;
 		if (psw_bits(*psw).dat) {
-			rc = guest_translate(vcpu, ga, pages, asce, mode, &prot);
+			rc = guest_translate(vcpu, ga, &gpa, asce, mode, &prot);
 			if (rc < 0)
 				return rc;
 		} else {
-			*pages = kvm_s390_real_to_abs(vcpu, ga);
-			if (kvm_is_error_gpa(vcpu->kvm, *pages))
+			gpa = kvm_s390_real_to_abs(vcpu, ga);
+			if (kvm_is_error_gpa(vcpu->kvm, gpa))
 				rc = PGM_ADDRESSING;
 		}
 		if (rc)
 			return trans_exc(vcpu, rc, ga, ar, mode, prot);
-		ga += PAGE_SIZE;
-		pages++;
-		nr_pages--;
+		if (gpas)
+			*gpas++ = gpa;
+		offset = 0;
+		ga += fragment_len;
+		len -= fragment_len;
 	}
 	return 0;
 }

+static int access_guest_page(struct kvm *kvm, enum gacc_mode mode, gpa_t gpa,
+			     void *data, unsigned int len)
+{
+	const unsigned int offset = offset_in_page(gpa);
+	const gfn_t gfn = gpa_to_gfn(gpa);
+	int rc;
+
+	if (!gfn_to_memslot(kvm, gfn))
+		return PGM_ADDRESSING;
+	if (mode == GACC_STORE)
+		rc = kvm_write_guest_page(kvm, gfn, data, offset, len);
+	else
+		rc = kvm_read_guest_page(kvm, gfn, data, offset, len);
+	return rc;
+}
+
 int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,
 		 unsigned long len, enum gacc_mode mode)
 {
 	psw_t *psw = &vcpu->arch.sie_block->gpsw;
-	unsigned long _len, nr_pages, gpa, idx;
-	unsigned long pages_array[2];
-	unsigned long *pages;
+	unsigned long nr_pages, idx;
+	unsigned long gpa_array[2];
+	unsigned int fragment_len;
+	unsigned long *gpas;
 	int need_ipte_lock;
 	union asce asce;
 	int rc;
@ -845,50 +901,45 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,
 	if (rc)
 		return rc;
 	nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1;
-	pages = pages_array;
-	if (nr_pages > ARRAY_SIZE(pages_array))
-		pages = vmalloc(array_size(nr_pages, sizeof(unsigned long)));
-	if (!pages)
+	gpas = gpa_array;
+	if (nr_pages > ARRAY_SIZE(gpa_array))
+		gpas = vmalloc(array_size(nr_pages, sizeof(unsigned long)));
+	if (!gpas)
 		return -ENOMEM;
 	need_ipte_lock = psw_bits(*psw).dat && !asce.r;
 	if (need_ipte_lock)
 		ipte_lock(vcpu);
-	rc = guest_page_range(vcpu, ga, ar, pages, nr_pages, asce, mode);
+	rc = guest_range_to_gpas(vcpu, ga, ar, gpas, len, asce, mode);
 	for (idx = 0; idx < nr_pages && !rc; idx++) {
-		gpa = *(pages + idx) + (ga & ~PAGE_MASK);
-		_len = min(PAGE_SIZE - (gpa & ~PAGE_MASK), len);
-		if (mode == GACC_STORE)
-			rc = kvm_write_guest(vcpu->kvm, gpa, data, _len);
-		else
-			rc = kvm_read_guest(vcpu->kvm, gpa, data, _len);
-		len -= _len;
-		ga += _len;
-		data += _len;
+		fragment_len = min(PAGE_SIZE - offset_in_page(gpas[idx]), len);
+		rc = access_guest_page(vcpu->kvm, mode, gpas[idx], data, fragment_len);
+		len -= fragment_len;
+		data += fragment_len;
 	}
 	if (need_ipte_lock)
 		ipte_unlock(vcpu);
-	if (nr_pages > ARRAY_SIZE(pages_array))
-		vfree(pages);
+	if (nr_pages > ARRAY_SIZE(gpa_array))
+		vfree(gpas);
 	return rc;
 }

 int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
 		      void *data, unsigned long len, enum gacc_mode mode)
 {
-	unsigned long _len, gpa;
+	unsigned int fragment_len;
+	unsigned long gpa;
 	int rc = 0;

 	while (len && !rc) {
 		gpa = kvm_s390_real_to_abs(vcpu, gra);
-		_len = min(PAGE_SIZE - (gpa & ~PAGE_MASK), len);
-		if (mode)
-			rc = write_guest_abs(vcpu, gpa, data, _len);
-		else
-			rc = read_guest_abs(vcpu, gpa, data, _len);
-		len -= _len;
-		gra += _len;
-		data += _len;
+		fragment_len = min(PAGE_SIZE - offset_in_page(gpa), len);
+		rc = access_guest_page(vcpu->kvm, mode, gpa, data, fragment_len);
+		len -= fragment_len;
+		gra += fragment_len;
+		data += fragment_len;
 	}
+	if (rc > 0)
+		vcpu->arch.pgm.code = rc;
 	return rc;
 }

@ -904,8 +955,6 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
 int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar,
 			    unsigned long *gpa, enum gacc_mode mode)
 {
-	psw_t *psw = &vcpu->arch.sie_block->gpsw;
-	enum prot_type prot;
 	union asce asce;
 	int rc;

@ -913,23 +962,7 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar,
 	rc = get_vcpu_asce(vcpu, &asce, gva, ar, mode);
 	if (rc)
 		return rc;
-	if (is_low_address(gva) && low_address_protection_enabled(vcpu, asce)) {
-		if (mode == GACC_STORE)
-			return trans_exc(vcpu, PGM_PROTECTION, gva, 0,
-					 mode, PROT_TYPE_LA);
-	}
-
-	if (psw_bits(*psw).dat && !asce.r) {	/* Use DAT? */
-		rc = guest_translate(vcpu, gva, gpa, asce, mode, &prot);
-		if (rc > 0)
-			return trans_exc(vcpu, rc, gva, 0, mode, prot);
-	} else {
-		*gpa = kvm_s390_real_to_abs(vcpu, gva);
-		if (kvm_is_error_gpa(vcpu->kvm, *gpa))
-			return trans_exc(vcpu, rc, gva, PGM_ADDRESSING, mode, 0);
-	}
-
-	return rc;
+	return guest_range_to_gpas(vcpu, gva, ar, gpa, 1, asce, mode);
 }

 /**
@ -938,17 +971,14 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar,
 int check_gva_range(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar,
 		    unsigned long length, enum gacc_mode mode)
 {
-	unsigned long gpa;
-	unsigned long currlen;
+	union asce asce;
 	int rc = 0;

+	rc = get_vcpu_asce(vcpu, &asce, gva, ar, mode);
+	if (rc)
+		return rc;
 	ipte_lock(vcpu);
-	while (length > 0 && !rc) {
-		currlen = min(length, PAGE_SIZE - (gva % PAGE_SIZE));
-		rc = guest_translate_address(vcpu, gva, ar, &gpa, mode);
-		gva += currlen;
-		length -= currlen;
-	}
+	rc = guest_range_to_gpas(vcpu, gva, ar, NULL, length, asce, mode);
 	ipte_unlock(vcpu);

 	return rc;
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@ -344,11 +344,12 @@ int read_guest_abs(struct kvm_vcpu *vcpu, unsigned long gpa, void *data,
 * @len: number of bytes to copy
 *
 * Copy @len bytes from @data (kernel space) to @gra (guest real address).
- * It is up to the caller to ensure that the entire guest memory range is
- * valid memory before calling this function.
 * Guest low address and key protection are not checked.
 *
- * Returns zero on success or -EFAULT on error.
+ * Returns zero on success, -EFAULT when copying from @data failed, or
+ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info
+ * is also stored to allow injecting into the guest (if applicable) using
+ * kvm_s390_inject_prog_cond().
 *
 * If an error occurs data may have been copied partially to guest memory.
 */
@ -367,11 +368,12 @@ int write_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, void *data,
 * @len: number of bytes to copy
 *
 * Copy @len bytes from @gra (guest real address) to @data (kernel space).
- * It is up to the caller to ensure that the entire guest memory range is
- * valid memory before calling this function.
 * Guest key protection is not checked.
 *
- * Returns zero on success or -EFAULT on error.
+ * Returns zero on success, -EFAULT when copying to @data failed, or
+ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info
+ * is also stored to allow injecting into the guest (if applicable) using
+ * kvm_s390_inject_prog_cond().
 *
 * If an error occurs data may have been copied partially to kernel space.
 */
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@ -98,11 +98,12 @@ static long cmm_alloc_pages(long nr, long *counter,
 		(*counter)++;
 		spin_unlock(&cmm_lock);
 		nr--;
+		cond_resched();
 	}
 	return nr;
 }

-static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+static long __cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 {
 	struct cmm_page_array *pa;
 	unsigned long addr;
@ -126,6 +127,21 @@ static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 	return nr;
 }

+static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+{
+	long inc = 0;
+
+	while (nr) {
+		inc = min(256L, nr);
+		nr -= inc;
+		inc = __cmm_free_pages(inc, counter, list);
+		if (inc)
+			break;
+		cond_resched();
+	}
+	return nr + inc;
+}
+
 static int cmm_oom_notify(struct notifier_block *self,
 			  unsigned long dummy, void *parm)
 {
--- a/arch/sh/kernel/cpu/proc.c
+++ b/arch/sh/kernel/cpu/proc.c
@ -133,7 +133,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)

 static void *c_start(struct seq_file *m, loff_t *pos)
 {
-	return *pos < NR_CPUS ? cpu_data + *pos : NULL;
+	return *pos < nr_cpu_ids ? cpu_data + *pos : NULL;
 }
 static void *c_next(struct seq_file *m, void *v, loff_t *pos)
 {
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void);
 int prom_ihandle2path(int handle, char *buffer, int bufsize);

 /* Client interface level routines. */
+void prom_cif_init(void *cif_handler);
 void p1275_cmd_direct(unsigned long *);

 #endif /* !(__SPARC64_OPLIB_H) */
--- a/arch/sparc/prom/init_64.c
+++ b/arch/sparc/prom/init_64.c
@ -26,9 +26,6 @@ phandle prom_chosen_node;
 * routines in the prom library.
 * It gets passed the pointer to the PROM vector.
 */
-
-extern void prom_cif_init(void *);
-
 void __init prom_init(void *cif_handler)
 {
 	phandle node;
--- a/arch/sparc/prom/p1275.c
+++ b/arch/sparc/prom/p1275.c
@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args)
 	local_irq_restore(flags);
 }

-void prom_cif_init(void *cif_handler, void *cif_stack)
+void prom_cif_init(void *cif_handler)
 {
 	p1275buf.prom_cif_handler = (void (*)(long *))cif_handler;
 }
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@ -383,6 +383,7 @@ int setup_one_line(struct line *lines, int n, char *init,
 			parse_chan_pair(NULL, line, n, opts, error_out);
 			err = 0;
 		}
+		*error_out = "configured as 'none'";
 	} else {
 		char *new = kstrdup(init, GFP_KERNEL);
 		if (!new) {
@ -406,6 +407,7 @@ int setup_one_line(struct line *lines, int n, char *init,
 			}
 		}
 		if (err) {
+			*error_out = "failed to parse channel pair";
 			line->init_str = NULL;
 			line->valid = 0;
 			kfree(new);
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@ -347,7 +347,7 @@ static struct platform_driver uml_net_driver = {

 static void net_device_release(struct device *dev)
 {
-	struct uml_net *device = dev_get_drvdata(dev);
+	struct uml_net *device = container_of(dev, struct uml_net, pdev.dev);
 	struct net_device *netdev = device->dev;
 	struct uml_net_private *lp = netdev_priv(netdev);

--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@ -860,7 +860,7 @@ static int ubd_open_dev(struct ubd *ubd_dev)

 static void ubd_device_release(struct device *dev)
 {
-	struct ubd *ubd_dev = dev_get_drvdata(dev);
+	struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev);

 	blk_cleanup_queue(ubd_dev->queue);
 	blk_mq_free_tag_set(&ubd_dev->tag_set);
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@ -802,7 +802,8 @@ static struct platform_driver uml_net_driver = {

 static void vector_device_release(struct device *dev)
 {
-	struct vector_device *device = dev_get_drvdata(dev);
+	struct vector_device *device =
+		container_of(dev, struct vector_device, pdev.dev);
 	struct net_device *netdev = device->dev;

 	list_del(&device->list);
--- a/arch/um/kernel/physmem.c
+++ b/arch/um/kernel/physmem.c
@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end,
 			  unsigned long len, unsigned long long highmem)
 {
 	unsigned long reserve = reserve_end - start;
-	long map_size = len - reserve;
+	unsigned long map_size = len - reserve;
 	int err;

-	if(map_size <= 0) {
+	if (len <= reserve) {
 		os_warn("Too few physical memory! Needed=%lu, given=%lu\n",
 			reserve, len);
 		exit(1);
@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end,
 	err = os_map_memory((void *) reserve_end, physmem_fd, reserve,
 			    map_size, 1, 1, 1);
 	if (err < 0) {
-		os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p "
+		os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p "
 			"failed - errno = %d\n", map_size,
 			(void *) reserve_end, err);
 		exit(1);
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@ -444,6 +444,6 @@ int elf_core_copy_fpregs(struct task_struct *t, elf_fpregset_t *fpu)
 {
 	int cpu = current_thread_info()->cpu;

-	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu);
+	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu) == 0;
 }

--- a/arch/um/kernel/sysrq.c
+++ b/arch/um/kernel/sysrq.c
@ -17,7 +17,9 @@

 static void _print_addr(void *data, unsigned long address, int reliable)
 {
-	pr_info(" [<%08lx>] %s%pS\n", address, reliable ? "" : "? ",
+	const char *loglvl = data;
+
+	printk("%s [<%08lx>] %s%pS\n", loglvl, address, reliable ? "" : "? ",
 		(void *)address);
 }

@ -25,9 +27,9 @@ static const struct stacktrace_ops stackops = {
 	.address = _print_addr
 };

-void show_stack(struct task_struct *task, unsigned long *stack)
+void show_stack_loglvl(struct task_struct *task, unsigned long *stack,
+		       const char *loglvl)
 {
-	unsigned long *sp = stack;
 	struct pt_regs *segv_regs = current->thread.segv_regs;
 	int i;

@ -38,10 +40,9 @@ void show_stack(struct task_struct *task, unsigned long *stack)
 	}

 	if (!stack)
-		sp = get_stack_pointer(task, segv_regs);
+		stack = get_stack_pointer(task, segv_regs);

-	pr_info("Stack:\n");
-	stack = sp;
+	printk("%sStack:\n", loglvl);
 	for (i = 0; i < 3 * STACKSLOTS_PER_LINE; i++) {
 		if (kstack_end(stack))
 			break;
@ -49,9 +50,12 @@ void show_stack(struct task_struct *task, unsigned long *stack)
 			pr_cont("\n");
 		pr_cont(" %08lx", *stack++);
 	}
-	pr_cont("\n");

-	pr_info("Call Trace:\n");
-	dump_trace(current, &stackops, NULL);
-	pr_info("\n");
+	printk("%sCall Trace:\n", loglvl);
+	dump_trace(task ?: current, &stackops, (void *)loglvl);
+}
+
+void show_stack(struct task_struct *task, unsigned long *stack)
+{
+	show_stack_loglvl(task, stack, KERN_INFO);
 }
--- a/arch/um/kernel/time.c
+++ b/arch/um/kernel/time.c
@ -256,9 +256,9 @@ int setup_time_travel_start(char *str)
 	return 1;
 }

-__setup("time-travel-start", setup_time_travel_start);
+__setup("time-travel-start=", setup_time_travel_start);
 __uml_help(setup_time_travel_start,
-"time-travel-start=<seconds>\n"
+"time-travel-start=<nanoseconds>\n"
 "Configure the UML instance's wall clock to start at this value rather than\n"
 "the host's wall clock at the time of UML boot.\n");
 #endif
--- a/Show more
+++ b/Show more