Merge tag 'android11-5.4.226_r00' into android11-5.4

This is the merge of the upstream LTS release of 5.4.226 into the android11-5.4 branch. It contains the following commits: 94bdbb0042 Revert "mmc: sdhci: Fix voltage switch delay" b0e3bda187 ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION 39c4c9c65c Merge 5.4.226 into android11-5.4-lts 316cdfc48d Linux 5.4.226 3ab84e8913 ipc/sem: Fix dangling sem_array access in semtimedop race 210f96fb7e v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails 0390da0565 proc: proc_skip_spaces() shouldn't think it is working on C strings dd3124a051 proc: avoid integer type confusion in get_proc_long 1061bf5d01 mmc: sdhci: Fix voltage switch delay 9a5f49c0f5 mmc: sdhci: use FIELD_GET for preset value bit masks d699373ac5 char: tpm: Protect tpm_pm_suspend with locks 9decec2993 Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" e67e119adf x86/ioremap: Fix page aligned size calculation in __ioremap_caller() 0d87bb6070 Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM b5041a3daa x86/pm: Add enumeration check before spec MSRs save/restore setup 3b28594576 x86/tsx: Add a feature bit for TSX control MSR support 99c59256ea nvme: ensure subsystem reset is single threaded dc85ff0a5f nvme: restrict management ioctls to admin c41a89af7b epoll: check for events when removing a timed out thread from the wait queue b8e803cda5 epoll: call final ep_events_available() check under the lock e65ac2bdda tracing/ring-buffer: Have polling block on watermark 899e148171 ipv4: Fix route deletion when nexthop info is not specified cc3cd130ec ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference a14f1a9c53 selftests: net: fix nexthop warning cleanup double ip typo 8aefb93295 selftests: net: add delete nexthop route warning test dd6d2d82f0 Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled 7da3a10f39 parisc: Increase FRAME_WARN to 2048 bytes on parisc 15568cdbe5 xtensa: increase size of gcc stack frame check 76f48511a1 parisc: Increase size of gcc stack frame check cbdd83bd2f iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() 0090231df2 pinctrl: single: Fix potential division by zero 73dce3c1d4 ASoC: ops: Fix bounds check for _sx controls ced17a55a8 mm: Fix '.data.once' orphan section warning c9ecc42094 arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 44ccd8c52f arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors 1603feac15 tracing: Free buffers when a used dynamic event is removed dcd1daad31 mmc: sdhci-sprd: Fix no reset data and command after voltage switch 9e5581c772 mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check bfdfe86d83 mmc: core: Fix ambiguous TRIM and DISCARD arg 040d08c996 mmc: mmc_test: Fix removal of debugfs file eb5001ecfb pinctrl: intel: Save and restore pins in "direct IRQ" mode ae34a4f4a2 x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 9a130b72e6 nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() 3ae3bb33c4 tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" cf1c12bc5c error-injection: Add prompt for function error injection 2f6fd2de72 net/mlx5: DR, Fix uninitialized var warning ea5844f946 hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() 89eecabe6a hwmon: (coretemp) Check for null before removing sysfs attrs 0aacac75b8 net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed a7555681e5 sctp: fix memory leak in sctp_stream_outq_migrate() 168de4096b packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE 16c244bc65 net: tun: Fix use-after-free in tun_detach() 1c1d4830a9 afs: Fix fileserver probe RTT handling 53a62c5efe net: hsr: Fix potential use-after-free ae633816dd dsa: lan9303: Correct stat name 910c0264b6 net: ethernet: nixge: fix NULL dereference 2d24d91b9f net/9p: Fix a potential socket leak in p9_socket_open 4720725e22 net: net_netdev: Fix error handling in ntb_netdev_init_module() 3e21f85d87 net: phy: fix null-ptr-deref while probe() failed f5c2ec288a wifi: cfg80211: fix buffer overflow in elem comparison 06785845e1 qlcnic: fix sleep-in-atomic-context bugs caused by msleep 78f8a34b37 can: cc770: cc770_isa_probe(): add missing free_cc770dev() e4b474fa78 can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() 0a2d73a770 net/mlx5e: Fix use-after-free when reverting termination table 093ccc2f84 net/mlx5: Fix uninitialized variable bug in outlen_write() b10dd3bd14 of: property: decrement node refcount in of_fwnode_get_reference_args() 7b2b67fe13 hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails 45a6437834 hwmon: (i5500_temp) fix missing pci_disable_device() dbcc339001 scripts/faddr2line: Fix regression in name resolution on ppc64le 2b916ee1d3 iio: light: rpr0521: add missing Kconfig dependencies 3f566b6260 iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw 2d6a437064 iio: health: afe4403: Fix oob read in afe4403_read_raw 8eb912af52 btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() 7e88a416ed drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" 41f0abeadc drm/amdgpu: update drm_display_info correctly when the edid is read 787138e4b9 btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker 255289adce spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock 83aae3204e btrfs: free btrfs_path before copying inodes to userspace 9fd11e2de7 fuse: lock inode unconditionally in fuse_fallocate() 3659e33c1e drm/i915: fix TLB invalidation for Gen12 video and compute engines 0d1cad5971 drm/amdgpu: always register an MMU notifier for userptr d4e9bab771 drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN a541f1f0ce btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() d037681515 btrfs: free btrfs_path before copying subvol info to userspace 69e2f1dd93 btrfs: free btrfs_path before copying fspath to userspace 3cde2bc708 btrfs: free btrfs_path before copying root refs to userspace 4741b00cac binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 4e682ce560 binder: Address corner cases in deferred copy and fixup 15e098ab1d binder: fix pointer cast warning 74e7f1828a binder: defer copies of pre-patched txn data 7b31ab0d9e binder: read pre-translated fds from sender buffer c056a6ba35 binder: avoid potential data leakage when copying txn f8fee36515 dm integrity: flush the journal on suspend 096e1bd659 net: usb: qmi_wwan: add Telit 0x103a composition 86136bf623 tcp: configurable source port perturb table size 07da8fca30 platform/x86: hp-wmi: Ignore Smart Experience App event 82d758c9da platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) 846c0f9cd0 platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() 6579436fd1 xen/platform-pci: add missing free_irq() in error path 375e79c571 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() e3a2211fe1 ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 3e2452cbc6 Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode 47b4949335 gcov: clang: fix the buffer overflow issue ecbde4222e nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty 7d08b4eba1 firmware: coreboot: Register bus in module init a2012335aa firmware: google: Release devices before unregistering the bus cb7495fe95 ceph: avoid putting the realm twice when decoding snaps fails 12a93545b2 ceph: do not update snapshot context when there is no new snapshot 0528b19d57 iio: pressure: ms5611: fixed value compensation bug 562f415bb3 iio: ms5611: Simplify IO callback parameters def48fbbac nios2: add FORCE for vmlinuz.gz da849abded init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash 03949acb58 iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails f8a76c28e9 iio: light: apds9960: fix wrong register for gesture gain d3ad47426a arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency ae6bcb2698 usb: dwc3: exynos: Fix remove() function 15f8b52523 lib/vdso: use "grep -E" instead of "egrep" 960cf3c7ff s390/crashdump: fix TOD programmable field size fabd3ab6a1 net: thunderx: Fix the ACPI memory leak 1633e6d6aa nfc: st-nci: fix memory leaks in EVT_TRANSACTION 0e2a4560db nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION 420b21235d s390/dasd: fix no record found for raw_track_access 9d1264c914 dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). 08f25427d8 bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() 59612acf6b regulator: twl6030: re-add TWL6032_SUBCLASS 1c12909a78 NFC: nci: fix memory leak in nci_rx_data_packet() 23b83a3c76 xfrm: Fix ignored return value in xfrm6_init() 23ba1997eb tipc: check skb_linearize() return value in tipc_disc_rcv() 59f9aad22f tipc: add an extra conn_get in tipc_conn_alloc 30f91687fa tipc: set con sock in tipc_conn_alloc 5c12136c00 net/mlx5: Fix FW tracer timestamp calculation 00492f823f Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() e0d5becab1 Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() ec3d7202e9 nfp: add port from netdev validation for EEPROM access 9b8061a6db net: pch_gbe: fix pci device refcount leak while module exiting 9a39ea43f1 net/qla3xxx: fix potential memleak in ql3xxx_send() a07149c10b net/mlx4: Check retval of mlx4_bitmap_init bbf6d1bc07 ARM: mxs: fix memory leak in mxs_machine_init() 3afa86449e 9p/fd: fix issue of list_del corruption in p9_fd_cancel() bfadcbf5ba net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() e00b42cbec nfc/nci: fix race with opening and closing 04ffa53ab7 net: liquidio: simplify if expression 79c55e66ca ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl 897f6a3091 tee: optee: fix possible memory leak in optee_register_device() 9c1fbac623 bus: sunxi-rsb: Support atomic transfers 347875ff9a regulator: core: fix UAF in destroy_regulator() 5561211031 regulator: core: fix kobject release warning and memory leak in regulator_register() c062676528 ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove 168d59f7f7 ARM: dts: am335x-pcm-953: Define fixed regulators in root node dd56c671cc af_key: Fix send_acquire race with pfkey_register 9221a53bfc MIPS: pic32: treat port as signed integer dff9b25cb9 RISC-V: vdso: Do not add missing symbols to version section in linker script b0e025dd87 arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. 0ba7c091f7 block, bfq: fix null pointer dereference in bfq_bio_bfqg() b848811655 drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) 5dfbb54fe1 spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run 9029aee874 wifi: mac80211: Fix ack frame idr leak when mesh has no route 1f75f9c1af audit: fix undefined behavior in bit shift for AUDIT_BIT 3129cec05f wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support b4cb3dc111 wifi: mac80211: fix memory free error when registering wiphy fail b1dfc3f888 Revert "can: af_can: fix NULL pointer dereference in can_rx_register()" 17d66a1fd0 Merge 5.4.225 into android11-5.4-lts d3df1dbcb2 Merge branch 'android11-5.4' into branch 'android11-5.4-lts' 4d2a309b5c Linux 5.4.225 b612f924f2 ntfs: check overflow when iterating ATTR_RECORDs 0e2ce0954b ntfs: fix out-of-bounds read in ntfs_attr_find() 266bd53062 ntfs: fix use-after-free in ntfs_attr_find() ed8b990e89 mm: fs: initialize fsdata passed to write_begin/write_end interface b1ad04da7f 9p/trans_fd: always use O_NONBLOCK read/write 179236a122 gfs2: Switch from strlcpy to strscpy 8b6534c9ae gfs2: Check sb_bsize_shift after reading superblock 96760723aa 9p: trans_fd/p9_conn_cancel: drop client lock earlier ce57d6474a kcm: close race conditions on sk_receive_queue 7a704dbfd3 bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() ad39d09190 kcm: avoid potential race in kcm_tx_work 78be2ee011 tcp: cdg: allow tcp_cdg_release() to be called multiple times a62aa84fe1 macvlan: enforce a consistent minimal mtu 4f348b60c7 Input: i8042 - fix leaking of platform device on module removal 7b0007b28d kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case 28f7ff5e75 scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() ec59a13252 ring-buffer: Include dropped pages in counting dirty patches 32a7f06451 serial: 8250: Flush DMA Rx on RLSI e7061dd1fe misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() 3da7098e8f docs: update mediator contact information in CoC doc 27f712cd47 mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() 616c6695dd mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout 076712ff50 mmc: core: properly select voltage range without power cycle 1bf8ed5855 scsi: zfcp: Fix double free of FSF request when qdio send fails 5d53797ce7 Input: iforce - invert valid length check when fetching device IDs 89c0c27ab3 serial: 8250_lpss: Configure DMA also w/o DMA filter d6ebe11ad3 serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs b545c0e1e4 dm ioctl: fix misbehavior if list_versions races with module loading 1c5866b4dd iio: pressure: ms5611: changed hardcoded SPI speed to value limited 0dd52e141a iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() 7b75515728 iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() c025c4505f usb: chipidea: fix deadlock in ci_otg_del_timer 8c8039ede2 usb: add NO_LPM quirk for Realforce 87U Keyboard bec9f91f7b USB: serial: option: add Fibocom FM160 0x0111 composition 1972f20f36 USB: serial: option: add u-blox LARA-L6 modem 089839cccf USB: serial: option: add u-blox LARA-R6 00B modem 31e6aba26b USB: serial: option: remove old LARA-R6 PID 5ee0a017e5 USB: serial: option: add Sierra Wireless EM9191 0410c2ae21 speakup: fix a segfault caused by switching consoles 6ed6a5dfa3 slimbus: stream: correct presence rate frequencies 56607f0bfc Revert "usb: dwc3: disable USB core PHY management" e7dc436aea ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() 72c2ea34fa ring_buffer: Do not deactivate non-existant pages f715f31559 ftrace: Fix null pointer dereference in ftrace_add_mod() c50e0bcf4a ftrace: Optimize the allocation for mcount entries 3041feeedb ftrace: Fix the possible incorrect kernel message 04e9e5eb45 cifs: add check for returning value of SMB2_set_info_init 293c0d7182 net: thunderbolt: Fix error handling in tbnet_init() e6546d5412 cifs: Fix wrong return value checking when GETFLAGS e109b41870 net/x25: Fix skb leak in x25_lapb_receive_frame() e313efddce platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized 813a8dd9c4 drbd: use after free in drbd_create_device() 0199bf0a8f xen/pcpu: fix possible memory leak in register_pcpu() aa2ba35650 bnxt_en: Remove debugfs when pci_register_driver failed 6134357f56 net: caif: fix double disconnect client in chnl_net_open() 90638373f1 net: macvlan: Use built-in RCU list checking 83672c1b83 mISDN: fix misuse of put_device() in mISDN_register_device() 8c85770d1a net: liquidio: release resources when liquidio driver open failed 0f2c681900 mISDN: fix possible memory leak in mISDN_dsp_element_register() d697f78cab net: bgmac: Drop free_netdev() from bgmac_enet_remove() bec9ded540 ata: libata-transport: fix double ata_host_put() in ata_tport_add() 2ff7e852bd arm64: dts: imx8mn: Fix NAND controller size-cells bb4a2f898e arm64: dts: imx8mm: Fix NAND controller size-cells 040f726fec pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map 5b3d6d510b parport_pc: Avoid FIFO port location truncation f9fe7ba4ea siox: fix possible memory leak in siox_device_add() 6bb50c14c9 block: sed-opal: kmalloc the cmd/resp buffers 8555c6c112 ASoC: soc-utils: Remove __exit for snd_soc_util_exit() b768afc68b tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send 476b09e07b serial: imx: Add missing .thaw_noirq hook b7c6033a8f serial: 8250: omap: Flush PM QOS work on remove 2d66412563 serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() 747e76f4cc serial: 8250_omap: remove wait loop from Errata i202 workaround 2ec3f558db ASoC: core: Fix use-after-free in snd_soc_exit() ee31abd047 spi: stm32: Print summary 'callbacks suppressed' message a39357b4ec ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route" 1a5f13b0c5 Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm 6fa082ad96 btrfs: remove pointless and double ulist frees in error paths of qgroup tests 741bded210 drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid 761976a617 i2c: i801: add lis3lv02d's I2C address for Vostro 5568 18a501e5c7 NFSv4: Retry LOCK on OLD_STATEID during delegation return 281b93e42e selftests/intel_pstate: fix build for ARCH=x86_64 2cce0a36ce selftests/futex: fix build for clang c81ab3d7d1 ASoC: codecs: jz4725b: fix capture selector naming 5b94d1bb1e ASoC: codecs: jz4725b: use right control for Capture Volume 21b6fbb934 ASoC: codecs: jz4725b: fix reported volume for Master ctl c9fb6a0311 ASoC: codecs: jz4725b: add missed Line In power control bit 1719b9c0fb spi: intel: Fix the offset to get the 64K erase opcode af93d7c9d9 ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK a3b07bb0b3 ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe" 4d487873ba ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe" f0901e1551 ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe" 1fd66e3b02 x86/cpu: Restore AMD's DE_CFG MSR after resume 30b0263d03 net: tun: call napi_schedule_prep() to ensure we own a napi 7a6e564ff2 dmaengine: at_hdmac: Check return code of dma_async_device_register 966dd087de dmaengine: at_hdmac: Fix impossible condition d6ce23165c dmaengine: at_hdmac: Don't allow CPU to reorder channel enable a535247029 dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors 77b97ef490 dmaengine: at_hdmac: Don't start transactions at tx_submit level 3d35e36d7a dmaengine: at_hdmac: Fix at_lli struct definition ab390c532e cert host tools: Stop complaining about deprecated OpenSSL functions d0513b095e can: j1939: j1939_send_one(): fix missing CAN header initialization d8971f4107 udf: Fix a slab-out-of-bounds write bug in udf_find_entry() c914c56ac0 btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() aa05252ab4 platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi 431b70544b drm/i915/dmabuf: fix sg_table handling in map_dma_buf 9b162e8104 nilfs2: fix use-after-free bug of ns_writer on remount 36ff974b03 nilfs2: fix deadlock in nilfs_count_free_blocks() b4421e6d9a vmlinux.lds.h: Fix placement of '.data..decrypted' section 022d8696a7 ALSA: usb-audio: Add DSD support for Accuphase DAC-60 ded2d51b85 ALSA: usb-audio: Add quirk entry for M-Audio Micro 02dea987ec ALSA: hda: fix potential memleak in 'add_widget_node' 9ab40b1df6 ALSA: hda/ca0132: add quirk for EVGA Z390 DARK d51861d291 mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI d2cf28caf5 mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI ae2aeee895 mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI 9fbe020829 MIPS: jump_label: Fix compat branch range check f967bbc72f arm64: efi: Fix handling of misaligned runtime regions and drop warning c5c0b31675 riscv: process: fix kernel info leakage 685e73e3f7 net: macvlan: fix memory leaks of macvlan_common_newlink d1dddadf4c ethernet: tundra: free irq when alloc ring failed in tsi108_open() 1b7a565143 net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() ec8a47afc5 ethernet: s2io: disable napi when start nic failed in s2io_card_up() b03f505c5d cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open() 834d2da28f net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() 8344451681 net: cpsw: disable napi in cpsw_ndo_open() 3892c2d335 net/mlx5: Allow async trigger completion execution on single CPU systems 5b72cf7a40 net: nixge: disable napi when enable interrupts failed in nixge_open() a8aade318d perf stat: Fix printing os->prefix in CSV metrics output da4daa36ea drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() 1d84887327 dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() 7c77e272b4 dmaengine: pxa_dma: use platform_get_irq_optional 36769b9477 tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header afab465575 can: af_can: fix NULL pointer dereference in can_rx_register() 58cd7fdc8c ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 3ad3414591 drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() 831ea56c34 hamradio: fix issue of dev reference count leakage in bpq_device_event() c7e0024852 net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() 5661f111a1 capabilities: fix undefined behavior in bit shift for CAP_TO_MASK 08c3d22f10 net: fman: Unregister ethernet device on removal aa94d1a607 bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer a5a05fbef4 bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() a4f73f6adc net: tun: Fix memory leaks of napi_get_frags 65ad047fd8 net: gso: fix panic on frag_list with mixed head alloc types e29289d0d8 HID: hyperv: fix possible memory leak in mousevsc_probe() d975bec1ea bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues 0ede1a9882 wifi: cfg80211: fix memory leak in query_regdb_file() 1c8d066317 wifi: cfg80211: silence a sparse RCU warning c38ea83169 phy: stm32: fix an error code in probe 45a841719f xfs: drain the buf delwri queue before xfsaild idles e107e953d2 xfs: preserve inode versioning across remounts 7d57979052 xfs: use MMAPLOCK around filemap_map_pages() 8b27e684a6 xfs: redesign the reflink remap loop to fix blkres depletion crash ece1eb9957 xfs: rename xfs_bmap_is_real_extent to is_written_extent d304fafb97 xfs: preserve rmapbt swapext block reservation from freed blocks 0bd6dcc07a Merge 5.4.224 into android11-5.4-lts 644fd1c691 Merge 5.4.223 into android11-5.4-lts e05ac131e9 Merge 5.4.222 into android11-5.4-lts 3fc02367ac Merge 5.4.221 into android11-5.4-lts f134fec530 ANDROID: properly copy the scm_io_uring field in struct sk_buff 771a8acbb8 Linux 5.4.224 3e0c1ab197 ipc: remove memcg accounting for sops objects in do_semtimedop() a16415c8f1 wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() a24bf3c317 drm/i915/sdvo: Setup DDC fully before output init 4dadd4b161 drm/i915/sdvo: Filter out invalid outputs more sensibly 57306fef4d drm/rockchip: dsi: Force synchronous probe e09ff743e3 mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times 8b1174d058 KVM: x86: emulator: update the emulation mode after CR0 write ac3bc06c9a KVM: x86: emulator: introduce emulator_recalc_and_set_mode f159cd915d KVM: x86: emulator: em_sysexit should update ctxt->mode ef3094c4e9 KVM: x86: Mask off reserved bits in CPUID.80000008H da1bf3732d KVM: x86: Mask off reserved bits in CPUID.8000001AH 2fa24d0274 ext4: fix BUG_ON() when directory entry has invalid rec_len 72743d5598 ext4: fix warning in 'ext4_da_release_space' eed040fd35 parisc: Avoid printing the hardware path twice 9e902284ee parisc: Export iosapic_serial_irq() symbol for serial port driver 506ae30167 parisc: Make 8250_gsc driver dependend on CONFIG_PARISC c586068aad ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices 4e8ee3cf74 perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] 6ffa48150b perf/x86/intel: Fix pebs event constraints for ICL fee896d453 efi: random: reduce seed size to 32 bytes 0c72757434 fuse: add file_modified() to fallocate 0c3e6288da capabilities: fix potential memleak on error path from vfs_getxattr_alloc() 4bc52ddf63 tracing/histogram: Update document for KEYS_MAX size c8938263e6 tools/nolibc/string: Fix memcmp() implementation 993bd0de8b kprobe: reverse kp->flags when arm_kprobe failed fe3da74428 tcp/udp: Make early_demux back namespacified. 4ae03c869c btrfs: fix type of parameter generation in btrfs_get_dentry 27a594bc7a binder: fix UAF of alloc->vma in race with munmap() bad83d5513 memcg: enable accounting of ipc resources 92aaa5e8fe tcp/udp: Fix memory leak in ipv6_renew_options(). c494ae1498 block, bfq: protect 'bfqd->queued' by 'bfqd->lock' 6949400ec9 Bluetooth: L2CAP: Fix attempting to access uninitialized memory ad18f624e3 xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster() 0802130a4d xfs: don't fail unwritten extent conversion on writeback due to edquot fef141f9e4 xfs: group quota should return EDQUOT when prj quota enabled 4267433dd3 xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() 24e7e39353 xfs: use ordered buffers to initialize dquot buffers during quotacheck 52802e9a03 xfs: don't fail verifier on empty attr3 leaf block 71d487a82d i2c: xiic: Add platform module alias cdd19e559a HID: saitek: add madcatz variant of MMO7 mouse device ID efdcd1e32c scsi: core: Restrict legal sdev_state transitions via sysfs 7011975631 media: meson: vdec: fix possible refcount leak in vdec_probe() bfa8ccf705 media: dvb-frontends/drxk: initialize err to 0 11c8f19e0f media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE 4a449430ec media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE 381453770f ipv6: fix WARNING in ip6_route_net_exit_late() b49f6b2f21 net, neigh: Fix null-ptr-deref in neigh_table_clear() 4954b5359e net: mdio: fix undefined behavior in bit shift for __mdiobus_register c1f594dddd Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() 4cd094fd5d Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu 5d1a47ebf8 btrfs: fix ulist leaks in error paths of qgroup self tests 6a6731a0df btrfs: fix inode list leak during backref walking at find_parent_nodes() 2c0329406b btrfs: fix inode list leak during backref walking at resolve_indirect_refs() 3d74329d8c isdn: mISDN: netjet: fix wrong check of device registration 2ff6b66952 mISDN: fix possible memory leak in mISDN_register_device() b13be5e852 rose: Fix NULL pointer dereference in rose_send_frame() 8457a00c98 ipvs: fix WARNING in ip_vs_app_net_cleanup() 7effc4ce3d ipvs: fix WARNING in __ip_vs_cleanup_batch() 2cc523978f ipvs: use explicitly signed chars 74fd583946 netfilter: nf_tables: release flow rule object from commit path ca791952d4 net: tun: fix bugs for oversize packet when napi frags enabled 52e0429471 net: sched: Fix use after free in red_enqueue() d605da3e5f ata: pata_legacy: fix pdc20230_set_piomode() 704b92c51b net: fec: fix improper use of NETDEV_TX_BUSY f30060efcf nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() aef89b91c7 nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() 875082ae83 RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() af8fb5a060 RDMA/core: Fix null-ptr-deref in ib_core_cleanup() bbc5d7b46a net: dsa: Fix possible memory leaks in dsa_loop_init() 925cb538bd nfs4: Fix kmemleak when allocate slot failed 0bc335d010 NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot 405309d860 NFSv4.1: Handle RECLAIM_COMPLETE trunking errors 25760a41e3 IB/hfi1: Correctly move list in sc_disable() 6b5c87f9b3 RDMA/cma: Use output interface for net_dev check a0d9384967 Linux 5.4.223 a0a2a4bdd1 can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive fc0eecb8b4 net: enetc: survive memory pressure without crashing 69dd3ad406 net/mlx5: Fix possible use-after-free in async command interface 827e36a031 net/mlx5e: Do not increment ESN when updating IPsec ESN state 7dc6ce3ef2 nh: fix scope used to find saddr when adding non gw nh ba6ee85355 net: ehea: fix possible memory leak in ehea_register_port() 4175d6381f openvswitch: switch from WARN to pr_warn 0667bb6000 ALSA: aoa: Fix I2S device accounting 5bdea67453 ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() 2a47cc2a3d PM: domains: Fix handling of unavailable/disabled idle states a49e74cc74 net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() e46f699ac2 i40e: Fix flow-type by setting GL_HASH_INSET registers e88c2a1e28 i40e: Fix VF hang when reset is triggered on another VF 28c47fd23c i40e: Fix ethtool rx-flow-hash setting for X722 d303dabe7e media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' b4a3a01762 media: v4l2-dv-timings: add sanity checks for blanking values d8f479c777 media: vivid: dev->bitmap_cap wasn't freed in all cases 9d6870949c media: vivid: s_fbuf: add more sanity checks 8e1592d415 PM: hibernate: Allow hybrid sleep to work with s2idle 77454bc744 can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path f79de6451e tcp: fix indefinite deferral of RTO with SACK reneging 38e4516960 net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY 97ad240fd9 net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed 663682cd31 kcm: annotate data-races around kcm->rx_wait e94395e916 kcm: annotate data-races around kcm->rx_psock f85e54b4f3 amd-xgbe: add the bit rate quirk for Molex cables 71ba2a9566 amd-xgbe: fix the SFP compliance codes check for DAC cables fe3fd27083 x86/unwind/orc: Fix unreliable stack dump with gcov fda2d07234 net: netsec: fix error handling in netsec_register_mdio() 24b129aed8 tipc: fix a null-ptr-deref in tipc_topsrv_accept 758dbcc6fb ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() ccaeef126e arc: iounmap() arg is volatile fa434a64a4 drm/msm: Fix return type of mdp4_lvds_connector_mode_valid 29a6902eb0 media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation 6f3511eb86 net: ieee802154: fix error return code in dgram_bind() 11993652d0 mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages 5a2d7c93d9 cgroup-v1: add disabled controller check in cgroup1_parse_param() 3d056d81b9 xen/gntdev: Prevent leaking grants 8f589b5c0e Xen/gntdev: don't ignore kernel unmapping error f45ee20384 xfs: force the log after remapping a synchronous-writes file 102de7717d xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush 03b449a880 xfs: finish dfops on every insert range shift iteration 3d295076ba s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() 344e1cb0ba s390/futex: add missing EX_TABLE entry to __futex_atomic_op() 4f969d0753 perf auxtrace: Fix address filter symbol name match for modules c78b0dc6fb kernfs: fix use-after-free in __kernfs_remove 7a09c64b7d mmc: core: Fix kernel panic when remove non-standard SDIO card ed7f1ff87a drm/msm/hdmi: fix memory corruption with too many bridges f649ed0e1b drm/msm/dsi: fix memory corruption with too many bridges e7348308f6 mac802154: Fix LQI recording 5385af2f89 fbdev: smscufx: Fix several use-after-free bugs 07ef3be6ca iio: light: tsl2583: Fix module unloading cb972e6d01 tools: iio: iio_utils: fix digit calculation 8f1cd9633d xhci: Remove device endpoints from bandwidth list when freeing the device 914704e0d2 mtd: rawnand: marvell: Use correct logic for nand-keep-config 5d36037b22 usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller 7b7a0d5433 usb: bdc: change state when port disconnected 6827b58a95 usb: dwc3: gadget: Don't set IMI for no_interrupt 9aa0254303 usb: dwc3: gadget: Stop processing more requests on IMI 035dda2bfd USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM e4045fbcd9 ALSA: au88x0: use explicitly signed char d853b43808 ALSA: Use del_timer_sync() before freeing timer caea5b20ef can: kvaser_usb: Fix possible completions during init_completion 5437642f91 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() d1e6abc127 UPSTREAM: once: fix section mismatch on clang builds 5bb30ff63f ANDROID: fix up struct sk_buf ABI breakage 9470c670ee ANDROID: fix up CRC issue with struct tcp_sock 5282d4de78 Linux 5.4.222 59f89518f5 once: fix section mismatch on clang builds 34c78f8fb6 ANDROID: fix up 131287ff83 ("once: add DO_ONCE_SLOW() for sleepable contexts") f4606e0bf2 Revert "serial: 8250: Fix restoring termios speed after suspend" 6b029aa535 Merge 5.4.220 into android11-5.4-lts b70bfeb986 Linux 5.4.221 6bb8769326 mm: /proc/pid/smaps_rollup: fix no vma's null-deref a351077e58 hv_netvsc: Fix race between VF offering and VF association message from host 2f1b3377b6 Makefile.debug: re-enable debug info for .S files 9220881831 ACPI: video: Force backlight native for more TongFang devices 8ad8fc82ee riscv: topology: fix default topology reporting 60dd3dc2ac arm64: topology: move store_cpu_topology() to shared code 724483b585 iommu/vt-d: Clean up si_domain in the init_dmars() error path dfc0337c6d net: hns: fix possible memory leak in hnae_ae_register() bc8301ea7e net: sched: cake: fix null pointer access issue when cake_init() fails b87f88d58f net: phy: dp83867: Extend RX strap quirk for SGMII mode 6453077a00 net/atm: fix proc_mpc_write incorrect return value 4258c473ee HID: magicmouse: Do not set BTN_MOUSE on double report 567f8de358 tipc: fix an information leak in tipc_topsrv_kern_subscr 27ee73c119 tipc: Fix recognition of trial period fa0676d94f ACPI: extlog: Handle multiple records 13a2719ec8 btrfs: fix processing of delayed tree block refs during backref walking b397ce3477 btrfs: fix processing of delayed data refs during backref walking 96894a4fe6 r8152: add PID for the Lenovo OneLink+ Dock 7f6d2188ec arm64: errata: Remove AES hwcap for COMPAT tasks aae3508163 media: venus: dec: Handle the case where find_format fails fd596e7371 KVM: arm64: vgic: Fix exit condition in scan_its_table() 383b7c50f5 ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS da97931502 ata: ahci-imx: Fix MODULE_ALIAS c00cdfc9bd hwmon/coretemp: Handle large core ID value 3ea7da6a97 x86/microcode/AMD: Apply the patch early on every logical thread 3064c74198 ocfs2: fix BUG when iput after ocfs2_mknod fails c2489774a2 ocfs2: clear dinode links count in case of error 6391ed32b1 xfs: fix use-after-free on CIL context on shutdown ac055fee25 xfs: move inode flush to the sync workqueue d3eb14b8ea xfs: reflink should force the log out if mounted with wsync 05e2b279ea xfs: factor out a new xfs_log_force_inode helper f1172b08bb xfs: trylock underlying buffer on dquot flush 890d7dfff7 xfs: don't write a corrupt unmount record to force summary counter recalc 8ebd3ba932 xfs: tail updates only need to occur when LSN changes 87b8a7fb62 xfs: factor common AIL item deletion code 4202b103d3 xfs: Throttle commits on delayed background CIL push 7a8f95bfb9 xfs: Lower CIL flush limit for large logs f43ff28b01 xfs: preserve default grace interval during quotacheck 553e5c8031 xfs: fix unmount hang and memory leak on shutdown during quotaoff 835306dd3f xfs: factor out quotaoff intent AIL removal and memory free a1e03f1600 xfs: Replace function declaration by actual definition fdce40c8fd xfs: remove the xfs_qoff_logitem_t typedef 926ddf7846 xfs: remove the xfs_dq_logitem_t typedef 80f78aa76a xfs: remove the xfs_disk_dquot_t and xfs_dquot_t 4776ae328c xfs: Use scnprintf() for avoiding potential buffer overflow 2f55a03891 xfs: check owner of dir3 blocks 15b0651f38 xfs: check owner of dir3 data blocks bc013efdcf xfs: fix buffer corruption reporting when xfs_dir3_free_header_check fails 6e204b9e67 xfs: xfs_buf_corruption_error should take __this_address 0213ee5f4c xfs: add a function to deal with corrupt buffers post-verifiers 3c88c3c00c xfs: rework collapse range into an atomic operation 3602df3f1f xfs: rework insert range into an atomic operation 7cd181cb23 xfs: open code insert range extent split helper fe18f1af38 Linux 5.4.220 d9fdda5efe thermal: intel_powerclamp: Use first online CPU as control_cpu c3bb4a7e8c inet: fully convert sk->sk_rx_dst to RCU rules 96e2e21284 efi: libstub: drop pointless get_memory_map() call 97238b8858 md: Replace snprintf with scnprintf 8b766dd707 ext4: continue to expand file system when the target size doesn't reach 4a36de8947 net/ieee802154: don't warn zero-sized raw_sendmsg() cff6131217 Revert "net/ieee802154: reject zero-sized raw_sendmsg()" 1210359a68 net: ieee802154: return -EINVAL for unknown addr type 04df9719df io_uring/af_unix: defer registered files gc to io_uring release f5dd24a664 perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc 036b1f3bca clk: bcm2835: Make peripheral PLLC critical 1eae30c011 usb: idmouse: fix an uninit-value in idmouse_open 0d150ccd55 nvmet-tcp: add bounds check on Transfer Tag 3a3a8d75af nvme: copy firmware_rev on each init e5d8f05edb staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() 072b5a41c5 Revert "usb: storage: Add quirk for Samsung Fit flash" d6afcab1b4 usb: musb: Fix musb_gadget.c rxstate overflow bug 9fa81cbd2d usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() 1c00bb624c md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d e30c3a9a88 HID: roccat: Fix use-after-free in roccat_read() 81247850b8 bcache: fix set_at_max_writeback_rate() for multiple attached devices 7cfc77f4fe ata: libahci_platform: Sanity check the DT child nodes number 16a45e78a6 staging: vt6655: fix potential memory leak 3376a0cf13 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() 3575949513 nbd: Fix hung when signal interrupts nbd_start_device_ioctl() 22f49d9d6e scsi: 3w-9xxx: Avoid disabling device if failing to enable it 66de922076 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate 9181af2dbf media: cx88: Fix a null-ptr-deref bug in buffer_prepare() 5dbfcf7b08 clk: zynqmp: Fix stack-out-of-bounds in strncpy` 715fe15785 btrfs: scrub: try to fix super block errors 8054f824a7 ARM: dts: imx6sx: add missing properties for sram 05f789afaf ARM: dts: imx6sll: add missing properties for sram 48d1766b35 ARM: dts: imx6sl: add missing properties for sram ef4a3baf00 ARM: dts: imx6qp: add missing properties for sram ee239c0340 ARM: dts: imx6dl: add missing properties for sram 82e5191b12 ARM: dts: imx6q: add missing properties for sram 0b2013ace8 ARM: dts: imx7d-sdb: config the max pressure for tsc2046 aec01503ba mmc: sdhci-msm: add compatible string check for sdm670 e67c2cda3d drm/amdgpu: fix initial connector audio value 079f64a1ea platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading 30a3601c2f drm: panel-orientation-quirks: Add quirk for Anbernic Win600 7de3e3514c drm/vc4: vec: Fix timings for VEC modes 8f6cad7c4b drm/amd/display: fix overflow on MIN_I64 definition cdde55f972 drm: Prevent drm_copy_field() to attempt copying a NULL pointer fb282b4e8a drm: Use size_t type for len variable in drm_copy_field() 1d0803b153 drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() 61fd56b0a1 r8152: Rate limit overflow messages 7d6f9cb24d Bluetooth: L2CAP: Fix user-after-free a76462dbdd net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory 4037270ea6 wifi: rt2x00: correctly set BBP register 86 for MT7620 2021a5aaf8 wifi: rt2x00: set SoC wmac clock register f9c053c3e4 wifi: rt2x00: set VGC gain for both chains of MT7620 0facbe6083 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 2f383edcb7 wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 fdcc57ef8c can: bcm: check the result of can_send() in bcm_can_tx() 6e85d2ad95 Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times 776f33c12f Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() 49c742afd6 wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() 18373ed500 xfrm: Update ipcomp_scratches with NULL when freed 2c485f4f2a wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() 42d579d910 tcp: annotate data-race around tcp_md5sig_pool_populated ce25d7caf3 openvswitch: Fix overreporting of drops in dropwatch a7fe12cea5 openvswitch: Fix double reporting of drops in dropwatch 06d73f4e6b bpftool: Clear errno after libcap's checks 56a0ac4863 wifi: brcmfmac: fix invalid address access when enabling SCAN log level 38ca9ece96 NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data 5a646c38f6 thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash 49a6ffdaed powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue ac84b26a16 MIPS: BCM47XX: Cast memcmp() of function to (void *) 13f4d3665b ACPI: video: Add Toshiba Satellite/Portege Z830 quirk c5ed3a3789 f2fs: fix race condition on setting FI_NO_EXTENT flag 584561e942 crypto: cavium - prevent integer overflow loading firmware 00791e017b kbuild: remove the target in signal traps when interrupted d59d36aa4c iommu/iova: Fix module config properly 0f224fde63 crypto: ccp - Release dma channels before dmaengine unrgister 95c4e20adc crypto: akcipher - default implementation for setting a private key 4010a1afaa iommu/omap: Fix buffer overflow in debugfs b32a285998 cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset 3317c7d211 powerpc: Fix SPE Power ISA properties for e500v1 platforms 6191f0310e powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 f11bce700b x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition 828d190380 powerpc/powernv: add missing of_node_put() in opal_export_attrs() 0a5cee97c0 powerpc/pci_dn: Add missing of_node_put() 1535e14731 powerpc/sysdev/fsl_msi: Add missing of_node_put() 85d23c4933 powerpc/math_emu/efp: Include module.h e77a85c3fb mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg f28eec4078 clk: ast2600: BCLK comes from EPLL fc39ebf85d clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe 111369bb8c clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration 2ee652f072 spmi: pmic-arb: correct duplicate APID to PPID mapping logic 1ea4efc09f dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() 8498490b3c clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent 8542422192 mfd: sm501: Add check for platform_driver_register() f95ba4aab6 mfd: fsl-imx25: Fix check for platform_get_irq() errors 6804b4fede mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() 595d077f3c mfd: lp8788: Fix an error handling path in lp8788_probe() b75f4912b3 mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() 1f4f8b6adb mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() b6c2c3059e fsi: core: Check error number after calling ida_simple_get 117331a2a5 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() 558a9fcb6c serial: 8250: Fix restoring termios speed after suspend c969316eee firmware: google: Test spinlock on panic path to avoid lockups 88b9cc60f2 staging: vt6655: fix some erroneous memory clean-up loops 83d11dd92a phy: qualcomm: call clk_disable_unprepare in the error handling 29b897ac7b tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown 744c2d33a8 drivers: serial: jsm: fix some leaks in probe 9fe0a8c069 usb: gadget: function: fix dangling pnp_string in f_printer.c 59e3d41265 xhci: Don't show warning for reinit on known broken suspend f8ba29ae23 md/raid5: Ensure stripe_fill happens on non-read IO with journal 9b881a2ca0 mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() 22830560eb ata: fix ata_id_has_dipm() 10d52d8dd1 ata: fix ata_id_has_ncq_autosense() 99e7e64451 ata: fix ata_id_has_devslp() 6ea4b3303a ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() e09caa38e1 RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. b21b0d17ad mtd: devices: docg3: check the return value of devm_ioremap() in the probe 3ca6939b5d dyndbg: let query-modname override actual module name ad0a65517c dyndbg: fix module.dyndbg handling fc797285c4 misc: ocxl: fix possible refcount leak in afu_ioctl() 7ed37be3a2 RDMA/rxe: Fix the error caused by qp->sk 0d773c58d7 RDMA/rxe: Fix "kernel NULL pointer dereference" error 59b3153532 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init 80a955dabb tty: xilinx_uartps: Fix the ignore_status 3e77ac46f2 media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop 3baf53328a HSI: omap_ssi_port: Fix dma_map_sg error check aa9c0598b1 HSI: omap_ssi: Fix refcount leak in ssi_probe 5d9fb09612 clk: tegra20: Fix refcount leak in tegra20_clock_init 5984b1d661 clk: tegra: Fix refcount leak in tegra114_clock_init 6d3ac23b95 clk: tegra: Fix refcount leak in tegra210_clock_init aa3898dec1 clk: berlin: Add of_node_put() for of_get_parent() fcaff9bc6b clk: oxnas: Hold reference returned by of_get_parent() ad3a056982 clk: meson: Hold reference returned by of_get_parent() 633c574e0f iio: ABI: Fix wrong format of differential capacitance channel ABI. 0111032d9a iio: inkern: only release the device node when done with it 246af42163 iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq 46778752bb iio: adc: at91-sama5d2_adc: check return status for pressure and touch d50e3817a4 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX c29c3d32bd ARM: dts: exynos: fix polarity of VBUS GPIO of Origen e00480d42b ARM: Drop CMDLINE_* dependency on ATAGS fcad2eef00 ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family 6858d8599c ARM: dts: kirkwood: lsxl: remove first ethernet port d45424d980 ARM: dts: kirkwood: lsxl: fix serial line 1edbceda07 ARM: dts: turris-omnia: Fix mpp26 pin name and comment 673db1cf4d soc: qcom: smem_state: Add refcounting for the 'state->of_node' 1e3ed59370 soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() 85a40bfb8e memory: of: Fix refcount leak bug in of_get_ddr_timings() b37f4a711e memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() 56c4299f76 ALSA: hda/hdmi: Don't skip notification handling during PM operation 45387ca422 ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe 371d4dbece ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe aa182988c0 ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe 28a12e24d1 mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() 93c8628183 ALSA: dmaengine: increment buffer pointer atomically 6c85495e58 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx c240431717 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API 9e421bd9fd mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() 9d7af9b162 drm/omap: dss: Fix refcount leak bugs 0c55618aaa ALSA: hda: beep: Simplify keep-power-at-enable behavior 3ac2045d04 ASoC: rsnd: Add check for rsnd_mod_power_on 1daf69228e drm/bridge: megachips: Fix a null pointer dereference bug b33b60afa5 drm: fix drm_mipi_dbi build errors a367b7a96a platform/x86: msi-laptop: Fix resource cleanup a9b32c9fe5 platform/x86: msi-laptop: Fix old-ec check for backlight registering e548f9503c platform/chrome: fix memory corruption in ioctl 783c1c5000 platform/chrome: fix double-free in chromeos_laptop_prepare() 8242167cfc drm/mipi-dsi: Detach devices when removing the host 4d4a58c9d4 drm: bridge: adv7511: fix CEC power down control register offset 72c0d36194 net: mvpp2: fix mvpp2 debugfs leak 131287ff83 once: add DO_ONCE_SLOW() for sleepable contexts 03ac583eef net/ieee802154: reject zero-sized raw_sendmsg() 71e0ab5b75 bnx2x: fix potential memory leak in bnx2x_tpa_stop() 360aa72192 net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() 3625b684a2 tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited 382ff44716 sctp: handle the error returned from sctp_auth_asoc_init_active_key 466ed722f2 mISDN: fix use-after-free bugs in l1oip timer handlers e6d0152c95 vhost/vsock: Use kvmalloc/kvfree for larger packets. c202ad048f spi: s3c64xx: Fix large transfers with DMA 60a7496b40 netfilter: nft_fib: Fix for rpath check with VRF devices 610798a58e spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe 1d8c928ed7 x86/microcode/AMD: Track patch allocation size explicitly 215c146b40 bpf: Ensure correct locking around vulnerable function find_vpid() 4017e91ff2 net: fs_enet: Fix wrong check in do_pd_setup 08a441a4ad wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration e0bab93245 bpf: btf: fix truncated last_member_type_id in btf_struct_resolve 374dd4e519 wifi: rtl8xxxu: Fix skb misuse in TX queue selection df0b024ade spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() 026ffbb07f spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() 321c51aa59 wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() 7993680752 x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register bbe293db7e bpftool: Fix a wrong type cast in btf_dumper_int 9ee70c3cb4 wifi: mac80211: allow bw change during channel switch in mesh 4494ec1c0b wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() acc393aecd nfsd: Fix a memory leak in an error handling path d7f1e7af1e ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE 5abd2626ca sh: machvec: Use char[] for section boundaries c0f4be8303 userfaultfd: open userfaultfds with O_RDONLY 29d0c45cf1 tracing: Disable interrupt or preemption before acquiring arch_spinlock_t b0c2e34be9 selinux: use "grep -E" instead of "egrep" 56ee957791 drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() 16435e58e5 gcov: support GCC 12.1 and newer compilers b6094c4829 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS 7644786461 KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" 45779be5ce KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility c3a98fc6c2 media: cedrus: Set the platform driver data earlier 3cf2ef86e0 ring-buffer: Fix race between reset page and reading page 7e06ef0345 ring-buffer: Check pending waiters when doing wake ups as well cc1f35733c ring-buffer: Have the shortest_full queue be the shortest not longest 22707f033d ring-buffer: Allow splice to read previous partially read pages e755b65a47 ftrace: Properly unset FTRACE_HASH_FL_MOD f66de70930 livepatch: fix race between fork and KLP transition 1211121f0e ext4: place buffer head allocation before handle start 52c7b8d3b7 ext4: make ext4_lazyinit_thread freezable 3638aa1c7d ext4: fix null-ptr-deref in ext4_write_info a22f52d883 ext4: avoid crash when inline data creation follows DIO write 21ea616f1e jbd2: wake up journal waiters in FIFO order, not LIFO d1c2d820a2 nilfs2: fix use-after-free bug of struct nilfs_root c99860f9a7 f2fs: fix to do sanity check on summary info 68b1e60755 f2fs: fix to do sanity check on destination blkaddr during recovery c5d8198ce8 f2fs: increase the limit for reserve_root 26b7c0ac49 btrfs: fix race between quota enable and quota rescan ioctl 3742e9fd55 fbdev: smscufx: Fix use-after-free in ufx_ops_open() 52895c495b powerpc/boot: Explicitly disable usage of SPE instructions e3f7e99337 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge cd251d39b1 UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK 08f03b333c riscv: Pass -mno-relax only on lld < 15.0.0 c61f553ba8 riscv: Allow PROT_WRITE-only mmap() 09058e5ef7 parisc: fbdev/stifb: Align graphics memory size to 4MB 2c60db6869 RISC-V: Make port I/O string accessors actually work 14c06375c8 regulator: qcom_rpm: Fix circular deferral regression 79b7547eeb ASoC: wcd9335: fix order of Slimbus unprepare/disable 6927ee818f quota: Check next/prev free block number after reading from quota file 4cf9233eb1 HID: multitouch: Add memory barriers 477ac1d57f fs: dlm: handle -EBUSY first in lock arg validation d3961f732d fs: dlm: fix race between test_bit() and queue_work() 4352db1e33 mmc: sdhci-sprd: Fix minimum clock limit fbefc5cce4 can: kvaser_usb_leaf: Fix CAN state after restart 9948b80910 can: kvaser_usb_leaf: Fix TX queue out of sync after restart 76d9afd30e can: kvaser_usb_leaf: Fix overread with an invalid command 953bb1dfea can: kvaser_usb: Fix use of uninitialized completion 42f7d93396 usb: add quirks for Lenovo OneLink+ Dock 37daa23f28 iio: pressure: dps310: Reset chip after timeout 228348a9fe iio: pressure: dps310: Refactor startup procedure 974c1f15ac iio: dac: ad5593r: Fix i2c read protocol requirements d0050ec3eb cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message bd09adde67 cifs: destage dirty pages before re-reading them for cache=none 8298f20e11 mtd: rawnand: atmel: Unmap streaming DMA mappings 8d763c8e6c ALSA: hda/realtek: Add Intel Reference SSID to support headset keys 4c35410517 ALSA: hda/realtek: Add quirk for ASUS GV601R laptop a943c4a16b ALSA: hda/realtek: Correct pin configs for ASUS G533Z 1973164962 ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 121fadc0ca ALSA: usb-audio: Fix NULL dererence at error path 988ec0cd0a ALSA: usb-audio: Fix potential memory leaks de7d80d0fe ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() afb507303e ALSA: oss: Fix potential deadlock at unregistration Change-Id: I06f42bac516b0d4c4bf2fd0794ea017548f7cbd9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2022-12-22 18:47:04 +00:00
parent 8912db2538 94bdbb0042
commit 98d8600199
693 changed files with 86646 additions and 87050 deletions
--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -138,7 +138,7 @@ Description:
 		Raw capacitance measurement from channel Y. Units after
 		application of scale and offset are nanofarads.

-What:		/sys/.../iio:deviceX/in_capacitanceY-in_capacitanceZ_raw
+What:		/sys/.../iio:deviceX/in_capacitanceY-capacitanceZ_raw
 KernelVersion:	3.2
 Contact:	linux-iio@vger.kernel.org
 Description:
--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -70,8 +70,12 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A57      | #834220         | ARM64_ERRATUM_834220        |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A57      | #1742098        | ARM64_ERRATUM_1742098       |
+----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A72      | #853709         | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A72      | #1655431        | ARM64_ERRATUM_1742098       |
+----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A73      | #858921         | ARM64_ERRATUM_858921        |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A55      | #1024718        | ARM64_ERRATUM_1024718       |
--- a/Documentation/process/code-of-conduct-interpretation.rst
+++ b/Documentation/process/code-of-conduct-interpretation.rst
@@ -51,7 +51,7 @@ the Technical Advisory Board (TAB) or other maintainers if you're
 uncertain how to handle situations that come up.  It will not be
 considered a violation report unless you want it to be.  If you are
 uncertain about approaching the TAB or any other maintainers, please
-reach out to our conflict mediator, Joanna Lee <joanna.lee@gesmer.com>.
+reach out to our conflict mediator, Joanna Lee <jlee@linuxfoundation.org>.

 In the end, "be kind to each other" is really what the end goal is for
 everybody.  We know everyone is human and we all fail at times, but the
--- a/Documentation/trace/histogram.rst
+++ b/Documentation/trace/histogram.rst
@@ -39,7 +39,7 @@ Documentation written by Tom Zanussi
  will use the event's kernel stacktrace as the key.  The keywords
  'keys' or 'key' can be used to specify keys, and the keywords
  'values', 'vals', or 'val' can be used to specify values.  Compound
-  keys consisting of up to two fields can be specified by the 'keys'
+  keys consisting of up to three fields can be specified by the 'keys'
  keyword.  Hashing a compound key produces a unique entry in the
  table for each unique combination of component keys, and can be
  useful for providing more fine-grained summaries of event data.
--- a/6
+++ b/6
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 219
+SUBLEVEL = 226
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus

@@ -825,7 +825,9 @@ DEBUG_CFLAGS	+= -gsplit-dwarf
 else
 DEBUG_CFLAGS	+= -g
 endif
-ifneq ($(LLVM_IAS),1)
+ifeq ($(LLVM_IAS),1)
+KBUILD_AFLAGS	+= -g
+else
 KBUILD_AFLAGS	+= -Wa,-gdwarf-2
 endif
 endif
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
--- a/arch/arc/include/asm/io.h
+++ b/arch/arc/include/asm/io.h
@@ -32,7 +32,7 @@ static inline void ioport_unmap(void __iomem *addr)
 {
 }

-extern void iounmap(const void __iomem *addr);
+extern void iounmap(const volatile void __iomem *addr);

 #define ioremap_nocache(phy, sz)	ioremap(phy, sz)
 #define ioremap_wc(phy, sz)		ioremap(phy, sz)
--- a/arch/arc/mm/ioremap.c
+++ b/arch/arc/mm/ioremap.c
@@ -93,7 +93,7 @@ void __iomem *ioremap_prot(phys_addr_t paddr, unsigned long size,
 EXPORT_SYMBOL(ioremap_prot);


-void iounmap(const void __iomem *addr)
+void iounmap(const volatile void __iomem *addr)
 {
 	/* weird double cast to handle phys_addr_t > 32 bits */
 	if (arc_uncached_addr_space((phys_addr_t)(u32)addr))
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1838,7 +1838,6 @@ config CMDLINE
 choice
 	prompt "Kernel command line type" if CMDLINE != ""
 	default CMDLINE_FROM_BOOTLOADER
-	depends on ATAGS

 config CMDLINE_FROM_BOOTLOADER
 	bool "Use bootloader kernel arguments if available"
--- a/arch/arm/boot/dts/am335x-pcm-953.dtsi
+++ b/arch/arm/boot/dts/am335x-pcm-953.dtsi
@@ -12,22 +12,20 @@
 	compatible = "phytec,am335x-pcm-953", "phytec,am335x-phycore-som", "ti,am33xx";

 	/* Power */
-	regulators {
-		vcc3v3: fixedregulator@1 {
-			compatible = "regulator-fixed";
-			regulator-name = "vcc3v3";
-			regulator-min-microvolt = <3300000>;
-			regulator-max-microvolt = <3300000>;
-			regulator-boot-on;
-		};
+	vcc3v3: fixedregulator1 {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc3v3";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+	};

-		vcc1v8: fixedregulator@2 {
-			compatible = "regulator-fixed";
-			regulator-name = "vcc1v8";
-			regulator-min-microvolt = <1800000>;
-			regulator-max-microvolt = <1800000>;
-			regulator-boot-on;
-		};
+	vcc1v8: fixedregulator2 {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc1v8";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
 	};

 	/* User IO */
--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
+++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
@@ -307,7 +307,7 @@
 		marvell,function = "spi0";
 	};

-	spi0cs1_pins: spi0cs1-pins {
+	spi0cs2_pins: spi0cs2-pins {
 		marvell,pins = "mpp26";
 		marvell,function = "spi0";
 	};
@@ -342,7 +342,7 @@
 		};
 	};

-	/* MISO, MOSI, SCLK and CS1 are routed to pin header CN11 */
+	/* MISO, MOSI, SCLK and CS2 are routed to pin header CN11 */
 };

 &uart0 {
--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
@@ -38,6 +38,13 @@

 				};

+				usb1 {
+					pinctrl_usb1_vbus_gpio: usb1_vbus_gpio {
+						atmel,pins =
+							<AT91_PIOC 5 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;	/* PC5 GPIO */
+					};
+				};
+
 				mmc0_slot1 {
 					pinctrl_board_mmc0_slot1: mmc0_slot1-board {
 						atmel,pins =
@@ -83,6 +90,8 @@
 			};

 			usb1: gadget@fffa4000 {
+				pinctrl-0 = <&pinctrl_usb1_vbus_gpio>;
+				pinctrl-names = "default";
 				atmel,vbus-gpio = <&pioC 5 GPIO_ACTIVE_HIGH>;
 				status = "okay";
 			};
--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
+++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
@@ -534,7 +534,7 @@
 		clocks = <&camera 1>;
 		clock-names = "extclk";
 		samsung,camclk-out = <1>;
-		gpios = <&gpm1 6 GPIO_ACTIVE_HIGH>;
+		gpios = <&gpm1 6 GPIO_ACTIVE_LOW>;

 		port {
 			is_s5k6a3_ep: endpoint {
--- a/arch/arm/boot/dts/exynos4412-origen.dts
+++ b/arch/arm/boot/dts/exynos4412-origen.dts
@@ -86,7 +86,7 @@
 };

 &ehci {
-	samsung,vbus-gpio = <&gpx3 5 1>;
+	samsung,vbus-gpio = <&gpx3 5 GPIO_ACTIVE_HIGH>;
 	status = "okay";
 	phys = <&exynos_usbphy 2>, <&exynos_usbphy 3>;
 	phy-names = "hsic0", "hsic1";
--- a/arch/arm/boot/dts/imx6dl.dtsi
+++ b/arch/arm/boot/dts/imx6dl.dtsi
@@ -81,6 +81,9 @@
 		ocram: sram@900000 {
 			compatible = "mmio-sram";
 			reg = <0x00900000 0x20000>;
+			ranges = <0 0x00900000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6QDL_CLK_OCRAM>;
 		};

--- a/arch/arm/boot/dts/imx6q.dtsi
+++ b/arch/arm/boot/dts/imx6q.dtsi
@@ -158,6 +158,9 @@
 		ocram: sram@900000 {
 			compatible = "mmio-sram";
 			reg = <0x00900000 0x40000>;
+			ranges = <0 0x00900000 0x40000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6QDL_CLK_OCRAM>;
 		};

--- a/arch/arm/boot/dts/imx6qp.dtsi
+++ b/arch/arm/boot/dts/imx6qp.dtsi
@@ -9,12 +9,18 @@
 		ocram2: sram@940000 {
 			compatible = "mmio-sram";
 			reg = <0x00940000 0x20000>;
+			ranges = <0 0x00940000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6QDL_CLK_OCRAM>;
 		};

 		ocram3: sram@960000 {
 			compatible = "mmio-sram";
 			reg = <0x00960000 0x20000>;
+			ranges = <0 0x00960000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6QDL_CLK_OCRAM>;
 		};

--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -121,6 +121,9 @@
 		ocram: sram@900000 {
 			compatible = "mmio-sram";
 			reg = <0x00900000 0x20000>;
+			ranges = <0 0x00900000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6SL_CLK_OCRAM>;
 		};

--- a/arch/arm/boot/dts/imx6sll.dtsi
+++ b/arch/arm/boot/dts/imx6sll.dtsi
@@ -123,6 +123,9 @@
 		ocram: sram@900000 {
 			compatible = "mmio-sram";
 			reg = <0x00900000 0x20000>;
+			ranges = <0 0x00900000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 		};

 		intc: interrupt-controller@a01000 {
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -163,12 +163,18 @@
 		ocram_s: sram@8f8000 {
 			compatible = "mmio-sram";
 			reg = <0x008f8000 0x4000>;
+			ranges = <0 0x008f8000 0x4000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6SX_CLK_OCRAM_S>;
 		};

 		ocram: sram@900000 {
 			compatible = "mmio-sram";
 			reg = <0x00900000 0x20000>;
+			ranges = <0 0x00900000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 			clocks = <&clks IMX6SX_CLK_OCRAM>;
 		};

--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -177,12 +177,7 @@
 		interrupt-parent = <&gpio2>;
 		interrupts = <29 0>;
 		pendown-gpio = <&gpio2 29 GPIO_ACTIVE_HIGH>;
-		ti,x-min = /bits/ 16 <0>;
-		ti,x-max = /bits/ 16 <0>;
-		ti,y-min = /bits/ 16 <0>;
-		ti,y-max = /bits/ 16 <0>;
-		ti,pressure-max = /bits/ 16 <0>;
-		ti,x-plate-ohms = /bits/ 16 <400>;
+		touchscreen-max-pressure = <255>;
 		wakeup-source;
 	};
 };
--- a/arch/arm/boot/dts/kirkwood-lsxl.dtsi
+++ b/arch/arm/boot/dts/kirkwood-lsxl.dtsi
@@ -10,6 +10,11 @@

 	ocp@f1000000 {
 		pinctrl: pin-controller@10000 {
+			/* Non-default UART pins */
+			pmx_uart0: pmx-uart0 {
+				marvell,pins = "mpp4", "mpp5";
+			};
+
 			pmx_power_hdd: pmx-power-hdd {
 				marvell,pins = "mpp10";
 				marvell,function = "gpo";
@@ -213,22 +218,11 @@
 &mdio {
 	status = "okay";

-	ethphy0: ethernet-phy@0 {
-		reg = <0>;
-	};
-
 	ethphy1: ethernet-phy@8 {
 		reg = <8>;
 	};
 };

-&eth0 {
-	status = "okay";
-	ethernet0-port@0 {
-		phy-handle = <&ethphy0>;
-	};
-};
-
 &eth1 {
 	status = "okay";
 	ethernet1-port@0 {
--- a/arch/arm/mach-mxs/mach-mxs.c
+++ b/arch/arm/mach-mxs/mach-mxs.c
@@ -387,8 +387,10 @@ static void __init mxs_machine_init(void)

 	root = of_find_node_by_path("/");
 	ret = of_property_read_string(root, "model", &soc_dev_attr->machine);
-	if (ret)
+	if (ret) {
+		kfree(soc_dev_attr);
 		return;
+	}

 	soc_dev_attr->family = "Freescale MXS Family";
 	soc_dev_attr->soc_id = mxs_get_soc_id();
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -320,7 +320,11 @@ static struct mem_type mem_types[] __ro_after_init = {
 		.prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
 			     L_PTE_XN | L_PTE_RDONLY,
 		.prot_l1   = PMD_TYPE_TABLE,
+#ifdef CONFIG_ARM_LPAE
+		.prot_sect = PMD_TYPE_SECT | L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+#else
 		.prot_sect = PMD_TYPE_SECT,
+#endif
 		.domain    = DOMAIN_KERNEL,
 	},
 	[MT_ROM] = {
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -577,6 +577,22 @@ config ARM64_ERRATUM_1542419

 	  If unsure, say Y.

+config ARM64_ERRATUM_1742098
+	bool "Cortex-A57/A72: 1742098: ELR recorded incorrectly on interrupt taken between cryptographic instructions in a sequence"
+	depends on COMPAT
+	default y
+	help
+	  This option removes the AES hwcap for aarch32 user-space to
+	  workaround erratum 1742098 on Cortex-A57 and Cortex-A72.
+
+	  Affected parts may corrupt the AES state if an interrupt is
+	  taken between a pair of AES instructions. These instructions
+	  are only present if the cryptography extensions are present.
+	  All software should have a fallback implementation for CPUs
+	  that don't implement the cryptography extensions.
+
+	  If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
 	bool "Cavium erratum 22375, 24313"
 	default y
--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
@@ -838,10 +838,10 @@
 			clocks = <&clk IMX8MM_CLK_NAND_USDHC_BUS_RAWNAND_CLK>;
 		};

-		gpmi: nand-controller@33002000{
+		gpmi: nand-controller@33002000 {
 			compatible = "fsl,imx8mm-gpmi-nand", "fsl,imx7d-gpmi-nand";
 			#address-cells = <1>;
-			#size-cells = <1>;
+			#size-cells = <0>;
 			reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
 			reg-names = "gpmi-nand", "bch";
 			interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
@@ -695,7 +695,7 @@
 		gpmi: nand-controller@33002000 {
 			compatible = "fsl,imx8mn-gpmi-nand", "fsl,imx7d-gpmi-nand";
 			#address-cells = <1>;
-			#size-cells = <1>;
+			#size-cells = <0>;
 			reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
 			reg-names = "gpmi-nand", "bch";
 			interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
@@ -203,7 +203,7 @@
 	cap-sd-highspeed;
 	cd-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>;
 	disable-wp;
-	max-frequency = <150000000>;
+	max-frequency = <40000000>;
 	pinctrl-names = "default";
 	pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
 	vmmc-supply = <&vcc3v3_baseboard>;
--- a/arch/arm64/configs/gki_defconfig
+++ b/arch/arm64/configs/gki_defconfig
@@ -583,6 +583,7 @@ CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=-1
 CONFIG_SCHEDSTATS=y
 # CONFIG_DEBUG_PREEMPT is not set
+CONFIG_FUNCTION_ERROR_INJECTION=y
 CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_STM=y
--- a/arch/arm64/include/asm/cpucaps.h
+++ b/arch/arm64/include/asm/cpucaps.h
@@ -57,8 +57,9 @@
 #define ARM64_WORKAROUND_1542419		47
 #define ARM64_HAS_AMU_EXTN			48
 #define ARM64_SPECTRE_BHB			49
+#define ARM64_WORKAROUND_1742098		50

-/* kabi: reserve 50 - 62 for future cpu capabilities */
+/* kabi: reserve 51 - 62 for future cpu capabilities */
 #define ARM64_NCAPS				62

 #endif /* __ASM_CPUCAPS_H */
--- a/arch/arm64/include/asm/syscall_wrapper.h
+++ b/arch/arm64/include/asm/syscall_wrapper.h
@@ -8,7 +8,7 @@
 #ifndef __ASM_SYSCALL_WRAPPER_H
 #define __ASM_SYSCALL_WRAPPER_H

-struct pt_regs;
+#include <asm/ptrace.h>

 #define SC_ARM64_REGS_TO_ARGS(x, ...)				\
 	__MAP(x,__SC_ARGS					\
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -170,9 +170,12 @@ static void install_bp_hardening_cb(bp_hardening_cb_t fn,
 		__copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
 	}

-	__this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
-	__this_cpu_write(bp_hardening_data.fn, fn);
-	__this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
+	if (fn != __this_cpu_read(bp_hardening_data.fn)) {
+		__this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+		__this_cpu_write(bp_hardening_data.fn, fn);
+		__this_cpu_write(bp_hardening_data.template_start,
+				 hyp_vecs_start);
+	}
 	raw_spin_unlock(&bp_lock);
 }
 #else
@@ -817,6 +820,14 @@ static const struct arm64_cpu_capabilities erratum_843419_list[] = {
 };
 #endif

+#ifdef CONFIG_ARM64_ERRATUM_1742098
+static struct midr_range broken_aarch32_aes[] = {
+	MIDR_RANGE(MIDR_CORTEX_A57, 0, 1, 0xf, 0xf),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
+	{},
+};
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE
 	{
@@ -997,6 +1008,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 		.matches = has_neoverse_n1_erratum_1542419,
 		.cpu_enable = cpu_enable_trap_ctr_access,
 	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_1742098
+	{
+		.desc = "ARM erratum 1742098",
+		.capability = ARM64_WORKAROUND_1742098,
+		CAP_MIDR_RANGE_LIST(broken_aarch32_aes),
+		.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+	},
 #endif
 	{
 	}
@@ -1304,8 +1323,11 @@ static void kvm_setup_bhb_slot(const char *hyp_vecs_start)
 		__copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
 	}

-	__this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
-	__this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
+	if (hyp_vecs_start != __this_cpu_read(bp_hardening_data.template_start)) {
+		__this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+		__this_cpu_write(bp_hardening_data.template_start,
+				 hyp_vecs_start);
+	}
 	raw_spin_unlock(&bp_lock);
 }
 #else
@@ -1341,7 +1363,13 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry)
 	} else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) {
 		switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) {
 		case 8:
-			kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
+			/*
+			 * A57/A72-r0 will already have selected the
+			 * spectre-indirect vector, which is sufficient
+			 * for BHB too.
+			 */
+			if (!__this_cpu_read(bp_hardening_data.fn))
+				kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
 			break;
 		case 24:
 			kvm_setup_bhb_slot(__spectre_bhb_loop_k24_start);
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -21,6 +21,7 @@
 #include <asm/cpufeature.h>
 #include <asm/cpu_ops.h>
 #include <asm/fpsimd.h>
+#include <asm/hwcap.h>
 #include <asm/mmu_context.h>
 #include <asm/processor.h>
 #include <asm/sysreg.h>
@@ -1328,6 +1329,14 @@ static bool can_use_gic_priorities(const struct arm64_cpu_capabilities *entry,
 }
 #endif

+static void elf_hwcap_fixup(void)
+{
+#ifdef CONFIG_ARM64_ERRATUM_1742098
+	if (cpus_have_const_cap(ARM64_WORKAROUND_1742098))
+		compat_elf_hwcap2 &= ~COMPAT_HWCAP2_AES;
+#endif /* ARM64_ERRATUM_1742098 */
+}
+
 static const struct arm64_cpu_capabilities arm64_features[] = {
 	{
 		.desc = "GIC system register CPU interface",
@@ -2169,8 +2178,10 @@ void __init setup_cpu_features(void)
 	mark_const_caps_ready();
 	setup_elf_hwcaps(arm64_elf_hwcaps);

-	if (system_supports_32bit_el0())
+	if (system_supports_32bit_el0()) {
 		setup_elf_hwcaps(compat_elf_hwcaps);
+		elf_hwcap_fixup();
+	}

 	if (system_uses_ttbr0_pan())
 		pr_info("emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching\n");
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -12,6 +12,14 @@

 #include <asm/efi.h>

+static bool region_is_misaligned(const efi_memory_desc_t *md)
+{
+	if (PAGE_SIZE == EFI_PAGE_SIZE)
+		return false;
+	return !PAGE_ALIGNED(md->phys_addr) ||
+	       !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT);
+}
+
 /*
 * Only regions of type EFI_RUNTIME_SERVICES_CODE need to be
 * executable, everything else can be mapped with the XN bits
@@ -25,14 +33,22 @@ static __init pteval_t create_mapping_protection(efi_memory_desc_t *md)
 	if (type == EFI_MEMORY_MAPPED_IO)
 		return PROT_DEVICE_nGnRE;

-	if (WARN_ONCE(!PAGE_ALIGNED(md->phys_addr),
-		      "UEFI Runtime regions are not aligned to 64 KB -- buggy firmware?"))
+	if (region_is_misaligned(md)) {
+		static bool __initdata code_is_misaligned;
+
 		/*
-		 * If the region is not aligned to the page size of the OS, we
-		 * can not use strict permissions, since that would also affect
-		 * the mapping attributes of the adjacent regions.
+		 * Regions that are not aligned to the OS page size cannot be
+		 * mapped with strict permissions, as those might interfere
+		 * with the permissions that are needed by the adjacent
+		 * region's mapping. However, if we haven't encountered any
+		 * misaligned runtime code regions so far, we can safely use
+		 * non-executable permissions for non-code regions.
 		 */
-		return pgprot_val(PAGE_KERNEL_EXEC);
+		code_is_misaligned |= (type == EFI_RUNTIME_SERVICES_CODE);
+
+		return code_is_misaligned ? pgprot_val(PAGE_KERNEL_EXEC)
+					  : pgprot_val(PAGE_KERNEL);
+	}

 	/* R-- */
 	if ((attr & (EFI_MEMORY_XP | EFI_MEMORY_RO)) ==
@@ -62,19 +78,16 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
 	bool page_mappings_only = (md->type == EFI_RUNTIME_SERVICES_CODE ||
 				   md->type == EFI_RUNTIME_SERVICES_DATA);

-	if (!PAGE_ALIGNED(md->phys_addr) ||
-	    !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT)) {
-		/*
-		 * If the end address of this region is not aligned to page
-		 * size, the mapping is rounded up, and may end up sharing a
-		 * page frame with the next UEFI memory region. If we create
-		 * a block entry now, we may need to split it again when mapping
-		 * the next region, and support for that is going to be removed
-		 * from the MMU routines. So avoid block mappings altogether in
-		 * that case.
-		 */
+	/*
+	 * If this region is not aligned to the page size used by the OS, the
+	 * mapping will be rounded outwards, and may end up sharing a page
+	 * frame with an adjacent runtime memory region. Given that the page
+	 * table descriptor covering the shared page will be rewritten when the
+	 * adjacent region gets mapped, we must avoid block mappings here so we
+	 * don't have to worry about splitting them when that happens.
+	 */
+	if (region_is_misaligned(md))
 		page_mappings_only = true;
-	}

 	create_pgd_mapping(mm, md->phys_addr, md->virt_addr,
 			   md->num_pages << EFI_PAGE_SHIFT,
@@ -101,6 +114,9 @@ int __init efi_set_mapping_permissions(struct mm_struct *mm,
 	BUG_ON(md->type != EFI_RUNTIME_SERVICES_CODE &&
 	       md->type != EFI_RUNTIME_SERVICES_DATA);

+	if (region_is_misaligned(md))
+		return 0;
+
 	/*
 	 * Calling apply_to_page_range() is only safe on regions that are
 	 * guaranteed to be mapped down to pages. Since we are only called
--- a/arch/arm64/kernel/topology.c
+++ b/arch/arm64/kernel/topology.c
@@ -21,46 +21,6 @@
 #include <asm/cputype.h>
 #include <asm/topology.h>

-void store_cpu_topology(unsigned int cpuid)
-{
-	struct cpu_topology *cpuid_topo = &cpu_topology[cpuid];
-	u64 mpidr;
-
-	if (cpuid_topo->package_id != -1)
-		goto topology_populated;
-
-	mpidr = read_cpuid_mpidr();
-
-	/* Uniprocessor systems can rely on default topology values */
-	if (mpidr & MPIDR_UP_BITMASK)
-		return;
-
-	/*
-	 * This would be the place to create cpu topology based on MPIDR.
-	 *
-	 * However, it cannot be trusted to depict the actual topology; some
-	 * pieces of the architecture enforce an artificial cap on Aff0 values
-	 * (e.g. GICv3's ICC_SGI1R_EL1 limits it to 15), leading to an
-	 * artificial cycling of Aff1, Aff2 and Aff3 values. IOW, these end up
-	 * having absolutely no relationship to the actual underlying system
-	 * topology, and cannot be reasonably used as core / package ID.
-	 *
-	 * If the MT bit is set, Aff0 *could* be used to define a thread ID, but
-	 * we still wouldn't be able to obtain a sane core ID. This means we
-	 * need to entirely ignore MPIDR for any topology deduction.
-	 */
-	cpuid_topo->thread_id  = -1;
-	cpuid_topo->core_id    = cpuid;
-	cpuid_topo->package_id = cpu_to_node(cpuid);
-
-	pr_debug("CPU%u: cluster %d core %d thread %d mpidr %#016llx\n",
-		 cpuid, cpuid_topo->package_id, cpuid_topo->core_id,
-		 cpuid_topo->thread_id, mpidr);
-
-topology_populated:
-	update_siblings_masks(cpuid);
-}
-
 #ifdef CONFIG_ACPI
 static bool __init acpi_cpu_is_threaded(int cpu)
 {
--- a/arch/mips/bcm47xx/prom.c
+++ b/arch/mips/bcm47xx/prom.c
@@ -85,7 +85,7 @@ static __init void prom_init_mem(void)
 			pr_debug("Assume 128MB RAM\n");
 			break;
 		}
-		if (!memcmp(prom_init, prom_init + mem, 32))
+		if (!memcmp((void *)prom_init, (void *)prom_init + mem, 32))
 			break;
 	}
 	lowmem = mem;
@@ -162,7 +162,7 @@ void __init bcm47xx_prom_highmem_init(void)

 	off = EXTVBASE + __pa(off);
 	for (extmem = 128 << 20; extmem < 512 << 20; extmem <<= 1) {
-		if (!memcmp(prom_init, (void *)(off + extmem), 16))
+		if (!memcmp((void *)prom_init, (void *)(off + extmem), 16))
 			break;
 	}
 	extmem -= lowmem;
--- a/arch/mips/include/asm/fw/fw.h
+++ b/arch/mips/include/asm/fw/fw.h
@@ -26,6 +26,6 @@ extern char *fw_getcmdline(void);
 extern void fw_meminit(void);
 extern char *fw_getenv(char *name);
 extern unsigned long fw_getenvl(char *name);
-extern void fw_init_early_console(char port);
+extern void fw_init_early_console(void);

 #endif /* __ASM_FW_H_ */
--- a/arch/mips/kernel/jump_label.c
+++ b/arch/mips/kernel/jump_label.c
@@ -56,7 +56,7 @@ void arch_jump_label_transform(struct jump_entry *e,
 			 * The branch offset must fit in the instruction's 26
 			 * bit field.
 			 */
-			WARN_ON((offset >= BIT(25)) ||
+			WARN_ON((offset >= (long)BIT(25)) ||
 				(offset < -(long)BIT(25)));

 			insn.j_format.opcode = bc6_op;
--- a/arch/mips/pic32/pic32mzda/early_console.c
+++ b/arch/mips/pic32/pic32mzda/early_console.c
@@ -27,7 +27,7 @@
 #define U_BRG(x)	(UART_BASE(x) + 0x40)

 static void __iomem *uart_base;
-static char console_port = -1;
+static int console_port = -1;

 static int __init configure_uart_pins(int port)
 {
@@ -47,7 +47,7 @@ static int __init configure_uart_pins(int port)
 	return 0;
 }

-static void __init configure_uart(char port, int baud)
+static void __init configure_uart(int port, int baud)
 {
 	u32 pbclk;

@@ -60,7 +60,7 @@ static void __init configure_uart(char port, int baud)
 		     uart_base + PIC32_SET(U_STA(port)));
 }

-static void __init setup_early_console(char port, int baud)
+static void __init setup_early_console(int port, int baud)
 {
 	if (configure_uart_pins(port))
 		return;
@@ -130,16 +130,15 @@ _out:
 	return baud;
 }

-void __init fw_init_early_console(char port)
+void __init fw_init_early_console(void)
 {
 	char *arch_cmdline = pic32_getcmdline();
-	int baud = -1;
+	int baud, port;

 	uart_base = ioremap_nocache(PIC32_BASE_UART, 0xc00);

 	baud = get_baud_from_cmdline(arch_cmdline);
-	if (port == -1)
-		port = get_port_from_cmdline(arch_cmdline);
+	port = get_port_from_cmdline(arch_cmdline);

 	if (port == -1)
 		port = EARLY_CONSOLE_PORT;
--- a/arch/mips/pic32/pic32mzda/init.c
+++ b/arch/mips/pic32/pic32mzda/init.c
@@ -60,7 +60,7 @@ void __init plat_mem_setup(void)
 		strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);

 #ifdef CONFIG_EARLY_PRINTK
-	fw_init_early_console(-1);
+	fw_init_early_console();
 #endif
 	pic32_config_init();
 }
--- a/arch/nios2/boot/Makefile
+++ b/arch/nios2/boot/Makefile
@@ -20,7 +20,7 @@ $(obj)/vmlinux.bin: vmlinux FORCE
 $(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE
 	$(call if_changed,gzip)

-$(obj)/vmImage: $(obj)/vmlinux.gz
+$(obj)/vmImage: $(obj)/vmlinux.gz FORCE
 	$(call if_changed,uimage)
 	@$(kecho) 'Kernel: $@ is ready'

--- a/arch/parisc/include/asm/hardware.h
+++ b/arch/parisc/include/asm/hardware.h
@@ -10,12 +10,12 @@
 #define SVERSION_ANY_ID		PA_SVERSION_ANY_ID

 struct hp_hardware {
-	unsigned short	hw_type:5;	/* HPHW_xxx */
-	unsigned short	hversion;
-	unsigned long	sversion:28;
-	unsigned short	opt;
-	const char	name[80];	/* The hardware description */
-};
+	unsigned int	hw_type:8;	/* HPHW_xxx */
+	unsigned int	hversion:12;
+	unsigned int	sversion:12;
+	unsigned char	opt;
+	unsigned char	name[59];	/* The hardware description */
+} __packed;

 struct parisc_device;

--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -882,15 +882,13 @@ void __init walk_central_bus(void)
 			&root);
 }

-static void print_parisc_device(struct parisc_device *dev)
+static __init void print_parisc_device(struct parisc_device *dev)
 {
-	char hw_path[64];
-	static int count;
+	static int count __initdata;

-	print_pa_hwpath(dev, hw_path);
-	pr_info("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
-		++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type,
-		dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
+	pr_info("%d. %s at %pap { type:%d, hv:%#x, sv:%#x, rev:%#x }",
+		++count, dev->name, &(dev->hpa.start), dev->id.hw_type,
+		dev->id.hversion, dev->id.sversion, dev->id.hversion_rev);

 	if (dev->num_addrs) {
 		int k;
@@ -1079,7 +1077,7 @@ static __init int qemu_print_iodc_data(struct device *lin_dev, void *data)



-static int print_one_device(struct device * dev, void * data)
+static __init int print_one_device(struct device * dev, void * data)
 {
 	struct parisc_device * pdev = to_parisc_device(dev);

--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -155,7 +155,7 @@ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power8
 CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power9,-mtune=power8)
 else
 CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5))
-CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4)
+CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power4
 endif
 else ifdef CONFIG_PPC_BOOK3E_64
 CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -30,6 +30,7 @@ endif

 BOOTCFLAGS    := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
 		 -fno-strict-aliasing -O2 -msoft-float -mno-altivec -mno-vsx \
+		 $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \
 		 -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
 		 $(LINUXINCLUDE)

--- a/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi
+++ b/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi
@@ -0,0 +1,51 @@
+/*
+ * e500v1 Power ISA Device Tree Source (include)
+ *
+ * Copyright 2012 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/ {
+	cpus {
+		power-isa-version = "2.03";
+		power-isa-b;		// Base
+		power-isa-e;		// Embedded
+		power-isa-atb;		// Alternate Time Base
+		power-isa-cs;		// Cache Specification
+		power-isa-e.le;		// Embedded.Little-Endian
+		power-isa-e.pm;		// Embedded.Performance Monitor
+		power-isa-ecl;		// Embedded Cache Locking
+		power-isa-mmc;		// Memory Coherence
+		power-isa-sp;		// Signal Processing Engine
+		power-isa-sp.fs;	// SPE.Embedded Float Scalar Single
+		power-isa-sp.fv;	// SPE.Embedded Float Vector
+		mmu-type = "power-embedded";
+	};
+};
--- a/arch/powerpc/boot/dts/fsl/mpc8540ads.dts
+++ b/arch/powerpc/boot/dts/fsl/mpc8540ads.dts
@@ -7,7 +7,7 @@

 /dts-v1/;

-/include/ "e500v2_power_isa.dtsi"
+/include/ "e500v1_power_isa.dtsi"

 / {
 	model = "MPC8540ADS";
--- a/arch/powerpc/boot/dts/fsl/mpc8541cds.dts
+++ b/arch/powerpc/boot/dts/fsl/mpc8541cds.dts
@@ -7,7 +7,7 @@

 /dts-v1/;

-/include/ "e500v2_power_isa.dtsi"
+/include/ "e500v1_power_isa.dtsi"

 / {
 	model = "MPC8541CDS";
--- a/arch/powerpc/boot/dts/fsl/mpc8555cds.dts
+++ b/arch/powerpc/boot/dts/fsl/mpc8555cds.dts
@@ -7,7 +7,7 @@

 /dts-v1/;

-/include/ "e500v2_power_isa.dtsi"
+/include/ "e500v1_power_isa.dtsi"

 / {
 	model = "MPC8555CDS";
--- a/arch/powerpc/boot/dts/fsl/mpc8560ads.dts
+++ b/arch/powerpc/boot/dts/fsl/mpc8560ads.dts
@@ -7,7 +7,7 @@

 /dts-v1/;

-/include/ "e500v2_power_isa.dtsi"
+/include/ "e500v1_power_isa.dtsi"

 / {
 	model = "MPC8560ADS";
--- a/arch/powerpc/kernel/pci_dn.c
+++ b/arch/powerpc/kernel/pci_dn.c
@@ -325,6 +325,7 @@ struct pci_dn *pci_add_device_node_info(struct pci_controller *hose,
 	INIT_LIST_HEAD(&pdn->list);
 	parent = of_get_parent(dn);
 	pdn->parent = parent ? PCI_DN(parent) : NULL;
+	of_node_put(parent);
 	if (pdn->parent)
 		list_add_tail(&pdn->list, &pdn->parent->child_list);

--- a/arch/powerpc/math-emu/math_efp.c
+++ b/arch/powerpc/math-emu/math_efp.c
@@ -17,6 +17,7 @@

 #include <linux/types.h>
 #include <linux/prctl.h>
+#include <linux/module.h>

 #include <linux/uaccess.h>
 #include <asm/reg.h>
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -776,6 +776,7 @@ static void opal_export_attrs(void)
 	kobj = kobject_create_and_add("exports", opal_kobj);
 	if (!kobj) {
 		pr_warn("kobject_create_and_add() of exports failed\n");
+		of_node_put(np);
 		return;
 	}

--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -211,8 +211,10 @@ static int fsl_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
 			dev_err(&pdev->dev,
 				"node %pOF has an invalid fsl,msi phandle %u\n",
 				hose->dn, np->phandle);
+			of_node_put(np);
 			return -EINVAL;
 		}
+		of_node_put(np);
 	}

 	for_each_pci_msi_entry(entry, pdev) {
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -51,7 +51,7 @@ config RISCV
 	select PCI_MSI if PCI
 	select RISCV_TIMER
 	select GENERIC_IRQ_MULTI_HANDLER
-	select GENERIC_ARCH_TOPOLOGY if SMP
+	select GENERIC_ARCH_TOPOLOGY
 	select ARCH_HAS_PTE_SPECIAL
 	select ARCH_HAS_MMIOWB
 	select HAVE_EBPF_JIT if 64BIT
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -35,6 +35,7 @@ else
 endif

 ifeq ($(CONFIG_LD_IS_LLD),y)
+ifeq ($(shell test $(CONFIG_LLD_VERSION) -lt 150000; echo $$?),0)
 	KBUILD_CFLAGS += -mno-relax
 	KBUILD_AFLAGS += -mno-relax
 ifneq ($(LLVM_IAS),1)
@@ -42,6 +43,7 @@ ifneq ($(LLVM_IAS),1)
 	KBUILD_AFLAGS += -Wa,-mno-relax
 endif
 endif
+endif

 # ISA string setting
 riscv-march-$(CONFIG_ARCH_RV32I)	:= rv32ima
--- a/arch/riscv/include/asm/io.h
+++ b/arch/riscv/include/asm/io.h
@@ -252,9 +252,9 @@ __io_reads_ins(reads, u32, l, __io_br(), __io_ar(addr))
 __io_reads_ins(ins,  u8, b, __io_pbr(), __io_par(addr))
 __io_reads_ins(ins, u16, w, __io_pbr(), __io_par(addr))
 __io_reads_ins(ins, u32, l, __io_pbr(), __io_par(addr))
-#define insb(addr, buffer, count) __insb((void __iomem *)(long)addr, buffer, count)
-#define insw(addr, buffer, count) __insw((void __iomem *)(long)addr, buffer, count)
-#define insl(addr, buffer, count) __insl((void __iomem *)(long)addr, buffer, count)
+#define insb(addr, buffer, count) __insb(PCI_IOBASE + (addr), buffer, count)
+#define insw(addr, buffer, count) __insw(PCI_IOBASE + (addr), buffer, count)
+#define insl(addr, buffer, count) __insl(PCI_IOBASE + (addr), buffer, count)

 __io_writes_outs(writes,  u8, b, __io_bw(), __io_aw())
 __io_writes_outs(writes, u16, w, __io_bw(), __io_aw())
@@ -266,22 +266,22 @@ __io_writes_outs(writes, u32, l, __io_bw(), __io_aw())
 __io_writes_outs(outs,  u8, b, __io_pbw(), __io_paw())
 __io_writes_outs(outs, u16, w, __io_pbw(), __io_paw())
 __io_writes_outs(outs, u32, l, __io_pbw(), __io_paw())
-#define outsb(addr, buffer, count) __outsb((void __iomem *)(long)addr, buffer, count)
-#define outsw(addr, buffer, count) __outsw((void __iomem *)(long)addr, buffer, count)
-#define outsl(addr, buffer, count) __outsl((void __iomem *)(long)addr, buffer, count)
+#define outsb(addr, buffer, count) __outsb(PCI_IOBASE + (addr), buffer, count)
+#define outsw(addr, buffer, count) __outsw(PCI_IOBASE + (addr), buffer, count)
+#define outsl(addr, buffer, count) __outsl(PCI_IOBASE + (addr), buffer, count)

 #ifdef CONFIG_64BIT
 __io_reads_ins(reads, u64, q, __io_br(), __io_ar(addr))
 #define readsq(addr, buffer, count) __readsq(addr, buffer, count)

 __io_reads_ins(ins, u64, q, __io_pbr(), __io_par(addr))
-#define insq(addr, buffer, count) __insq((void __iomem *)addr, buffer, count)
+#define insq(addr, buffer, count) __insq(PCI_IOBASE + (addr), buffer, count)

 __io_writes_outs(writes, u64, q, __io_bw(), __io_aw())
 #define writesq(addr, buffer, count) __writesq(addr, buffer, count)

 __io_writes_outs(outs, u64, q, __io_pbr(), __io_paw())
-#define outsq(addr, buffer, count) __outsq((void __iomem *)addr, buffer, count)
+#define outsq(addr, buffer, count) __outsq(PCI_IOBASE + (addr), buffer, count)
 #endif

 #include <asm-generic/io.h>
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -104,6 +104,8 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
 {
 	struct pt_regs *childregs = task_pt_regs(p);

+	memset(&p->thread.s, 0, sizeof(p->thread.s));
+
 	/* p->thread holds context to be restored by __switch_to() */
 	if (unlikely(p->flags & PF_KTHREAD)) {
 		/* Kernel thread */
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -46,6 +46,8 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 {
 	int cpuid;

+	store_cpu_topology(smp_processor_id());
+
 	/* This covers non-smp usecase mandated by "nosmp" option */
 	if (max_cpus == 0)
 		return;
@@ -142,8 +144,8 @@ asmlinkage __visible void __init smp_callin(void)
 	current->active_mm = mm;

 	trap_init();
+	store_cpu_topology(smp_processor_id());
 	notify_cpu_starting(smp_processor_id());
-	update_siblings_masks(smp_processor_id());
 	set_cpu_online(smp_processor_id(), 1);
 	/*
 	 * Remote TLB flushes are ignored while the CPU is offline, so emit
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -18,9 +18,6 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
 	if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
 		return -EINVAL;

-	if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
-		return -EINVAL;
-
 	return ksys_mmap_pgoff(addr, len, prot, flags, fd,
 			       offset >> (PAGE_SHIFT - page_shift_offset));
 }
--- a/arch/riscv/kernel/vdso/Makefile
+++ b/arch/riscv/kernel/vdso/Makefile
@@ -20,6 +20,9 @@ obj-vdso := $(addprefix $(obj)/, $(obj-vdso))

 obj-y += vdso.o vdso-syms.o
 CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
+ifneq ($(filter vgettimeofday, $(vdso-syms)),)
+CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY
+endif

 # Disable gcov profiling for VDSO code
 GCOV_PROFILE := n
--- a/arch/riscv/kernel/vdso/vdso.lds.S
+++ b/arch/riscv/kernel/vdso/vdso.lds.S
@@ -62,9 +62,11 @@ VERSION
 	LINUX_4.15 {
 	global:
 		__vdso_rt_sigreturn;
+#ifdef HAS_VGETTIMEOFDAY
 		__vdso_gettimeofday;
 		__vdso_clock_gettime;
 		__vdso_clock_getres;
+#endif
 		__vdso_getcpu;
 		__vdso_flush_icache;
 	local: *;
--- a/arch/s390/include/asm/futex.h
+++ b/arch/s390/include/asm/futex.h
@@ -16,7 +16,8 @@
 		"3: jl    1b\n"						\
 		"   lhi   %0,0\n"					\
 		"4: sacf  768\n"					\
-		EX_TABLE(0b,4b) EX_TABLE(2b,4b) EX_TABLE(3b,4b)		\
+		EX_TABLE(0b,4b) EX_TABLE(1b,4b)				\
+		EX_TABLE(2b,4b) EX_TABLE(3b,4b)				\
 		: "=d" (ret), "=&d" (oldval), "=&d" (newval),		\
 		  "=m" (*uaddr)						\
 		: "0" (-EFAULT), "d" (oparg), "a" (uaddr),		\
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -44,7 +44,7 @@ struct save_area {
 	u64 fprs[16];
 	u32 fpc;
 	u32 prefix;
-	u64 todpreg;
+	u32 todpreg;
 	u64 timer;
 	u64 todcmp;
 	u64 vxrs_low[16];
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -64,7 +64,7 @@ static inline int __pcistg_mio_inuser(
 	asm volatile (
 		"       sacf    256\n"
 		"0:     llgc    %[tmp],0(%[src])\n"
-		"       sllg    %[val],%[val],8\n"
+		"4:	sllg	%[val],%[val],8\n"
 		"       aghi    %[src],1\n"
 		"       ogr     %[val],%[tmp]\n"
 		"       brctg   %[cnt],0b\n"
@@ -72,7 +72,7 @@ static inline int __pcistg_mio_inuser(
 		"2:     ipm     %[cc]\n"
 		"       srl     %[cc],28\n"
 		"3:     sacf    768\n"
-		EX_TABLE(0b, 3b) EX_TABLE(1b, 3b) EX_TABLE(2b, 3b)
+		EX_TABLE(0b, 3b) EX_TABLE(4b, 3b) EX_TABLE(1b, 3b) EX_TABLE(2b, 3b)
 		:
 		[src] "+a" (src), [cnt] "+d" (cnt),
 		[val] "+d" (val), [tmp] "=d" (tmp),
@@ -220,10 +220,10 @@ static inline int __pcilg_mio_inuser(
 		"2:     ahi     %[shift],-8\n"
 		"       srlg    %[tmp],%[val],0(%[shift])\n"
 		"3:     stc     %[tmp],0(%[dst])\n"
-		"       aghi    %[dst],1\n"
+		"5:	aghi	%[dst],1\n"
 		"       brctg   %[cnt],2b\n"
 		"4:     sacf    768\n"
-		EX_TABLE(0b, 4b) EX_TABLE(1b, 4b) EX_TABLE(3b, 4b)
+		EX_TABLE(0b, 4b) EX_TABLE(1b, 4b) EX_TABLE(3b, 4b) EX_TABLE(5b, 4b)
 		:
 		[cc] "+d" (cc), [val] "=d" (val), [len] "+d" (len),
 		[dst] "+a" (dst), [cnt] "+d" (cnt), [tmp] "=d" (tmp),
--- a/arch/sh/include/asm/sections.h
+++ b/arch/sh/include/asm/sections.h
@@ -4,7 +4,7 @@

 #include <asm-generic/sections.h>

-extern long __machvec_start, __machvec_end;
+extern char __machvec_start[], __machvec_end[];
 extern char __uncached_start, __uncached_end;
 extern char __start_eh_frame[], __stop_eh_frame[];

--- a/arch/sh/kernel/machvec.c
+++ b/arch/sh/kernel/machvec.c
@@ -19,8 +19,8 @@
 #define MV_NAME_SIZE 32

 #define for_each_mv(mv) \
-	for ((mv) = (struct sh_machine_vector *)&__machvec_start; \
-	     (mv) && (unsigned long)(mv) < (unsigned long)&__machvec_end; \
+	for ((mv) = (struct sh_machine_vector *)__machvec_start; \
+	     (mv) && (unsigned long)(mv) < (unsigned long)__machvec_end; \
 	     (mv)++)

 static struct sh_machine_vector * __init get_mv_byname(const char *name)
@@ -86,8 +86,8 @@ void __init sh_mv_setup(void)
 	if (!machvec_selected) {
 		unsigned long machvec_size;

-		machvec_size = ((unsigned long)&__machvec_end -
-				(unsigned long)&__machvec_start);
+		machvec_size = ((unsigned long)__machvec_end -
+				(unsigned long)__machvec_start);

 		/*
 		 * Sanity check for machvec section alignment. Ensure
@@ -101,7 +101,7 @@ void __init sh_mv_setup(void)
 		 * vector (usually the only one) from .machvec.init.
 		 */
 		if (machvec_size >= sizeof(struct sh_machine_vector))
-			sh_mv = *(struct sh_machine_vector *)&__machvec_start;
+			sh_mv = *(struct sh_machine_vector *)__machvec_start;
 	}

 	printk(KERN_NOTICE "Booting machvec: %s\n", get_system_type());
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -77,7 +77,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)

 static void *c_start(struct seq_file *m, loff_t *pos)
 {
-	return *pos < NR_CPUS ? cpu_data + *pos : NULL;
+	return *pos < nr_cpu_ids ? cpu_data + *pos : NULL;
 }

 static void *c_next(struct seq_file *m, void *v, loff_t *pos)
--- a/arch/x86/configs/gki_defconfig
+++ b/arch/x86/configs/gki_defconfig
@@ -510,4 +510,5 @@ CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=5
 CONFIG_SCHEDSTATS=y
+CONFIG_FUNCTION_ERROR_INJECTION=y
 CONFIG_BUG_ON_DATA_CORRUPTION=y
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4010,6 +4010,7 @@ static const struct x86_cpu_desc isolation_ucodes[] = {
 	INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X,		 5, 0x00000000),
 	INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X,		 6, 0x00000000),
 	INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X,		 7, 0x00000000),
+	INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X,		11, 0x00000000),
 	INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_L,		 3, 0x0000007c),
 	INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE,		 3, 0x0000007c),
 	INTEL_CPU_DESC(INTEL_FAM6_KABYLAKE,		 9, 0x0000004e),
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -852,8 +852,13 @@ struct event_constraint intel_icl_pebs_event_constraints[] = {
 	INTEL_FLAGS_UEVENT_CONSTRAINT(0x0400, 0x800000000ULL),	/* SLOTS */

 	INTEL_PLD_CONSTRAINT(0x1cd, 0xff),			/* MEM_TRANS_RETIRED.LOAD_LATENCY */
-	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x1d0, 0xf),	/* MEM_INST_RETIRED.LOAD */
-	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_ST(0x2d0, 0xf),	/* MEM_INST_RETIRED.STORE */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x11d0, 0xf),	/* MEM_INST_RETIRED.STLB_MISS_LOADS */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_ST(0x12d0, 0xf),	/* MEM_INST_RETIRED.STLB_MISS_STORES */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x21d0, 0xf),	/* MEM_INST_RETIRED.LOCK_LOADS */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x41d0, 0xf),	/* MEM_INST_RETIRED.SPLIT_LOADS */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_ST(0x42d0, 0xf),	/* MEM_INST_RETIRED.SPLIT_STORES */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x81d0, 0xf),	/* MEM_INST_RETIRED.ALL_LOADS */
+	INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_ST(0x82d0, 0xf),	/* MEM_INST_RETIRED.ALL_STORES */

 	INTEL_FLAGS_EVENT_CONSTRAINT_DATALA_LD_RANGE(0xd1, 0xd4, 0xf), /* MEM_LOAD_*_RETIRED.* */

--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -290,6 +290,7 @@
 #define X86_FEATURE_RETPOLINE		(11*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */
 #define X86_FEATURE_RETPOLINE_LFENCE	(11*32+13) /* "" Use LFENCE for Spectre variant 2 */
 #define X86_FEATURE_RSB_VMEXIT_LITE	(11*32+17) /* "" Fill RSB on VM exit when EIBRS is enabled */
+#define X86_FEATURE_MSR_TSX_CTRL	(11*32+18) /* "" MSR IA32_TSX_CTRL (Intel) implemented */

 /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */
 #define X86_FEATURE_AVX512_BF16		(12*32+ 5) /* AVX512 BFLOAT16 instructions */
--- a/arch/x86/include/asm/hyperv-tlfs.h
+++ b/arch/x86/include/asm/hyperv-tlfs.h
@@ -721,7 +721,7 @@ struct hv_enlightened_vmcs {
 	u64 guest_rip;

 	u32 hv_clean_fields;
-	u32 hv_padding_32;
+	u32 padding32_1;
 	u32 hv_synthetic_controls;
 	struct {
 		u32 nested_flush_hypercall:1;
@@ -729,7 +729,7 @@ struct hv_enlightened_vmcs {
 		u32 reserved:30;
 	}  __packed hv_enlightenments_control;
 	u32 hv_vp_id;
-
+	u32 padding32_2;
 	u64 hv_vm_id;
 	u64 partition_assist_page;
 	u64 padding64_4[4];
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -9,6 +9,7 @@
 struct ucode_patch {
 	struct list_head plist;
 	void *data;		/* Intel uses only this one */
+	unsigned int size;
 	u32 patch_id;
 	u16 equiv_cpu;
 };
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -454,6 +454,11 @@
 #define MSR_AMD64_OSVW_STATUS		0xc0010141
 #define MSR_AMD64_LS_CFG		0xc0011020
 #define MSR_AMD64_DC_CFG		0xc0011022
+
+#define MSR_AMD64_DE_CFG		0xc0011029
+#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT	 1
+#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE	BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT)
+
 #define MSR_AMD64_BU_CFG2		0xc001102a
 #define MSR_AMD64_IBSFETCHCTL		0xc0011030
 #define MSR_AMD64_IBSFETCHLINAD		0xc0011031
@@ -522,9 +527,6 @@
 #define FAM10H_MMIO_CONF_BASE_MASK	0xfffffffULL
 #define FAM10H_MMIO_CONF_BASE_SHIFT	20
 #define MSR_FAM10H_NODE_ID		0xc001100c
-#define MSR_F10H_DECFG			0xc0011029
-#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT	1
-#define MSR_F10H_DECFG_LFENCE_SERIALIZE		BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT)

 /* K8 MSRs */
 #define MSR_K8_TOP_MEM1			0xc001001a
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -312,7 +312,7 @@ static inline void indirect_branch_prediction_barrier(void)
 /* The Intel SPEC CTRL MSR base value cache */
 extern u64 x86_spec_ctrl_base;
 DECLARE_PER_CPU(u64, x86_spec_ctrl_current);
-extern void write_spec_ctrl_current(u64 val, bool force);
+extern void update_spec_ctrl_cond(u64 val);
 extern u64 spec_ctrl_current(void);

 /*
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -794,8 +794,6 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
 		set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
 }

-#define MSR_AMD64_DE_CFG	0xC0011029
-
 static void init_amd_ln(struct cpuinfo_x86 *c)
 {
 	/*
@@ -965,8 +963,8 @@ static void init_amd(struct cpuinfo_x86 *c)
 		 * msr_set_bit() uses the safe accessors, too, even if the MSR
 		 * is not present.
 		 */
-		msr_set_bit(MSR_F10H_DECFG,
-			    MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT);
+		msr_set_bit(MSR_AMD64_DE_CFG,
+			    MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT);

 		/* A serializing LFENCE stops RDTSC speculation */
 		set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC);
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -58,11 +58,18 @@ EXPORT_SYMBOL_GPL(x86_spec_ctrl_current);

 static DEFINE_MUTEX(spec_ctrl_mutex);

+/* Update SPEC_CTRL MSR and its cached copy unconditionally */
+static void update_spec_ctrl(u64 val)
+{
+	this_cpu_write(x86_spec_ctrl_current, val);
+	wrmsrl(MSR_IA32_SPEC_CTRL, val);
+}
+
 /*
 * Keep track of the SPEC_CTRL MSR value for the current task, which may differ
 * from x86_spec_ctrl_base due to STIBP/SSB in __speculation_ctrl_update().
 */
-void write_spec_ctrl_current(u64 val, bool force)
+void update_spec_ctrl_cond(u64 val)
 {
 	if (this_cpu_read(x86_spec_ctrl_current) == val)
 		return;
@@ -73,7 +80,7 @@ void write_spec_ctrl_current(u64 val, bool force)
 	 * When KERNEL_IBRS this MSR is written on return-to-user, unless
 	 * forced the update can be delayed until that time.
 	 */
-	if (force || !cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS))
+	if (!cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS))
 		wrmsrl(MSR_IA32_SPEC_CTRL, val);
 }

@@ -1194,7 +1201,7 @@ static void __init spec_ctrl_disable_kernel_rrsba(void)

 	if (ia32_cap & ARCH_CAP_RRSBA) {
 		x86_spec_ctrl_base |= SPEC_CTRL_RRSBA_DIS_S;
-		write_spec_ctrl_current(x86_spec_ctrl_base, true);
+		update_spec_ctrl(x86_spec_ctrl_base);
 	}
 }

@@ -1315,7 +1322,7 @@ static void __init spectre_v2_select_mitigation(void)

 	if (spectre_v2_in_ibrs_mode(mode)) {
 		x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
-		write_spec_ctrl_current(x86_spec_ctrl_base, true);
+		update_spec_ctrl(x86_spec_ctrl_base);
 	}

 	switch (mode) {
@@ -1419,7 +1426,7 @@ static void __init spectre_v2_select_mitigation(void)
 static void update_stibp_msr(void * __unused)
 {
 	u64 val = spec_ctrl_current() | (x86_spec_ctrl_base & SPEC_CTRL_STIBP);
-	write_spec_ctrl_current(val, true);
+	update_spec_ctrl(val);
 }

 /* Update x86_spec_ctrl_base in case SMT state changed. */
@@ -1652,7 +1659,7 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
 			x86_amd_ssb_disable();
 		} else {
 			x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
-			write_spec_ctrl_current(x86_spec_ctrl_base, true);
+			update_spec_ctrl(x86_spec_ctrl_base);
 		}
 	}

@@ -1869,7 +1876,7 @@ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
 void x86_spec_ctrl_setup_ap(void)
 {
 	if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
-		write_spec_ctrl_current(x86_spec_ctrl_base, true);
+		update_spec_ctrl(x86_spec_ctrl_base);

 	if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)
 		x86_amd_ssb_disable();
--- a/arch/x86/kernel/cpu/hygon.c
+++ b/arch/x86/kernel/cpu/hygon.c
@@ -335,8 +335,8 @@ static void init_hygon(struct cpuinfo_x86 *c)
 		 * msr_set_bit() uses the safe accessors, too, even if the MSR
 		 * is not present.
 		 */
-		msr_set_bit(MSR_F10H_DECFG,
-			    MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT);
+		msr_set_bit(MSR_AMD64_DE_CFG,
+			    MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT);

 		/* A serializing LFENCE stops RDTSC speculation */
 		set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC);
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -441,7 +441,13 @@ apply_microcode_early_amd(u32 cpuid_1_eax, void *ucode, size_t size, bool save_p
 		return ret;

 	native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
-	if (rev >= mc->hdr.patch_id)
+
+	/*
+	 * Allow application of the same revision to pick up SMT-specific
+	 * changes even if the revision of the other SMT thread is already
+	 * up-to-date.
+	 */
+	if (rev > mc->hdr.patch_id)
 		return ret;

 	if (!__apply_microcode_amd(mc)) {
@@ -523,8 +529,12 @@ void load_ucode_amd_ap(unsigned int cpuid_1_eax)

 	native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);

-	/* Check whether we have saved a new patch already: */
-	if (*new_rev && rev < mc->hdr.patch_id) {
+	/*
+	 * Check whether a new patch has been saved already. Also, allow application of
+	 * the same revision in order to pick up SMT-thread-specific configuration even
+	 * if the sibling SMT thread already has an up-to-date revision.
+	 */
+	if (*new_rev && rev <= mc->hdr.patch_id) {
 		if (!__apply_microcode_amd(mc)) {
 			*new_rev = mc->hdr.patch_id;
 			return;
@@ -783,6 +793,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover,
 		kfree(patch);
 		return -EINVAL;
 	}
+	patch->size = *patch_size;

 	mc_hdr      = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE);
 	proc_id     = mc_hdr->processor_rev_id;
@@ -864,7 +875,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 		return ret;

 	memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
-	memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));
+	memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE));

 	return ret;
 }
--- a/arch/x86/kernel/cpu/resctrl/pseudo_lock.c
+++ b/arch/x86/kernel/cpu/resctrl/pseudo_lock.c
@@ -416,6 +416,7 @@ static int pseudo_lock_fn(void *_rdtgrp)
 	struct pseudo_lock_region *plr = rdtgrp->plr;
 	u32 rmid_p, closid_p;
 	unsigned long i;
+	u64 saved_msr;
 #ifdef CONFIG_KASAN
 	/*
 	 * The registers used for local register variables are also used
@@ -459,6 +460,7 @@ static int pseudo_lock_fn(void *_rdtgrp)
 	 * the buffer and evict pseudo-locked memory read earlier from the
 	 * cache.
 	 */
+	saved_msr = __rdmsr(MSR_MISC_FEATURE_CONTROL);
 	__wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0);
 	closid_p = this_cpu_read(pqr_state.cur_closid);
 	rmid_p = this_cpu_read(pqr_state.cur_rmid);
@@ -510,7 +512,7 @@ static int pseudo_lock_fn(void *_rdtgrp)
 	__wrmsr(IA32_PQR_ASSOC, rmid_p, closid_p);

 	/* Re-enable the hardware prefetcher(s) */
-	wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0);
+	wrmsrl(MSR_MISC_FEATURE_CONTROL, saved_msr);
 	local_irq_enable();

 	plr->thread_done = 1;
@@ -867,6 +869,7 @@ bool rdtgroup_pseudo_locked_in_hierarchy(struct rdt_domain *d)
 static int measure_cycles_lat_fn(void *_plr)
 {
 	struct pseudo_lock_region *plr = _plr;
+	u32 saved_low, saved_high;
 	unsigned long i;
 	u64 start, end;
 	void *mem_r;
@@ -875,6 +878,7 @@ static int measure_cycles_lat_fn(void *_plr)
 	/*
 	 * Disable hardware prefetchers.
 	 */
+	rdmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high);
 	wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0);
 	mem_r = READ_ONCE(plr->kmem);
 	/*
@@ -891,7 +895,7 @@ static int measure_cycles_lat_fn(void *_plr)
 		end = rdtsc_ordered();
 		trace_pseudo_lock_mem_latency((u32)(end - start));
 	}
-	wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0);
+	wrmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high);
 	local_irq_enable();
 	plr->thread_done = 1;
 	wake_up_interruptible(&plr->lock_thread_wq);
@@ -936,6 +940,7 @@ static int measure_residency_fn(struct perf_event_attr *miss_attr,
 	u64 hits_before = 0, hits_after = 0, miss_before = 0, miss_after = 0;
 	struct perf_event *miss_event, *hit_event;
 	int hit_pmcnum, miss_pmcnum;
+	u32 saved_low, saved_high;
 	unsigned int line_size;
 	unsigned int size;
 	unsigned long i;
@@ -969,6 +974,7 @@ static int measure_residency_fn(struct perf_event_attr *miss_attr,
 	/*
 	 * Disable hardware prefetchers.
 	 */
+	rdmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high);
 	wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0);

 	/* Initialize rest of local variables */
@@ -1027,7 +1033,7 @@ static int measure_residency_fn(struct perf_event_attr *miss_attr,
 	 */
 	rmb();
 	/* Re-enable hardware prefetchers */
-	wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0);
+	wrmsr(MSR_MISC_FEATURE_CONTROL, saved_low, saved_high);
 	local_irq_enable();
 out_hit:
 	perf_event_release_kernel(hit_event);
--- a/arch/x86/kernel/cpu/tsx.c
+++ b/arch/x86/kernel/cpu/tsx.c
@@ -55,24 +55,6 @@ void tsx_enable(void)
 	wrmsrl(MSR_IA32_TSX_CTRL, tsx);
 }

-static bool __init tsx_ctrl_is_supported(void)
-{
-	u64 ia32_cap = x86_read_arch_cap_msr();
-
-	/*
-	 * TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
-	 * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
-	 *
-	 * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
-	 * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
-	 * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
-	 * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
-	 * tsx= cmdline requests will do nothing on CPUs without
-	 * MSR_IA32_TSX_CTRL support.
-	 */
-	return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR);
-}
-
 static enum tsx_ctrl_states x86_get_tsx_auto_mode(void)
 {
 	if (boot_cpu_has_bug(X86_BUG_TAA))
@@ -86,9 +68,22 @@ void __init tsx_init(void)
 	char arg[5] = {};
 	int ret;

-	if (!tsx_ctrl_is_supported())
+	/*
+	 * TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
+	 * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
+	 *
+	 * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
+	 * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
+	 * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
+	 * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
+	 * tsx= cmdline requests will do nothing on CPUs without
+	 * MSR_IA32_TSX_CTRL support.
+	 */
+	if (!(x86_read_arch_cap_msr() & ARCH_CAP_TSX_CTRL_MSR))
 		return;

+	setup_force_cpu_cap(X86_FEATURE_MSR_TSX_CTRL);
+
 	ret = cmdline_find_option(boot_command_line, "tsx", arg, sizeof(arg));
 	if (ret >= 0) {
 		if (!strcmp(arg, "on")) {
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -449,7 +449,7 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
 	}

 	if (updmsr)
-		write_spec_ctrl_current(msr, false);
+		update_spec_ctrl_cond(msr);
 }

 static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -687,7 +687,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
 	/* Otherwise, skip ahead to the user-specified starting frame: */
 	while (!unwind_done(state) &&
 	       (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
-			state->sp < (unsigned long)first_frame))
+			state->sp <= (unsigned long)first_frame))
 		unwind_next_frame(state);

 	return;
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -759,6 +759,7 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function,
 			g_phys_as = phys_as;

 		entry->eax = g_phys_as | (virt_as << 8);
+		entry->ecx &= ~(GENMASK(31, 16) | GENMASK(11, 8));
 		entry->edx = 0;
 		entry->ebx &= kvm_cpuid_8000_0008_ebx_x86_features;
 		cpuid_mask(&entry->ebx, CPUID_8000_0008_EBX);
@@ -791,6 +792,9 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function,
 		entry->ecx = entry->edx = 0;
 		break;
 	case 0x8000001a:
+		entry->eax &= GENMASK(2, 0);
+		entry->ebx = entry->ecx = entry->edx = 0;
+		break;
 	case 0x8000001e:
 		break;
 	/*Add support for Centaur's CPUID instruction*/
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -776,8 +776,7 @@ static int linearize(struct x86_emulate_ctxt *ctxt,
 			   ctxt->mode, linear);
 }

-static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst,
-			     enum x86emul_mode mode)
+static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst)
 {
 	ulong linear;
 	int rc;
@@ -787,41 +786,71 @@ static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst,

 	if (ctxt->op_bytes != sizeof(unsigned long))
 		addr.ea = dst & ((1UL << (ctxt->op_bytes << 3)) - 1);
-	rc = __linearize(ctxt, addr, &max_size, 1, false, true, mode, &linear);
+	rc = __linearize(ctxt, addr, &max_size, 1, false, true, ctxt->mode, &linear);
 	if (rc == X86EMUL_CONTINUE)
 		ctxt->_eip = addr.ea;
 	return rc;
 }

-static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
+static inline int emulator_recalc_and_set_mode(struct x86_emulate_ctxt *ctxt)
 {
-	return assign_eip(ctxt, dst, ctxt->mode);
+	u64 efer;
+	struct desc_struct cs;
+	u16 selector;
+	u32 base3;
+
+	ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
+
+	if (!(ctxt->ops->get_cr(ctxt, 0) & X86_CR0_PE)) {
+		/* Real mode. cpu must not have long mode active */
+		if (efer & EFER_LMA)
+			return X86EMUL_UNHANDLEABLE;
+		ctxt->mode = X86EMUL_MODE_REAL;
+		return X86EMUL_CONTINUE;
+	}
+
+	if (ctxt->eflags & X86_EFLAGS_VM) {
+		/* Protected/VM86 mode. cpu must not have long mode active */
+		if (efer & EFER_LMA)
+			return X86EMUL_UNHANDLEABLE;
+		ctxt->mode = X86EMUL_MODE_VM86;
+		return X86EMUL_CONTINUE;
+	}
+
+	if (!ctxt->ops->get_segment(ctxt, &selector, &cs, &base3, VCPU_SREG_CS))
+		return X86EMUL_UNHANDLEABLE;
+
+	if (efer & EFER_LMA) {
+		if (cs.l) {
+			/* Proper long mode */
+			ctxt->mode = X86EMUL_MODE_PROT64;
+		} else if (cs.d) {
+			/* 32 bit compatibility mode*/
+			ctxt->mode = X86EMUL_MODE_PROT32;
+		} else {
+			ctxt->mode = X86EMUL_MODE_PROT16;
+		}
+	} else {
+		/* Legacy 32 bit / 16 bit mode */
+		ctxt->mode = cs.d ? X86EMUL_MODE_PROT32 : X86EMUL_MODE_PROT16;
+	}
+
+	return X86EMUL_CONTINUE;
 }

-static int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
-			  const struct desc_struct *cs_desc)
+static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
 {
-	enum x86emul_mode mode = ctxt->mode;
-	int rc;
+	return assign_eip(ctxt, dst);
+}

-#ifdef CONFIG_X86_64
-	if (ctxt->mode >= X86EMUL_MODE_PROT16) {
-		if (cs_desc->l) {
-			u64 efer = 0;
+static int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst)
+{
+	int rc = emulator_recalc_and_set_mode(ctxt);

-			ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
-			if (efer & EFER_LMA)
-				mode = X86EMUL_MODE_PROT64;
-		} else
-			mode = X86EMUL_MODE_PROT32; /* temporary value */
-	}
-#endif
-	if (mode == X86EMUL_MODE_PROT16 || mode == X86EMUL_MODE_PROT32)
-		mode = cs_desc->d ? X86EMUL_MODE_PROT32 : X86EMUL_MODE_PROT16;
-	rc = assign_eip(ctxt, dst, mode);
-	if (rc == X86EMUL_CONTINUE)
-		ctxt->mode = mode;
-	return rc;
+	if (rc != X86EMUL_CONTINUE)
+		return rc;
+
+	return assign_eip(ctxt, dst);
 }

 static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
@@ -2020,7 +2049,7 @@ static int em_pop_sreg(struct x86_emulate_ctxt *ctxt)
 	if (rc != X86EMUL_CONTINUE)
 		return rc;

-	if (ctxt->modrm_reg == VCPU_SREG_SS)
+	if (seg == VCPU_SREG_SS)
 		ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
 	if (ctxt->op_bytes > 2)
 		rsp_increment(ctxt, ctxt->op_bytes - 2);
@@ -2237,7 +2266,7 @@ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
 	if (rc != X86EMUL_CONTINUE)
 		return rc;

-	rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
+	rc = assign_eip_far(ctxt, ctxt->src.val);
 	/* Error handling is not implemented. */
 	if (rc != X86EMUL_CONTINUE)
 		return X86EMUL_UNHANDLEABLE;
@@ -2318,7 +2347,7 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
 				       &new_desc);
 	if (rc != X86EMUL_CONTINUE)
 		return rc;
-	rc = assign_eip_far(ctxt, eip, &new_desc);
+	rc = assign_eip_far(ctxt, eip);
 	/* Error handling is not implemented. */
 	if (rc != X86EMUL_CONTINUE)
 		return X86EMUL_UNHANDLEABLE;
@@ -2953,6 +2982,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
 	ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);

 	ctxt->_eip = rdx;
+	ctxt->mode = usermode;
 	*reg_write(ctxt, VCPU_REGS_RSP) = rcx;

 	return X86EMUL_CONTINUE;
@@ -3549,7 +3579,7 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
 	if (rc != X86EMUL_CONTINUE)
 		return rc;

-	rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
+	rc = assign_eip_far(ctxt, ctxt->src.val);
 	if (rc != X86EMUL_CONTINUE)
 		goto fail;

@@ -3696,11 +3726,25 @@ static int em_movbe(struct x86_emulate_ctxt *ctxt)

 static int em_cr_write(struct x86_emulate_ctxt *ctxt)
 {
-	if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))
+	int cr_num = ctxt->modrm_reg;
+	int r;
+
+	if (ctxt->ops->set_cr(ctxt, cr_num, ctxt->src.val))
 		return emulate_gp(ctxt, 0);

 	/* Disable writeback. */
 	ctxt->dst.type = OP_NONE;
+
+	if (cr_num == 0) {
+		/*
+		 * CR0 write might have updated CR0.PE and/or CR0.PG
+		 * which can affect the cpu's execution mode.
+		 */
+		r = emulator_recalc_and_set_mode(ctxt);
+		if (r != X86EMUL_CONTINUE)
+			return r;
+	}
+
 	return X86EMUL_CONTINUE;
 }

--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -4180,9 +4180,9 @@ static int svm_get_msr_feature(struct kvm_msr_entry *msr)
 	msr->data = 0;

 	switch (msr->index) {
-	case MSR_F10H_DECFG:
-		if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC))
-			msr->data |= MSR_F10H_DECFG_LFENCE_SERIALIZE;
+	case MSR_AMD64_DE_CFG:
+		if (cpu_feature_enabled(X86_FEATURE_LFENCE_RDTSC))
+			msr->data |= MSR_AMD64_DE_CFG_LFENCE_SERIALIZE;
 		break;
 	default:
 		return 1;
@@ -4284,7 +4284,7 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 			msr_info->data = 0x1E;
 		}
 		break;
-	case MSR_F10H_DECFG:
+	case MSR_AMD64_DE_CFG:
 		msr_info->data = svm->msr_decfg;
 		break;
 	default:
@@ -4451,7 +4451,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 	case MSR_VM_IGNNE:
 		vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
 		break;
-	case MSR_F10H_DECFG: {
+	case MSR_AMD64_DE_CFG: {
 		struct kvm_msr_entry msr_entry;

 		msr_entry.index = msr->index;
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3427,7 +3427,16 @@ static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu,
 	u32 intr_info = nr | INTR_INFO_VALID_MASK;

 	if (vcpu->arch.exception.has_error_code) {
-		vmcs12->vm_exit_intr_error_code = vcpu->arch.exception.error_code;
+		/*
+		 * Intel CPUs do not generate error codes with bits 31:16 set,
+		 * and more importantly VMX disallows setting bits 31:16 in the
+		 * injected error code for VM-Entry.  Drop the bits to mimic
+		 * hardware and avoid inducing failure on nested VM-Entry if L1
+		 * chooses to inject the exception back to L2.  AMD CPUs _do_
+		 * generate "full" 32-bit error codes, so KVM allows userspace
+		 * to inject exception error codes with bits 31:16 set.
+		 */
+		vmcs12->vm_exit_intr_error_code = (u16)vcpu->arch.exception.error_code;
 		intr_info |= INTR_INFO_DELIVER_CODE_MASK;
 	}

@@ -3762,14 +3771,6 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 			nested_vmx_abort(vcpu,
 					 VMX_ABORT_SAVE_GUEST_MSR_FAIL);
 	}
-
-	/*
-	 * Drop what we picked up for L2 via vmx_complete_interrupts. It is
-	 * preserved above and would only end up incorrectly in L1.
-	 */
-	vcpu->arch.nmi_injected = false;
-	kvm_clear_exception_queue(vcpu);
-	kvm_clear_interrupt_queue(vcpu);
 }

 /*
@@ -4104,6 +4105,17 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
 		WARN_ON_ONCE(nested_early_check);
 	}

+	/*
+	 * Drop events/exceptions that were queued for re-injection to L2
+	 * (picked up via vmx_complete_interrupts()), as well as exceptions
+	 * that were pending for L2.  Note, this must NOT be hoisted above
+	 * prepare_vmcs12(), events/exceptions queued for re-injection need to
+	 * be captured in vmcs12 (see vmcs12_save_pending_event()).
+	 */
+	vcpu->arch.nmi_injected = false;
+	kvm_clear_exception_queue(vcpu);
+	kvm_clear_interrupt_queue(vcpu);
+
 	vmx_switch_vmcs(vcpu, &vmx->vmcs01);

 	/* Update any VMCS fields that might have changed while L2 ran */
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1676,7 +1676,17 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu)
 	kvm_deliver_exception_payload(vcpu);

 	if (has_error_code) {
-		vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
+		/*
+		 * Despite the error code being architecturally defined as 32
+		 * bits, and the VMCS field being 32 bits, Intel CPUs and thus
+		 * VMX don't actually supporting setting bits 31:16.  Hardware
+		 * will (should) never provide a bogus error code, but AMD CPUs
+		 * do generate error codes with bits 31:16 set, and so KVM's
+		 * ABI lets userspace shove in arbitrary 32-bit values.  Drop
+		 * the upper bits to avoid VM-Fail, losing information that
+		 * does't really exist is preferable to killing the VM.
+		 */
+		vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, (u16)error_code);
 		intr_info |= INTR_INFO_DELIVER_CODE_MASK;
 	}

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1337,7 +1337,7 @@ static const u32 msr_based_features_all[] = {
 	MSR_IA32_VMX_EPT_VPID_CAP,
 	MSR_IA32_VMX_VMFUNC,

-	MSR_F10H_DECFG,
+	MSR_AMD64_DE_CFG,
 	MSR_IA32_UCODE_REV,
 	MSR_IA32_ARCH_CAPABILITIES,
 };
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -214,9 +214,15 @@ __ioremap_caller(resource_size_t phys_addr, unsigned long size,
 	 * Mappings have to be page-aligned
 	 */
 	offset = phys_addr & ~PAGE_MASK;
-	phys_addr &= PHYSICAL_PAGE_MASK;
+	phys_addr &= PAGE_MASK;
 	size = PAGE_ALIGN(last_addr+1) - phys_addr;

+	/*
+	 * Mask out any bits not part of the actual physical
+	 * address, like memory encryption bits.
+	 */
+	phys_addr &= PHYSICAL_PAGE_MASK;
+
 	retval = reserve_memtype(phys_addr, (u64)phys_addr + size,
 						pcm, &new_pcm);
 	if (retval) {
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -535,15 +535,23 @@ static int pm_cpu_check(const struct x86_cpu_id *c)

 static void pm_save_spec_msr(void)
 {
-	u32 spec_msr_id[] = {
-		MSR_IA32_SPEC_CTRL,
-		MSR_IA32_TSX_CTRL,
-		MSR_TSX_FORCE_ABORT,
-		MSR_IA32_MCU_OPT_CTRL,
-		MSR_AMD64_LS_CFG,
+	struct msr_enumeration {
+		u32 msr_no;
+		u32 feature;
+	} msr_enum[] = {
+		{ MSR_IA32_SPEC_CTRL,	 X86_FEATURE_MSR_SPEC_CTRL },
+		{ MSR_IA32_TSX_CTRL,	 X86_FEATURE_MSR_TSX_CTRL },
+		{ MSR_TSX_FORCE_ABORT,	 X86_FEATURE_TSX_FORCE_ABORT },
+		{ MSR_IA32_MCU_OPT_CTRL, X86_FEATURE_SRBDS_CTRL },
+		{ MSR_AMD64_LS_CFG,	 X86_FEATURE_LS_CFG_SSBD },
+		{ MSR_AMD64_DE_CFG,	 X86_FEATURE_LFENCE_RDTSC },
 	};
+	int i;

-	msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id));
+	for (i = 0; i < ARRAY_SIZE(msr_enum); i++) {
+		if (boot_cpu_has(msr_enum[i].feature))
+			msr_build_context(&msr_enum[i].msr_no, 1);
+	}
 }

 static int pm_check_save_msr(void)
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -594,6 +594,10 @@ struct bfq_group *bfq_bio_bfqg(struct bfq_data *bfqd, struct bio *bio)
 	struct bfq_group *bfqg;

 	while (blkg) {
+		if (!blkg->online) {
+			blkg = blkg->parent;
+			continue;
+		}
 		bfqg = blkg_to_bfqg(blkg);
 		if (bfqg->online) {
 			bio_associate_blkg_from_css(bio, &blkg->blkcg->css);
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -420,6 +420,8 @@ static struct bfq_io_cq *bfq_bic_lookup(struct bfq_data *bfqd,
 */
 void bfq_schedule_dispatch(struct bfq_data *bfqd)
 {
+	lockdep_assert_held(&bfqd->lock);
+
 	if (bfqd->queued != 0) {
 		bfq_log(bfqd, "schedule dispatch");
 		blk_mq_run_hw_queues(bfqd->queue, true);
@@ -6257,8 +6259,8 @@ bfq_idle_slice_timer_body(struct bfq_data *bfqd, struct bfq_queue *bfqq)
 	bfq_bfqq_expire(bfqd, bfqq, true, reason);

 schedule_dispatch:
-	spin_unlock_irqrestore(&bfqd->lock, flags);
 	bfq_schedule_dispatch(bfqd);
+	spin_unlock_irqrestore(&bfqd->lock, flags);
 }

 /*
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -88,8 +88,8 @@ struct opal_dev {
 	u64 lowest_lba;

 	size_t pos;
-	u8 cmd[IO_BUFFER_LENGTH];
-	u8 resp[IO_BUFFER_LENGTH];
+	u8 *cmd;
+	u8 *resp;

 	struct parsed_resp parsed;
 	size_t prev_d_len;
@@ -2019,6 +2019,8 @@ void free_opal_dev(struct opal_dev *dev)
 		return;

 	clean_opal_dev(dev);
+	kfree(dev->resp);
+	kfree(dev->cmd);
 	kfree(dev);
 }
 EXPORT_SYMBOL(free_opal_dev);
@@ -2031,17 +2033,39 @@ struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv)
 	if (!dev)
 		return NULL;

+	/*
+	 * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes
+	 * sure the allocated buffer is DMA-safe in that regard.
+	 */
+	dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
+	if (!dev->cmd)
+		goto err_free_dev;
+
+	dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
+	if (!dev->resp)
+		goto err_free_cmd;
+
 	INIT_LIST_HEAD(&dev->unlk_lst);
 	mutex_init(&dev->dev_lock);
 	dev->data = data;
 	dev->send_recv = send_recv;
 	if (check_opal_support(dev) != 0) {
 		pr_debug("Opal is not supported on this device\n");
-		kfree(dev);
-		return NULL;
+		goto err_free_resp;
 	}

 	return dev;
+
+err_free_resp:
+	kfree(dev->resp);
+
+err_free_cmd:
+	kfree(dev->cmd);
+
+err_free_dev:
+	kfree(dev);
+
+	return NULL;
 }
 EXPORT_SYMBOL(init_opal_dev);

--- a/crypto/akcipher.c
+++ b/crypto/akcipher.c
@@ -119,6 +119,12 @@ static int akcipher_default_op(struct akcipher_request *req)
 	return -ENOSYS;
 }

+static int akcipher_default_set_key(struct crypto_akcipher *tfm,
+				     const void *key, unsigned int keylen)
+{
+	return -ENOSYS;
+}
+
 int crypto_register_akcipher(struct akcipher_alg *alg)
 {
 	struct crypto_alg *base = &alg->base;
@@ -131,6 +137,8 @@ int crypto_register_akcipher(struct akcipher_alg *alg)
 		alg->encrypt = akcipher_default_op;
 	if (!alg->decrypt)
 		alg->decrypt = akcipher_default_op;
+	if (!alg->set_priv_key)
+		alg->set_priv_key = akcipher_default_set_key;

 	akcipher_prepare_alg(alg);
 	return crypto_register_alg(base);
--- a/drivers/acpi/acpi_extlog.c
+++ b/drivers/acpi/acpi_extlog.c
@@ -12,6 +12,7 @@
 #include <linux/ratelimit.h>
 #include <linux/edac.h>
 #include <linux/ras.h>
+#include <acpi/ghes.h>
 #include <asm/cpu.h>
 #include <asm/mce.h>

@@ -140,8 +141,8 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
 	int	cpu = mce->extcpu;
 	struct acpi_hest_generic_status *estatus, *tmp;
 	struct acpi_hest_generic_data *gdata;
-	const guid_t *fru_id = &guid_null;
-	char *fru_text = "";
+	const guid_t *fru_id;
+	char *fru_text;
 	guid_t *sec_type;
 	static u32 err_seq;

@@ -162,17 +163,23 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,

 	/* log event via trace */
 	err_seq++;
-	gdata = (struct acpi_hest_generic_data *)(tmp + 1);
-	if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID)
-		fru_id = (guid_t *)gdata->fru_id;
-	if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT)
-		fru_text = gdata->fru_text;
-	sec_type = (guid_t *)gdata->section_type;
-	if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
-		struct cper_sec_mem_err *mem = (void *)(gdata + 1);
-		if (gdata->error_data_length >= sizeof(*mem))
-			trace_extlog_mem_event(mem, err_seq, fru_id, fru_text,
-					       (u8)gdata->error_severity);
+	apei_estatus_for_each_section(tmp, gdata) {
+		if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID)
+			fru_id = (guid_t *)gdata->fru_id;
+		else
+			fru_id = &guid_null;
+		if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT)
+			fru_text = gdata->fru_text;
+		else
+			fru_text = "";
+		sec_type = (guid_t *)gdata->section_type;
+		if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
+			struct cper_sec_mem_err *mem = (void *)(gdata + 1);
+
+			if (gdata->error_data_length >= sizeof(*mem))
+				trace_extlog_mem_event(mem, err_seq, fru_id, fru_text,
+						       (u8)gdata->error_severity);
+		}
 	}

 out:
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -498,6 +498,22 @@ static const struct dmi_system_id video_dmi_table[] = {
 		DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE R830"),
 		},
 	},
+	{
+	 .callback = video_disable_backlight_sysfs_if,
+	 .ident = "Toshiba Satellite Z830",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE Z830"),
+		},
+	},
+	{
+	 .callback = video_disable_backlight_sysfs_if,
+	 .ident = "Toshiba Portege Z830",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE Z830"),
+		},
+	},
 	/*
 	 * Some machine's _DOD IDs don't have bit 31(Device ID Scheme) set
 	 * but the IDs actually follow the Device ID Scheme.
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -463,6 +463,70 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
 		DMI_MATCH(DMI_BOARD_NAME, "PF5LUXG"),
 		},
 	},
+	/*
+	 * More Tongfang devices with the same issue as the Clevo NL5xRU and
+	 * NL5xNU/TUXEDO Aura 15 Gen1 and Gen2. See the description above.
+	 */
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GKxNRxx",
+	.matches = {
+		DMI_MATCH(DMI_BOARD_NAME, "GKxNRxx"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GKxNRxx",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+		DMI_MATCH(DMI_BOARD_NAME, "POLARIS1501A1650TI"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GKxNRxx",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+		DMI_MATCH(DMI_BOARD_NAME, "POLARIS1501A2060"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GKxNRxx",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+		DMI_MATCH(DMI_BOARD_NAME, "POLARIS1701A1650TI"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GKxNRxx",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+		DMI_MATCH(DMI_BOARD_NAME, "POLARIS1701A2060"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GMxNGxx",
+	.matches = {
+		DMI_MATCH(DMI_BOARD_NAME, "GMxNGxx"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GMxZGxx",
+	.matches = {
+		DMI_MATCH(DMI_BOARD_NAME, "GMxZGxx"),
+		},
+	},
+	{
+	.callback = video_detect_force_native,
+	.ident = "TongFang GMxRGxx",
+	.matches = {
+		DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"),
+		},
+	},
 	/*
 	 * Desktops which falsely report a backlight and which our heuristics
 	 * for this do not catch.
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1785,15 +1785,21 @@ static void binder_cleanup_transaction(struct binder_transaction *t,
 /**
 * binder_get_object() - gets object and checks for valid metadata
 * @proc:	binder_proc owning the buffer
+ * @u:		sender's user pointer to base of buffer
 * @buffer:	binder_buffer that we're parsing.
 * @offset:	offset in the @buffer at which to validate an object.
 * @object:	struct binder_object to read into
 *
- * Return:	If there's a valid metadata object at @offset in @buffer, the
+ * Copy the binder object at the given offset into @object. If @u is
+ * provided then the copy is from the sender's buffer. If not, then
+ * it is copied from the target's @buffer.
+ *
+ * Return:	If there's a valid metadata object at @offset, the
 *		size of that object. Otherwise, it returns zero. The object
 *		is read into the struct binder_object pointed to by @object.
 */
 static size_t binder_get_object(struct binder_proc *proc,
+				const void __user *u,
 				struct binder_buffer *buffer,
 				unsigned long offset,
 				struct binder_object *object)
@@ -1803,10 +1809,16 @@ static size_t binder_get_object(struct binder_proc *proc,
 	size_t object_size = 0;

 	read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
-	if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
-	    binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
-					  offset, read_size))
+	if (offset > buffer->data_size || read_size < sizeof(*hdr))
 		return 0;
+	if (u) {
+		if (copy_from_user(object, u + offset, read_size))
+			return 0;
+	} else {
+		if (binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
+						  offset, read_size))
+			return 0;
+	}

 	/* Ok, now see if we read a complete object. */
 	hdr = &object->hdr;
@@ -1879,7 +1891,7 @@ static struct binder_buffer_object *binder_validate_ptr(
 					  b, buffer_offset,
 					  sizeof(object_offset)))
 		return NULL;
-	object_size = binder_get_object(proc, b, object_offset, object);
+	object_size = binder_get_object(proc, NULL, b, object_offset, object);
 	if (!object_size || object->hdr.type != BINDER_TYPE_PTR)
 		return NULL;
 	if (object_offsetp)
@@ -1944,7 +1956,8 @@ static bool binder_validate_fixup(struct binder_proc *proc,
 		unsigned long buffer_offset;
 		struct binder_object last_object;
 		struct binder_buffer_object *last_bbo;
-		size_t object_size = binder_get_object(proc, b, last_obj_offset,
+		size_t object_size = binder_get_object(proc, NULL, b,
+						       last_obj_offset,
 						       &last_object);
 		if (object_size != sizeof(*last_bbo))
 			return false;
@@ -2057,7 +2070,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
 						   buffer, buffer_offset,
 						   sizeof(object_offset)))
-			object_size = binder_get_object(proc, buffer,
+			object_size = binder_get_object(proc, NULL, buffer,
 							object_offset, &object);
 		if (object_size == 0) {
 			pr_err("transaction release %d bad object at offset %lld, size %zd\n",
@@ -2398,16 +2411,266 @@ err_fd_not_accepted:
 	return ret;
 }

-static int binder_translate_fd_array(struct binder_fd_array_object *fda,
+/**
+ * struct binder_ptr_fixup - data to be fixed-up in target buffer
+ * @offset	offset in target buffer to fixup
+ * @skip_size	bytes to skip in copy (fixup will be written later)
+ * @fixup_data	data to write at fixup offset
+ * @node	list node
+ *
+ * This is used for the pointer fixup list (pf) which is created and consumed
+ * during binder_transaction() and is only accessed locally. No
+ * locking is necessary.
+ *
+ * The list is ordered by @offset.
+ */
+struct binder_ptr_fixup {
+	binder_size_t offset;
+	size_t skip_size;
+	binder_uintptr_t fixup_data;
+	struct list_head node;
+};
+
+/**
+ * struct binder_sg_copy - scatter-gather data to be copied
+ * @offset		offset in target buffer
+ * @sender_uaddr	user address in source buffer
+ * @length		bytes to copy
+ * @node		list node
+ *
+ * This is used for the sg copy list (sgc) which is created and consumed
+ * during binder_transaction() and is only accessed locally. No
+ * locking is necessary.
+ *
+ * The list is ordered by @offset.
+ */
+struct binder_sg_copy {
+	binder_size_t offset;
+	const void __user *sender_uaddr;
+	size_t length;
+	struct list_head node;
+};
+
+/**
+ * binder_do_deferred_txn_copies() - copy and fixup scatter-gather data
+ * @alloc:	binder_alloc associated with @buffer
+ * @buffer:	binder buffer in target process
+ * @sgc_head:	list_head of scatter-gather copy list
+ * @pf_head:	list_head of pointer fixup list
+ *
+ * Processes all elements of @sgc_head, applying fixups from @pf_head
+ * and copying the scatter-gather data from the source process' user
+ * buffer to the target's buffer. It is expected that the list creation
+ * and processing all occurs during binder_transaction() so these lists
+ * are only accessed in local context.
+ *
+ * Return: 0=success, else -errno
+ */
+static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
+					 struct binder_buffer *buffer,
+					 struct list_head *sgc_head,
+					 struct list_head *pf_head)
+{
+	int ret = 0;
+	struct binder_sg_copy *sgc, *tmpsgc;
+	struct binder_ptr_fixup *tmppf;
+	struct binder_ptr_fixup *pf =
+		list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
+					 node);
+
+	list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) {
+		size_t bytes_copied = 0;
+
+		while (bytes_copied < sgc->length) {
+			size_t copy_size;
+			size_t bytes_left = sgc->length - bytes_copied;
+			size_t offset = sgc->offset + bytes_copied;
+
+			/*
+			 * We copy up to the fixup (pointed to by pf)
+			 */
+			copy_size = pf ? min(bytes_left, (size_t)pf->offset - offset)
+				       : bytes_left;
+			if (!ret && copy_size)
+				ret = binder_alloc_copy_user_to_buffer(
+						alloc, buffer,
+						offset,
+						sgc->sender_uaddr + bytes_copied,
+						copy_size);
+			bytes_copied += copy_size;
+			if (copy_size != bytes_left) {
+				BUG_ON(!pf);
+				/* we stopped at a fixup offset */
+				if (pf->skip_size) {
+					/*
+					 * we are just skipping. This is for
+					 * BINDER_TYPE_FDA where the translated
+					 * fds will be fixed up when we get
+					 * to target context.
+					 */
+					bytes_copied += pf->skip_size;
+				} else {
+					/* apply the fixup indicated by pf */
+					if (!ret)
+						ret = binder_alloc_copy_to_buffer(
+							alloc, buffer,
+							pf->offset,
+							&pf->fixup_data,
+							sizeof(pf->fixup_data));
+					bytes_copied += sizeof(pf->fixup_data);
+				}
+				list_del(&pf->node);
+				kfree(pf);
+				pf = list_first_entry_or_null(pf_head,
+						struct binder_ptr_fixup, node);
+			}
+		}
+		list_del(&sgc->node);
+		kfree(sgc);
+	}
+	list_for_each_entry_safe(pf, tmppf, pf_head, node) {
+		BUG_ON(pf->skip_size == 0);
+		list_del(&pf->node);
+		kfree(pf);
+	}
+	BUG_ON(!list_empty(sgc_head));
+
+	return ret > 0 ? -EINVAL : ret;
+}
+
+/**
+ * binder_cleanup_deferred_txn_lists() - free specified lists
+ * @sgc_head:	list_head of scatter-gather copy list
+ * @pf_head:	list_head of pointer fixup list
+ *
+ * Called to clean up @sgc_head and @pf_head if there is an
+ * error.
+ */
+static void binder_cleanup_deferred_txn_lists(struct list_head *sgc_head,
+					      struct list_head *pf_head)
+{
+	struct binder_sg_copy *sgc, *tmpsgc;
+	struct binder_ptr_fixup *pf, *tmppf;
+
+	list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) {
+		list_del(&sgc->node);
+		kfree(sgc);
+	}
+	list_for_each_entry_safe(pf, tmppf, pf_head, node) {
+		list_del(&pf->node);
+		kfree(pf);
+	}
+}
+
+/**
+ * binder_defer_copy() - queue a scatter-gather buffer for copy
+ * @sgc_head:		list_head of scatter-gather copy list
+ * @offset:		binder buffer offset in target process
+ * @sender_uaddr:	user address in source process
+ * @length:		bytes to copy
+ *
+ * Specify a scatter-gather block to be copied. The actual copy must
+ * be deferred until all the needed fixups are identified and queued.
+ * Then the copy and fixups are done together so un-translated values
+ * from the source are never visible in the target buffer.
+ *
+ * We are guaranteed that repeated calls to this function will have
+ * monotonically increasing @offset values so the list will naturally
+ * be ordered.
+ *
+ * Return: 0=success, else -errno
+ */
+static int binder_defer_copy(struct list_head *sgc_head, binder_size_t offset,
+			     const void __user *sender_uaddr, size_t length)
+{
+	struct binder_sg_copy *bc = kzalloc(sizeof(*bc), GFP_KERNEL);
+
+	if (!bc)
+		return -ENOMEM;
+
+	bc->offset = offset;
+	bc->sender_uaddr = sender_uaddr;
+	bc->length = length;
+	INIT_LIST_HEAD(&bc->node);
+
+	/*
+	 * We are guaranteed that the deferred copies are in-order
+	 * so just add to the tail.
+	 */
+	list_add_tail(&bc->node, sgc_head);
+
+	return 0;
+}
+
+/**
+ * binder_add_fixup() - queue a fixup to be applied to sg copy
+ * @pf_head:	list_head of binder ptr fixup list
+ * @offset:	binder buffer offset in target process
+ * @fixup:	bytes to be copied for fixup
+ * @skip_size:	bytes to skip when copying (fixup will be applied later)
+ *
+ * Add the specified fixup to a list ordered by @offset. When copying
+ * the scatter-gather buffers, the fixup will be copied instead of
+ * data from the source buffer. For BINDER_TYPE_FDA fixups, the fixup
+ * will be applied later (in target process context), so we just skip
+ * the bytes specified by @skip_size. If @skip_size is 0, we copy the
+ * value in @fixup.
+ *
+ * This function is called *mostly* in @offset order, but there are
+ * exceptions. Since out-of-order inserts are relatively uncommon,
+ * we insert the new element by searching backward from the tail of
+ * the list.
+ *
+ * Return: 0=success, else -errno
+ */
+static int binder_add_fixup(struct list_head *pf_head, binder_size_t offset,
+			    binder_uintptr_t fixup, size_t skip_size)
+{
+	struct binder_ptr_fixup *pf = kzalloc(sizeof(*pf), GFP_KERNEL);
+	struct binder_ptr_fixup *tmppf;
+
+	if (!pf)
+		return -ENOMEM;
+
+	pf->offset = offset;
+	pf->fixup_data = fixup;
+	pf->skip_size = skip_size;
+	INIT_LIST_HEAD(&pf->node);
+
+	/* Fixups are *mostly* added in-order, but there are some
+	 * exceptions. Look backwards through list for insertion point.
+	 */
+	list_for_each_entry_reverse(tmppf, pf_head, node) {
+		if (tmppf->offset < pf->offset) {
+			list_add(&pf->node, &tmppf->node);
+			return 0;
+		}
+	}
+	/*
+	 * if we get here, then the new offset is the lowest so
+	 * insert at the head
+	 */
+	list_add(&pf->node, pf_head);
+	return 0;
+}
+
+static int binder_translate_fd_array(struct list_head *pf_head,
+				     struct binder_fd_array_object *fda,
+				     const void __user *sender_ubuffer,
 				     struct binder_buffer_object *parent,
+				     struct binder_buffer_object *sender_uparent,
 				     struct binder_transaction *t,
 				     struct binder_thread *thread,
 				     struct binder_transaction *in_reply_to)
 {
 	binder_size_t fdi, fd_buf_size;
 	binder_size_t fda_offset;
+	const void __user *sender_ufda_base;
 	struct binder_proc *proc = thread->proc;
-	struct binder_proc *target_proc = t->to_proc;
+	int ret;
+
+	if (fda->num_fds == 0)
+		return 0;

 	fd_buf_size = sizeof(u32) * fda->num_fds;
 	if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
@@ -2431,19 +2694,25 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
 	 */
 	fda_offset = (parent->buffer - (uintptr_t)t->buffer->user_data) +
 		fda->parent_offset;
-	if (!IS_ALIGNED((unsigned long)fda_offset, sizeof(u32))) {
+	sender_ufda_base = (void __user *)(uintptr_t)sender_uparent->buffer +
+				fda->parent_offset;
+
+	if (!IS_ALIGNED((unsigned long)fda_offset, sizeof(u32)) ||
+	    !IS_ALIGNED((unsigned long)sender_ufda_base, sizeof(u32))) {
 		binder_user_error("%d:%d parent offset not aligned correctly.\n",
 				  proc->pid, thread->pid);
 		return -EINVAL;
 	}
+	ret = binder_add_fixup(pf_head, fda_offset, 0, fda->num_fds * sizeof(u32));
+	if (ret)
+		return ret;
+
 	for (fdi = 0; fdi < fda->num_fds; fdi++) {
 		u32 fd;
-		int ret;
 		binder_size_t offset = fda_offset + fdi * sizeof(fd);
+		binder_size_t sender_uoffset = fdi * sizeof(fd);

-		ret = binder_alloc_copy_from_buffer(&target_proc->alloc,
-						    &fd, t->buffer,
-						    offset, sizeof(fd));
+		ret = copy_from_user(&fd, sender_ufda_base + sender_uoffset, sizeof(fd));
 		if (!ret)
 			ret = binder_translate_fd(fd, offset, t, thread,
 						  in_reply_to);
@@ -2453,7 +2722,8 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
 	return 0;
 }

-static int binder_fixup_parent(struct binder_transaction *t,
+static int binder_fixup_parent(struct list_head *pf_head,
+			       struct binder_transaction *t,
 			       struct binder_thread *thread,
 			       struct binder_buffer_object *bp,
 			       binder_size_t off_start_offset,
@@ -2499,14 +2769,7 @@ static int binder_fixup_parent(struct binder_transaction *t,
 	}
 	buffer_offset = bp->parent_offset +
 			(uintptr_t)parent->buffer - (uintptr_t)b->user_data;
-	if (binder_alloc_copy_to_buffer(&target_proc->alloc, b, buffer_offset,
-					&bp->buffer, sizeof(bp->buffer))) {
-		binder_user_error("%d:%d got transaction with invalid parent offset\n",
-				  proc->pid, thread->pid);
-		return -EINVAL;
-	}
-
-	return 0;
+	return binder_add_fixup(pf_head, buffer_offset, bp->buffer, 0);
 }

 /**
@@ -2637,6 +2900,7 @@ static void binder_transaction(struct binder_proc *proc,
 	binder_size_t off_start_offset, off_end_offset;
 	binder_size_t off_min;
 	binder_size_t sg_buf_offset, sg_buf_end_offset;
+	binder_size_t user_offset = 0;
 	struct binder_proc *target_proc = NULL;
 	struct binder_thread *target_thread = NULL;
 	struct binder_node *target_node = NULL;
@@ -2652,6 +2916,12 @@ static void binder_transaction(struct binder_proc *proc,
 	char *secctx = NULL;
 	u32 secctx_sz = 0;
 	bool is_nested = false;
+	struct list_head sgc_head;
+	struct list_head pf_head;
+	const void __user *user_buffer = (const void __user *)
+				(uintptr_t)tr->data.ptr.buffer;
+	INIT_LIST_HEAD(&sgc_head);
+	INIT_LIST_HEAD(&pf_head);

 	e = binder_transaction_log_add(&binder_transaction_log);
 	e->debug_id = t_debug_id;
@@ -2967,19 +3237,6 @@ static void binder_transaction(struct binder_proc *proc,
 	t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF);
 	trace_binder_transaction_alloc_buf(t->buffer);

-	if (binder_alloc_copy_user_to_buffer(
-				&target_proc->alloc,
-				t->buffer, 0,
-				(const void __user *)
-					(uintptr_t)tr->data.ptr.buffer,
-				tr->data_size)) {
-		binder_user_error("%d:%d got transaction with invalid data ptr\n",
-				proc->pid, thread->pid);
-		return_error = BR_FAILED_REPLY;
-		return_error_param = -EFAULT;
-		return_error_line = __LINE__;
-		goto err_copy_data_failed;
-	}
 	if (binder_alloc_copy_user_to_buffer(
 				&target_proc->alloc,
 				t->buffer,
@@ -3024,6 +3281,7 @@ static void binder_transaction(struct binder_proc *proc,
 		size_t object_size;
 		struct binder_object object;
 		binder_size_t object_offset;
+		binder_size_t copy_size;

 		if (binder_alloc_copy_from_buffer(&target_proc->alloc,
 						  &object_offset,
@@ -3035,8 +3293,27 @@ static void binder_transaction(struct binder_proc *proc,
 			return_error_line = __LINE__;
 			goto err_bad_offset;
 		}
-		object_size = binder_get_object(target_proc, t->buffer,
-						object_offset, &object);
+
+		/*
+		 * Copy the source user buffer up to the next object
+		 * that will be processed.
+		 */
+		copy_size = object_offset - user_offset;
+		if (copy_size && (user_offset > object_offset ||
+				binder_alloc_copy_user_to_buffer(
+					&target_proc->alloc,
+					t->buffer, user_offset,
+					user_buffer + user_offset,
+					copy_size))) {
+			binder_user_error("%d:%d got transaction with invalid data ptr\n",
+					proc->pid, thread->pid);
+			return_error = BR_FAILED_REPLY;
+			return_error_param = -EFAULT;
+			return_error_line = __LINE__;
+			goto err_copy_data_failed;
+		}
+		object_size = binder_get_object(target_proc, user_buffer,
+				t->buffer, object_offset, &object);
 		if (object_size == 0 || object_offset < off_min) {
 			binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
 					  proc->pid, thread->pid,
@@ -3048,6 +3325,11 @@ static void binder_transaction(struct binder_proc *proc,
 			return_error_line = __LINE__;
 			goto err_bad_offset;
 		}
+		/*
+		 * Set offset to the next buffer fragment to be
+		 * copied
+		 */
+		user_offset = object_offset + object_size;

 		hdr = &object.hdr;
 		off_min = object_offset + object_size;
@@ -3110,6 +3392,8 @@ static void binder_transaction(struct binder_proc *proc,
 		case BINDER_TYPE_FDA: {
 			struct binder_object ptr_object;
 			binder_size_t parent_offset;
+			struct binder_object user_object;
+			size_t user_parent_size;
 			struct binder_fd_array_object *fda =
 				to_binder_fd_array_object(hdr);
 			size_t num_valid = (buffer_offset - off_start_offset) /
@@ -3141,11 +3425,35 @@ static void binder_transaction(struct binder_proc *proc,
 				return_error_line = __LINE__;
 				goto err_bad_parent;
 			}
-			ret = binder_translate_fd_array(fda, parent, t, thread,
-							in_reply_to);
-			if (ret < 0) {
+			/*
+			 * We need to read the user version of the parent
+			 * object to get the original user offset
+			 */
+			user_parent_size =
+				binder_get_object(proc, user_buffer, t->buffer,
+						  parent_offset, &user_object);
+			if (user_parent_size != sizeof(user_object.bbo)) {
+				binder_user_error("%d:%d invalid ptr object size: %zd vs %zd\n",
+						  proc->pid, thread->pid,
+						  user_parent_size,
+						  sizeof(user_object.bbo));
 				return_error = BR_FAILED_REPLY;
-				return_error_param = ret;
+				return_error_param = -EINVAL;
+				return_error_line = __LINE__;
+				goto err_bad_parent;
+			}
+			ret = binder_translate_fd_array(&pf_head, fda,
+							user_buffer, parent,
+							&user_object.bbo, t,
+							thread, in_reply_to);
+			if (!ret)
+				ret = binder_alloc_copy_to_buffer(&target_proc->alloc,
+								  t->buffer,
+								  object_offset,
+								  fda, sizeof(*fda));
+			if (ret) {
+				return_error = BR_FAILED_REPLY;
+				return_error_param = ret > 0 ? -EINVAL : ret;
 				return_error_line = __LINE__;
 				goto err_translate_failed;
 			}
@@ -3167,19 +3475,14 @@ static void binder_transaction(struct binder_proc *proc,
 				return_error_line = __LINE__;
 				goto err_bad_offset;
 			}
-			if (binder_alloc_copy_user_to_buffer(
-						&target_proc->alloc,
-						t->buffer,
-						sg_buf_offset,
-						(const void __user *)
-							(uintptr_t)bp->buffer,
-						bp->length)) {
-				binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
-						  proc->pid, thread->pid);
-				return_error_param = -EFAULT;
+			ret = binder_defer_copy(&sgc_head, sg_buf_offset,
+				(const void __user *)(uintptr_t)bp->buffer,
+				bp->length);
+			if (ret) {
 				return_error = BR_FAILED_REPLY;
+				return_error_param = ret;
 				return_error_line = __LINE__;
-				goto err_copy_data_failed;
+				goto err_translate_failed;
 			}
 			/* Fixup buffer pointer to target proc address space */
 			bp->buffer = (uintptr_t)
@@ -3188,7 +3491,8 @@ static void binder_transaction(struct binder_proc *proc,

 			num_valid = (buffer_offset - off_start_offset) /
 					sizeof(binder_size_t);
-			ret = binder_fixup_parent(t, thread, bp,
+			ret = binder_fixup_parent(&pf_head, t,
+						  thread, bp,
 						  off_start_offset,
 						  num_valid,
 						  last_fixup_obj_off,
@@ -3215,6 +3519,30 @@ static void binder_transaction(struct binder_proc *proc,
 			goto err_bad_object_type;
 		}
 	}
+	/* Done processing objects, copy the rest of the buffer */
+	if (binder_alloc_copy_user_to_buffer(
+				&target_proc->alloc,
+				t->buffer, user_offset,
+				user_buffer + user_offset,
+				tr->data_size - user_offset)) {
+		binder_user_error("%d:%d got transaction with invalid data ptr\n",
+				proc->pid, thread->pid);
+		return_error = BR_FAILED_REPLY;
+		return_error_param = -EFAULT;
+		return_error_line = __LINE__;
+		goto err_copy_data_failed;
+	}
+
+	ret = binder_do_deferred_txn_copies(&target_proc->alloc, t->buffer,
+					    &sgc_head, &pf_head);
+	if (ret) {
+		binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
+				  proc->pid, thread->pid);
+		return_error = BR_FAILED_REPLY;
+		return_error_param = ret;
+		return_error_line = __LINE__;
+		goto err_copy_data_failed;
+	}
 	tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
 	t->work.type = BINDER_WORK_TRANSACTION;

@@ -3293,6 +3621,7 @@ err_bad_object_type:
 err_bad_offset:
 err_bad_parent:
 err_copy_data_failed:
+	binder_cleanup_deferred_txn_lists(&sgc_head, &pf_head);
 	binder_free_txn_fixups(t);
 	trace_binder_transaction_failed_buffer_release(t->buffer);
 	binder_transaction_buffer_release(target_proc, NULL, t->buffer,
--- a/Show More
+++ b/Show More