Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.20/0102-4.20.3-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.20/0102-4.20.3-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3279 - (show annotations) (download)
    Mon Mar 4 10:35:51 2019 UTC (5 years, 1 month ago) by niro
    File size: 65079 byte(s) 
    linux-4.20.3
    1 diff --git a/Makefile b/Makefile
    2 index 4ba3dd0bf35d..3b9e4658d31f 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 4
    8 PATCHLEVEL = 20
    9 -SUBLEVEL = 2
    10 +SUBLEVEL = 3
    11 EXTRAVERSION =
    12 NAME = Shy Crocodile
    13
    14 diff --git a/arch/arm/mach-davinci/board-da830-evm.c b/arch/arm/mach-davinci/board-da830-evm.c
    15 index 7d8ab36ff83d..b3a3f5a59b5c 100644
    16 --- a/arch/arm/mach-davinci/board-da830-evm.c
    17 +++ b/arch/arm/mach-davinci/board-da830-evm.c
    18 @@ -207,9 +207,9 @@ static struct gpiod_lookup_table mmc_gpios_table = {
    19 .dev_id = "da830-mmc.0",
    20 .table = {
    21 /* gpio chip 1 contains gpio range 32-63 */
    22 - GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_CD_PIN, "cd",
    23 + GPIO_LOOKUP("davinci_gpio", DA830_MMCSD_CD_PIN, "cd",
    24 GPIO_ACTIVE_LOW),
    25 - GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_WP_PIN, "wp",
    26 + GPIO_LOOKUP("davinci_gpio", DA830_MMCSD_WP_PIN, "wp",
    27 GPIO_ACTIVE_LOW),
    28 },
    29 };
    30 diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
    31 index e1a949b47306..bf2549e1894b 100644
    32 --- a/arch/arm/mach-davinci/board-da850-evm.c
    33 +++ b/arch/arm/mach-davinci/board-da850-evm.c
    34 @@ -780,9 +780,9 @@ static struct gpiod_lookup_table mmc_gpios_table = {
    35 .dev_id = "da830-mmc.0",
    36 .table = {
    37 /* gpio chip 2 contains gpio range 64-95 */
    38 - GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd",
    39 + GPIO_LOOKUP("davinci_gpio", DA850_MMCSD_CD_PIN, "cd",
    40 GPIO_ACTIVE_LOW),
    41 - GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp",
    42 + GPIO_LOOKUP("davinci_gpio", DA850_MMCSD_WP_PIN, "wp",
    43 GPIO_ACTIVE_HIGH),
    44 },
    45 };
    46 diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c
    47 index f53a461a606f..f7fa960c23e3 100644
    48 --- a/arch/arm/mach-davinci/board-dm355-evm.c
    49 +++ b/arch/arm/mach-davinci/board-dm355-evm.c
    50 @@ -117,9 +117,9 @@ static struct platform_device davinci_nand_device = {
    51 static struct gpiod_lookup_table i2c_recovery_gpiod_table = {
    52 .dev_id = "i2c_davinci.1",
    53 .table = {
    54 - GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SDA_PIN, "sda",
    55 + GPIO_LOOKUP("davinci_gpio", DM355_I2C_SDA_PIN, "sda",
    56 GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
    57 - GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SCL_PIN, "scl",
    58 + GPIO_LOOKUP("davinci_gpio", DM355_I2C_SCL_PIN, "scl",
    59 GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
    60 },
    61 };
    62 diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c
    63 index e4a8f9225d16..f752d828e42f 100644
    64 --- a/arch/arm/mach-davinci/board-dm644x-evm.c
    65 +++ b/arch/arm/mach-davinci/board-dm644x-evm.c
    66 @@ -638,9 +638,9 @@ static struct i2c_board_info __initdata i2c_info[] = {
    67 static struct gpiod_lookup_table i2c_recovery_gpiod_table = {
    68 .dev_id = "i2c_davinci.1",
    69 .table = {
    70 - GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SDA_PIN, "sda",
    71 + GPIO_LOOKUP("davinci_gpio", DM644X_I2C_SDA_PIN, "sda",
    72 GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
    73 - GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SCL_PIN, "scl",
    74 + GPIO_LOOKUP("davinci_gpio", DM644X_I2C_SCL_PIN, "scl",
    75 GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
    76 },
    77 };
    78 diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c
    79 index 8e8d51f4a276..94c4f126ef86 100644
    80 --- a/arch/arm/mach-davinci/board-omapl138-hawk.c
    81 +++ b/arch/arm/mach-davinci/board-omapl138-hawk.c
    82 @@ -134,9 +134,9 @@ static const short hawk_mmcsd0_pins[] = {
    83 static struct gpiod_lookup_table mmc_gpios_table = {
    84 .dev_id = "da830-mmc.0",
    85 .table = {
    86 - GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_CD_PIN, "cd",
    87 + GPIO_LOOKUP("davinci_gpio", DA850_HAWK_MMCSD_CD_PIN, "cd",
    88 GPIO_ACTIVE_LOW),
    89 - GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_WP_PIN, "wp",
    90 + GPIO_LOOKUP("davinci_gpio", DA850_HAWK_MMCSD_WP_PIN, "wp",
    91 GPIO_ACTIVE_LOW),
    92 },
    93 };
    94 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
    95 index fd59fef9931b..1355fab5f676 100644
    96 --- a/arch/powerpc/kernel/signal_32.c
    97 +++ b/arch/powerpc/kernel/signal_32.c
    98 @@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
    99 {
    100 struct rt_sigframe __user *rt_sf;
    101 struct pt_regs *regs = current_pt_regs();
    102 + int tm_restore = 0;
    103 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
    104 struct ucontext __user *uc_transact;
    105 unsigned long msr_hi;
    106 unsigned long tmp;
    107 - int tm_restore = 0;
    108 #endif
    109 /* Always make any pending restarted system calls return -EINTR */
    110 current->restart_block.fn = do_no_restart_syscall;
    111 @@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
    112 goto bad;
    113 }
    114 }
    115 - if (!tm_restore)
    116 - /* Fall through, for non-TM restore */
    117 + if (!tm_restore) {
    118 + /*
    119 + * Unset regs->msr because ucontext MSR TS is not
    120 + * set, and recheckpoint was not called. This avoid
    121 + * hitting a TM Bad thing at RFID
    122 + */
    123 + regs->msr &= ~MSR_TS_MASK;
    124 + }
    125 + /* Fall through, for non-TM restore */
    126 #endif
    127 - if (do_setcontext(&rt_sf->uc, regs, 1))
    128 - goto bad;
    129 + if (!tm_restore)
    130 + if (do_setcontext(&rt_sf->uc, regs, 1))
    131 + goto bad;
    132
    133 /*
    134 * It's not clear whether or why it is desirable to save the
    135 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
    136 index bbd1c73243d7..6f70d1b4bf36 100644
    137 --- a/arch/powerpc/kernel/signal_64.c
    138 +++ b/arch/powerpc/kernel/signal_64.c
    139 @@ -756,11 +756,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
    140 &uc_transact->uc_mcontext))
    141 goto badframe;
    142 }
    143 - else
    144 - /* Fall through, for non-TM restore */
    145 #endif
    146 - if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
    147 - goto badframe;
    148 + /* Fall through, for non-TM restore */
    149 + if (!MSR_TM_ACTIVE(msr)) {
    150 + /*
    151 + * Unset MSR[TS] on the thread regs since MSR from user
    152 + * context does not have MSR active, and recheckpoint was
    153 + * not called since restore_tm_sigcontexts() was not called
    154 + * also.
    155 + *
    156 + * If not unsetting it, the code can RFID to userspace with
    157 + * MSR[TS] set, but without CPU in the proper state,
    158 + * causing a TM bad thing.
    159 + */
    160 + current->thread.regs->msr &= ~MSR_TS_MASK;
    161 + if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
    162 + goto badframe;
    163 + }
    164
    165 if (restore_altstack(&uc->uc_stack))
    166 goto badframe;
    167 diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
    168 index 362f3cde6a31..7b135796813f 100644
    169 --- a/arch/x86/kernel/cpu/bugs.c
    170 +++ b/arch/x86/kernel/cpu/bugs.c
    171 @@ -213,7 +213,7 @@ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
    172 static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
    173 SPECTRE_V2_USER_NONE;
    174
    175 -#ifdef RETPOLINE
    176 +#ifdef CONFIG_RETPOLINE
    177 static bool spectre_v2_bad_module;
    178
    179 bool retpoline_module_ok(bool has_retpoline)
    180 diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
    181 index 70f4e80b9246..a1a22e9c0328 100644
    182 --- a/drivers/acpi/arm64/iort.c
    183 +++ b/drivers/acpi/arm64/iort.c
    184 @@ -951,9 +951,10 @@ static int rc_dma_get_range(struct device *dev, u64 *size)
    185 {
    186 struct acpi_iort_node *node;
    187 struct acpi_iort_root_complex *rc;
    188 + struct pci_bus *pbus = to_pci_dev(dev)->bus;
    189
    190 node = iort_scan_node(ACPI_IORT_NODE_PCI_ROOT_COMPLEX,
    191 - iort_match_node_callback, dev);
    192 + iort_match_node_callback, &pbus->dev);
    193 if (!node || node->revision < 1)
    194 return -ENODEV;
    195
    196 diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c
    197 index 2579675b7082..e7c0006e6602 100644
    198 --- a/drivers/acpi/pmic/intel_pmic_xpower.c
    199 +++ b/drivers/acpi/pmic/intel_pmic_xpower.c
    200 @@ -20,8 +20,11 @@
    201 #define GPI1_LDO_ON (3 << 0)
    202 #define GPI1_LDO_OFF (4 << 0)
    203
    204 -#define AXP288_ADC_TS_PIN_GPADC 0xf2
    205 -#define AXP288_ADC_TS_PIN_ON 0xf3
    206 +#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
    207 +#define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
    208 +#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
    209 +#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0)
    210 +#define AXP288_ADC_TS_CURRENT_ON (3 << 0)
    211
    212 static struct pmic_table power_table[] = {
    213 {
    214 @@ -212,22 +215,44 @@ out:
    215 */
    216 static int intel_xpower_pmic_get_raw_temp(struct regmap *regmap, int reg)
    217 {
    218 + int ret, adc_ts_pin_ctrl;
    219 u8 buf[2];
    220 - int ret;
    221
    222 - ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL,
    223 - AXP288_ADC_TS_PIN_GPADC);
    224 + /*
    225 + * The current-source used for the battery temp-sensor (TS) is shared
    226 + * with the GPADC. For proper fuel-gauge and charger operation the TS
    227 + * current-source needs to be permanently on. But to read the GPADC we
    228 + * need to temporary switch the TS current-source to ondemand, so that
    229 + * the GPADC can use it, otherwise we will always read an all 0 value.
    230 + *
    231 + * Note that the switching from on to on-ondemand is not necessary
    232 + * when the TS current-source is off (this happens on devices which
    233 + * do not use the TS-pin).
    234 + */
    235 + ret = regmap_read(regmap, AXP288_ADC_TS_PIN_CTRL, &adc_ts_pin_ctrl);
    236 if (ret)
    237 return ret;
    238
    239 - /* After switching to the GPADC pin give things some time to settle */
    240 - usleep_range(6000, 10000);
    241 + if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) {
    242 + ret = regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL,
    243 + AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
    244 + AXP288_ADC_TS_CURRENT_ON_ONDEMAND);
    245 + if (ret)
    246 + return ret;
    247 +
    248 + /* Wait a bit after switching the current-source */
    249 + usleep_range(6000, 10000);
    250 + }
    251
    252 ret = regmap_bulk_read(regmap, AXP288_GP_ADC_H, buf, 2);
    253 if (ret == 0)
    254 ret = (buf[0] << 4) + ((buf[1] >> 4) & 0x0f);
    255
    256 - regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON);
    257 + if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) {
    258 + regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL,
    259 + AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
    260 + AXP288_ADC_TS_CURRENT_ON);
    261 + }
    262
    263 return ret;
    264 }
    265 diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
    266 index 1b475bc1ae16..665e93ca0b40 100644
    267 --- a/drivers/acpi/power.c
    268 +++ b/drivers/acpi/power.c
    269 @@ -131,6 +131,23 @@ void acpi_power_resources_list_free(struct list_head *list)
    270 }
    271 }
    272
    273 +static bool acpi_power_resource_is_dup(union acpi_object *package,
    274 + unsigned int start, unsigned int i)
    275 +{
    276 + acpi_handle rhandle, dup;
    277 + unsigned int j;
    278 +
    279 + /* The caller is expected to check the package element types */
    280 + rhandle = package->package.elements[i].reference.handle;
    281 + for (j = start; j < i; j++) {
    282 + dup = package->package.elements[j].reference.handle;
    283 + if (dup == rhandle)
    284 + return true;
    285 + }
    286 +
    287 + return false;
    288 +}
    289 +
    290 int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
    291 struct list_head *list)
    292 {
    293 @@ -150,6 +167,11 @@ int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
    294 err = -ENODEV;
    295 break;
    296 }
    297 +
    298 + /* Some ACPI tables contain duplicate power resource references */
    299 + if (acpi_power_resource_is_dup(package, start, i))
    300 + continue;
    301 +
    302 err = acpi_add_power_resource(rhandle);
    303 if (err)
    304 break;
    305 diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    306 index 8e5140bbf241..1e92b61d0bd5 100644
    307 --- a/drivers/block/rbd.c
    308 +++ b/drivers/block/rbd.c
    309 @@ -5986,7 +5986,6 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
    310 struct list_head *tmp;
    311 int dev_id;
    312 char opt_buf[6];
    313 - bool already = false;
    314 bool force = false;
    315 int ret;
    316
    317 @@ -6019,13 +6018,13 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
    318 spin_lock_irq(&rbd_dev->lock);
    319 if (rbd_dev->open_count && !force)
    320 ret = -EBUSY;
    321 - else
    322 - already = test_and_set_bit(RBD_DEV_FLAG_REMOVING,
    323 - &rbd_dev->flags);
    324 + else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING,
    325 + &rbd_dev->flags))
    326 + ret = -EINPROGRESS;
    327 spin_unlock_irq(&rbd_dev->lock);
    328 }
    329 spin_unlock(&rbd_dev_list_lock);
    330 - if (ret < 0 || already)
    331 + if (ret)
    332 return ret;
    333
    334 if (force) {
    335 diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
    336 index 50b1551ba894..242c3370544e 100644
    337 --- a/drivers/cpufreq/scmi-cpufreq.c
    338 +++ b/drivers/cpufreq/scmi-cpufreq.c
    339 @@ -52,9 +52,9 @@ scmi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
    340 int ret;
    341 struct scmi_data *priv = policy->driver_data;
    342 struct scmi_perf_ops *perf_ops = handle->perf_ops;
    343 - u64 freq = policy->freq_table[index].frequency * 1000;
    344 + u64 freq = policy->freq_table[index].frequency;
    345
    346 - ret = perf_ops->freq_set(handle, priv->domain_id, freq, false);
    347 + ret = perf_ops->freq_set(handle, priv->domain_id, freq * 1000, false);
    348 if (!ret)
    349 arch_set_freq_scale(policy->related_cpus, freq,
    350 policy->cpuinfo.max_freq);
    351 @@ -176,7 +176,7 @@ static int scmi_cpufreq_init(struct cpufreq_policy *policy)
    352 out_free_priv:
    353 kfree(priv);
    354 out_free_opp:
    355 - dev_pm_opp_cpumask_remove_table(policy->cpus);
    356 + dev_pm_opp_remove_all_dynamic(cpu_dev);
    357
    358 return ret;
    359 }
    360 @@ -188,7 +188,7 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
    361 cpufreq_cooling_unregister(priv->cdev);
    362 dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
    363 kfree(priv);
    364 - dev_pm_opp_cpumask_remove_table(policy->related_cpus);
    365 + dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
    366
    367 return 0;
    368 }
    369 diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
    370 index 87a98ec77773..99449738faa4 100644
    371 --- a/drivers/cpufreq/scpi-cpufreq.c
    372 +++ b/drivers/cpufreq/scpi-cpufreq.c
    373 @@ -177,7 +177,7 @@ out_free_cpufreq_table:
    374 out_free_priv:
    375 kfree(priv);
    376 out_free_opp:
    377 - dev_pm_opp_cpumask_remove_table(policy->cpus);
    378 + dev_pm_opp_remove_all_dynamic(cpu_dev);
    379
    380 return ret;
    381 }
    382 @@ -190,7 +190,7 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy)
    383 clk_put(priv->clk);
    384 dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
    385 kfree(priv);
    386 - dev_pm_opp_cpumask_remove_table(policy->related_cpus);
    387 + dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
    388
    389 return 0;
    390 }
    391 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
    392 index 74b611e8a1b1..c79517dc8804 100644
    393 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
    394 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
    395 @@ -864,6 +864,7 @@ static const struct pci_device_id pciidlist[] = {
    396 /* VEGAM */
    397 {0x1002, 0x694C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
    398 {0x1002, 0x694E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
    399 + {0x1002, 0x694F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
    400 /* Vega 10 */
    401 {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
    402 {0x1002, 0x6861, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
    403 diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
    404 index 5a6edf65c9ea..3118ae0e7a87 100644
    405 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
    406 +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
    407 @@ -645,22 +645,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend)
    408 {
    409 struct amdgpu_dm_connector *aconnector;
    410 struct drm_connector *connector;
    411 + struct drm_dp_mst_topology_mgr *mgr;
    412 + int ret;
    413 + bool need_hotplug = false;
    414
    415 drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
    416
    417 - list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    418 - aconnector = to_amdgpu_dm_connector(connector);
    419 - if (aconnector->dc_link->type == dc_connection_mst_branch &&
    420 - !aconnector->mst_port) {
    421 + list_for_each_entry(connector, &dev->mode_config.connector_list,
    422 + head) {
    423 + aconnector = to_amdgpu_dm_connector(connector);
    424 + if (aconnector->dc_link->type != dc_connection_mst_branch ||
    425 + aconnector->mst_port)
    426 + continue;
    427
    428 - if (suspend)
    429 - drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr);
    430 - else
    431 - drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr);
    432 - }
    433 + mgr = &aconnector->mst_mgr;
    434 +
    435 + if (suspend) {
    436 + drm_dp_mst_topology_mgr_suspend(mgr);
    437 + } else {
    438 + ret = drm_dp_mst_topology_mgr_resume(mgr);
    439 + if (ret < 0) {
    440 + drm_dp_mst_topology_mgr_set_mst(mgr, false);
    441 + need_hotplug = true;
    442 + }
    443 + }
    444 }
    445
    446 drm_modeset_unlock(&dev->mode_config.connection_mutex);
    447 +
    448 + if (need_hotplug)
    449 + drm_kms_helper_hotplug_event(dev);
    450 }
    451
    452 static int dm_hw_init(void *handle)
    453 @@ -816,7 +830,6 @@ static int dm_resume(void *handle)
    454 struct drm_plane_state *new_plane_state;
    455 struct dm_plane_state *dm_new_plane_state;
    456 enum dc_connection_type new_connection_type = dc_connection_none;
    457 - int ret;
    458 int i;
    459
    460 /* power on hardware */
    461 @@ -889,13 +902,13 @@ static int dm_resume(void *handle)
    462 }
    463 }
    464
    465 - ret = drm_atomic_helper_resume(ddev, dm->cached_state);
    466 + drm_atomic_helper_resume(ddev, dm->cached_state);
    467
    468 dm->cached_state = NULL;
    469
    470 amdgpu_dm_irq_resume_late(adev);
    471
    472 - return ret;
    473 + return 0;
    474 }
    475
    476 static const struct amd_ip_funcs amdgpu_dm_funcs = {
    477 diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
    478 index 5da2186b3615..5141c1401889 100644
    479 --- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
    480 +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
    481 @@ -2617,11 +2617,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
    482 {
    483 struct dc *core_dc = pipe_ctx->stream->ctx->dc;
    484
    485 + core_dc->hwss.blank_stream(pipe_ctx);
    486 +
    487 if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
    488 deallocate_mst_payload(pipe_ctx);
    489
    490 - core_dc->hwss.blank_stream(pipe_ctx);
    491 -
    492 core_dc->hwss.disable_stream(pipe_ctx, option);
    493
    494 disable_link(pipe_ctx->stream->sink->link, pipe_ctx->stream->signal);
    495 diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
    496 index 9d64f874f965..b10ed61526a5 100644
    497 --- a/drivers/gpu/drm/drm_fb_helper.c
    498 +++ b/drivers/gpu/drm/drm_fb_helper.c
    499 @@ -1621,6 +1621,64 @@ static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1,
    500 var_1->transp.msb_right == var_2->transp.msb_right;
    501 }
    502
    503 +static void drm_fb_helper_fill_pixel_fmt(struct fb_var_screeninfo *var,
    504 + u8 depth)
    505 +{
    506 + switch (depth) {
    507 + case 8:
    508 + var->red.offset = 0;
    509 + var->green.offset = 0;
    510 + var->blue.offset = 0;
    511 + var->red.length = 8; /* 8bit DAC */
    512 + var->green.length = 8;
    513 + var->blue.length = 8;
    514 + var->transp.offset = 0;
    515 + var->transp.length = 0;
    516 + break;
    517 + case 15:
    518 + var->red.offset = 10;
    519 + var->green.offset = 5;
    520 + var->blue.offset = 0;
    521 + var->red.length = 5;
    522 + var->green.length = 5;
    523 + var->blue.length = 5;
    524 + var->transp.offset = 15;
    525 + var->transp.length = 1;
    526 + break;
    527 + case 16:
    528 + var->red.offset = 11;
    529 + var->green.offset = 5;
    530 + var->blue.offset = 0;
    531 + var->red.length = 5;
    532 + var->green.length = 6;
    533 + var->blue.length = 5;
    534 + var->transp.offset = 0;
    535 + break;
    536 + case 24:
    537 + var->red.offset = 16;
    538 + var->green.offset = 8;
    539 + var->blue.offset = 0;
    540 + var->red.length = 8;
    541 + var->green.length = 8;
    542 + var->blue.length = 8;
    543 + var->transp.offset = 0;
    544 + var->transp.length = 0;
    545 + break;
    546 + case 32:
    547 + var->red.offset = 16;
    548 + var->green.offset = 8;
    549 + var->blue.offset = 0;
    550 + var->red.length = 8;
    551 + var->green.length = 8;
    552 + var->blue.length = 8;
    553 + var->transp.offset = 24;
    554 + var->transp.length = 8;
    555 + break;
    556 + default:
    557 + break;
    558 + }
    559 +}
    560 +
    561 /**
    562 * drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var
    563 * @var: screeninfo to check
    564 @@ -1650,6 +1708,20 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
    565 return -EINVAL;
    566 }
    567
    568 + /*
    569 + * Workaround for SDL 1.2, which is known to be setting all pixel format
    570 + * fields values to zero in some cases. We treat this situation as a
    571 + * kind of "use some reasonable autodetected values".
    572 + */
    573 + if (!var->red.offset && !var->green.offset &&
    574 + !var->blue.offset && !var->transp.offset &&
    575 + !var->red.length && !var->green.length &&
    576 + !var->blue.length && !var->transp.length &&
    577 + !var->red.msb_right && !var->green.msb_right &&
    578 + !var->blue.msb_right && !var->transp.msb_right) {
    579 + drm_fb_helper_fill_pixel_fmt(var, fb->format->depth);
    580 + }
    581 +
    582 /*
    583 * drm fbdev emulation doesn't support changing the pixel format at all,
    584 * so reject all pixel format changing requests.
    585 @@ -1961,59 +2033,7 @@ void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helpe
    586 info->var.yoffset = 0;
    587 info->var.activate = FB_ACTIVATE_NOW;
    588
    589 - switch (fb->format->depth) {
    590 - case 8:
    591 - info->var.red.offset = 0;
    592 - info->var.green.offset = 0;
    593 - info->var.blue.offset = 0;
    594 - info->var.red.length = 8; /* 8bit DAC */
    595 - info->var.green.length = 8;
    596 - info->var.blue.length = 8;
    597 - info->var.transp.offset = 0;
    598 - info->var.transp.length = 0;
    599 - break;
    600 - case 15:
    601 - info->var.red.offset = 10;
    602 - info->var.green.offset = 5;
    603 - info->var.blue.offset = 0;
    604 - info->var.red.length = 5;
    605 - info->var.green.length = 5;
    606 - info->var.blue.length = 5;
    607 - info->var.transp.offset = 15;
    608 - info->var.transp.length = 1;
    609 - break;
    610 - case 16:
    611 - info->var.red.offset = 11;
    612 - info->var.green.offset = 5;
    613 - info->var.blue.offset = 0;
    614 - info->var.red.length = 5;
    615 - info->var.green.length = 6;
    616 - info->var.blue.length = 5;
    617 - info->var.transp.offset = 0;
    618 - break;
    619 - case 24:
    620 - info->var.red.offset = 16;
    621 - info->var.green.offset = 8;
    622 - info->var.blue.offset = 0;
    623 - info->var.red.length = 8;
    624 - info->var.green.length = 8;
    625 - info->var.blue.length = 8;
    626 - info->var.transp.offset = 0;
    627 - info->var.transp.length = 0;
    628 - break;
    629 - case 32:
    630 - info->var.red.offset = 16;
    631 - info->var.green.offset = 8;
    632 - info->var.blue.offset = 0;
    633 - info->var.red.length = 8;
    634 - info->var.green.length = 8;
    635 - info->var.blue.length = 8;
    636 - info->var.transp.offset = 24;
    637 - info->var.transp.length = 8;
    638 - break;
    639 - default:
    640 - break;
    641 - }
    642 + drm_fb_helper_fill_pixel_fmt(&info->var, fb->format->depth);
    643
    644 info->var.xres = fb_width;
    645 info->var.yres = fb_height;
    646 diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
    647 index 07999fe09ad2..4fa1d2b146b1 100644
    648 --- a/drivers/gpu/drm/i915/i915_gem_gtt.c
    649 +++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
    650 @@ -2117,6 +2117,7 @@ static struct i915_vma *pd_vma_create(struct gen6_hw_ppgtt *ppgtt, int size)
    651 int gen6_ppgtt_pin(struct i915_hw_ppgtt *base)
    652 {
    653 struct gen6_hw_ppgtt *ppgtt = to_gen6_ppgtt(base);
    654 + int err;
    655
    656 /*
    657 * Workaround the limited maximum vma->pin_count and the aliasing_ppgtt
    658 @@ -2132,9 +2133,17 @@ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base)
    659 * allocator works in address space sizes, so it's multiplied by page
    660 * size. We allocate at the top of the GTT to avoid fragmentation.
    661 */
    662 - return i915_vma_pin(ppgtt->vma,
    663 - 0, GEN6_PD_ALIGN,
    664 - PIN_GLOBAL | PIN_HIGH);
    665 + err = i915_vma_pin(ppgtt->vma,
    666 + 0, GEN6_PD_ALIGN,
    667 + PIN_GLOBAL | PIN_HIGH);
    668 + if (err)
    669 + goto unpin;
    670 +
    671 + return 0;
    672 +
    673 +unpin:
    674 + ppgtt->pin_count = 0;
    675 + return err;
    676 }
    677
    678 void gen6_ppgtt_unpin(struct i915_hw_ppgtt *base)
    679 diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
    680 index 1aca742fde4a..ccd76c71af09 100644
    681 --- a/drivers/i2c/i2c-dev.c
    682 +++ b/drivers/i2c/i2c-dev.c
    683 @@ -470,9 +470,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
    684 data_arg.data);
    685 }
    686 case I2C_RETRIES:
    687 + if (arg > INT_MAX)
    688 + return -EINVAL;
    689 +
    690 client->adapter->retries = arg;
    691 break;
    692 case I2C_TIMEOUT:
    693 + if (arg > INT_MAX)
    694 + return -EINVAL;
    695 +
    696 /* For historical reasons, user-space sets the timeout
    697 * value in units of 10 ms.
    698 */
    699 diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
    700 index 699d3cf49c6d..7c42a57aca1f 100644
    701 --- a/drivers/mtd/nand/raw/qcom_nandc.c
    702 +++ b/drivers/mtd/nand/raw/qcom_nandc.c
    703 @@ -2833,6 +2833,16 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc,
    704 if (ret)
    705 return ret;
    706
    707 + if (nandc->props->is_bam) {
    708 + free_bam_transaction(nandc);
    709 + nandc->bam_txn = alloc_bam_transaction(nandc);
    710 + if (!nandc->bam_txn) {
    711 + dev_err(nandc->dev,
    712 + "failed to allocate bam transaction\n");
    713 + return -ENOMEM;
    714 + }
    715 + }
    716 +
    717 ret = mtd_device_register(mtd, NULL, 0);
    718 if (ret)
    719 nand_cleanup(chip);
    720 @@ -2847,16 +2857,6 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
    721 struct qcom_nand_host *host;
    722 int ret;
    723
    724 - if (nandc->props->is_bam) {
    725 - free_bam_transaction(nandc);
    726 - nandc->bam_txn = alloc_bam_transaction(nandc);
    727 - if (!nandc->bam_txn) {
    728 - dev_err(nandc->dev,
    729 - "failed to allocate bam transaction\n");
    730 - return -ENOMEM;
    731 - }
    732 - }
    733 -
    734 for_each_available_child_of_node(dn, child) {
    735 host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
    736 if (!host) {
    737 diff --git a/drivers/opp/core.c b/drivers/opp/core.c
    738 index 2c2df4e4fc14..9280f51f1ce6 100644
    739 --- a/drivers/opp/core.c
    740 +++ b/drivers/opp/core.c
    741 @@ -951,11 +951,9 @@ void _opp_free(struct dev_pm_opp *opp)
    742 kfree(opp);
    743 }
    744
    745 -static void _opp_kref_release(struct kref *kref)
    746 +static void _opp_kref_release(struct dev_pm_opp *opp,
    747 + struct opp_table *opp_table)
    748 {
    749 - struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref);
    750 - struct opp_table *opp_table = opp->opp_table;
    751 -
    752 /*
    753 * Notify the changes in the availability of the operable
    754 * frequency/voltage list.
    755 @@ -964,7 +962,22 @@ static void _opp_kref_release(struct kref *kref)
    756 opp_debug_remove_one(opp);
    757 list_del(&opp->node);
    758 kfree(opp);
    759 +}
    760
    761 +static void _opp_kref_release_unlocked(struct kref *kref)
    762 +{
    763 + struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref);
    764 + struct opp_table *opp_table = opp->opp_table;
    765 +
    766 + _opp_kref_release(opp, opp_table);
    767 +}
    768 +
    769 +static void _opp_kref_release_locked(struct kref *kref)
    770 +{
    771 + struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref);
    772 + struct opp_table *opp_table = opp->opp_table;
    773 +
    774 + _opp_kref_release(opp, opp_table);
    775 mutex_unlock(&opp_table->lock);
    776 }
    777
    778 @@ -975,10 +988,16 @@ void dev_pm_opp_get(struct dev_pm_opp *opp)
    779
    780 void dev_pm_opp_put(struct dev_pm_opp *opp)
    781 {
    782 - kref_put_mutex(&opp->kref, _opp_kref_release, &opp->opp_table->lock);
    783 + kref_put_mutex(&opp->kref, _opp_kref_release_locked,
    784 + &opp->opp_table->lock);
    785 }
    786 EXPORT_SYMBOL_GPL(dev_pm_opp_put);
    787
    788 +static void dev_pm_opp_put_unlocked(struct dev_pm_opp *opp)
    789 +{
    790 + kref_put(&opp->kref, _opp_kref_release_unlocked);
    791 +}
    792 +
    793 /**
    794 * dev_pm_opp_remove() - Remove an OPP from OPP table
    795 * @dev: device for which we do this operation
    796 @@ -1022,6 +1041,40 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq)
    797 }
    798 EXPORT_SYMBOL_GPL(dev_pm_opp_remove);
    799
    800 +/**
    801 + * dev_pm_opp_remove_all_dynamic() - Remove all dynamically created OPPs
    802 + * @dev: device for which we do this operation
    803 + *
    804 + * This function removes all dynamically created OPPs from the opp table.
    805 + */
    806 +void dev_pm_opp_remove_all_dynamic(struct device *dev)
    807 +{
    808 + struct opp_table *opp_table;
    809 + struct dev_pm_opp *opp, *temp;
    810 + int count = 0;
    811 +
    812 + opp_table = _find_opp_table(dev);
    813 + if (IS_ERR(opp_table))
    814 + return;
    815 +
    816 + mutex_lock(&opp_table->lock);
    817 + list_for_each_entry_safe(opp, temp, &opp_table->opp_list, node) {
    818 + if (opp->dynamic) {
    819 + dev_pm_opp_put_unlocked(opp);
    820 + count++;
    821 + }
    822 + }
    823 + mutex_unlock(&opp_table->lock);
    824 +
    825 + /* Drop the references taken by dev_pm_opp_add() */
    826 + while (count--)
    827 + dev_pm_opp_put_opp_table(opp_table);
    828 +
    829 + /* Drop the reference taken by _find_opp_table() */
    830 + dev_pm_opp_put_opp_table(opp_table);
    831 +}
    832 +EXPORT_SYMBOL_GPL(dev_pm_opp_remove_all_dynamic);
    833 +
    834 struct dev_pm_opp *_opp_allocate(struct opp_table *table)
    835 {
    836 struct dev_pm_opp *opp;
    837 diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
    838 index 29a05759a294..0fa9e8fdce66 100644
    839 --- a/drivers/pci/controller/dwc/pcie-designware-host.c
    840 +++ b/drivers/pci/controller/dwc/pcie-designware-host.c
    841 @@ -99,9 +99,6 @@ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp)
    842 (i * MAX_MSI_IRQS_PER_CTRL) +
    843 pos);
    844 generic_handle_irq(irq);
    845 - dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS +
    846 - (i * MSI_REG_CTRL_BLOCK_SIZE),
    847 - 4, 1 << pos);
    848 pos++;
    849 }
    850 }
    851 @@ -168,8 +165,8 @@ static void dw_pci_bottom_mask(struct irq_data *data)
    852 bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL;
    853
    854 pp->irq_status[ctrl] &= ~(1 << bit);
    855 - dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4,
    856 - pp->irq_status[ctrl]);
    857 + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4,
    858 + ~pp->irq_status[ctrl]);
    859 }
    860
    861 raw_spin_unlock_irqrestore(&pp->lock, flags);
    862 @@ -191,8 +188,8 @@ static void dw_pci_bottom_unmask(struct irq_data *data)
    863 bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL;
    864
    865 pp->irq_status[ctrl] |= 1 << bit;
    866 - dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4,
    867 - pp->irq_status[ctrl]);
    868 + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4,
    869 + ~pp->irq_status[ctrl]);
    870 }
    871
    872 raw_spin_unlock_irqrestore(&pp->lock, flags);
    873 @@ -200,13 +197,22 @@ static void dw_pci_bottom_unmask(struct irq_data *data)
    874
    875 static void dw_pci_bottom_ack(struct irq_data *d)
    876 {
    877 - struct msi_desc *msi = irq_data_get_msi_desc(d);
    878 - struct pcie_port *pp;
    879 + struct pcie_port *pp = irq_data_get_irq_chip_data(d);
    880 + unsigned int res, bit, ctrl;
    881 + unsigned long flags;
    882 +
    883 + ctrl = d->hwirq / MAX_MSI_IRQS_PER_CTRL;
    884 + res = ctrl * MSI_REG_CTRL_BLOCK_SIZE;
    885 + bit = d->hwirq % MAX_MSI_IRQS_PER_CTRL;
    886 +
    887 + raw_spin_lock_irqsave(&pp->lock, flags);
    888
    889 - pp = msi_desc_to_pci_sysdata(msi);
    890 + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + res, 4, 1 << bit);
    891
    892 if (pp->ops->msi_irq_ack)
    893 pp->ops->msi_irq_ack(d->hwirq, pp);
    894 +
    895 + raw_spin_unlock_irqrestore(&pp->lock, flags);
    896 }
    897
    898 static struct irq_chip dw_pci_msi_bottom_irq_chip = {
    899 @@ -658,10 +664,15 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
    900 num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL;
    901
    902 /* Initialize IRQ Status array */
    903 - for (ctrl = 0; ctrl < num_ctrls; ctrl++)
    904 - dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_ENABLE +
    905 + for (ctrl = 0; ctrl < num_ctrls; ctrl++) {
    906 + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK +
    907 (ctrl * MSI_REG_CTRL_BLOCK_SIZE),
    908 - 4, &pp->irq_status[ctrl]);
    909 + 4, ~0);
    910 + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE +
    911 + (ctrl * MSI_REG_CTRL_BLOCK_SIZE),
    912 + 4, ~0);
    913 + pp->irq_status[ctrl] = 0;
    914 + }
    915
    916 /* Setup RC BARs */
    917 dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 0x00000004);
    918 diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
    919 index f7407632e80b..bab96c870042 100644
    920 --- a/drivers/staging/rtl8188eu/core/rtw_security.c
    921 +++ b/drivers/staging/rtl8188eu/core/rtw_security.c
    922 @@ -154,7 +154,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe)
    923
    924 pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + hw_hdr_offset;
    925
    926 - crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
    927 + crypto_ops = lib80211_get_crypto_ops("WEP");
    928
    929 if (!crypto_ops)
    930 return;
    931 @@ -210,7 +210,7 @@ int rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe)
    932 void *crypto_private = NULL;
    933 int status = _SUCCESS;
    934 const int keyindex = prxattrib->key_index;
    935 - struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
    936 + struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("WEP");
    937 char iv[4], icv[4];
    938
    939 if (!crypto_ops) {
    940 @@ -1291,7 +1291,7 @@ u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe)
    941 struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
    942 void *crypto_private = NULL;
    943 u8 *key, *pframe = skb->data;
    944 - struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("CCMP"), "lib80211_crypt_ccmp");
    945 + struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("CCMP");
    946 struct security_priv *psecuritypriv = &padapter->securitypriv;
    947 char iv[8], icv[8];
    948
    949 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    950 index ed8c62b2d9d1..739f8960811a 100644
    951 --- a/drivers/usb/class/cdc-acm.c
    952 +++ b/drivers/usb/class/cdc-acm.c
    953 @@ -1865,6 +1865,13 @@ static const struct usb_device_id acm_ids[] = {
    954 .driver_info = IGNORE_DEVICE,
    955 },
    956
    957 + { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
    958 + .driver_info = SEND_ZERO_PACKET,
    959 + },
    960 + { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */
    961 + .driver_info = SEND_ZERO_PACKET,
    962 + },
    963 +
    964 /* control interfaces without any protocol set */
    965 { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
    966 USB_CDC_PROTO_NONE) },
    967 diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
    968 index 356b05c82dbc..f713cecc1f41 100644
    969 --- a/drivers/usb/core/generic.c
    970 +++ b/drivers/usb/core/generic.c
    971 @@ -143,9 +143,12 @@ int usb_choose_configuration(struct usb_device *udev)
    972 continue;
    973 }
    974
    975 - if (i > 0 && desc && is_audio(desc) && is_uac3_config(desc)) {
    976 - best = c;
    977 - break;
    978 + if (i > 0 && desc && is_audio(desc)) {
    979 + if (is_uac3_config(desc)) {
    980 + best = c;
    981 + break;
    982 + }
    983 + continue;
    984 }
    985
    986 /* From the remaining configs, choose the first one whose
    987 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    988 index 514c5214ddb2..8bc35d53408b 100644
    989 --- a/drivers/usb/core/quirks.c
    990 +++ b/drivers/usb/core/quirks.c
    991 @@ -394,7 +394,8 @@ static const struct usb_device_id usb_quirk_list[] = {
    992 { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
    993
    994 /* Corsair K70 RGB */
    995 - { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
    996 + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT |
    997 + USB_QUIRK_DELAY_CTRL_MSG },
    998
    999 /* Corsair Strafe */
    1000 { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
    1001 diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
    1002 index e227bb5b794f..101ebac43c87 100644
    1003 --- a/drivers/usb/storage/scsiglue.c
    1004 +++ b/drivers/usb/storage/scsiglue.c
    1005 @@ -235,8 +235,12 @@ static int slave_configure(struct scsi_device *sdev)
    1006 if (!(us->fflags & US_FL_NEEDS_CAP16))
    1007 sdev->try_rc_10_first = 1;
    1008
    1009 - /* assume SPC3 or latter devices support sense size > 18 */
    1010 - if (sdev->scsi_level > SCSI_SPC_2)
    1011 + /*
    1012 + * assume SPC3 or latter devices support sense size > 18
    1013 + * unless US_FL_BAD_SENSE quirk is specified.
    1014 + */
    1015 + if (sdev->scsi_level > SCSI_SPC_2 &&
    1016 + !(us->fflags & US_FL_BAD_SENSE))
    1017 us->fflags |= US_FL_SANE_SENSE;
    1018
    1019 /*
    1020 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    1021 index f7f83b21dc74..ea0d27a94afe 100644
    1022 --- a/drivers/usb/storage/unusual_devs.h
    1023 +++ b/drivers/usb/storage/unusual_devs.h
    1024 @@ -1265,6 +1265,18 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
    1025 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    1026 US_FL_FIX_CAPACITY ),
    1027
    1028 +/*
    1029 + * Reported by Icenowy Zheng <icenowy@aosc.io>
    1030 + * The SMI SM3350 USB-UFS bridge controller will enter a wrong state
    1031 + * that do not process read/write command if a long sense is requested,
    1032 + * so force to use 18-byte sense.
    1033 + */
    1034 +UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff,
    1035 + "SMI",
    1036 + "SM3350 UFS-to-USB-Mass-Storage bridge",
    1037 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    1038 + US_FL_BAD_SENSE ),
    1039 +
    1040 /*
    1041 * Reported by Paul Hartman <paul.hartman+linux@gmail.com>
    1042 * This card reader returns "Illegal Request, Logical Block Address
    1043 diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
    1044 index d9fd3188615d..64cbc2d007c9 100644
    1045 --- a/drivers/vfio/vfio_iommu_type1.c
    1046 +++ b/drivers/vfio/vfio_iommu_type1.c
    1047 @@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu,
    1048 return -EINVAL;
    1049 if (!unmap->size || unmap->size & mask)
    1050 return -EINVAL;
    1051 - if (unmap->iova + unmap->size < unmap->iova ||
    1052 + if (unmap->iova + unmap->size - 1 < unmap->iova ||
    1053 unmap->size > SIZE_MAX)
    1054 return -EINVAL;
    1055
    1056 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
    1057 index 99e7645ad94e..47f1183b3dbe 100644
    1058 --- a/fs/btrfs/ctree.c
    1059 +++ b/fs/btrfs/ctree.c
    1060 @@ -1015,19 +1015,21 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
    1061 parent_start = parent->start;
    1062
    1063 /*
    1064 - * If we are COWing a node/leaf from the extent, chunk or device trees,
    1065 - * make sure that we do not finish block group creation of pending block
    1066 - * groups. We do this to avoid a deadlock.
    1067 + * If we are COWing a node/leaf from the extent, chunk, device or free
    1068 + * space trees, make sure that we do not finish block group creation of
    1069 + * pending block groups. We do this to avoid a deadlock.
    1070 * COWing can result in allocation of a new chunk, and flushing pending
    1071 * block groups (btrfs_create_pending_block_groups()) can be triggered
    1072 * when finishing allocation of a new chunk. Creation of a pending block
    1073 - * group modifies the extent, chunk and device trees, therefore we could
    1074 - * deadlock with ourselves since we are holding a lock on an extent
    1075 - * buffer that btrfs_create_pending_block_groups() may try to COW later.
    1076 + * group modifies the extent, chunk, device and free space trees,
    1077 + * therefore we could deadlock with ourselves since we are holding a
    1078 + * lock on an extent buffer that btrfs_create_pending_block_groups() may
    1079 + * try to COW later.
    1080 */
    1081 if (root == fs_info->extent_root ||
    1082 root == fs_info->chunk_root ||
    1083 - root == fs_info->dev_root)
    1084 + root == fs_info->dev_root ||
    1085 + root == fs_info->free_space_root)
    1086 trans->can_flush_pending_bgs = false;
    1087
    1088 cow = btrfs_alloc_tree_block(trans, root, parent_start,
    1089 diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
    1090 index f70825af6438..9e419f6878c5 100644
    1091 --- a/fs/btrfs/qgroup.c
    1092 +++ b/fs/btrfs/qgroup.c
    1093 @@ -1013,16 +1013,22 @@ out_add_root:
    1094 btrfs_abort_transaction(trans, ret);
    1095 goto out_free_path;
    1096 }
    1097 - spin_lock(&fs_info->qgroup_lock);
    1098 - fs_info->quota_root = quota_root;
    1099 - set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
    1100 - spin_unlock(&fs_info->qgroup_lock);
    1101
    1102 ret = btrfs_commit_transaction(trans);
    1103 trans = NULL;
    1104 if (ret)
    1105 goto out_free_path;
    1106
    1107 + /*
    1108 + * Set quota enabled flag after committing the transaction, to avoid
    1109 + * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot
    1110 + * creation.
    1111 + */
    1112 + spin_lock(&fs_info->qgroup_lock);
    1113 + fs_info->quota_root = quota_root;
    1114 + set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
    1115 + spin_unlock(&fs_info->qgroup_lock);
    1116 +
    1117 ret = qgroup_rescan_init(fs_info, 0, 1);
    1118 if (!ret) {
    1119 qgroup_rescan_zero_tracking(fs_info);
    1120 diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
    1121 index f435d397019e..c872adfc939e 100644
    1122 --- a/fs/btrfs/volumes.c
    1123 +++ b/fs/btrfs/volumes.c
    1124 @@ -3724,6 +3724,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
    1125 int ret;
    1126 u64 num_devices;
    1127 unsigned seq;
    1128 + bool reducing_integrity;
    1129
    1130 if (btrfs_fs_closing(fs_info) ||
    1131 atomic_read(&fs_info->balance_pause_req) ||
    1132 @@ -3803,24 +3804,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
    1133 !(bctl->sys.target & allowed)) ||
    1134 ((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
    1135 (fs_info->avail_metadata_alloc_bits & allowed) &&
    1136 - !(bctl->meta.target & allowed))) {
    1137 - if (bctl->flags & BTRFS_BALANCE_FORCE) {
    1138 - btrfs_info(fs_info,
    1139 - "balance: force reducing metadata integrity");
    1140 - } else {
    1141 - btrfs_err(fs_info,
    1142 - "balance: reduces metadata integrity, use --force if you want this");
    1143 - ret = -EINVAL;
    1144 - goto out;
    1145 - }
    1146 - }
    1147 + !(bctl->meta.target & allowed)))
    1148 + reducing_integrity = true;
    1149 + else
    1150 + reducing_integrity = false;
    1151 +
    1152 + /* if we're not converting, the target field is uninitialized */
    1153 + meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
    1154 + bctl->meta.target : fs_info->avail_metadata_alloc_bits;
    1155 + data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
    1156 + bctl->data.target : fs_info->avail_data_alloc_bits;
    1157 } while (read_seqretry(&fs_info->profiles_lock, seq));
    1158
    1159 - /* if we're not converting, the target field is uninitialized */
    1160 - meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
    1161 - bctl->meta.target : fs_info->avail_metadata_alloc_bits;
    1162 - data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
    1163 - bctl->data.target : fs_info->avail_data_alloc_bits;
    1164 + if (reducing_integrity) {
    1165 + if (bctl->flags & BTRFS_BALANCE_FORCE) {
    1166 + btrfs_info(fs_info,
    1167 + "balance: force reducing metadata integrity");
    1168 + } else {
    1169 + btrfs_err(fs_info,
    1170 + "balance: reduces metadata integrity, use --force if you want this");
    1171 + ret = -EINVAL;
    1172 + goto out;
    1173 + }
    1174 + }
    1175 +
    1176 if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) <
    1177 btrfs_get_num_tolerated_disk_barrier_failures(data_target)) {
    1178 int meta_index = btrfs_bg_flags_to_raid_index(meta_target);
    1179 diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
    1180 index ea78c3d6dcfc..f141b45ce349 100644
    1181 --- a/fs/btrfs/xattr.c
    1182 +++ b/fs/btrfs/xattr.c
    1183 @@ -11,6 +11,7 @@
    1184 #include <linux/security.h>
    1185 #include <linux/posix_acl_xattr.h>
    1186 #include <linux/iversion.h>
    1187 +#include <linux/sched/mm.h>
    1188 #include "ctree.h"
    1189 #include "btrfs_inode.h"
    1190 #include "transaction.h"
    1191 @@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode,
    1192 {
    1193 const struct xattr *xattr;
    1194 struct btrfs_trans_handle *trans = fs_info;
    1195 + unsigned int nofs_flag;
    1196 char *name;
    1197 int err = 0;
    1198
    1199 + /*
    1200 + * We're holding a transaction handle, so use a NOFS memory allocation
    1201 + * context to avoid deadlock if reclaim happens.
    1202 + */
    1203 + nofs_flag = memalloc_nofs_save();
    1204 for (xattr = xattr_array; xattr->name != NULL; xattr++) {
    1205 name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
    1206 strlen(xattr->name) + 1, GFP_KERNEL);
    1207 @@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode,
    1208 if (err < 0)
    1209 break;
    1210 }
    1211 + memalloc_nofs_restore(nofs_flag);
    1212 return err;
    1213 }
    1214
    1215 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    1216 index c23bf9da93d2..d5c3e0725849 100644
    1217 --- a/fs/cifs/file.c
    1218 +++ b/fs/cifs/file.c
    1219 @@ -1131,10 +1131,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
    1220
    1221 /*
    1222 * Accessing maxBuf is racy with cifs_reconnect - need to store value
    1223 - * and check it for zero before using.
    1224 + * and check it before using.
    1225 */
    1226 max_buf = tcon->ses->server->maxBuf;
    1227 - if (!max_buf) {
    1228 + if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) {
    1229 free_xid(xid);
    1230 return -EINVAL;
    1231 }
    1232 @@ -1471,10 +1471,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
    1233
    1234 /*
    1235 * Accessing maxBuf is racy with cifs_reconnect - need to store value
    1236 - * and check it for zero before using.
    1237 + * and check it before using.
    1238 */
    1239 max_buf = tcon->ses->server->maxBuf;
    1240 - if (!max_buf)
    1241 + if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
    1242 return -EINVAL;
    1243
    1244 max_num = (max_buf - sizeof(struct smb_hdr)) /
    1245 diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
    1246 index 8a41f4eba726..6f33253938cd 100644
    1247 --- a/fs/cifs/misc.c
    1248 +++ b/fs/cifs/misc.c
    1249 @@ -111,21 +111,27 @@ struct cifs_tcon *
    1250 tconInfoAlloc(void)
    1251 {
    1252 struct cifs_tcon *ret_buf;
    1253 - ret_buf = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL);
    1254 - if (ret_buf) {
    1255 - atomic_inc(&tconInfoAllocCount);
    1256 - ret_buf->tidStatus = CifsNew;
    1257 - ++ret_buf->tc_count;
    1258 - INIT_LIST_HEAD(&ret_buf->openFileList);
    1259 - INIT_LIST_HEAD(&ret_buf->tcon_list);
    1260 - spin_lock_init(&ret_buf->open_file_lock);
    1261 - mutex_init(&ret_buf->crfid.fid_mutex);
    1262 - ret_buf->crfid.fid = kzalloc(sizeof(struct cifs_fid),
    1263 - GFP_KERNEL);
    1264 - spin_lock_init(&ret_buf->stat_lock);
    1265 - atomic_set(&ret_buf->num_local_opens, 0);
    1266 - atomic_set(&ret_buf->num_remote_opens, 0);
    1267 +
    1268 + ret_buf = kzalloc(sizeof(*ret_buf), GFP_KERNEL);
    1269 + if (!ret_buf)
    1270 + return NULL;
    1271 + ret_buf->crfid.fid = kzalloc(sizeof(*ret_buf->crfid.fid), GFP_KERNEL);
    1272 + if (!ret_buf->crfid.fid) {
    1273 + kfree(ret_buf);
    1274 + return NULL;
    1275 }
    1276 +
    1277 + atomic_inc(&tconInfoAllocCount);
    1278 + ret_buf->tidStatus = CifsNew;
    1279 + ++ret_buf->tc_count;
    1280 + INIT_LIST_HEAD(&ret_buf->openFileList);
    1281 + INIT_LIST_HEAD(&ret_buf->tcon_list);
    1282 + spin_lock_init(&ret_buf->open_file_lock);
    1283 + mutex_init(&ret_buf->crfid.fid_mutex);
    1284 + spin_lock_init(&ret_buf->stat_lock);
    1285 + atomic_set(&ret_buf->num_local_opens, 0);
    1286 + atomic_set(&ret_buf->num_remote_opens, 0);
    1287 +
    1288 return ret_buf;
    1289 }
    1290
    1291 diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
    1292 index 4ed10dd086e6..2fc3d31967ee 100644
    1293 --- a/fs/cifs/smb2file.c
    1294 +++ b/fs/cifs/smb2file.c
    1295 @@ -122,10 +122,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
    1296
    1297 /*
    1298 * Accessing maxBuf is racy with cifs_reconnect - need to store value
    1299 - * and check it for zero before using.
    1300 + * and check it before using.
    1301 */
    1302 max_buf = tcon->ses->server->maxBuf;
    1303 - if (!max_buf)
    1304 + if (max_buf < sizeof(struct smb2_lock_element))
    1305 return -EINVAL;
    1306
    1307 max_num = max_buf / sizeof(struct smb2_lock_element);
    1308 diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
    1309 index 27f86537a5d1..836c59fca049 100644
    1310 --- a/fs/cifs/smb2pdu.c
    1311 +++ b/fs/cifs/smb2pdu.c
    1312 @@ -3197,12 +3197,14 @@ smb2_async_readv(struct cifs_readdata *rdata)
    1313 if (rdata->credits) {
    1314 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
    1315 SMB2_MAX_BUFFER_SIZE));
    1316 - shdr->CreditRequest = shdr->CreditCharge;
    1317 + shdr->CreditRequest =
    1318 + cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
    1319 spin_lock(&server->req_lock);
    1320 server->credits += rdata->credits -
    1321 le16_to_cpu(shdr->CreditCharge);
    1322 spin_unlock(&server->req_lock);
    1323 wake_up(&server->request_q);
    1324 + rdata->credits = le16_to_cpu(shdr->CreditCharge);
    1325 flags |= CIFS_HAS_CREDITS;
    1326 }
    1327
    1328 @@ -3474,12 +3476,14 @@ smb2_async_writev(struct cifs_writedata *wdata,
    1329 if (wdata->credits) {
    1330 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
    1331 SMB2_MAX_BUFFER_SIZE));
    1332 - shdr->CreditRequest = shdr->CreditCharge;
    1333 + shdr->CreditRequest =
    1334 + cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
    1335 spin_lock(&server->req_lock);
    1336 server->credits += wdata->credits -
    1337 le16_to_cpu(shdr->CreditCharge);
    1338 spin_unlock(&server->req_lock);
    1339 wake_up(&server->request_q);
    1340 + wdata->credits = le16_to_cpu(shdr->CreditCharge);
    1341 flags |= CIFS_HAS_CREDITS;
    1342 }
    1343
    1344 diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
    1345 index 83ff0c25710d..d51064c1ba42 100644
    1346 --- a/fs/cifs/transport.c
    1347 +++ b/fs/cifs/transport.c
    1348 @@ -385,7 +385,7 @@ smbd_done:
    1349 if (rc < 0 && rc != -EINTR)
    1350 cifs_dbg(VFS, "Error %d sending data on socket to server\n",
    1351 rc);
    1352 - else
    1353 + else if (rc > 0)
    1354 rc = 0;
    1355
    1356 return rc;
    1357 @@ -793,7 +793,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
    1358 int i, j, rc = 0;
    1359 int timeout, optype;
    1360 struct mid_q_entry *midQ[MAX_COMPOUND];
    1361 - unsigned int credits = 0;
    1362 + bool cancelled_mid[MAX_COMPOUND] = {false};
    1363 + unsigned int credits[MAX_COMPOUND] = {0};
    1364 char *buf;
    1365
    1366 timeout = flags & CIFS_TIMEOUT_MASK;
    1367 @@ -811,13 +812,31 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
    1368 return -ENOENT;
    1369
    1370 /*
    1371 - * Ensure that we do not send more than 50 overlapping requests
    1372 - * to the same server. We may make this configurable later or
    1373 - * use ses->maxReq.
    1374 + * Ensure we obtain 1 credit per request in the compound chain.
    1375 + * It can be optimized further by waiting for all the credits
    1376 + * at once but this can wait long enough if we don't have enough
    1377 + * credits due to some heavy operations in progress or the server
    1378 + * not granting us much, so a fallback to the current approach is
    1379 + * needed anyway.
    1380 */
    1381 - rc = wait_for_free_request(ses->server, timeout, optype);
    1382 - if (rc)
    1383 - return rc;
    1384 + for (i = 0; i < num_rqst; i++) {
    1385 + rc = wait_for_free_request(ses->server, timeout, optype);
    1386 + if (rc) {
    1387 + /*
    1388 + * We haven't sent an SMB packet to the server yet but
    1389 + * we already obtained credits for i requests in the
    1390 + * compound chain - need to return those credits back
    1391 + * for future use. Note that we need to call add_credits
    1392 + * multiple times to match the way we obtained credits
    1393 + * in the first place and to account for in flight
    1394 + * requests correctly.
    1395 + */
    1396 + for (j = 0; j < i; j++)
    1397 + add_credits(ses->server, 1, optype);
    1398 + return rc;
    1399 + }
    1400 + credits[i] = 1;
    1401 + }
    1402
    1403 /*
    1404 * Make sure that we sign in the same order that we send on this socket
    1405 @@ -833,8 +852,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
    1406 for (j = 0; j < i; j++)
    1407 cifs_delete_mid(midQ[j]);
    1408 mutex_unlock(&ses->server->srv_mutex);
    1409 +
    1410 /* Update # of requests on wire to server */
    1411 - add_credits(ses->server, 1, optype);
    1412 + for (j = 0; j < num_rqst; j++)
    1413 + add_credits(ses->server, credits[j], optype);
    1414 return PTR_ERR(midQ[i]);
    1415 }
    1416
    1417 @@ -881,19 +902,16 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
    1418 if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
    1419 midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
    1420 midQ[i]->callback = DeleteMidQEntry;
    1421 - spin_unlock(&GlobalMid_Lock);
    1422 - add_credits(ses->server, 1, optype);
    1423 - return rc;
    1424 + cancelled_mid[i] = true;
    1425 }
    1426 spin_unlock(&GlobalMid_Lock);
    1427 }
    1428 }
    1429
    1430 for (i = 0; i < num_rqst; i++)
    1431 - if (midQ[i]->resp_buf)
    1432 - credits += ses->server->ops->get_credits(midQ[i]);
    1433 - if (!credits)
    1434 - credits = 1;
    1435 + if (!cancelled_mid[i] && midQ[i]->resp_buf
    1436 + && (midQ[i]->mid_state == MID_RESPONSE_RECEIVED))
    1437 + credits[i] = ses->server->ops->get_credits(midQ[i]);
    1438
    1439 for (i = 0; i < num_rqst; i++) {
    1440 if (rc < 0)
    1441 @@ -901,8 +919,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
    1442
    1443 rc = cifs_sync_mid_result(midQ[i], ses->server);
    1444 if (rc != 0) {
    1445 - add_credits(ses->server, credits, optype);
    1446 - return rc;
    1447 + /* mark this mid as cancelled to not free it below */
    1448 + cancelled_mid[i] = true;
    1449 + goto out;
    1450 }
    1451
    1452 if (!midQ[i]->resp_buf ||
    1453 @@ -949,9 +968,11 @@ out:
    1454 * This is prevented above by using a noop callback that will not
    1455 * wake this thread except for the very last PDU.
    1456 */
    1457 - for (i = 0; i < num_rqst; i++)
    1458 - cifs_delete_mid(midQ[i]);
    1459 - add_credits(ses->server, credits, optype);
    1460 + for (i = 0; i < num_rqst; i++) {
    1461 + if (!cancelled_mid[i])
    1462 + cifs_delete_mid(midQ[i]);
    1463 + add_credits(ses->server, credits[i], optype);
    1464 + }
    1465
    1466 return rc;
    1467 }
    1468 diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
    1469 index 26a7fe5c4fd3..712f00995390 100644
    1470 --- a/fs/ext4/fsync.c
    1471 +++ b/fs/ext4/fsync.c
    1472 @@ -116,8 +116,16 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
    1473 goto out;
    1474 }
    1475
    1476 + ret = file_write_and_wait_range(file, start, end);
    1477 + if (ret)
    1478 + return ret;
    1479 +
    1480 if (!journal) {
    1481 - ret = __generic_file_fsync(file, start, end, datasync);
    1482 + struct writeback_control wbc = {
    1483 + .sync_mode = WB_SYNC_ALL
    1484 + };
    1485 +
    1486 + ret = ext4_write_inode(inode, &wbc);
    1487 if (!ret)
    1488 ret = ext4_sync_parent(inode);
    1489 if (test_opt(inode->i_sb, BARRIER))
    1490 @@ -125,9 +133,6 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
    1491 goto out;
    1492 }
    1493
    1494 - ret = file_write_and_wait_range(file, start, end);
    1495 - if (ret)
    1496 - return ret;
    1497 /*
    1498 * data=writeback,ordered:
    1499 * The caller's filemap_fdatawrite()/wait will sync the data.
    1500 @@ -159,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
    1501 ret = err;
    1502 }
    1503 out:
    1504 + err = file_check_and_advance_wb_err(file);
    1505 + if (ret == 0)
    1506 + ret = err;
    1507 trace_ext4_sync_file_exit(inode, ret);
    1508 return ret;
    1509 }
    1510 diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
    1511 index 27373d88b5f0..56f6e1782d5f 100644
    1512 --- a/fs/ext4/inline.c
    1513 +++ b/fs/ext4/inline.c
    1514 @@ -1890,12 +1890,12 @@ int ext4_inline_data_fiemap(struct inode *inode,
    1515 physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data;
    1516 physical += offsetof(struct ext4_inode, i_block);
    1517
    1518 - if (physical)
    1519 - error = fiemap_fill_next_extent(fieinfo, start, physical,
    1520 - inline_len, flags);
    1521 brelse(iloc.bh);
    1522 out:
    1523 up_read(&EXT4_I(inode)->xattr_sem);
    1524 + if (physical)
    1525 + error = fiemap_fill_next_extent(fieinfo, start, physical,
    1526 + inline_len, flags);
    1527 return (error < 0 ? error : 0);
    1528 }
    1529
    1530 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
    1531 index 9affabd07682..34d7e0703cc6 100644
    1532 --- a/fs/ext4/inode.c
    1533 +++ b/fs/ext4/inode.c
    1534 @@ -2778,7 +2778,8 @@ static int ext4_writepages(struct address_space *mapping,
    1535 * We may need to convert up to one extent per block in
    1536 * the page and we may dirty the inode.
    1537 */
    1538 - rsv_blocks = 1 + (PAGE_SIZE >> inode->i_blkbits);
    1539 + rsv_blocks = 1 + ext4_chunk_trans_blocks(inode,
    1540 + PAGE_SIZE >> inode->i_blkbits);
    1541 }
    1542
    1543 /*
    1544 @@ -4833,7 +4834,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
    1545 gid_t i_gid;
    1546 projid_t i_projid;
    1547
    1548 - if (((flags & EXT4_IGET_NORMAL) &&
    1549 + if ((!(flags & EXT4_IGET_SPECIAL) &&
    1550 (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
    1551 (ino < EXT4_ROOT_INO) ||
    1552 (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
    1553 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    1554 index 6641a1b8a6a5..521320de2017 100644
    1555 --- a/fs/ext4/super.c
    1556 +++ b/fs/ext4/super.c
    1557 @@ -4905,7 +4905,7 @@ static int ext4_commit_super(struct super_block *sb, int sync)
    1558 ext4_superblock_csum_set(sb);
    1559 if (sync)
    1560 lock_buffer(sbh);
    1561 - if (buffer_write_io_error(sbh)) {
    1562 + if (buffer_write_io_error(sbh) || !buffer_uptodate(sbh)) {
    1563 /*
    1564 * Oh, dear. A previous attempt to write the
    1565 * superblock failed. This could happen because the
    1566 diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
    1567 index 2010493e1040..977ddf2774f9 100644
    1568 --- a/include/linux/compiler-gcc.h
    1569 +++ b/include/linux/compiler-gcc.h
    1570 @@ -68,7 +68,7 @@
    1571 */
    1572 #define uninitialized_var(x) x = x
    1573
    1574 -#ifdef RETPOLINE
    1575 +#ifdef CONFIG_RETPOLINE
    1576 #define __noretpoline __attribute__((__indirect_branch__("keep")))
    1577 #endif
    1578
    1579 diff --git a/include/linux/module.h b/include/linux/module.h
    1580 index fce6b4335e36..0c575f51fe57 100644
    1581 --- a/include/linux/module.h
    1582 +++ b/include/linux/module.h
    1583 @@ -817,7 +817,7 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr,
    1584 static inline void module_bug_cleanup(struct module *mod) {}
    1585 #endif /* CONFIG_GENERIC_BUG */
    1586
    1587 -#ifdef RETPOLINE
    1588 +#ifdef CONFIG_RETPOLINE
    1589 extern bool retpoline_module_ok(bool has_retpoline);
    1590 #else
    1591 static inline bool retpoline_module_ok(bool has_retpoline)
    1592 diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
    1593 index 5d399eeef172..f4f8840eab04 100644
    1594 --- a/include/linux/pm_opp.h
    1595 +++ b/include/linux/pm_opp.h
    1596 @@ -108,6 +108,7 @@ void dev_pm_opp_put(struct dev_pm_opp *opp);
    1597 int dev_pm_opp_add(struct device *dev, unsigned long freq,
    1598 unsigned long u_volt);
    1599 void dev_pm_opp_remove(struct device *dev, unsigned long freq);
    1600 +void dev_pm_opp_remove_all_dynamic(struct device *dev);
    1601
    1602 int dev_pm_opp_enable(struct device *dev, unsigned long freq);
    1603
    1604 @@ -214,6 +215,10 @@ static inline void dev_pm_opp_remove(struct device *dev, unsigned long freq)
    1605 {
    1606 }
    1607
    1608 +static inline void dev_pm_opp_remove_all_dynamic(struct device *dev)
    1609 +{
    1610 +}
    1611 +
    1612 static inline int dev_pm_opp_enable(struct device *dev, unsigned long freq)
    1613 {
    1614 return 0;
    1615 diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
    1616 index 73e130a840ce..fdb6b317d974 100644
    1617 --- a/include/linux/sunrpc/svc.h
    1618 +++ b/include/linux/sunrpc/svc.h
    1619 @@ -295,9 +295,12 @@ struct svc_rqst {
    1620 struct svc_cacherep * rq_cacherep; /* cache info */
    1621 struct task_struct *rq_task; /* service thread */
    1622 spinlock_t rq_lock; /* per-request lock */
    1623 + struct net *rq_bc_net; /* pointer to backchannel's
    1624 + * net namespace
    1625 + */
    1626 };
    1627
    1628 -#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
    1629 +#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
    1630
    1631 /*
    1632 * Rigorous type checking on sockaddr type conversions
    1633 diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
    1634 index 28e384186c35..8617f4fd6b70 100644
    1635 --- a/include/trace/events/sunrpc.h
    1636 +++ b/include/trace/events/sunrpc.h
    1637 @@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
    1638 __field(u32, vers)
    1639 __field(u32, proc)
    1640 __string(service, name)
    1641 - __string(addr, rqst->rq_xprt->xpt_remotebuf)
    1642 + __string(addr, rqst->rq_xprt ?
    1643 + rqst->rq_xprt->xpt_remotebuf : "(null)")
    1644 ),
    1645
    1646 TP_fast_assign(
    1647 @@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
    1648 __entry->vers = rqst->rq_vers;
    1649 __entry->proc = rqst->rq_proc;
    1650 __assign_str(service, name);
    1651 - __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
    1652 + __assign_str(addr, rqst->rq_xprt ?
    1653 + rqst->rq_xprt->xpt_remotebuf : "(null)");
    1654 ),
    1655
    1656 TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
    1657 diff --git a/kernel/fork.c b/kernel/fork.c
    1658 index 3c16bc490583..906cd0c13d15 100644
    1659 --- a/kernel/fork.c
    1660 +++ b/kernel/fork.c
    1661 @@ -221,6 +221,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
    1662 memset(s->addr, 0, THREAD_SIZE);
    1663
    1664 tsk->stack_vm_area = s;
    1665 + tsk->stack = s->addr;
    1666 return s->addr;
    1667 }
    1668
    1669 diff --git a/mm/memory.c b/mm/memory.c
    1670 index 4ad2d293ddc2..59c00ae6b928 100644
    1671 --- a/mm/memory.c
    1672 +++ b/mm/memory.c
    1673 @@ -2993,6 +2993,29 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
    1674 struct vm_area_struct *vma = vmf->vma;
    1675 vm_fault_t ret;
    1676
    1677 + /*
    1678 + * Preallocate pte before we take page_lock because this might lead to
    1679 + * deadlocks for memcg reclaim which waits for pages under writeback:
    1680 + * lock_page(A)
    1681 + * SetPageWriteback(A)
    1682 + * unlock_page(A)
    1683 + * lock_page(B)
    1684 + * lock_page(B)
    1685 + * pte_alloc_pne
    1686 + * shrink_page_list
    1687 + * wait_on_page_writeback(A)
    1688 + * SetPageWriteback(B)
    1689 + * unlock_page(B)
    1690 + * # flush A, B to clear the writeback
    1691 + */
    1692 + if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
    1693 + vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm,
    1694 + vmf->address);
    1695 + if (!vmf->prealloc_pte)
    1696 + return VM_FAULT_OOM;
    1697 + smp_wmb(); /* See comment in __pte_alloc() */
    1698 + }
    1699 +
    1700 ret = vma->vm_ops->fault(vmf);
    1701 if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
    1702 VM_FAULT_DONE_COW)))
    1703 diff --git a/mm/slab.c b/mm/slab.c
    1704 index 2a5654bb3b3f..9d5de959d9d9 100644
    1705 --- a/mm/slab.c
    1706 +++ b/mm/slab.c
    1707 @@ -679,8 +679,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries,
    1708 struct alien_cache *alc = NULL;
    1709
    1710 alc = kmalloc_node(memsize, gfp, node);
    1711 - init_arraycache(&alc->ac, entries, batch);
    1712 - spin_lock_init(&alc->lock);
    1713 + if (alc) {
    1714 + init_arraycache(&alc->ac, entries, batch);
    1715 + spin_lock_init(&alc->lock);
    1716 + }
    1717 return alc;
    1718 }
    1719
    1720 diff --git a/mm/usercopy.c b/mm/usercopy.c
    1721 index 852eb4e53f06..14faadcedd06 100644
    1722 --- a/mm/usercopy.c
    1723 +++ b/mm/usercopy.c
    1724 @@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
    1725 /*
    1726 * Validates that the given object is:
    1727 * - not bogus address
    1728 - * - known-safe heap or stack object
    1729 + * - fully contained by stack (or stack frame, when available)
    1730 + * - fully within SLAB object (or object whitelist area, when available)
    1731 * - not in kernel text
    1732 */
    1733 void __check_object_size(const void *ptr, unsigned long n, bool to_user)
    1734 @@ -262,9 +263,6 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
    1735 /* Check for invalid addresses. */
    1736 check_bogus_address((const unsigned long)ptr, n, to_user);
    1737
    1738 - /* Check for bad heap object. */
    1739 - check_heap_object(ptr, n, to_user);
    1740 -
    1741 /* Check for bad stack object. */
    1742 switch (check_stack_object(ptr, n)) {
    1743 case NOT_STACK:
    1744 @@ -282,6 +280,9 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
    1745 usercopy_abort("process stack", NULL, to_user, 0, n);
    1746 }
    1747
    1748 + /* Check for bad heap object. */
    1749 + check_heap_object(ptr, n, to_user);
    1750 +
    1751 /* Check for object in kernel to avoid text exposure. */
    1752 check_kernel_text_object((const unsigned long)ptr, n, to_user);
    1753 }
    1754 diff --git a/mm/util.c b/mm/util.c
    1755 index 8bf08b5b5760..5c9c7359ee8a 100644
    1756 --- a/mm/util.c
    1757 +++ b/mm/util.c
    1758 @@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
    1759 return true;
    1760 if (PageHuge(page))
    1761 return false;
    1762 - for (i = 0; i < hpage_nr_pages(page); i++) {
    1763 + for (i = 0; i < (1 << compound_order(page)); i++) {
    1764 if (atomic_read(&page[i]._mapcount) >= 0)
    1765 return true;
    1766 }
    1767 diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
    1768 index d13e05f1a990..d65f8d35de87 100644
    1769 --- a/net/sunrpc/svc.c
    1770 +++ b/net/sunrpc/svc.c
    1771 @@ -1144,6 +1144,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
    1772 static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
    1773 #endif
    1774
    1775 +extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
    1776 +
    1777 /*
    1778 * Common routine for processing the RPC request.
    1779 */
    1780 @@ -1172,7 +1174,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
    1781 clear_bit(RQ_DROPME, &rqstp->rq_flags);
    1782
    1783 /* Setup reply header */
    1784 - rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
    1785 + if (rqstp->rq_prot == IPPROTO_TCP)
    1786 + svc_tcp_prep_reply_hdr(rqstp);
    1787
    1788 svc_putu32(resv, rqstp->rq_xid);
    1789
    1790 @@ -1244,7 +1247,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
    1791 * for lower versions. RPC_PROG_MISMATCH seems to be the closest
    1792 * fit.
    1793 */
    1794 - if (versp->vs_need_cong_ctrl &&
    1795 + if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
    1796 !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
    1797 goto err_bad_vers;
    1798
    1799 @@ -1336,7 +1339,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
    1800 return 0;
    1801
    1802 close:
    1803 - if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
    1804 + if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
    1805 svc_close_xprt(rqstp->rq_xprt);
    1806 dprintk("svc: svc_process close\n");
    1807 return 0;
    1808 @@ -1459,10 +1462,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
    1809 dprintk("svc: %s(%p)\n", __func__, req);
    1810
    1811 /* Build the svc_rqst used by the common processing routine */
    1812 - rqstp->rq_xprt = serv->sv_bc_xprt;
    1813 rqstp->rq_xid = req->rq_xid;
    1814 rqstp->rq_prot = req->rq_xprt->prot;
    1815 rqstp->rq_server = serv;
    1816 + rqstp->rq_bc_net = req->rq_xprt->xprt_net;
    1817
    1818 rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
    1819 memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
    1820 diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
    1821 index 51d36230b6e3..bd42da287c26 100644
    1822 --- a/net/sunrpc/svc_xprt.c
    1823 +++ b/net/sunrpc/svc_xprt.c
    1824 @@ -468,10 +468,11 @@ out:
    1825 */
    1826 void svc_reserve(struct svc_rqst *rqstp, int space)
    1827 {
    1828 + struct svc_xprt *xprt = rqstp->rq_xprt;
    1829 +
    1830 space += rqstp->rq_res.head[0].iov_len;
    1831
    1832 - if (space < rqstp->rq_reserved) {
    1833 - struct svc_xprt *xprt = rqstp->rq_xprt;
    1834 + if (xprt && space < rqstp->rq_reserved) {
    1835 atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
    1836 rqstp->rq_reserved = space;
    1837
    1838 diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
    1839 index b7e67310ec37..b90492c43711 100644
    1840 --- a/net/sunrpc/svcsock.c
    1841 +++ b/net/sunrpc/svcsock.c
    1842 @@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
    1843 /*
    1844 * Setup response header. TCP has a 4B record length field.
    1845 */
    1846 -static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
    1847 +void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
    1848 {
    1849 struct kvec *resv = &rqstp->rq_res.head[0];
    1850
    1851 diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
    1852 index 0d998c54564d..5a5b3780456f 100644
    1853 --- a/scripts/mod/modpost.c
    1854 +++ b/scripts/mod/modpost.c
    1855 @@ -2157,7 +2157,7 @@ static void add_intree_flag(struct buffer *b, int is_intree)
    1856 /* Cannot check for assembler */
    1857 static void add_retpoline(struct buffer *b)
    1858 {
    1859 - buf_printf(b, "\n#ifdef RETPOLINE\n");
    1860 + buf_printf(b, "\n#ifdef CONFIG_RETPOLINE\n");
    1861 buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
    1862 buf_printf(b, "#endif\n");
    1863 }
    1864 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1865 index 54fc9c0f07de..0d95316d6dbd 100644
    1866 --- a/sound/pci/hda/patch_realtek.c
    1867 +++ b/sound/pci/hda/patch_realtek.c
    1868 @@ -4102,6 +4102,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
    1869 case 0x10ec0295:
    1870 case 0x10ec0289:
    1871 case 0x10ec0299:
    1872 + alc_process_coef_fw(codec, alc225_pre_hsmode);
    1873 alc_process_coef_fw(codec, coef0225);
    1874 break;
    1875 case 0x10ec0867:
    1876 @@ -5380,6 +5381,13 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec,
    1877 snd_hda_override_wcaps(codec, 0x03, 0);
    1878 }
    1879
    1880 +static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
    1881 + const struct hda_fixup *fix, int action)
    1882 +{
    1883 + if (action == HDA_FIXUP_ACT_PRE_PROBE)
    1884 + snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
    1885 +}
    1886 +
    1887 /* for hda_fixup_thinkpad_acpi() */
    1888 #include "thinkpad_helper.c"
    1889
    1890 @@ -5492,6 +5500,7 @@ enum {
    1891 ALC293_FIXUP_LENOVO_SPK_NOISE,
    1892 ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
    1893 ALC255_FIXUP_DELL_SPK_NOISE,
    1894 + ALC225_FIXUP_DISABLE_MIC_VREF,
    1895 ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
    1896 ALC295_FIXUP_DISABLE_DAC3,
    1897 ALC280_FIXUP_HP_HEADSET_MIC,
    1898 @@ -6191,6 +6200,12 @@ static const struct hda_fixup alc269_fixups[] = {
    1899 .chained = true,
    1900 .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
    1901 },
    1902 + [ALC225_FIXUP_DISABLE_MIC_VREF] = {
    1903 + .type = HDA_FIXUP_FUNC,
    1904 + .v.func = alc_fixup_disable_mic_vref,
    1905 + .chained = true,
    1906 + .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
    1907 + },
    1908 [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
    1909 .type = HDA_FIXUP_VERBS,
    1910 .v.verbs = (const struct hda_verb[]) {
    1911 @@ -6200,7 +6215,7 @@ static const struct hda_fixup alc269_fixups[] = {
    1912 {}
    1913 },
    1914 .chained = true,
    1915 - .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
    1916 + .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF
    1917 },
    1918 [ALC280_FIXUP_HP_HEADSET_MIC] = {
    1919 .type = HDA_FIXUP_FUNC,
    1920 @@ -6503,6 +6518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    1921 SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
    1922 SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
    1923 SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
    1924 + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
    1925 SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
    1926 SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
    1927 SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),