Linux patch 6.1.156.1-17

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 1652 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index aa47ca9b..328fcd23 100644
--- a/0000_README
+++ b/0000_README
@@ -99,6 +99,10 @@ Patch:  1013_linux-6.1.14.patch
 From:   https://www.kernel.org
 Desc:   Linux 6.1.14
 
+Patch:  1014_linux-6.1.15.patch
+From:   https://www.kernel.org
+Desc:   Linux 6.1.15
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1014_linux-6.1.15.patch b/1014_linux-6.1.15.patch
new file mode 100644
index 00000000..03dcc23c
--- /dev/null
+++ b/1014_linux-6.1.15.patch
@@ -0,0 +1,1648 @@
+diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
+index 60bceb018d6a9..21f01d32c9598 100644
+--- a/Documentation/trace/ftrace.rst
++++ b/Documentation/trace/ftrace.rst
+@@ -2940,7 +2940,7 @@ Produces::
+               bash-1994  [000] ....  4342.324898: ima_get_action <-process_measurement
+               bash-1994  [000] ....  4342.324898: ima_match_policy <-ima_get_action
+               bash-1994  [000] ....  4342.324899: do_truncate <-do_last
+-              bash-1994  [000] ....  4342.324899: should_remove_suid <-do_truncate
++              bash-1994  [000] ....  4342.324899: setattr_should_drop_suidgid <-do_truncate
+               bash-1994  [000] ....  4342.324899: notify_change <-do_truncate
+               bash-1994  [000] ....  4342.324900: current_fs_time <-notify_change
+               bash-1994  [000] ....  4342.324900: current_kernel_time <-current_fs_time
+diff --git a/Makefile b/Makefile
+index 3e82a32243626..4dfe902b7f193 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 6
+ PATCHLEVEL = 1
+-SUBLEVEL = 14
++SUBLEVEL = 15
+ EXTRAVERSION =
+ NAME = Hurr durr I'ma ninja sloth
+ 
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 487b0e03d4b43..2ca76b69add78 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -1181,6 +1181,7 @@
+ 		clock-names = "dp", "pclk";
+ 		phys = <&edp_phy>;
+ 		phy-names = "dp";
++		power-domains = <&power RK3288_PD_VIO>;
+ 		resets = <&cru SRST_EDP>;
+ 		reset-names = "dp";
+ 		rockchip,grf = <&grf>;
+diff --git a/arch/arm/boot/dts/stihxxx-b2120.dtsi b/arch/arm/boot/dts/stihxxx-b2120.dtsi
+index 2aa94605d3d47..d52a7aaa10743 100644
+--- a/arch/arm/boot/dts/stihxxx-b2120.dtsi
++++ b/arch/arm/boot/dts/stihxxx-b2120.dtsi
+@@ -178,7 +178,7 @@
+ 				tsin-num = <0>;
+ 				serial-not-parallel;
+ 				i2c-bus = <&ssc2>;
+-				reset-gpios = <&pio15 4 GPIO_ACTIVE_HIGH>;
++				reset-gpios = <&pio15 4 GPIO_ACTIVE_LOW>;
+ 				dvb-card = <STV0367_TDA18212_NIMA_1>;
+ 			};
+ 		};
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index aa22a0c222655..5d5d9574088ca 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -96,7 +96,6 @@
+ 			linux,default-trigger = "heartbeat";
+ 			gpios = <&rk805 1 GPIO_ACTIVE_LOW>;
+ 			default-state = "on";
+-			mode = <0x23>;
+ 		};
+ 
+ 		user_led: led-1 {
+@@ -104,7 +103,6 @@
+ 			linux,default-trigger = "mmc1";
+ 			gpios = <&rk805 0 GPIO_ACTIVE_LOW>;
+ 			default-state = "off";
+-			mode = <0x05>;
+ 		};
+ 	};
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi
+index 6e29e74f6fc68..783120e9cebeb 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi
+@@ -111,7 +111,7 @@
+ 		};
+ 	};
+ 
+-	dmc_opp_table: dmc_opp_table {
++	dmc_opp_table: opp-table-3 {
+ 		compatible = "operating-points-v2";
+ 
+ 		opp00 {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+index 2e058c3150256..fccc2b2f327df 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+@@ -83,6 +83,13 @@
+ 	};
+ };
+ 
++&cpu_alert0 {
++	temperature = <65000>;
++};
++&cpu_alert1 {
++	temperature = <68000>;
++};
++
+ &cpu_l0 {
+ 	cpu-supply = <&vdd_cpu_l>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+index 44313a18e484e..bab46db2b18cd 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+@@ -521,6 +521,8 @@
+ };
+ 
+ &i2s1_8ch {
++	pinctrl-names = "default";
++	pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>;
+ 	rockchip,trcm-sync-tx-only;
+ 	status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+index 164708f1eb674..1d423daae971b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -966,6 +966,7 @@
+ 		clock-names = "aclk_mst", "aclk_slv",
+ 			      "aclk_dbi", "pclk", "aux";
+ 		device_type = "pci";
++		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 7>;
+ 		interrupt-map = <0 0 0 1 &pcie_intc 0>,
+ 				<0 0 0 2 &pcie_intc 1>,
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts b/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts
+index 7069f51bc120e..99136adb1857f 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts
++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts
+@@ -24,7 +24,7 @@
+ 	snps,dis_enblslpm_quirk;
+ 	snps,dis_u2_susphy_quirk;
+ 	snps,dis_u3_susphy_quirk;
+-	snps,usb2_gadget_lpm_disable;
++	snps,usb2-gadget-lpm-disable;
+ 	phy-names = "usb2-phy", "usb3-phy";
+ 	phys = <&usb0_hsphy0>, <&usb0_ssphy0>;
+ };
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts b/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts
+index a3cfa8113ffb2..4c960f455461c 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts
++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts
+@@ -24,7 +24,7 @@
+ 	snps,dis_enblslpm_quirk;
+ 	snps,dis_u2_susphy_quirk;
+ 	snps,dis_u3_susphy_quirk;
+-	snps,usb2_gadget_lpm_disable;
++	snps,usb2-gadget-lpm-disable;
+ 	phy-names = "usb2-phy", "usb3-phy";
+ 	phys = <&usb1_hsphy0>, <&usb1_ssphy0>;
+ };
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 2ca5418457ed2..2b1141645d9e1 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -161,7 +161,6 @@ config PPC
+ 	select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
+ 	select ARCH_WANT_LD_ORPHAN_WARN
+ 	select ARCH_WANTS_MODULES_DATA_IN_VMALLOC	if PPC_BOOK3S_32 || PPC_8xx
+-	select ARCH_WANTS_NO_INSTR
+ 	select ARCH_WEAK_RELEASE_ACQUIRE
+ 	select BINFMT_ELF
+ 	select BUILDTIME_TABLE_SORT
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 347707d459c67..cbaf174d8efd9 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -123,6 +123,8 @@
+ #define INTEL_FAM6_METEORLAKE		0xAC
+ #define INTEL_FAM6_METEORLAKE_L		0xAA
+ 
++#define INTEL_FAM6_LUNARLAKE_M		0xBD
++
+ /* "Small Core" Processors (Atom/E-Core) */
+ 
+ #define INTEL_FAM6_ATOM_BONNELL		0x1C /* Diamondville, Pineview */
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ae5f4acf26753..6d4ac934cd499 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3297,8 +3297,8 @@ void acpi_nfit_shutdown(void *data)
+ 
+ 	mutex_lock(&acpi_desc->init_mutex);
+ 	set_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
+-	cancel_delayed_work_sync(&acpi_desc->dwork);
+ 	mutex_unlock(&acpi_desc->init_mutex);
++	cancel_delayed_work_sync(&acpi_desc->dwork);
+ 
+ 	/*
+ 	 * Bounce the nvdimm bus lock to make sure any in-flight
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index e9c4f22696c5c..a930b1873f2a4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -147,14 +147,6 @@ MODULE_FIRMWARE(FIRMWARE_NAVI12_DMCU);
+ /* Number of bytes in PSP footer for firmware. */
+ #define PSP_FOOTER_BYTES 0x100
+ 
+-/*
+- * DMUB Async to Sync Mechanism Status
+- */
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_FAIL 1
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT 2
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS 3
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_INVALID 4
+-
+ /**
+  * DOC: overview
+  *
+@@ -1456,6 +1448,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+ 	memset(&init_params, 0, sizeof(init_params));
+ #endif
+ 
++	mutex_init(&adev->dm.dpia_aux_lock);
+ 	mutex_init(&adev->dm.dc_lock);
+ 	mutex_init(&adev->dm.audio_lock);
+ 	spin_lock_init(&adev->dm.vblank_lock);
+@@ -1816,6 +1809,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
+ 
+ 	mutex_destroy(&adev->dm.audio_lock);
+ 	mutex_destroy(&adev->dm.dc_lock);
++	mutex_destroy(&adev->dm.dpia_aux_lock);
+ 
+ 	return;
+ }
+@@ -10200,91 +10194,95 @@ uint32_t dm_read_reg_func(const struct dc_context *ctx, uint32_t address,
+ 	return value;
+ }
+ 
+-static int amdgpu_dm_set_dmub_async_sync_status(bool is_cmd_aux,
+-						struct dc_context *ctx,
+-						uint8_t status_type,
+-						uint32_t *operation_result)
++int amdgpu_dm_process_dmub_aux_transfer_sync(
++		struct dc_context *ctx,
++		unsigned int link_index,
++		struct aux_payload *payload,
++		enum aux_return_code_type *operation_result)
+ {
+ 	struct amdgpu_device *adev = ctx->driver_context;
+-	int return_status = -1;
+ 	struct dmub_notification *p_notify = adev->dm.dmub_notify;
++	int ret = -1;
+ 
+-	if (is_cmd_aux) {
+-		if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS) {
+-			return_status = p_notify->aux_reply.length;
+-			*operation_result = p_notify->result;
+-		} else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT) {
+-			*operation_result = AUX_RET_ERROR_TIMEOUT;
+-		} else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_FAIL) {
+-			*operation_result = AUX_RET_ERROR_ENGINE_ACQUIRE;
+-		} else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_INVALID) {
+-			*operation_result = AUX_RET_ERROR_INVALID_REPLY;
+-		} else {
+-			*operation_result = AUX_RET_ERROR_UNKNOWN;
++	mutex_lock(&adev->dm.dpia_aux_lock);
++	if (!dc_process_dmub_aux_transfer_async(ctx->dc, link_index, payload)) {
++		*operation_result = AUX_RET_ERROR_ENGINE_ACQUIRE;
++		goto out;
++ 	}
++
++	if (!wait_for_completion_timeout(&adev->dm.dmub_aux_transfer_done, 10 * HZ)) {
++		DRM_ERROR("wait_for_completion_timeout timeout!");
++		*operation_result = AUX_RET_ERROR_TIMEOUT;
++		goto out;
++	}
++
++	if (p_notify->result != AUX_RET_SUCCESS) {
++		/*
++		 * Transient states before tunneling is enabled could
++		 * lead to this error. We can ignore this for now.
++		 */
++		if (p_notify->result != AUX_RET_ERROR_PROTOCOL_ERROR) {
++			DRM_WARN("DPIA AUX failed on 0x%x(%d), error %d\n",
++					payload->address, payload->length,
++					p_notify->result);
+ 		}
+-	} else {
+-		if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS) {
+-			return_status = 0;
+-			*operation_result = p_notify->sc_status;
+-		} else {
+-			*operation_result = SET_CONFIG_UNKNOWN_ERROR;
++		*operation_result = AUX_RET_ERROR_INVALID_REPLY;
++		goto out;
++	}
++
++
++	payload->reply[0] = adev->dm.dmub_notify->aux_reply.command;
++	if (!payload->write && p_notify->aux_reply.length &&
++			(payload->reply[0] == AUX_TRANSACTION_REPLY_AUX_ACK)) {
++
++		if (payload->length != p_notify->aux_reply.length) {
++			DRM_WARN("invalid read length %d from DPIA AUX 0x%x(%d)!\n",
++				p_notify->aux_reply.length,
++					payload->address, payload->length);
++			*operation_result = AUX_RET_ERROR_INVALID_REPLY;
++			goto out;
+ 		}
++
++		memcpy(payload->data, p_notify->aux_reply.data,
++				p_notify->aux_reply.length);
+ 	}
+ 
+-	return return_status;
++	/* success */
++	ret = p_notify->aux_reply.length;
++	*operation_result = p_notify->result;
++out:
++	reinit_completion(&adev->dm.dmub_aux_transfer_done);
++	mutex_unlock(&adev->dm.dpia_aux_lock);
++	return ret;
+ }
+ 
+-int amdgpu_dm_process_dmub_aux_transfer_sync(bool is_cmd_aux, struct dc_context *ctx,
+-	unsigned int link_index, void *cmd_payload, void *operation_result)
++int amdgpu_dm_process_dmub_set_config_sync(
++		struct dc_context *ctx,
++		unsigned int link_index,
++		struct set_config_cmd_payload *payload,
++		enum set_config_status *operation_result)
+ {
+ 	struct amdgpu_device *adev = ctx->driver_context;
+-	int ret = 0;
++	bool is_cmd_complete;
++	int ret;
+ 
+-	if (is_cmd_aux) {
+-		dc_process_dmub_aux_transfer_async(ctx->dc,
+-			link_index, (struct aux_payload *)cmd_payload);
+-	} else if (dc_process_dmub_set_config_async(ctx->dc, link_index,
+-					(struct set_config_cmd_payload *)cmd_payload,
+-					adev->dm.dmub_notify)) {
+-		return amdgpu_dm_set_dmub_async_sync_status(is_cmd_aux,
+-					ctx, DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS,
+-					(uint32_t *)operation_result);
+-	}
++	mutex_lock(&adev->dm.dpia_aux_lock);
++	is_cmd_complete = dc_process_dmub_set_config_async(ctx->dc,
++			link_index, payload, adev->dm.dmub_notify);
+ 
+-	ret = wait_for_completion_timeout(&adev->dm.dmub_aux_transfer_done, 10 * HZ);
+-	if (ret == 0) {
++	if (is_cmd_complete || wait_for_completion_timeout(&adev->dm.dmub_aux_transfer_done, 10 * HZ)) {
++		ret = 0;
++		*operation_result = adev->dm.dmub_notify->sc_status;
++	} else {
+ 		DRM_ERROR("wait_for_completion_timeout timeout!");
+-		return amdgpu_dm_set_dmub_async_sync_status(is_cmd_aux,
+-				ctx, DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT,
+-				(uint32_t *)operation_result);
+-	}
+-
+-	if (is_cmd_aux) {
+-		if (adev->dm.dmub_notify->result == AUX_RET_SUCCESS) {
+-			struct aux_payload *payload = (struct aux_payload *)cmd_payload;
+-
+-			payload->reply[0] = adev->dm.dmub_notify->aux_reply.command;
+-			if (!payload->write && adev->dm.dmub_notify->aux_reply.length &&
+-			    payload->reply[0] == AUX_TRANSACTION_REPLY_AUX_ACK) {
+-
+-				if (payload->length != adev->dm.dmub_notify->aux_reply.length) {
+-					DRM_WARN("invalid read from DPIA AUX %x(%d) got length %d!\n",
+-							payload->address, payload->length,
+-							adev->dm.dmub_notify->aux_reply.length);
+-					return amdgpu_dm_set_dmub_async_sync_status(is_cmd_aux, ctx,
+-							DMUB_ASYNC_TO_SYNC_ACCESS_INVALID,
+-							(uint32_t *)operation_result);
+-				}
+-
+-				memcpy(payload->data, adev->dm.dmub_notify->aux_reply.data,
+-				       adev->dm.dmub_notify->aux_reply.length);
+-			}
+-		}
++		ret = -1;
++		*operation_result = SET_CONFIG_UNKNOWN_ERROR;
+ 	}
+ 
+-	return amdgpu_dm_set_dmub_async_sync_status(is_cmd_aux,
+-			ctx, DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS,
+-			(uint32_t *)operation_result);
++	if (!is_cmd_complete)
++		reinit_completion(&adev->dm.dmub_aux_transfer_done);
++	mutex_unlock(&adev->dm.dpia_aux_lock);
++	return ret;
+ }
+ 
+ /*
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index 635c398fcefe7..ac26e917240b9 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -59,7 +59,9 @@
+ #include "signal_types.h"
+ #include "amdgpu_dm_crc.h"
+ struct aux_payload;
++struct set_config_cmd_payload;
+ enum aux_return_code_type;
++enum set_config_status;
+ 
+ /* Forward declarations */
+ struct amdgpu_device;
+@@ -549,6 +551,13 @@ struct amdgpu_display_manager {
+ 	 * occurred on certain intel platform
+ 	 */
+ 	bool aux_hpd_discon_quirk;
++
++	/**
++	 * @dpia_aux_lock:
++	 *
++	 * Guards access to DPIA AUX
++	 */
++	struct mutex dpia_aux_lock;
+ };
+ 
+ enum dsc_clock_force_state {
+@@ -792,9 +801,11 @@ void amdgpu_dm_update_connector_after_detect(
+ 
+ extern const struct drm_encoder_helper_funcs amdgpu_dm_encoder_helper_funcs;
+ 
+-int amdgpu_dm_process_dmub_aux_transfer_sync(bool is_cmd_aux,
+-					struct dc_context *ctx, unsigned int link_index,
+-					void *payload, void *operation_result);
++int amdgpu_dm_process_dmub_aux_transfer_sync(struct dc_context *ctx, unsigned int link_index,
++					struct aux_payload *payload, enum aux_return_code_type *operation_result);
++
++int amdgpu_dm_process_dmub_set_config_sync(struct dc_context *ctx, unsigned int link_index,
++					struct set_config_cmd_payload *payload, enum set_config_status *operation_result);
+ 
+ bool check_seamless_boot_capability(struct amdgpu_device *adev);
+ 
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+index 16623f73ddbe6..57454967617f8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+@@ -844,9 +844,8 @@ int dm_helper_dmub_aux_transfer_sync(
+ 		struct aux_payload *payload,
+ 		enum aux_return_code_type *operation_result)
+ {
+-	return amdgpu_dm_process_dmub_aux_transfer_sync(true, ctx,
+-			link->link_index, (void *)payload,
+-			(void *)operation_result);
++	return amdgpu_dm_process_dmub_aux_transfer_sync(ctx, link->link_index, payload,
++			operation_result);
+ }
+ 
+ int dm_helpers_dmub_set_config_sync(struct dc_context *ctx,
+@@ -854,9 +853,8 @@ int dm_helpers_dmub_set_config_sync(struct dc_context *ctx,
+ 		struct set_config_cmd_payload *payload,
+ 		enum set_config_status *operation_result)
+ {
+-	return amdgpu_dm_process_dmub_aux_transfer_sync(false, ctx,
+-			link->link_index, (void *)payload,
+-			(void *)operation_result);
++	return amdgpu_dm_process_dmub_set_config_sync(ctx, link->link_index, payload,
++			operation_result);
+ }
+ 
+ void dm_set_dcn_clocks(struct dc_context *ctx, struct dc_clocks *clks)
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c
+index a0741794db62a..8e824dc81dede 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c
+@@ -391,3 +391,27 @@ void dcn314_set_pixels_per_cycle(struct pipe_ctx *pipe_ctx)
+ 		pipe_ctx->stream_res.stream_enc->funcs->set_input_mode(pipe_ctx->stream_res.stream_enc,
+ 				pix_per_cycle);
+ }
++
++void dcn314_hubp_pg_control(struct dce_hwseq *hws, unsigned int hubp_inst, bool power_on)
++{
++	struct dc_context *ctx = hws->ctx;
++	union dmub_rb_cmd cmd;
++
++	if (hws->ctx->dc->debug.disable_hubp_power_gate)
++		return;
++
++	PERF_TRACE();
++
++	memset(&cmd, 0, sizeof(cmd));
++	cmd.domain_control.header.type = DMUB_CMD__VBIOS;
++	cmd.domain_control.header.sub_type = DMUB_CMD__VBIOS_DOMAIN_CONTROL;
++	cmd.domain_control.header.payload_bytes = sizeof(cmd.domain_control.data);
++	cmd.domain_control.data.inst = hubp_inst;
++	cmd.domain_control.data.power_gate = !power_on;
++
++	dc_dmub_srv_cmd_queue(ctx->dmub_srv, &cmd);
++	dc_dmub_srv_cmd_execute(ctx->dmub_srv);
++	dc_dmub_srv_wait_idle(ctx->dmub_srv);
++
++	PERF_TRACE();
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h
+index 244280298212c..c419d3dbdfee6 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h
+@@ -41,4 +41,6 @@ unsigned int dcn314_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsig
+ 
+ void dcn314_set_pixels_per_cycle(struct pipe_ctx *pipe_ctx);
+ 
++void dcn314_hubp_pg_control(struct dce_hwseq *hws, unsigned int hubp_inst, bool power_on);
++
+ #endif /* __DC_HWSS_DCN314_H__ */
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_init.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_init.c
+index 5b6c2d94ec71d..343f4d9dd5e34 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_init.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_init.c
+@@ -137,7 +137,7 @@ static const struct hwseq_private_funcs dcn314_private_funcs = {
+ 	.plane_atomic_disable = dcn20_plane_atomic_disable,
+ 	.plane_atomic_power_down = dcn10_plane_atomic_power_down,
+ 	.enable_power_gating_plane = dcn314_enable_power_gating_plane,
+-	.hubp_pg_control = dcn31_hubp_pg_control,
++	.hubp_pg_control = dcn314_hubp_pg_control,
+ 	.program_all_writeback_pipes_in_tree = dcn30_program_all_writeback_pipes_in_tree,
+ 	.update_odm = dcn314_update_odm,
+ 	.dsc_pg_control = dcn314_dsc_pg_control,
+diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+index 7a8f61517424c..27a4ea7dc74ec 100644
+--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
++++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+@@ -450,6 +450,10 @@ enum dmub_cmd_vbios_type {
+ 	 * Query DP alt status on a transmitter.
+ 	 */
+ 	DMUB_CMD__VBIOS_TRANSMITTER_QUERY_DP_ALT  = 26,
++	/**
++	 * Controls domain power gating
++	 */
++	DMUB_CMD__VBIOS_DOMAIN_CONTROL = 28,
+ };
+ 
+ //==============================================================================
+@@ -1191,6 +1195,23 @@ struct dmub_rb_cmd_dig1_transmitter_control {
+ 	union dmub_cmd_dig1_transmitter_control_data transmitter_control; /**< payload */
+ };
+ 
++/**
++ * struct dmub_rb_cmd_domain_control_data - Data for DOMAIN power control
++ */
++struct dmub_rb_cmd_domain_control_data {
++	uint8_t inst : 6; /**< DOMAIN instance to control */
++	uint8_t power_gate : 1; /**< 1=power gate, 0=power up */
++	uint8_t reserved[3]; /**< Reserved for future use */
++};
++
++/**
++ * struct dmub_rb_cmd_domain_control - Controls DOMAIN power gating
++ */
++struct dmub_rb_cmd_domain_control {
++	struct dmub_cmd_header header; /**< header */
++	struct dmub_rb_cmd_domain_control_data data; /**< payload */
++};
++
+ /**
+  * DPIA tunnel command parameters.
+  */
+@@ -3187,6 +3208,10 @@ union dmub_rb_cmd {
+ 	 * Definition of a DMUB_CMD__VBIOS_DIG1_TRANSMITTER_CONTROL command.
+ 	 */
+ 	struct dmub_rb_cmd_dig1_transmitter_control dig1_transmitter_control;
++	/**
++	 * Definition of a DMUB_CMD__VBIOS_DOMAIN_CONTROL command.
++	 */
++	struct dmub_rb_cmd_domain_control domain_control;
+ 	/**
+ 	 * Definition of a DMUB_CMD__PSR_SET_VERSION command.
+ 	 */
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 3e1803592bd4a..5c72aef3d3dd5 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1202,6 +1202,7 @@ int hid_open_report(struct hid_device *device)
+ 	__u8 *end;
+ 	__u8 *next;
+ 	int ret;
++	int i;
+ 	static int (*dispatch_type[])(struct hid_parser *parser,
+ 				      struct hid_item *item) = {
+ 		hid_parser_main,
+@@ -1252,6 +1253,8 @@ int hid_open_report(struct hid_device *device)
+ 		goto err;
+ 	}
+ 	device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
++	for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++)
++		device->collection[i].parent_idx = -1;
+ 
+ 	ret = -EINVAL;
+ 	while ((next = fetch_item(start, end, &item)) != NULL) {
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index e59e9911fc370..4fa45ee77503b 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -12,6 +12,7 @@
+  *  Copyright (c) 2017 Alex Manoussakis <amanou@gnu.org>
+  *  Copyright (c) 2017 Tomasz Kramkowski <tk@the-tk.com>
+  *  Copyright (c) 2020 YOSHIOKA Takuma <lo48576@hard-wi.red>
++ *  Copyright (c) 2022 Takahiro Fujii <fujii@xaxxi.net>
+  */
+ 
+ /*
+@@ -89,7 +90,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 	case USB_DEVICE_ID_ELECOM_M_DT1URBK:
+ 	case USB_DEVICE_ID_ELECOM_M_DT1DRBK:
+ 	case USB_DEVICE_ID_ELECOM_M_HT1URBK:
+-	case USB_DEVICE_ID_ELECOM_M_HT1DRBK:
++	case USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D:
+ 		/*
+ 		 * Report descriptor format:
+ 		 * 12: button bit count
+@@ -99,6 +100,16 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		 */
+ 		mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8);
+ 		break;
++	case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C:
++		/*
++		 * Report descriptor format:
++		 * 22: button bit count
++		 * 30: padding bit count
++		 * 24: button report size
++		 * 16: button usage maximum
++		 */
++		mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
++		break;
+ 	}
+ 	return rdesc;
+ }
+@@ -112,7 +123,8 @@ static const struct hid_device_id elecom_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 0f8c11842a3a5..9e36b4cd905ee 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -413,6 +413,8 @@
+ #define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100	0x29CF
+ #define I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV	0x2CF9
+ #define I2C_DEVICE_ID_HP_SPECTRE_X360_15	0x2817
++#define I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG  0x29DF
++#define I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN 0x2BC8
+ #define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN	0x2544
+ #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706
+ #define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN	0x261A
+@@ -428,7 +430,8 @@
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK	0x00fe
+ #define USB_DEVICE_ID_ELECOM_M_DT1DRBK	0x00ff
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK	0x010c
+-#define USB_DEVICE_ID_ELECOM_M_HT1DRBK	0x010d
++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D	0x010d
++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C	0x011c
+ 
+ #define USB_VENDOR_ID_DREAM_CHEEKY	0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN	0x0004
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 3ee5a9fea20e6..7e94ca1822afb 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -370,6 +370,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
+ 		USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
+ 	  HID_BATTERY_QUIRK_IGNORE },
++	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN),
++	  HID_BATTERY_QUIRK_IGNORE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN),
+ 	  HID_BATTERY_QUIRK_IGNORE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
+@@ -384,6 +386,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ 	  HID_BATTERY_QUIRK_IGNORE },
+ 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15),
+ 	  HID_BATTERY_QUIRK_IGNORE },
++	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG),
++	  HID_BATTERY_QUIRK_IGNORE },
+ 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN),
+ 	  HID_BATTERY_QUIRK_IGNORE },
+ 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN),
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index be3ad02573de8..5bc91f68b3747 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -393,7 +393,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index b02f2f0809c81..350884d5f0896 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -160,16 +160,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
+ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ {
+ 	int pinned;
+-	unsigned int npages;
++	unsigned int npages = tidbuf->npages;
+ 	unsigned long vaddr = tidbuf->vaddr;
+ 	struct page **pages = NULL;
+ 	struct hfi1_devdata *dd = fd->uctxt->dd;
+ 
+-	/* Get the number of pages the user buffer spans */
+-	npages = num_user_pages(vaddr, tidbuf->length);
+-	if (!npages)
+-		return -EINVAL;
+-
+ 	if (npages > fd->uctxt->expected_count) {
+ 		dd_dev_err(dd, "Expected buffer too big\n");
+ 		return -EINVAL;
+@@ -196,7 +191,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ 		return pinned;
+ 	}
+ 	tidbuf->pages = pages;
+-	tidbuf->npages = npages;
+ 	fd->tid_n_pinned += pinned;
+ 	return pinned;
+ }
+@@ -274,6 +268,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+ 	mutex_init(&tidbuf->cover_mutex);
+ 	tidbuf->vaddr = tinfo->vaddr;
+ 	tidbuf->length = tinfo->length;
++	tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
+ 	tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
+ 				GFP_KERNEL);
+ 	if (!tidbuf->psets) {
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 9bc6e3922e78e..32c3edaf90385 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -365,6 +365,7 @@ static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc)
+ 
+ 			} else {
+ 				debounce_enable = "  ∅";
++				time = 0;
+ 			}
+ 			snprintf(debounce_value, sizeof(debounce_value), "%u", time * unit);
+ 			seq_printf(s, "debounce %s (🕑 %sus)| ", debounce_enable, debounce_value);
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index f566eb1839dc5..71e091f879f0e 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -403,10 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ 		unsigned int this_round, skip = 0;
+ 		int size;
+ 
+-		ret = -ENXIO;
+ 		vc = vcs_vc(inode, &viewed);
+-		if (!vc)
+-			goto unlock_out;
++		if (!vc) {
++			ret = -ENXIO;
++			break;
++		}
+ 
+ 		/* Check whether we are above size each round,
+ 		 * as copy_to_user at the end of this loop
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 0aaaadb02cc69..1abe43ddb75f0 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2389,9 +2389,8 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
+  * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
+  * @udev: newly addressed device (in ADDRESS state)
+  *
+- * This is only called by usb_new_device() and usb_authorize_device()
+- * and FIXME -- all comments that apply to them apply here wrt to
+- * environment.
++ * This is only called by usb_new_device() -- all comments that apply there
++ * apply here wrt to environment.
+  *
+  * If the device is WUSB and not authorized, we don't attempt to read
+  * the string descriptors, as they will be errored out by the device
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index 631574718d8ac..ccf6cd9722693 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -868,11 +868,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
+ 	size_t srclen, n;
+ 	int cfgno;
+ 	void *src;
+-	int retval;
+ 
+-	retval = usb_lock_device_interruptible(udev);
+-	if (retval < 0)
+-		return -EINTR;
+ 	/* The binary attribute begins with the device descriptor.
+ 	 * Following that are the raw descriptor entries for all the
+ 	 * configurations (config plus subsidiary descriptors).
+@@ -897,7 +893,6 @@ read_descriptors(struct file *filp, struct kobject *kobj,
+ 			off -= srclen;
+ 		}
+ 	}
+-	usb_unlock_device(udev);
+ 	return count - nleft;
+ }
+ 
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 89c9ab2b19f85..a23ddbb819795 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -47,6 +47,7 @@
+ #define PCI_DEVICE_ID_INTEL_ADLS		0x7ae1
+ #define PCI_DEVICE_ID_INTEL_RPL			0xa70e
+ #define PCI_DEVICE_ID_INTEL_RPLS		0x7a61
++#define PCI_DEVICE_ID_INTEL_MTLM		0x7eb1
+ #define PCI_DEVICE_ID_INTEL_MTLP		0x7ec1
+ #define PCI_DEVICE_ID_INTEL_MTL			0x7e7e
+ #define PCI_DEVICE_ID_INTEL_TGL			0x9a15
+@@ -467,6 +468,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS),
+ 	  (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+ 
++	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLM),
++	  (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP),
+ 	  (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+ 
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index 7538279f98179..db6fd0238d4b4 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -81,6 +81,9 @@
+ #define WRITE_BUF_SIZE		8192		/* TX only */
+ #define GS_CONSOLE_BUF_SIZE	8192
+ 
++/* Prevents race conditions while accessing gser->ioport */
++static DEFINE_SPINLOCK(serial_port_lock);
++
+ /* console info */
+ struct gs_console {
+ 	struct console		console;
+@@ -1374,8 +1377,10 @@ void gserial_disconnect(struct gserial *gser)
+ 	if (!port)
+ 		return;
+ 
++	spin_lock_irqsave(&serial_port_lock, flags);
++
+ 	/* tell the TTY glue not to do I/O here any more */
+-	spin_lock_irqsave(&port->port_lock, flags);
++	spin_lock(&port->port_lock);
+ 
+ 	gs_console_disconnect(port);
+ 
+@@ -1390,7 +1395,8 @@ void gserial_disconnect(struct gserial *gser)
+ 			tty_hangup(port->port.tty);
+ 	}
+ 	port->suspended = false;
+-	spin_unlock_irqrestore(&port->port_lock, flags);
++	spin_unlock(&port->port_lock);
++	spin_unlock_irqrestore(&serial_port_lock, flags);
+ 
+ 	/* disable endpoints, aborting down any active I/O */
+ 	usb_ep_disable(gser->out);
+@@ -1424,10 +1430,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend);
+ 
+ void gserial_resume(struct gserial *gser)
+ {
+-	struct gs_port *port = gser->ioport;
++	struct gs_port *port;
+ 	unsigned long	flags;
+ 
+-	spin_lock_irqsave(&port->port_lock, flags);
++	spin_lock_irqsave(&serial_port_lock, flags);
++	port = gser->ioport;
++
++	if (!port) {
++		spin_unlock_irqrestore(&serial_port_lock, flags);
++		return;
++	}
++
++	spin_lock(&port->port_lock);
++	spin_unlock(&serial_port_lock);
+ 	port->suspended = false;
+ 	if (!port->start_delayed) {
+ 		spin_unlock_irqrestore(&port->port_lock, flags);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6b69d05e2fb06..a8534065e0d6d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -402,6 +402,8 @@ static void option_instat_callback(struct urb *urb);
+ #define LONGCHEER_VENDOR_ID			0x1c9e
+ 
+ /* 4G Systems products */
++/* This one was sold as the VW and Skoda "Carstick LTE" */
++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE	0x7605
+ /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
+  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
+@@ -1976,6 +1978,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = RSVD(2) },
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
++	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE),
++	  .driver_info = RSVD(0) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ 	  .driver_info = NCTRL(0) | NCTRL(1) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),
+diff --git a/drivers/usb/typec/pd.c b/drivers/usb/typec/pd.c
+index dc72005d68db9..b5ab26422c349 100644
+--- a/drivers/usb/typec/pd.c
++++ b/drivers/usb/typec/pd.c
+@@ -161,7 +161,6 @@ static struct device_type source_fixed_supply_type = {
+ 
+ static struct attribute *sink_fixed_supply_attrs[] = {
+ 	&dev_attr_dual_role_power.attr,
+-	&dev_attr_usb_suspend_supported.attr,
+ 	&dev_attr_unconstrained_power.attr,
+ 	&dev_attr_usb_communication_capable.attr,
+ 	&dev_attr_dual_role_data.attr,
+diff --git a/fs/attr.c b/fs/attr.c
+index 1552a5f23d6b3..b45f30e516fad 100644
+--- a/fs/attr.c
++++ b/fs/attr.c
+@@ -18,6 +18,70 @@
+ #include <linux/evm.h>
+ #include <linux/ima.h>
+ 
++#include "internal.h"
++
++/**
++ * setattr_should_drop_sgid - determine whether the setgid bit needs to be
++ *                            removed
++ * @mnt_userns:	user namespace of the mount @inode was found from
++ * @inode:	inode to check
++ *
++ * This function determines whether the setgid bit needs to be removed.
++ * We retain backwards compatibility and require setgid bit to be removed
++ * unconditionally if S_IXGRP is set. Otherwise we have the exact same
++ * requirements as setattr_prepare() and setattr_copy().
++ *
++ * Return: ATTR_KILL_SGID if setgid bit needs to be removed, 0 otherwise.
++ */
++int setattr_should_drop_sgid(struct user_namespace *mnt_userns,
++			     const struct inode *inode)
++{
++	umode_t mode = inode->i_mode;
++
++	if (!(mode & S_ISGID))
++		return 0;
++	if (mode & S_IXGRP)
++		return ATTR_KILL_SGID;
++	if (!in_group_or_capable(mnt_userns, inode,
++				 i_gid_into_vfsgid(mnt_userns, inode)))
++		return ATTR_KILL_SGID;
++	return 0;
++}
++
++/**
++ * setattr_should_drop_suidgid - determine whether the set{g,u}id bit needs to
++ *                               be dropped
++ * @mnt_userns:	user namespace of the mount @inode was found from
++ * @inode:	inode to check
++ *
++ * This function determines whether the set{g,u}id bits need to be removed.
++ * If the setuid bit needs to be removed ATTR_KILL_SUID is returned. If the
++ * setgid bit needs to be removed ATTR_KILL_SGID is returned. If both
++ * set{g,u}id bits need to be removed the corresponding mask of both flags is
++ * returned.
++ *
++ * Return: A mask of ATTR_KILL_S{G,U}ID indicating which - if any - setid bits
++ * to remove, 0 otherwise.
++ */
++int setattr_should_drop_suidgid(struct user_namespace *mnt_userns,
++				struct inode *inode)
++{
++	umode_t mode = inode->i_mode;
++	int kill = 0;
++
++	/* suid always must be killed */
++	if (unlikely(mode & S_ISUID))
++		kill = ATTR_KILL_SUID;
++
++	kill |= setattr_should_drop_sgid(mnt_userns, inode);
++
++	if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
++		return kill;
++
++	return 0;
++}
++EXPORT_SYMBOL(setattr_should_drop_suidgid);
++
+ /**
+  * chown_ok - verify permissions to chown inode
+  * @mnt_userns:	user namespace of the mount @inode was found from
+@@ -140,8 +204,7 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
+ 			vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
+ 
+ 		/* Also check the setgid bit! */
+-		if (!vfsgid_in_group_p(vfsgid) &&
+-		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
++		if (!in_group_or_capable(mnt_userns, inode, vfsgid))
+ 			attr->ia_mode &= ~S_ISGID;
+ 	}
+ 
+@@ -251,9 +314,8 @@ void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
+ 		inode->i_ctime = attr->ia_ctime;
+ 	if (ia_valid & ATTR_MODE) {
+ 		umode_t mode = attr->ia_mode;
+-		vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
+-		if (!vfsgid_in_group_p(vfsgid) &&
+-		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
++		if (!in_group_or_capable(mnt_userns, inode,
++					 i_gid_into_vfsgid(mnt_userns, inode)))
+ 			mode &= ~S_ISGID;
+ 		inode->i_mode = mode;
+ 	}
+@@ -375,7 +437,7 @@ int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry,
+ 		}
+ 	}
+ 	if (ia_valid & ATTR_KILL_SGID) {
+-		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
++		if (mode & S_ISGID) {
+ 			if (!(ia_valid & ATTR_MODE)) {
+ 				ia_valid = attr->ia_valid |= ATTR_MODE;
+ 				attr->ia_mode = inode->i_mode;
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 1c4b693ee4a3a..937b60ae576e0 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -7839,10 +7839,10 @@ long btrfs_ioctl_send(struct inode *inode, struct btrfs_ioctl_send_args *arg)
+ 	/*
+ 	 * Check that we don't overflow at later allocations, we request
+ 	 * clone_sources_count + 1 items, and compare to unsigned long inside
+-	 * access_ok.
++	 * access_ok. Also set an upper limit for allocation size so this can't
++	 * easily exhaust memory. Max number of clone sources is about 200K.
+ 	 */
+-	if (arg->clone_sources_count >
+-	    ULONG_MAX / sizeof(struct clone_root) - 1) {
++	if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 89f4741728ba3..c996c0ef8c632 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1313,7 +1313,7 @@ static ssize_t fuse_cache_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 			return err;
+ 
+ 		if (fc->handle_killpriv_v2 &&
+-		    should_remove_suid(file_dentry(file))) {
++		    setattr_should_drop_suidgid(&init_user_ns, file_inode(file))) {
+ 			goto writethrough;
+ 		}
+ 
+diff --git a/fs/inode.c b/fs/inode.c
+index b608528efd3a4..8c4078889754f 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -1948,41 +1948,13 @@ skip_update:
+ }
+ EXPORT_SYMBOL(touch_atime);
+ 
+-/*
+- * The logic we want is
+- *
+- *	if suid or (sgid and xgrp)
+- *		remove privs
+- */
+-int should_remove_suid(struct dentry *dentry)
+-{
+-	umode_t mode = d_inode(dentry)->i_mode;
+-	int kill = 0;
+-
+-	/* suid always must be killed */
+-	if (unlikely(mode & S_ISUID))
+-		kill = ATTR_KILL_SUID;
+-
+-	/*
+-	 * sgid without any exec bits is just a mandatory locking mark; leave
+-	 * it alone.  If some exec bits are set, it's a real sgid; kill it.
+-	 */
+-	if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
+-		kill |= ATTR_KILL_SGID;
+-
+-	if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
+-		return kill;
+-
+-	return 0;
+-}
+-EXPORT_SYMBOL(should_remove_suid);
+-
+ /*
+  * Return mask of changes for notify_change() that need to be done as a
+  * response to write or truncate. Return 0 if nothing has to be changed.
+  * Negative value on error (change should be denied).
+  */
+-int dentry_needs_remove_privs(struct dentry *dentry)
++int dentry_needs_remove_privs(struct user_namespace *mnt_userns,
++			      struct dentry *dentry)
+ {
+ 	struct inode *inode = d_inode(dentry);
+ 	int mask = 0;
+@@ -1991,7 +1963,7 @@ int dentry_needs_remove_privs(struct dentry *dentry)
+ 	if (IS_NOSEC(inode))
+ 		return 0;
+ 
+-	mask = should_remove_suid(dentry);
++	mask = setattr_should_drop_suidgid(mnt_userns, inode);
+ 	ret = security_inode_need_killpriv(dentry);
+ 	if (ret < 0)
+ 		return ret;
+@@ -2023,7 +1995,7 @@ static int __file_remove_privs(struct file *file, unsigned int flags)
+ 	if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode))
+ 		return 0;
+ 
+-	kill = dentry_needs_remove_privs(dentry);
++	kill = dentry_needs_remove_privs(file_mnt_user_ns(file), dentry);
+ 	if (kill < 0)
+ 		return kill;
+ 
+@@ -2487,6 +2459,28 @@ struct timespec64 current_time(struct inode *inode)
+ }
+ EXPORT_SYMBOL(current_time);
+ 
++/**
++ * in_group_or_capable - check whether caller is CAP_FSETID privileged
++ * @mnt_userns: user namespace of the mount @inode was found from
++ * @inode:	inode to check
++ * @vfsgid:	the new/current vfsgid of @inode
++ *
++ * Check wether @vfsgid is in the caller's group list or if the caller is
++ * privileged with CAP_FSETID over @inode. This can be used to determine
++ * whether the setgid bit can be kept or must be dropped.
++ *
++ * Return: true if the caller is sufficiently privileged, false if not.
++ */
++bool in_group_or_capable(struct user_namespace *mnt_userns,
++			 const struct inode *inode, vfsgid_t vfsgid)
++{
++	if (vfsgid_in_group_p(vfsgid))
++		return true;
++	if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
++		return true;
++	return false;
++}
++
+ /**
+  * mode_strip_sgid - handle the sgid bit for non-directories
+  * @mnt_userns: User namespace of the mount the inode was created from
+@@ -2508,11 +2502,9 @@ umode_t mode_strip_sgid(struct user_namespace *mnt_userns,
+ 		return mode;
+ 	if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID))
+ 		return mode;
+-	if (in_group_p(i_gid_into_mnt(mnt_userns, dir)))
+-		return mode;
+-	if (capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID))
++	if (in_group_or_capable(mnt_userns, dir,
++				i_gid_into_vfsgid(mnt_userns, dir)))
+ 		return mode;
+-
+ 	return mode & ~S_ISGID;
+ }
+ EXPORT_SYMBOL(mode_strip_sgid);
+diff --git a/fs/internal.h b/fs/internal.h
+index 6f0386b34faec..5545c26d86ae5 100644
+--- a/fs/internal.h
++++ b/fs/internal.h
+@@ -150,7 +150,9 @@ extern int vfs_open(const struct path *, struct file *);
+  * inode.c
+  */
+ extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc);
+-extern int dentry_needs_remove_privs(struct dentry *dentry);
++int dentry_needs_remove_privs(struct user_namespace *, struct dentry *dentry);
++bool in_group_or_capable(struct user_namespace *mnt_userns,
++			 const struct inode *inode, vfsgid_t vfsgid);
+ 
+ /*
+  * fs-writeback.c
+@@ -234,3 +236,9 @@ int do_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
+ 		struct xattr_ctx *ctx);
+ 
+ ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *pos);
++
++/*
++ * fs/attr.c
++ */
++int setattr_should_drop_sgid(struct user_namespace *mnt_userns,
++			     const struct inode *inode);
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 9c67edd215d5a..4d78e09795179 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1991,7 +1991,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ 		}
+ 	}
+ 
+-	if (file && should_remove_suid(file->f_path.dentry)) {
++	if (file && setattr_should_drop_suidgid(&init_user_ns, file_inode(file))) {
+ 		ret = __ocfs2_write_remove_suid(inode, di_bh);
+ 		if (ret) {
+ 			mlog_errno(ret);
+@@ -2279,7 +2279,7 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
+ 		 * inode. There's also the dinode i_size state which
+ 		 * can be lost via setattr during extending writes (we
+ 		 * set inode->i_size at the end of a write. */
+-		if (should_remove_suid(dentry)) {
++		if (setattr_should_drop_suidgid(&init_user_ns, inode)) {
+ 			if (meta_level == 0) {
+ 				ocfs2_inode_unlock_for_extent_tree(inode,
+ 								   &di_bh,
+diff --git a/fs/open.c b/fs/open.c
+index a81319b6177f6..9d0197db15e7b 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -54,7 +54,7 @@ int do_truncate(struct user_namespace *mnt_userns, struct dentry *dentry,
+ 	}
+ 
+ 	/* Remove suid, sgid, and file capabilities on truncate too */
+-	ret = dentry_needs_remove_privs(dentry);
++	ret = dentry_needs_remove_privs(mnt_userns, dentry);
+ 	if (ret < 0)
+ 		return ret;
+ 	if (ret)
+@@ -723,10 +723,10 @@ retry_deleg:
+ 		return -EINVAL;
+ 	if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid))
+ 		return -EINVAL;
+-	if (!S_ISDIR(inode->i_mode))
+-		newattrs.ia_valid |=
+-			ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
+ 	inode_lock(inode);
++	if (!S_ISDIR(inode->i_mode))
++		newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV |
++				     setattr_should_drop_sgid(mnt_userns, inode);
+ 	/* Continue to send actual fs values, not the mount values. */
+ 	error = security_path_chown(
+ 		path,
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 081d1f539628b..f14ecbeab2a9d 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3118,7 +3118,7 @@ extern void __destroy_inode(struct inode *);
+ extern struct inode *new_inode_pseudo(struct super_block *sb);
+ extern struct inode *new_inode(struct super_block *sb);
+ extern void free_inode_nonrcu(struct inode *inode);
+-extern int should_remove_suid(struct dentry *);
++extern int setattr_should_drop_suidgid(struct user_namespace *, struct inode *);
+ extern int file_remove_privs(struct file *);
+ 
+ /*
+@@ -3549,7 +3549,7 @@ int __init list_bdev_fs_names(char *buf, size_t size);
+ 
+ static inline bool is_sxid(umode_t mode)
+ {
+-	return (mode & S_ISUID) || ((mode & S_ISGID) && (mode & S_IXGRP));
++	return mode & (S_ISUID | S_ISGID);
+ }
+ 
+ static inline int check_sticky(struct user_namespace *mnt_userns,
+diff --git a/kernel/power/process.c b/kernel/power/process.c
+index ddd9988327fe2..beeab7f9fac86 100644
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -27,6 +27,8 @@ unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC;
+ 
+ static int try_to_freeze_tasks(bool user_only)
+ {
++	const char *what = user_only ? "user space processes" :
++					"remaining freezable tasks";
+ 	struct task_struct *g, *p;
+ 	unsigned long end_time;
+ 	unsigned int todo;
+@@ -36,6 +38,8 @@ static int try_to_freeze_tasks(bool user_only)
+ 	bool wakeup = false;
+ 	int sleep_usecs = USEC_PER_MSEC;
+ 
++	pr_info("Freezing %s\n", what);
++
+ 	start = ktime_get_boottime();
+ 
+ 	end_time = jiffies + msecs_to_jiffies(freeze_timeout_msecs);
+@@ -82,7 +86,6 @@ static int try_to_freeze_tasks(bool user_only)
+ 	elapsed_msecs = ktime_to_ms(elapsed);
+ 
+ 	if (todo) {
+-		pr_cont("\n");
+ 		pr_err("Freezing of tasks %s after %d.%03d seconds "
+ 		       "(%d tasks refusing to freeze, wq_busy=%d):\n",
+ 		       wakeup ? "aborted" : "failed",
+@@ -101,8 +104,8 @@ static int try_to_freeze_tasks(bool user_only)
+ 			read_unlock(&tasklist_lock);
+ 		}
+ 	} else {
+-		pr_cont("(elapsed %d.%03d seconds) ", elapsed_msecs / 1000,
+-			elapsed_msecs % 1000);
++		pr_info("Freezing %s completed (elapsed %d.%03d seconds)\n",
++			what, elapsed_msecs / 1000, elapsed_msecs % 1000);
+ 	}
+ 
+ 	return todo ? -EBUSY : 0;
+@@ -130,14 +133,11 @@ int freeze_processes(void)
+ 		static_branch_inc(&freezer_active);
+ 
+ 	pm_wakeup_clear(0);
+-	pr_info("Freezing user space processes ... ");
+ 	pm_freezing = true;
+ 	error = try_to_freeze_tasks(true);
+-	if (!error) {
++	if (!error)
+ 		__usermodehelper_set_disable_depth(UMH_DISABLED);
+-		pr_cont("done.");
+-	}
+-	pr_cont("\n");
++
+ 	BUG_ON(in_atomic());
+ 
+ 	/*
+@@ -166,14 +166,9 @@ int freeze_kernel_threads(void)
+ {
+ 	int error;
+ 
+-	pr_info("Freezing remaining freezable tasks ... ");
+-
+ 	pm_nosig_freezing = true;
+ 	error = try_to_freeze_tasks(false);
+-	if (!error)
+-		pr_cont("done.");
+ 
+-	pr_cont("\n");
+ 	BUG_ON(in_atomic());
+ 
+ 	if (error)
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 748be72532485..78c9729a6057d 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -1015,6 +1015,7 @@ static void caif_sock_destructor(struct sock *sk)
+ 		return;
+ 	}
+ 	sk_stream_kill_queues(&cf_sk->sk);
++	WARN_ON_ONCE(sk->sk_forward_alloc);
+ 	caif_free_client(&cf_sk->layer);
+ }
+ 
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 0c2666e041d3c..b79a070fa8246 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -5807,7 +5807,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
+ 		neigh = __ipv6_neigh_lookup_noref_stub(dev, dst);
+ 	}
+ 
+-	if (!neigh)
++	if (!neigh || !(neigh->nud_state & NUD_VALID))
+ 		return BPF_FIB_LKUP_RET_NO_NEIGH;
+ 
+ 	return bpf_fib_set_fwd_params(params, neigh, dev, mtu);
+@@ -5922,7 +5922,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
+ 	 * not needed here.
+ 	 */
+ 	neigh = __ipv6_neigh_lookup_noref_stub(dev, dst);
+-	if (!neigh)
++	if (!neigh || !(neigh->nud_state & NUD_VALID))
+ 		return BPF_FIB_LKUP_RET_NO_NEIGH;
+ 
+ 	return bpf_fib_set_fwd_params(params, neigh, dev, mtu);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 952a54763358e..bf081f62ae58b 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -269,7 +269,7 @@ static int neigh_forced_gc(struct neigh_table *tbl)
+ 			    (n->nud_state == NUD_NOARP) ||
+ 			    (tbl->is_multicast &&
+ 			     tbl->is_multicast(n->primary_key)) ||
+-			    time_after(tref, n->updated))
++			    !time_in_range(n->updated, tref, jiffies))
+ 				remove = true;
+ 			write_unlock(&n->lock);
+ 
+@@ -289,7 +289,17 @@ static int neigh_forced_gc(struct neigh_table *tbl)
+ 
+ static void neigh_add_timer(struct neighbour *n, unsigned long when)
+ {
++	/* Use safe distance from the jiffies - LONG_MAX point while timer
++	 * is running in DELAY/PROBE state but still show to user space
++	 * large times in the past.
++	 */
++	unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ);
++
+ 	neigh_hold(n);
++	if (!time_in_range(n->confirmed, mint, jiffies))
++		n->confirmed = mint;
++	if (time_before(n->used, n->confirmed))
++		n->used = n->confirmed;
+ 	if (unlikely(mod_timer(&n->timer, when))) {
+ 		printk("NEIGH: BUG, double timer add, state is %x\n",
+ 		       n->nud_state);
+@@ -1001,12 +1011,14 @@ static void neigh_periodic_work(struct work_struct *work)
+ 				goto next_elt;
+ 			}
+ 
+-			if (time_before(n->used, n->confirmed))
++			if (time_before(n->used, n->confirmed) &&
++			    time_is_before_eq_jiffies(n->confirmed))
+ 				n->used = n->confirmed;
+ 
+ 			if (refcount_read(&n->refcnt) == 1 &&
+ 			    (state == NUD_FAILED ||
+-			     time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
++			     !time_in_range_open(jiffies, n->used,
++						 n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
+ 				*np = n->next;
+ 				neigh_mark_dead(n);
+ 				write_unlock(&n->lock);
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 516895f482356..cbb268c15251c 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock *sk)
+ 	sk_mem_reclaim_final(sk);
+ 
+ 	WARN_ON_ONCE(sk->sk_wmem_queued);
+-	WARN_ON_ONCE(sk->sk_forward_alloc);
+ 
+ 	/* It is _impossible_ for the backlog to contain anything
+ 	 * when we get here.  All user references to this socket
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 5a67b120c4dbd..94a3609548b11 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -310,6 +310,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
+ 	skb->mark = 0;
+ }
+ 
++static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi,
++		       int encap_type, unsigned short family)
++{
++	struct sec_path *sp;
++
++	sp = skb_sec_path(skb);
++	if (sp && (sp->len || sp->olen) &&
++	    !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
++		goto discard;
++
++	XFRM_SPI_SKB_CB(skb)->family = family;
++	if (family == AF_INET) {
++		XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
++		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
++	} else {
++		XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
++		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
++	}
++
++	return xfrm_input(skb, nexthdr, spi, encap_type);
++discard:
++	kfree_skb(skb);
++	return 0;
++}
++
++static int xfrmi4_rcv(struct sk_buff *skb)
++{
++	return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET);
++}
++
++static int xfrmi6_rcv(struct sk_buff *skb)
++{
++	return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
++			   0, 0, AF_INET6);
++}
++
++static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
++{
++	return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET);
++}
++
++static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
++{
++	return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6);
++}
++
+ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
+ {
+ 	const struct xfrm_mode *inner_mode;
+@@ -937,8 +983,8 @@ static struct pernet_operations xfrmi_net_ops = {
+ };
+ 
+ static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
+-	.handler	=	xfrm6_rcv,
+-	.input_handler	=	xfrm_input,
++	.handler	=	xfrmi6_rcv,
++	.input_handler	=	xfrmi6_input,
+ 	.cb_handler	=	xfrmi_rcv_cb,
+ 	.err_handler	=	xfrmi6_err,
+ 	.priority	=	10,
+@@ -988,8 +1034,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {
+ #endif
+ 
+ static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
+-	.handler	=	xfrm4_rcv,
+-	.input_handler	=	xfrm_input,
++	.handler	=	xfrmi4_rcv,
++	.input_handler	=	xfrmi4_input,
+ 	.cb_handler	=	xfrmi_rcv_cb,
+ 	.err_handler	=	xfrmi4_err,
+ 	.priority	=	10,
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 52538d5360673..7f49dab3b6b59 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3670,6 +3670,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ 			goto reject;
+ 		}
+ 
++		if (if_id)
++			secpath_reset(skb);
++
+ 		xfrm_pols_put(pols, npols);
+ 		return 1;
+ 	}
+diff --git a/scripts/tags.sh b/scripts/tags.sh
+index e137cf15aae9d..0d045182c08c0 100755
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -91,7 +91,7 @@ all_compiled_sources()
+ 	{
+ 		echo include/generated/autoconf.h
+ 		find $ignore -name "*.cmd" -exec \
+-			grep -Poh '(?(?=^source_.* \K).*|(?=^  \K\S).*(?= \\))' {} \+ |
++			sed -n -E 's/^source_.* (.*)/\1/p; s/^  (\S.*) \\/\1/p' {} \+ |
+ 		awk '!a[$0]++'
+ 	} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
+ 	sort -u
+diff --git a/sound/soc/codecs/es8326.c b/sound/soc/codecs/es8326.c
+index 87c1cc16592bb..555125efd9ad3 100644
+--- a/sound/soc/codecs/es8326.c
++++ b/sound/soc/codecs/es8326.c
+@@ -729,14 +729,16 @@ static int es8326_probe(struct snd_soc_component *component)
+ 	}
+ 	dev_dbg(component->dev, "jack-pol %x", es8326->jack_pol);
+ 
+-	ret = device_property_read_u8(component->dev, "everest,interrupt-src", &es8326->jack_pol);
++	ret = device_property_read_u8(component->dev, "everest,interrupt-src",
++				      &es8326->interrupt_src);
+ 	if (ret != 0) {
+ 		dev_dbg(component->dev, "interrupt-src return %d", ret);
+ 		es8326->interrupt_src = ES8326_HP_DET_SRC_PIN9;
+ 	}
+ 	dev_dbg(component->dev, "interrupt-src %x", es8326->interrupt_src);
+ 
+-	ret = device_property_read_u8(component->dev, "everest,interrupt-clk", &es8326->jack_pol);
++	ret = device_property_read_u8(component->dev, "everest,interrupt-clk",
++				      &es8326->interrupt_clk);
+ 	if (ret != 0) {
+ 		dev_dbg(component->dev, "interrupt-clk return %d", ret);
+ 		es8326->interrupt_clk = 0x45;
+diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c
+index 3f981a9e7fb67..c54ecf3e69879 100644
+--- a/sound/soc/codecs/rt715-sdca-sdw.c
++++ b/sound/soc/codecs/rt715-sdca-sdw.c
+@@ -167,7 +167,7 @@ static int rt715_sdca_read_prop(struct sdw_slave *slave)
+ 	}
+ 
+ 	/* set the timeout values */
+-	prop->clk_stop_timeout = 20;
++	prop->clk_stop_timeout = 200;
+ 
+ 	return 0;
+ }
+diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c
+index 36966643e36ab..8afd67ba1e5a3 100644
+--- a/sound/soc/sof/amd/acp.c
++++ b/sound/soc/sof/amd/acp.c
+@@ -316,7 +316,6 @@ static irqreturn_t acp_irq_thread(int irq, void *context)
+ {
+ 	struct snd_sof_dev *sdev = context;
+ 	const struct sof_amd_acp_desc *desc = get_chip_info(sdev->pdata);
+-	unsigned int base = desc->dsp_intr_base;
+ 	unsigned int val, count = ACP_HW_SEM_RETRY_COUNT;
+ 
+ 	val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->ext_intr_stat);
+@@ -326,28 +325,20 @@ static irqreturn_t acp_irq_thread(int irq, void *context)
+ 		return IRQ_HANDLED;
+ 	}
+ 
+-	val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET);
+-	if (val & ACP_DSP_TO_HOST_IRQ) {
+-		while (snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset)) {
+-			/* Wait until acquired HW Semaphore lock or timeout */
+-			count--;
+-			if (!count) {
+-				dev_err(sdev->dev, "%s: Failed to acquire HW lock\n", __func__);
+-				return IRQ_NONE;
+-			}
++	while (snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset)) {
++		/* Wait until acquired HW Semaphore lock or timeout */
++		count--;
++		if (!count) {
++			dev_err(sdev->dev, "%s: Failed to acquire HW lock\n", __func__);
++			return IRQ_NONE;
+ 		}
+-
+-		sof_ops(sdev)->irq_thread(irq, sdev);
+-		val |= ACP_DSP_TO_HOST_IRQ;
+-		snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET, val);
+-
+-		/* Unlock or Release HW Semaphore */
+-		snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset, 0x0);
+-
+-		return IRQ_HANDLED;
+ 	}
+ 
+-	return IRQ_NONE;
++	sof_ops(sdev)->irq_thread(irq, sdev);
++	/* Unlock or Release HW Semaphore */
++	snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset, 0x0);
++
++	return IRQ_HANDLED;
+ };
+ 
+ static irqreturn_t acp_irq_handler(int irq, void *dev_id)
+@@ -358,8 +349,11 @@ static irqreturn_t acp_irq_handler(int irq, void *dev_id)
+ 	unsigned int val;
+ 
+ 	val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET);
+-	if (val)
++	if (val) {
++		val |= ACP_DSP_TO_HOST_IRQ;
++		snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET, val);
+ 		return IRQ_WAKE_THREAD;
++	}
+ 
+ 	return IRQ_NONE;
+ }
+diff --git a/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh b/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
+index 9c79bbcce5a87..aff0a59f92d9a 100755
+--- a/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
++++ b/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
+@@ -246,7 +246,7 @@ test_vlan_ingress_modify()
+ 	bridge vlan add dev $swp2 vid 300
+ 
+ 	tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \
+-		protocol 802.1Q flower skip_sw vlan_id 200 \
++		protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \
+ 		action vlan modify id 300 \
+ 		action goto chain $(IS2 0 0)
+