commit:     f745b9507cb522a1a06e93f2dcd1f04d9d0ec998
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Oct  9 21:30:06 2021 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Oct  9 21:30:06 2021 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f745b950

Linux patch 5.14.11

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1010_linux-5.14.11.patch | 1738 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1742 insertions(+)

diff --git a/0000_README b/0000_README
index 11074a3..6096d94 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch:  1009_linux-5.14.10.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.14.10
 
+Patch:  1010_linux-5.14.11.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.14.11
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1010_linux-5.14.11.patch b/1010_linux-5.14.11.patch
new file mode 100644
index 0000000..ce6e1f2
--- /dev/null
+++ b/1010_linux-5.14.11.patch
@@ -0,0 +1,1738 @@
+diff --git a/Makefile b/Makefile
+index 9f99a61d2589b..ca6c4472775cb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 14
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = Opossums on Parade
+ 
+diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
+index 11dcc369ec14a..c9d7c29d95e1e 100644
+--- a/arch/arm/mach-imx/mach-imx6q.c
++++ b/arch/arm/mach-imx/mach-imx6q.c
+@@ -172,6 +172,9 @@ static void __init imx6q_init_machine(void)
+                               imx_get_soc_revision());
+ 
+       imx6q_enet_phy_init();
++
++      of_platform_default_populate(NULL, NULL, NULL);
++
+       imx_anatop_init();
+       cpu_is_imx6q() ?  imx6q_pm_init() : imx6dl_pm_init();
+       imx6q_1588_init();
+diff --git a/arch/sparc/lib/iomap.c b/arch/sparc/lib/iomap.c
+index c9da9f139694d..f3a8cd491ce0d 100644
+--- a/arch/sparc/lib/iomap.c
++++ b/arch/sparc/lib/iomap.c
+@@ -19,8 +19,10 @@ void ioport_unmap(void __iomem *addr)
+ EXPORT_SYMBOL(ioport_map);
+ EXPORT_SYMBOL(ioport_unmap);
+ 
++#ifdef CONFIG_PCI
+ void pci_iounmap(struct pci_dev *dev, void __iomem * addr)
+ {
+       /* nothing to do */
+ }
+ EXPORT_SYMBOL(pci_iounmap);
++#endif
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index 3092fbf9dbe4c..98729ce899175 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -2467,6 +2467,7 @@ static int x86_pmu_event_init(struct perf_event *event)
+       if (err) {
+               if (event->destroy)
+                       event->destroy(event);
++              event->destroy = NULL;
+       }
+ 
+       if (READ_ONCE(x86_pmu.attr_rdpmc) &&
+diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
+index 69639f9624f56..19d6ffdd3f736 100644
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -1601,6 +1601,8 @@ static void svm_clear_vintr(struct vcpu_svm *svm)
+ 
+               svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
+                       V_IRQ_INJECTION_BITS_MASK;
++
++              svm->vmcb->control.int_vector = svm->nested.ctl.int_vector;
+       }
+ 
+       vmcb_mark_dirty(svm->vmcb, VMCB_INTR);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6d5d6e93f5c41..4b0e866e9f086 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1327,6 +1327,13 @@ static const u32 msrs_to_save_all[] = {
+       MSR_ARCH_PERFMON_EVENTSEL0 + 12, MSR_ARCH_PERFMON_EVENTSEL0 + 13,
+       MSR_ARCH_PERFMON_EVENTSEL0 + 14, MSR_ARCH_PERFMON_EVENTSEL0 + 15,
+       MSR_ARCH_PERFMON_EVENTSEL0 + 16, MSR_ARCH_PERFMON_EVENTSEL0 + 17,
++
++      MSR_K7_EVNTSEL0, MSR_K7_EVNTSEL1, MSR_K7_EVNTSEL2, MSR_K7_EVNTSEL3,
++      MSR_K7_PERFCTR0, MSR_K7_PERFCTR1, MSR_K7_PERFCTR2, MSR_K7_PERFCTR3,
++      MSR_F15H_PERF_CTL0, MSR_F15H_PERF_CTL1, MSR_F15H_PERF_CTL2,
++      MSR_F15H_PERF_CTL3, MSR_F15H_PERF_CTL4, MSR_F15H_PERF_CTL5,
++      MSR_F15H_PERF_CTR0, MSR_F15H_PERF_CTR1, MSR_F15H_PERF_CTR2,
++      MSR_F15H_PERF_CTR3, MSR_F15H_PERF_CTR4, MSR_F15H_PERF_CTR5,
+ };
+ 
+ static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_all)];
+@@ -7659,6 +7666,13 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu, bool 
entering_smm)
+ 
+               /* Process a latched INIT or SMI, if any.  */
+               kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++              /*
++               * Even if KVM_SET_SREGS2 loaded PDPTRs out of band,
++               * on SMM exit we still need to reload them from
++               * guest memory
++               */
++              vcpu->arch.pdptrs_from_userspace = false;
+       }
+ 
+       kvm_mmu_reset_context(vcpu);
+diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
+index 058f19b20465f..c565def611e24 100644
+--- a/arch/x86/lib/insn.c
++++ b/arch/x86/lib/insn.c
+@@ -37,10 +37,10 @@
+       ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
+ 
+ #define __get_next(t, insn)   \
+-      ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); 
leXX_to_cpu(t, r); })
++      ({ t r; memcpy(&r, insn->next_byte, sizeof(t)); insn->next_byte += 
sizeof(t); leXX_to_cpu(t, r); })
+ 
+ #define __peek_nbyte_next(t, insn, n) \
+-      ({ t r = *(t*)((insn)->next_byte + n); leXX_to_cpu(t, r); })
++      ({ t r; memcpy(&r, (insn)->next_byte + n, sizeof(t)); leXX_to_cpu(t, 
r); })
+ 
+ #define get_next(t, insn)     \
+       ({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; 
__get_next(t, insn); })
+diff --git a/block/bio.c b/block/bio.c
+index d95e3456ba0c5..52548c4878836 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1396,7 +1396,7 @@ again:
+       if (!bio_integrity_endio(bio))
+               return;
+ 
+-      if (bio->bi_bdev)
++      if (bio->bi_bdev && bio_flagged(bio, BIO_TRACKED))
+               rq_qos_done_bio(bio->bi_bdev->bd_disk->queue, bio);
+ 
+       if (bio->bi_bdev && bio_flagged(bio, BIO_TRACE_COMPLETION)) {
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 0e6e73b8023fc..8916163d508e0 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2199,6 +2199,25 @@ static void ata_dev_config_ncq_prio(struct ata_device 
*dev)
+ 
+ }
+ 
++static bool ata_dev_check_adapter(struct ata_device *dev,
++                                unsigned short vendor_id)
++{
++      struct pci_dev *pcidev = NULL;
++      struct device *parent_dev = NULL;
++
++      for (parent_dev = dev->tdev.parent; parent_dev != NULL;
++           parent_dev = parent_dev->parent) {
++              if (dev_is_pci(parent_dev)) {
++                      pcidev = to_pci_dev(parent_dev);
++                      if (pcidev->vendor == vendor_id)
++                              return true;
++                      break;
++              }
++      }
++
++      return false;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+                              char *desc, size_t desc_sz)
+ {
+@@ -2217,6 +2236,13 @@ static int ata_dev_config_ncq(struct ata_device *dev,
+               snprintf(desc, desc_sz, "NCQ (not used)");
+               return 0;
+       }
++
++      if (dev->horkage & ATA_HORKAGE_NO_NCQ_ON_ATI &&
++          ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI)) {
++              snprintf(desc, desc_sz, "NCQ (not used)");
++              return 0;
++      }
++
+       if (ap->flags & ATA_FLAG_NCQ) {
+               hdepth = min(ap->scsi_host->can_queue, ATA_MAX_QUEUE);
+               dev->flags |= ATA_DFLAG_NCQ;
+@@ -3951,9 +3977,11 @@ static const struct ata_blacklist_entry 
ata_device_blacklist [] = {
+       { "Samsung SSD 850*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                               ATA_HORKAGE_ZERO_AFTER_TRIM, },
+       { "Samsung SSD 860*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+-                                              ATA_HORKAGE_ZERO_AFTER_TRIM, },
++                                              ATA_HORKAGE_ZERO_AFTER_TRIM |
++                                              ATA_HORKAGE_NO_NCQ_ON_ATI, },
+       { "Samsung SSD 870*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+-                                              ATA_HORKAGE_ZERO_AFTER_TRIM, },
++                                              ATA_HORKAGE_ZERO_AFTER_TRIM |
++                                              ATA_HORKAGE_NO_NCQ_ON_ATI, },
+       { "FCCT*M500*",                 NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                               ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ 
+@@ -6108,6 +6136,8 @@ static int __init ata_parse_force_one(char **cur,
+               { "ncq",        .horkage_off    = ATA_HORKAGE_NONCQ },
+               { "noncqtrim",  .horkage_on     = ATA_HORKAGE_NO_NCQ_TRIM },
+               { "ncqtrim",    .horkage_off    = ATA_HORKAGE_NO_NCQ_TRIM },
++              { "noncqati",   .horkage_on     = ATA_HORKAGE_NO_NCQ_ON_ATI },
++              { "ncqati",     .horkage_off    = ATA_HORKAGE_NO_NCQ_ON_ATI },
+               { "dump_id",    .horkage_on     = ATA_HORKAGE_DUMP_ID },
+               { "pio0",       .xfer_mask      = 1 << (ATA_SHIFT_PIO + 0) },
+               { "pio1",       .xfer_mask      = 1 << (ATA_SHIFT_PIO + 1) },
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 5a872adcfdb98..5ba8a4f353440 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -922,7 +922,6 @@ out:
+ void kgd2kfd_device_exit(struct kfd_dev *kfd)
+ {
+       if (kfd->init_complete) {
+-              svm_migrate_fini((struct amdgpu_device *)kfd->kgd);
+               device_queue_manager_uninit(kfd->dqm);
+               kfd_interrupt_exit(kfd);
+               kfd_topology_remove_device(kfd);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index dab290a4d19d1..4a16e3c257b92 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -891,9 +891,16 @@ int svm_migrate_init(struct amdgpu_device *adev)
+       pgmap->ops = &svm_migrate_pgmap_ops;
+       pgmap->owner = SVM_ADEV_PGMAP_OWNER(adev);
+       pgmap->flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE;
++
++      /* Device manager releases device-specific resources, memory region and
++       * pgmap when driver disconnects from device.
++       */
+       r = devm_memremap_pages(adev->dev, pgmap);
+       if (IS_ERR(r)) {
+               pr_err("failed to register HMM device memory\n");
++
++              /* Disable SVM support capability */
++              pgmap->type = 0;
+               devm_release_mem_region(adev->dev, res->start,
+                                       res->end - res->start + 1);
+               return PTR_ERR(r);
+@@ -908,12 +915,3 @@ int svm_migrate_init(struct amdgpu_device *adev)
+ 
+       return 0;
+ }
+-
+-void svm_migrate_fini(struct amdgpu_device *adev)
+-{
+-      struct dev_pagemap *pgmap = &adev->kfd.dev->pgmap;
+-
+-      devm_memunmap_pages(adev->dev, pgmap);
+-      devm_release_mem_region(adev->dev, pgmap->range.start,
+-                              pgmap->range.end - pgmap->range.start + 1);
+-}
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h 
b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h
+index 0de76b5d49739..2f5b3394c9ed9 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h
+@@ -47,7 +47,6 @@ unsigned long
+ svm_migrate_addr_to_pfn(struct amdgpu_device *adev, unsigned long addr);
+ 
+ int svm_migrate_init(struct amdgpu_device *adev);
+-void svm_migrate_fini(struct amdgpu_device *adev);
+ 
+ #else
+ 
+@@ -55,10 +54,6 @@ static inline int svm_migrate_init(struct amdgpu_device 
*adev)
+ {
+       return 0;
+ }
+-static inline void svm_migrate_fini(struct amdgpu_device *adev)
+-{
+-      /* empty */
+-}
+ 
+ #endif /* IS_ENABLED(CONFIG_HSA_AMD_SVM) */
+ 
+diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
+index d329ec3d64d81..5f22c9d65e578 100644
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -107,6 +107,8 @@ static DEFINE_RAW_SPINLOCK(cpu_map_lock);
+ 
+ #endif
+ 
++static DEFINE_STATIC_KEY_FALSE(needs_rmw_access);
++
+ /*
+  * The GIC mapping of CPU interfaces does not necessarily match
+  * the logical CPU numbering.  Let's use a mapping as returned
+@@ -774,6 +776,25 @@ static int gic_pm_init(struct gic_chip_data *gic)
+ #endif
+ 
+ #ifdef CONFIG_SMP
++static void rmw_writeb(u8 bval, void __iomem *addr)
++{
++      static DEFINE_RAW_SPINLOCK(rmw_lock);
++      unsigned long offset = (unsigned long)addr & 3UL;
++      unsigned long shift = offset * 8;
++      unsigned long flags;
++      u32 val;
++
++      raw_spin_lock_irqsave(&rmw_lock, flags);
++
++      addr -= offset;
++      val = readl_relaxed(addr);
++      val &= ~GENMASK(shift + 7, shift);
++      val |= bval << shift;
++      writel_relaxed(val, addr);
++
++      raw_spin_unlock_irqrestore(&rmw_lock, flags);
++}
++
+ static int gic_set_affinity(struct irq_data *d, const struct cpumask 
*mask_val,
+                           bool force)
+ {
+@@ -788,7 +809,10 @@ static int gic_set_affinity(struct irq_data *d, const 
struct cpumask *mask_val,
+       if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
+               return -EINVAL;
+ 
+-      writeb_relaxed(gic_cpu_map[cpu], reg);
++      if (static_branch_unlikely(&needs_rmw_access))
++              rmw_writeb(gic_cpu_map[cpu], reg);
++      else
++              writeb_relaxed(gic_cpu_map[cpu], reg);
+       irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ 
+       return IRQ_SET_MASK_OK_DONE;
+@@ -1375,6 +1399,30 @@ static bool gic_check_eoimode(struct device_node *node, 
void __iomem **base)
+       return true;
+ }
+ 
++static bool gic_enable_rmw_access(void *data)
++{
++      /*
++       * The EMEV2 class of machines has a broken interconnect, and
++       * locks up on accesses that are less than 32bit. So far, only
++       * the affinity setting requires it.
++       */
++      if (of_machine_is_compatible("renesas,emev2")) {
++              static_branch_enable(&needs_rmw_access);
++              return true;
++      }
++
++      return false;
++}
++
++static const struct gic_quirk gic_quirks[] = {
++      {
++              .desc           = "broken byte access",
++              .compatible     = "arm,pl390",
++              .init           = gic_enable_rmw_access,
++      },
++      { },
++};
++
+ static int gic_of_setup(struct gic_chip_data *gic, struct device_node *node)
+ {
+       if (!gic || !node)
+@@ -1391,6 +1439,8 @@ static int gic_of_setup(struct gic_chip_data *gic, 
struct device_node *node)
+       if (of_property_read_u32(node, "cpu-offset", &gic->percpu_offset))
+               gic->percpu_offset = 0;
+ 
++      gic_enable_of_quirks(node, gic_quirks, gic);
++
+       return 0;
+ 
+ error:
+diff --git a/drivers/misc/habanalabs/common/command_submission.c 
b/drivers/misc/habanalabs/common/command_submission.c
+index 80c60fb41bbca..d249101106dea 100644
+--- a/drivers/misc/habanalabs/common/command_submission.c
++++ b/drivers/misc/habanalabs/common/command_submission.c
+@@ -1727,6 +1727,15 @@ static int cs_ioctl_signal_wait(struct hl_fpriv *hpriv, 
enum hl_cs_type cs_type,
+                       goto free_cs_chunk_array;
+               }
+ 
++              if (!hdev->nic_ports_mask) {
++                      atomic64_inc(&ctx->cs_counters.validation_drop_cnt);
++                      atomic64_inc(&cntr->validation_drop_cnt);
++                      dev_err(hdev->dev,
++                              "Collective operations not supported when NIC 
ports are disabled");
++                      rc = -EINVAL;
++                      goto free_cs_chunk_array;
++              }
++
+               collective_engine_id = chunk->collective_engine_id;
+       }
+ 
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c 
b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 409f05c962f24..8a9c4f0f37f96 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -5620,6 +5620,7 @@ static void gaudi_add_end_of_cb_packets(struct hl_device 
*hdev,
+ {
+       struct gaudi_device *gaudi = hdev->asic_specific;
+       struct packet_msg_prot *cq_pkt;
++      u64 msi_addr;
+       u32 tmp;
+ 
+       cq_pkt = kernel_address + len - (sizeof(struct packet_msg_prot) * 2);
+@@ -5641,10 +5642,12 @@ static void gaudi_add_end_of_cb_packets(struct 
hl_device *hdev,
+       cq_pkt->ctl = cpu_to_le32(tmp);
+       cq_pkt->value = cpu_to_le32(1);
+ 
+-      if (!gaudi->multi_msi_mode)
+-              msi_vec = 0;
++      if (gaudi->multi_msi_mode)
++              msi_addr = mmPCIE_MSI_INTR_0 + msi_vec * 4;
++      else
++              msi_addr = mmPCIE_CORE_MSI_REQ;
+ 
+-      cq_pkt->addr = cpu_to_le64(CFG_BASE + mmPCIE_MSI_INTR_0 + msi_vec * 4);
++      cq_pkt->addr = cpu_to_le64(CFG_BASE + msi_addr);
+ }
+ 
+ static void gaudi_update_eq_ci(struct hl_device *hdev, u32 val)
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi_security.c 
b/drivers/misc/habanalabs/gaudi/gaudi_security.c
+index 0d3240f1f7d76..2b8bafda41bcc 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi_security.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi_security.c
+@@ -8,16 +8,21 @@
+ #include "gaudiP.h"
+ #include "../include/gaudi/asic_reg/gaudi_regs.h"
+ 
+-#define GAUDI_NUMBER_OF_RR_REGS               24
+-#define GAUDI_NUMBER_OF_LBW_RANGES    12
++#define GAUDI_NUMBER_OF_LBW_RR_REGS   28
++#define GAUDI_NUMBER_OF_HBW_RR_REGS   24
++#define GAUDI_NUMBER_OF_LBW_RANGES    10
+ 
+-static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++      mmDMA_IF_W_S_SOB_HIT_WPROT,
+       mmDMA_IF_W_S_DMA0_HIT_WPROT,
+       mmDMA_IF_W_S_DMA1_HIT_WPROT,
++      mmDMA_IF_E_S_SOB_HIT_WPROT,
+       mmDMA_IF_E_S_DMA0_HIT_WPROT,
+       mmDMA_IF_E_S_DMA1_HIT_WPROT,
++      mmDMA_IF_W_N_SOB_HIT_WPROT,
+       mmDMA_IF_W_N_DMA0_HIT_WPROT,
+       mmDMA_IF_W_N_DMA1_HIT_WPROT,
++      mmDMA_IF_E_N_SOB_HIT_WPROT,
+       mmDMA_IF_E_N_DMA0_HIT_WPROT,
+       mmDMA_IF_E_N_DMA1_HIT_WPROT,
+       mmSIF_RTR_0_LBW_RANGE_PROT_HIT_AW,
+@@ -38,13 +43,17 @@ static u64 
gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_7_LBW_RANGE_PROT_HIT_AW,
+ };
+ 
+-static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++      mmDMA_IF_W_S_SOB_HIT_RPROT,
+       mmDMA_IF_W_S_DMA0_HIT_RPROT,
+       mmDMA_IF_W_S_DMA1_HIT_RPROT,
++      mmDMA_IF_E_S_SOB_HIT_RPROT,
+       mmDMA_IF_E_S_DMA0_HIT_RPROT,
+       mmDMA_IF_E_S_DMA1_HIT_RPROT,
++      mmDMA_IF_W_N_SOB_HIT_RPROT,
+       mmDMA_IF_W_N_DMA0_HIT_RPROT,
+       mmDMA_IF_W_N_DMA1_HIT_RPROT,
++      mmDMA_IF_E_N_SOB_HIT_RPROT,
+       mmDMA_IF_E_N_DMA0_HIT_RPROT,
+       mmDMA_IF_E_N_DMA1_HIT_RPROT,
+       mmSIF_RTR_0_LBW_RANGE_PROT_HIT_AR,
+@@ -65,13 +74,17 @@ static u64 
gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_7_LBW_RANGE_PROT_HIT_AR,
+ };
+ 
+-static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++      mmDMA_IF_W_S_SOB_MIN_WPROT_0,
+       mmDMA_IF_W_S_DMA0_MIN_WPROT_0,
+       mmDMA_IF_W_S_DMA1_MIN_WPROT_0,
++      mmDMA_IF_E_S_SOB_MIN_WPROT_0,
+       mmDMA_IF_E_S_DMA0_MIN_WPROT_0,
+       mmDMA_IF_E_S_DMA1_MIN_WPROT_0,
++      mmDMA_IF_W_N_SOB_MIN_WPROT_0,
+       mmDMA_IF_W_N_DMA0_MIN_WPROT_0,
+       mmDMA_IF_W_N_DMA1_MIN_WPROT_0,
++      mmDMA_IF_E_N_SOB_MIN_WPROT_0,
+       mmDMA_IF_E_N_DMA0_MIN_WPROT_0,
+       mmDMA_IF_E_N_DMA1_MIN_WPROT_0,
+       mmSIF_RTR_0_LBW_RANGE_PROT_MIN_AW_0,
+@@ -92,13 +105,17 @@ static u64 
gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_7_LBW_RANGE_PROT_MIN_AW_0,
+ };
+ 
+-static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++      mmDMA_IF_W_S_SOB_MAX_WPROT_0,
+       mmDMA_IF_W_S_DMA0_MAX_WPROT_0,
+       mmDMA_IF_W_S_DMA1_MAX_WPROT_0,
++      mmDMA_IF_E_S_SOB_MAX_WPROT_0,
+       mmDMA_IF_E_S_DMA0_MAX_WPROT_0,
+       mmDMA_IF_E_S_DMA1_MAX_WPROT_0,
++      mmDMA_IF_W_N_SOB_MAX_WPROT_0,
+       mmDMA_IF_W_N_DMA0_MAX_WPROT_0,
+       mmDMA_IF_W_N_DMA1_MAX_WPROT_0,
++      mmDMA_IF_E_N_SOB_MAX_WPROT_0,
+       mmDMA_IF_E_N_DMA0_MAX_WPROT_0,
+       mmDMA_IF_E_N_DMA1_MAX_WPROT_0,
+       mmSIF_RTR_0_LBW_RANGE_PROT_MAX_AW_0,
+@@ -119,13 +136,17 @@ static u64 
gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_7_LBW_RANGE_PROT_MAX_AW_0,
+ };
+ 
+-static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++      mmDMA_IF_W_S_SOB_MIN_RPROT_0,
+       mmDMA_IF_W_S_DMA0_MIN_RPROT_0,
+       mmDMA_IF_W_S_DMA1_MIN_RPROT_0,
++      mmDMA_IF_E_S_SOB_MIN_RPROT_0,
+       mmDMA_IF_E_S_DMA0_MIN_RPROT_0,
+       mmDMA_IF_E_S_DMA1_MIN_RPROT_0,
++      mmDMA_IF_W_N_SOB_MIN_RPROT_0,
+       mmDMA_IF_W_N_DMA0_MIN_RPROT_0,
+       mmDMA_IF_W_N_DMA1_MIN_RPROT_0,
++      mmDMA_IF_E_N_SOB_MIN_RPROT_0,
+       mmDMA_IF_E_N_DMA0_MIN_RPROT_0,
+       mmDMA_IF_E_N_DMA1_MIN_RPROT_0,
+       mmSIF_RTR_0_LBW_RANGE_PROT_MIN_AR_0,
+@@ -146,13 +167,17 @@ static u64 
gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_7_LBW_RANGE_PROT_MIN_AR_0,
+ };
+ 
+-static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++      mmDMA_IF_W_S_SOB_MAX_RPROT_0,
+       mmDMA_IF_W_S_DMA0_MAX_RPROT_0,
+       mmDMA_IF_W_S_DMA1_MAX_RPROT_0,
++      mmDMA_IF_E_S_SOB_MAX_RPROT_0,
+       mmDMA_IF_E_S_DMA0_MAX_RPROT_0,
+       mmDMA_IF_E_S_DMA1_MAX_RPROT_0,
++      mmDMA_IF_W_N_SOB_MAX_RPROT_0,
+       mmDMA_IF_W_N_DMA0_MAX_RPROT_0,
+       mmDMA_IF_W_N_DMA1_MAX_RPROT_0,
++      mmDMA_IF_E_N_SOB_MAX_RPROT_0,
+       mmDMA_IF_E_N_DMA0_MAX_RPROT_0,
+       mmDMA_IF_E_N_DMA1_MAX_RPROT_0,
+       mmSIF_RTR_0_LBW_RANGE_PROT_MAX_AR_0,
+@@ -173,7 +198,7 @@ static u64 
gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_7_LBW_RANGE_PROT_MAX_AR_0,
+ };
+ 
+-static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_HIT_AW,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_HIT_AW,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_HIT_AW,
+@@ -200,7 +225,7 @@ static u64 
gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_HIT_AW
+ };
+ 
+-static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_HIT_AR,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_HIT_AR,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_HIT_AR,
+@@ -227,7 +252,7 @@ static u64 
gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_HIT_AR
+ };
+ 
+-static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AW_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_LOW_AW_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AW_0,
+@@ -254,7 +279,7 @@ static u64 
gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_LOW_AW_0
+ };
+ 
+-static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AW_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_HIGH_AW_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AW_0,
+@@ -281,7 +306,7 @@ static u64 
gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_HIGH_AW_0
+ };
+ 
+-static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AW_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_LOW_AW_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AW_0,
+@@ -308,7 +333,7 @@ static u64 
gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_LOW_AW_0
+ };
+ 
+-static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AW_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_HIGH_AW_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AW_0,
+@@ -335,7 +360,7 @@ static u64 
gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_HIGH_AW_0
+ };
+ 
+-static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AR_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_LOW_AR_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AR_0,
+@@ -362,7 +387,7 @@ static u64 
gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_LOW_AR_0
+ };
+ 
+-static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AR_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_HIGH_AR_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AR_0,
+@@ -389,7 +414,7 @@ static u64 
gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_HIGH_AR_0
+ };
+ 
+-static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AR_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_LOW_AR_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AR_0,
+@@ -416,7 +441,7 @@ static u64 
gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+       mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_LOW_AR_0
+ };
+ 
+-static u64 gaudi_rr_hbw_mask_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_high_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+       mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AR_0,
+       mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_HIGH_AR_0,
+       mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AR_0,
+@@ -12841,50 +12866,44 @@ static void gaudi_init_range_registers_lbw(struct 
hl_device *hdev)
+       u32 lbw_rng_end[GAUDI_NUMBER_OF_LBW_RANGES];
+       int i, j;
+ 
+-      lbw_rng_start[0]  = (0xFBFE0000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[0]    = (0xFBFFF000 & 0x3FFFFFF) + 1;
++      lbw_rng_start[0]  = (0xFC0E8000 & 0x3FFFFFF) - 1; /* 0x000E7FFF */
++      lbw_rng_end[0]    = (0xFC11FFFF & 0x3FFFFFF) + 1; /* 0x00120000 */
+ 
+-      lbw_rng_start[1]  = (0xFC0E8000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[1]    = (0xFC120000 & 0x3FFFFFF) + 1;
++      lbw_rng_start[1]  = (0xFC1E8000 & 0x3FFFFFF) - 1; /* 0x001E7FFF */
++      lbw_rng_end[1]    = (0xFC48FFFF & 0x3FFFFFF) + 1; /* 0x00490000 */
+ 
+-      lbw_rng_start[2]  = (0xFC1E8000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[2]    = (0xFC48FFFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[2]  = (0xFC600000 & 0x3FFFFFF) - 1; /* 0x005FFFFF */
++      lbw_rng_end[2]    = (0xFCC48FFF & 0x3FFFFFF) + 1; /* 0x00C49000 */
+ 
+-      lbw_rng_start[3]  = (0xFC600000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[3]    = (0xFCC48FFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[3]  = (0xFCC4A000 & 0x3FFFFFF) - 1; /* 0x00C49FFF */
++      lbw_rng_end[3]    = (0xFCCDFFFF & 0x3FFFFFF) + 1; /* 0x00CE0000 */
+ 
+-      lbw_rng_start[4]  = (0xFCC4A000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[4]    = (0xFCCDFFFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[4]  = (0xFCCE4000 & 0x3FFFFFF) - 1; /* 0x00CE3FFF */
++      lbw_rng_end[4]    = (0xFCD1FFFF & 0x3FFFFFF) + 1; /* 0x00D20000 */
+ 
+-      lbw_rng_start[5]  = (0xFCCE4000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[5]    = (0xFCD1FFFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[5]  = (0xFCD24000 & 0x3FFFFFF) - 1; /* 0x00D23FFF */
++      lbw_rng_end[5]    = (0xFCD5FFFF & 0x3FFFFFF) + 1; /* 0x00D60000 */
+ 
+-      lbw_rng_start[6]  = (0xFCD24000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[6]    = (0xFCD5FFFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[6]  = (0xFCD64000 & 0x3FFFFFF) - 1; /* 0x00D63FFF */
++      lbw_rng_end[6]    = (0xFCD9FFFF & 0x3FFFFFF) + 1; /* 0x00DA0000 */
+ 
+-      lbw_rng_start[7]  = (0xFCD64000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[7]    = (0xFCD9FFFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[7]  = (0xFCDA4000 & 0x3FFFFFF) - 1; /* 0x00DA3FFF */
++      lbw_rng_end[7]    = (0xFCDDFFFF & 0x3FFFFFF) + 1; /* 0x00DE0000 */
+ 
+-      lbw_rng_start[8]  = (0xFCDA4000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[8]    = (0xFCDDFFFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[8]  = (0xFCDE4000 & 0x3FFFFFF) - 1; /* 0x00DE3FFF */
++      lbw_rng_end[8]    = (0xFCE05FFF & 0x3FFFFFF) + 1; /* 0x00E06000 */
+ 
+-      lbw_rng_start[9]  = (0xFCDE4000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[9]    = (0xFCE05FFF & 0x3FFFFFF) + 1;
++      lbw_rng_start[9]  = (0xFCFC9000 & 0x3FFFFFF) - 1; /* 0x00FC8FFF */
++      lbw_rng_end[9]    = (0xFFFFFFFE & 0x3FFFFFF) + 1; /* 0x03FFFFFF */
+ 
+-      lbw_rng_start[10]  = (0xFEC43000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[10]    = (0xFEC43FFF & 0x3FFFFFF) + 1;
+-
+-      lbw_rng_start[11] = (0xFE484000 & 0x3FFFFFF) - 1;
+-      lbw_rng_end[11]   = (0xFE484FFF & 0x3FFFFFF) + 1;
+-
+-      for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
++      for (i = 0 ; i < GAUDI_NUMBER_OF_LBW_RR_REGS ; i++) {
+               WREG32(gaudi_rr_lbw_hit_aw_regs[i],
+                               (1 << GAUDI_NUMBER_OF_LBW_RANGES) - 1);
+               WREG32(gaudi_rr_lbw_hit_ar_regs[i],
+                               (1 << GAUDI_NUMBER_OF_LBW_RANGES) - 1);
+       }
+ 
+-      for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++)
++      for (i = 0 ; i < GAUDI_NUMBER_OF_LBW_RR_REGS ; i++)
+               for (j = 0 ; j < GAUDI_NUMBER_OF_LBW_RANGES ; j++) {
+                       WREG32(gaudi_rr_lbw_min_aw_regs[i] + (j << 2),
+                                                       lbw_rng_start[j]);
+@@ -12931,12 +12950,12 @@ static void gaudi_init_range_registers_hbw(struct 
hl_device *hdev)
+        * 6th range is the host
+        */
+ 
+-      for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
++      for (i = 0 ; i < GAUDI_NUMBER_OF_HBW_RR_REGS ; i++) {
+               WREG32(gaudi_rr_hbw_hit_aw_regs[i], 0x1F);
+               WREG32(gaudi_rr_hbw_hit_ar_regs[i], 0x1D);
+       }
+ 
+-      for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
++      for (i = 0 ; i < GAUDI_NUMBER_OF_HBW_RR_REGS ; i++) {
+               WREG32(gaudi_rr_hbw_base_low_aw_regs[i], dram_addr_lo);
+               WREG32(gaudi_rr_hbw_base_low_ar_regs[i], dram_addr_lo);
+ 
+diff --git a/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h 
b/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h
+index 5bb54b34a8aeb..907644202b0c3 100644
+--- a/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h
++++ b/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h
+@@ -305,6 +305,8 @@
+ #define mmPCIE_AUX_FLR_CTRL                                          0xC07394
+ #define mmPCIE_AUX_DBI                                               0xC07490
+ 
++#define mmPCIE_CORE_MSI_REQ                                          0xC04100
++
+ #define mmPSOC_PCI_PLL_NR                                            0xC72100
+ #define mmSRAM_W_PLL_NR                                              0x4C8100
+ #define mmPSOC_HBM_PLL_NR                                            0xC74100
+diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
+index c94cb5382dc92..250742ffdfd91 100644
+--- a/drivers/net/phy/mdio_device.c
++++ b/drivers/net/phy/mdio_device.c
+@@ -179,6 +179,16 @@ static int mdio_remove(struct device *dev)
+       return 0;
+ }
+ 
++static void mdio_shutdown(struct device *dev)
++{
++      struct mdio_device *mdiodev = to_mdio_device(dev);
++      struct device_driver *drv = mdiodev->dev.driver;
++      struct mdio_driver *mdiodrv = to_mdio_driver(drv);
++
++      if (mdiodrv->shutdown)
++              mdiodrv->shutdown(mdiodev);
++}
++
+ /**
+  * mdio_driver_register - register an mdio_driver with the MDIO layer
+  * @drv: new mdio_driver to register
+@@ -193,6 +203,7 @@ int mdio_driver_register(struct mdio_driver *drv)
+       mdiodrv->driver.bus = &mdio_bus_type;
+       mdiodrv->driver.probe = mdio_probe;
+       mdiodrv->driver.remove = mdio_remove;
++      mdiodrv->driver.shutdown = mdio_shutdown;
+ 
+       retval = driver_register(&mdiodrv->driver);
+       if (retval) {
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index cedba56fc448e..ef925895739f0 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -7455,23 +7455,18 @@ static s32 brcmf_translate_country_code(struct 
brcmf_pub *drvr, char alpha2[2],
+       s32 found_index;
+       int i;
+ 
++      country_codes = drvr->settings->country_codes;
++      if (!country_codes) {
++              brcmf_dbg(TRACE, "No country codes configured for device\n");
++              return -EINVAL;
++      }
++
+       if ((alpha2[0] == ccreq->country_abbrev[0]) &&
+           (alpha2[1] == ccreq->country_abbrev[1])) {
+               brcmf_dbg(TRACE, "Country code already set\n");
+               return -EAGAIN;
+       }
+ 
+-      country_codes = drvr->settings->country_codes;
+-      if (!country_codes) {
+-              brcmf_dbg(TRACE, "No country codes configured for device, using 
ISO3166 code and 0 rev\n");
+-              memset(ccreq, 0, sizeof(*ccreq));
+-              ccreq->country_abbrev[0] = alpha2[0];
+-              ccreq->country_abbrev[1] = alpha2[1];
+-              ccreq->ccode[0] = alpha2[0];
+-              ccreq->ccode[1] = alpha2[1];
+-              return 0;
+-      }
+-
+       found_index = -1;
+       for (i = 0; i < country_codes->table_size; i++) {
+               cc = &country_codes->table[i];
+diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
+index 39a01c2a3058d..32d5bc4919d8c 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -499,7 +499,7 @@ check_frags:
+                                * the header's copy failed, and they are
+                                * sharing a slot, send an error
+                                */
+-                              if (i == 0 && sharedslot)
++                              if (i == 0 && !first_shinfo && sharedslot)
+                                       xenvif_idx_release(queue, pending_idx,
+                                                          XEN_NETIF_RSP_ERROR);
+                               else
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index b08a61ca283f2..6ebe68396712c 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -2487,6 +2487,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl 
*ctrl, bool start_queues)
+        */
+       if (ctrl->ctrl.queue_count > 1) {
+               nvme_stop_queues(&ctrl->ctrl);
++              nvme_sync_io_queues(&ctrl->ctrl);
+               blk_mq_tagset_busy_iter(&ctrl->tag_set,
+                               nvme_fc_terminate_exchange, &ctrl->ctrl);
+               blk_mq_tagset_wait_completed_request(&ctrl->tag_set);
+@@ -2510,6 +2511,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl 
*ctrl, bool start_queues)
+        * clean up the admin queue. Same thing as above.
+        */
+       blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++      blk_sync_queue(ctrl->ctrl.admin_q);
+       blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
+                               nvme_fc_terminate_exchange, &ctrl->ctrl);
+       blk_mq_tagset_wait_completed_request(&ctrl->admin_tag_set);
+@@ -2951,14 +2953,6 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
+       if (ctrl->ctrl.queue_count == 1)
+               return 0;
+ 
+-      ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
+-      if (ret)
+-              goto out_free_io_queues;
+-
+-      ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
+-      if (ret)
+-              goto out_delete_hw_queues;
+-
+       if (prior_ioq_cnt != nr_io_queues) {
+               dev_info(ctrl->ctrl.device,
+                       "reconnect: revising io queue count from %d to %d\n",
+@@ -2968,6 +2962,14 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
+               nvme_unfreeze(&ctrl->ctrl);
+       }
+ 
++      ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
++      if (ret)
++              goto out_free_io_queues;
++
++      ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
++      if (ret)
++              goto out_delete_hw_queues;
++
+       return 0;
+ 
+ out_delete_hw_queues:
+diff --git a/drivers/platform/x86/gigabyte-wmi.c 
b/drivers/platform/x86/gigabyte-wmi.c
+index 7f3a03f937f66..d53634c8a6e09 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -144,6 +144,7 @@ static const struct dmi_system_id 
gigabyte_wmi_known_working_platforms[] = {
+       DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"),
+       DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE V2"),
+       DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 GAMING X V2"),
++      DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550I AORUS PRO AX"),
+       DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550M AORUS PRO-P"),
+       DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550M DS3H"),
+       DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z390 I AORUS PRO WIFI-CF"),
+diff --git a/drivers/platform/x86/touchscreen_dmi.c 
b/drivers/platform/x86/touchscreen_dmi.c
+index 0e1451b1d9c6c..033f797861d8a 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -100,10 +100,10 @@ static const struct ts_dmi_data chuwi_hi10_air_data = {
+ };
+ 
+ static const struct property_entry chuwi_hi10_plus_props[] = {
+-      PROPERTY_ENTRY_U32("touchscreen-min-x", 0),
+-      PROPERTY_ENTRY_U32("touchscreen-min-y", 5),
+-      PROPERTY_ENTRY_U32("touchscreen-size-x", 1914),
+-      PROPERTY_ENTRY_U32("touchscreen-size-y", 1283),
++      PROPERTY_ENTRY_U32("touchscreen-min-x", 12),
++      PROPERTY_ENTRY_U32("touchscreen-min-y", 10),
++      PROPERTY_ENTRY_U32("touchscreen-size-x", 1908),
++      PROPERTY_ENTRY_U32("touchscreen-size-y", 1270),
+       PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-chuwi-hi10plus.fw"),
+       PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+       PROPERTY_ENTRY_BOOL("silead,home-button"),
+@@ -111,6 +111,15 @@ static const struct property_entry 
chuwi_hi10_plus_props[] = {
+ };
+ 
+ static const struct ts_dmi_data chuwi_hi10_plus_data = {
++      .embedded_fw = {
++              .name   = "silead/gsl1680-chuwi-hi10plus.fw",
++              .prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
++              .length = 34056,
++              .sha256 = { 0xfd, 0x0a, 0x08, 0x08, 0x3c, 0xa6, 0x34, 0x4e,
++                          0x2c, 0x49, 0x9c, 0xcd, 0x7d, 0x44, 0x9d, 0x38,
++                          0x10, 0x68, 0xb5, 0xbd, 0xb7, 0x2a, 0x63, 0xb5,
++                          0x67, 0x0b, 0x96, 0xbd, 0x89, 0x67, 0x85, 0x09 },
++      },
+       .acpi_name      = "MSSL0017:00",
+       .properties     = chuwi_hi10_plus_props,
+ };
+@@ -141,6 +150,33 @@ static const struct ts_dmi_data chuwi_hi10_pro_data = {
+       .properties     = chuwi_hi10_pro_props,
+ };
+ 
++static const struct property_entry chuwi_hibook_props[] = {
++      PROPERTY_ENTRY_U32("touchscreen-min-x", 30),
++      PROPERTY_ENTRY_U32("touchscreen-min-y", 4),
++      PROPERTY_ENTRY_U32("touchscreen-size-x", 1892),
++      PROPERTY_ENTRY_U32("touchscreen-size-y", 1276),
++      PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"),
++      PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++      PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-chuwi-hibook.fw"),
++      PROPERTY_ENTRY_U32("silead,max-fingers", 10),
++      PROPERTY_ENTRY_BOOL("silead,home-button"),
++      { }
++};
++
++static const struct ts_dmi_data chuwi_hibook_data = {
++      .embedded_fw = {
++              .name   = "silead/gsl1680-chuwi-hibook.fw",
++              .prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
++              .length = 40392,
++              .sha256 = { 0xf7, 0xc0, 0xe8, 0x5a, 0x6c, 0xf2, 0xeb, 0x8d,
++                          0x12, 0xc4, 0x45, 0xbf, 0x55, 0x13, 0x4c, 0x1a,
++                          0x13, 0x04, 0x31, 0x08, 0x65, 0x73, 0xf7, 0xa8,
++                          0x1b, 0x7d, 0x59, 0xc9, 0xe6, 0x97, 0xf7, 0x38 },
++      },
++      .acpi_name      = "MSSL0017:00",
++      .properties     = chuwi_hibook_props,
++};
++
+ static const struct property_entry chuwi_vi8_props[] = {
+       PROPERTY_ENTRY_U32("touchscreen-min-x", 4),
+       PROPERTY_ENTRY_U32("touchscreen-min-y", 6),
+@@ -979,6 +1015,16 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
+                       DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+               },
+       },
++      {
++              /* Chuwi HiBook (CWI514) */
++              .driver_data = (void *)&chuwi_hibook_data,
++              .matches = {
++                      DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
++                      DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++                      /* Above matches are too generic, add bios-date match */
++                      DMI_MATCH(DMI_BIOS_DATE, "05/07/2016"),
++              },
++      },
+       {
+               /* Chuwi Vi8 (CWI506) */
+               .driver_data = (void *)&chuwi_vi8_data,
+diff --git a/drivers/scsi/elx/efct/efct_lio.c 
b/drivers/scsi/elx/efct/efct_lio.c
+index e0d798d6baee3..f1d6fcfe12f0d 100644
+--- a/drivers/scsi/elx/efct/efct_lio.c
++++ b/drivers/scsi/elx/efct/efct_lio.c
+@@ -880,11 +880,11 @@ efct_lio_npiv_drop_nport(struct se_wwn *wwn)
+       struct efct *efct = lio_vport->efct;
+       unsigned long flags = 0;
+ 
+-      spin_lock_irqsave(&efct->tgt_efct.efct_lio_lock, flags);
+-
+       if (lio_vport->fc_vport)
+               fc_vport_terminate(lio_vport->fc_vport);
+ 
++      spin_lock_irqsave(&efct->tgt_efct.efct_lio_lock, flags);
++
+       list_for_each_entry_safe(vport, next_vport, &efct->tgt_efct.vport_list,
+                                list_entry) {
+               if (vport->lio_vport == lio_vport) {
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index b8d55af763f92..134c7a8145efa 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3441,15 +3441,16 @@ static int sd_probe(struct device *dev)
+       }
+ 
+       device_initialize(&sdkp->dev);
+-      sdkp->dev.parent = dev;
++      sdkp->dev.parent = get_device(dev);
+       sdkp->dev.class = &sd_disk_class;
+       dev_set_name(&sdkp->dev, "%s", dev_name(dev));
+ 
+       error = device_add(&sdkp->dev);
+-      if (error)
+-              goto out_free_index;
++      if (error) {
++              put_device(&sdkp->dev);
++              goto out;
++      }
+ 
+-      get_device(dev);
+       dev_set_drvdata(dev, sdkp);
+ 
+       gd->major = sd_major((index & 0xf0) >> 4);
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index c2afba2a5414d..43e682297fd5f 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -87,9 +87,16 @@ static int ses_recv_diag(struct scsi_device *sdev, int 
page_code,
+               0
+       };
+       unsigned char recv_page_code;
++      unsigned int retries = SES_RETRIES;
++      struct scsi_sense_hdr sshdr;
++
++      do {
++              ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
++                                     &sshdr, SES_TIMEOUT, 1, NULL);
++      } while (ret > 0 && --retries && scsi_sense_valid(&sshdr) &&
++               (sshdr.sense_key == NOT_READY ||
++                (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
+ 
+-      ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+-                              NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+       if (unlikely(ret))
+               return ret;
+ 
+@@ -121,9 +128,16 @@ static int ses_send_diag(struct scsi_device *sdev, int 
page_code,
+               bufflen & 0xff,
+               0
+       };
++      struct scsi_sense_hdr sshdr;
++      unsigned int retries = SES_RETRIES;
++
++      do {
++              result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, 
bufflen,
++                                        &sshdr, SES_TIMEOUT, 1, NULL);
++      } while (result > 0 && --retries && scsi_sense_valid(&sshdr) &&
++               (sshdr.sense_key == NOT_READY ||
++                (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
+ 
+-      result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
+-                                NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+       if (result)
+               sdev_printk(KERN_ERR, sdev, "SEND DIAGNOSTIC result: %8x\n",
+                           result);
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 540861ca2ba37..553b6b9d02222 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -600,6 +600,12 @@ static int rockchip_spi_transfer_one(
+       int ret;
+       bool use_dma;
+ 
++      /* Zero length transfers won't trigger an interrupt on completion */
++      if (!xfer->len) {
++              spi_finalize_current_transfer(ctlr);
++              return 1;
++      }
++
+       WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
+               (readl_relaxed(rs->regs + ROCKCHIP_SPI_SR) & SR_BUSY));
+ 
+diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
+index 4c7ebd1d3f9c9..b1162e566a707 100644
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -417,7 +417,7 @@ static irqreturn_t tsens_critical_irq_thread(int irq, void 
*data)
+               const struct tsens_sensor *s = &priv->sensor[i];
+               u32 hw_id = s->hw_id;
+ 
+-              if (IS_ERR(s->tzd))
++              if (!s->tzd)
+                       continue;
+               if (!tsens_threshold_violated(priv, hw_id, &d))
+                       continue;
+@@ -467,7 +467,7 @@ static irqreturn_t tsens_irq_thread(int irq, void *data)
+               const struct tsens_sensor *s = &priv->sensor[i];
+               u32 hw_id = s->hw_id;
+ 
+-              if (IS_ERR(s->tzd))
++              if (!s->tzd)
+                       continue;
+               if (!tsens_threshold_violated(priv, hw_id, &d))
+                       continue;
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 2a7828971d056..a215ec9e172e6 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5191,6 +5191,10 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+       hcd->has_tt = 1;
+ 
+       res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++      if (!res) {
++              retval = -EINVAL;
++              goto error1;
++      }
+       hcd->rsrc_start = res->start;
+       hcd->rsrc_len = resource_size(res);
+ 
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index a3e7be96527d7..23fd09a9bbaf1 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -396,6 +396,14 @@ static int __unmap_grant_pages(struct gntdev_grant_map 
*map, int offset,
+                       map->unmap_ops[offset+i].handle,
+                       map->unmap_ops[offset+i].status);
+               map->unmap_ops[offset+i].handle = INVALID_GRANT_HANDLE;
++              if (use_ptemod) {
++                      if (map->kunmap_ops[offset+i].status)
++                              err = -EINVAL;
++                      pr_debug("kunmap handle=%u st=%d\n",
++                               map->kunmap_ops[offset+i].handle,
++                               map->kunmap_ops[offset+i].status);
++                      map->kunmap_ops[offset+i].handle = INVALID_GRANT_HANDLE;
++              }
+       }
+       return err;
+ }
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index dbb18dc956f34..de4f55154d498 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -232,10 +232,11 @@ retry:
+       /*
+        * Get IO TLB memory from any location.
+        */
+-      start = memblock_alloc(PAGE_ALIGN(bytes), PAGE_SIZE);
++      start = memblock_alloc(PAGE_ALIGN(bytes),
++                             IO_TLB_SEGSIZE << IO_TLB_SHIFT);
+       if (!start)
+-              panic("%s: Failed to allocate %lu bytes align=0x%lx\n",
+-                    __func__, PAGE_ALIGN(bytes), PAGE_SIZE);
++              panic("%s: Failed to allocate %lu bytes\n",
++                    __func__, PAGE_ALIGN(bytes));
+ 
+       /*
+        * And replace that memory with pages under 4GB.
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 54ee54ae36bc8..4579bbda46346 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -1760,6 +1760,10 @@ static int afs_link(struct dentry *from, struct inode 
*dir,
+               goto error;
+       }
+ 
++      ret = afs_validate(vnode, op->key);
++      if (ret < 0)
++              goto error_op;
++
+       afs_op_set_vnode(op, 0, dvnode);
+       afs_op_set_vnode(op, 1, vnode);
+       op->file[0].dv_delta = 1;
+@@ -1773,6 +1777,8 @@ static int afs_link(struct dentry *from, struct inode 
*dir,
+       op->create.reason       = afs_edit_dir_for_link;
+       return afs_do_sync_operation(op);
+ 
++error_op:
++      afs_put_operation(op);
+ error:
+       d_drop(dentry);
+       _leave(" = %d", ret);
+@@ -1957,6 +1963,11 @@ static int afs_rename(struct user_namespace 
*mnt_userns, struct inode *old_dir,
+       if (IS_ERR(op))
+               return PTR_ERR(op);
+ 
++      ret = afs_validate(vnode, op->key);
++      op->error = ret;
++      if (ret < 0)
++              goto error;
++
+       afs_op_set_vnode(op, 0, orig_dvnode);
+       afs_op_set_vnode(op, 1, new_dvnode); /* May be same as orig_dvnode */
+       op->file[0].dv_delta = 1;
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index db035ae2a1345..5efa1cf2a20a4 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -24,12 +24,13 @@ static void afs_invalidatepage(struct page *page, unsigned 
int offset,
+ static int afs_releasepage(struct page *page, gfp_t gfp_flags);
+ 
+ static void afs_readahead(struct readahead_control *ractl);
++static ssize_t afs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter);
+ 
+ const struct file_operations afs_file_operations = {
+       .open           = afs_open,
+       .release        = afs_release,
+       .llseek         = generic_file_llseek,
+-      .read_iter      = generic_file_read_iter,
++      .read_iter      = afs_file_read_iter,
+       .write_iter     = afs_file_write,
+       .mmap           = afs_file_mmap,
+       .splice_read    = generic_file_splice_read,
+@@ -502,3 +503,16 @@ static int afs_file_mmap(struct file *file, struct 
vm_area_struct *vma)
+               vma->vm_ops = &afs_vm_ops;
+       return ret;
+ }
++
++static ssize_t afs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
++{
++      struct afs_vnode *vnode = AFS_FS_I(file_inode(iocb->ki_filp));
++      struct afs_file *af = iocb->ki_filp->private_data;
++      int ret;
++
++      ret = afs_validate(vnode, af->key);
++      if (ret < 0)
++              return ret;
++
++      return generic_file_read_iter(iocb, iter);
++}
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index e86f5a245514d..2dfe3b3a53d69 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -807,6 +807,7 @@ int afs_writepages(struct address_space *mapping,
+ ssize_t afs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ {
+       struct afs_vnode *vnode = AFS_FS_I(file_inode(iocb->ki_filp));
++      struct afs_file *af = iocb->ki_filp->private_data;
+       ssize_t result;
+       size_t count = iov_iter_count(from);
+ 
+@@ -822,6 +823,10 @@ ssize_t afs_file_write(struct kiocb *iocb, struct 
iov_iter *from)
+       if (!count)
+               return 0;
+ 
++      result = afs_validate(vnode, af->key);
++      if (result < 0)
++              return result;
++
+       result = generic_file_write_iter(iocb, from);
+ 
+       _leave(" = %zd", result);
+@@ -835,13 +840,18 @@ ssize_t afs_file_write(struct kiocb *iocb, struct 
iov_iter *from)
+  */
+ int afs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+ {
+-      struct inode *inode = file_inode(file);
+-      struct afs_vnode *vnode = AFS_FS_I(inode);
++      struct afs_vnode *vnode = AFS_FS_I(file_inode(file));
++      struct afs_file *af = file->private_data;
++      int ret;
+ 
+       _enter("{%llx:%llu},{n=%pD},%d",
+              vnode->fid.vid, vnode->fid.vnode, file,
+              datasync);
+ 
++      ret = afs_validate(vnode, af->key);
++      if (ret < 0)
++              return ret;
++
+       return file_write_and_wait_range(file, start, end);
+ }
+ 
+@@ -855,11 +865,14 @@ vm_fault_t afs_page_mkwrite(struct vm_fault *vmf)
+       struct file *file = vmf->vma->vm_file;
+       struct inode *inode = file_inode(file);
+       struct afs_vnode *vnode = AFS_FS_I(inode);
++      struct afs_file *af = file->private_data;
+       unsigned long priv;
+       vm_fault_t ret = VM_FAULT_RETRY;
+ 
+       _enter("{{%llx:%llu}},{%lx}", vnode->fid.vid, vnode->fid.vnode, 
page->index);
+ 
++      afs_validate(vnode, af->key);
++
+       sb_start_pagefault(inode->i_sb);
+ 
+       /* Wait for the page to be written to the cache before we allow it to
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index df6631eefc652..5e8a56113b23d 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -666,7 +666,18 @@ blk_status_t btrfs_csum_one_bio(struct btrfs_inode 
*inode, struct bio *bio,
+ 
+               if (!ordered) {
+                       ordered = btrfs_lookup_ordered_extent(inode, offset);
+-                      BUG_ON(!ordered); /* Logic error */
++                      /*
++                       * The bio range is not covered by any ordered extent,
++                       * must be a code logic error.
++                       */
++                      if (unlikely(!ordered)) {
++                              WARN(1, KERN_WARNING
++                      "no ordered extent for root %llu ino %llu offset 
%llu\n",
++                                   inode->root->root_key.objectid,
++                                   btrfs_ino(inode), offset);
++                              kvfree(sums);
++                              return BLK_STS_IOERR;
++                      }
+               }
+ 
+               nr_sectors = BTRFS_BYTES_TO_BLKS(fs_info,
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 682416d4edefa..19c780242e127 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1149,6 +1149,19 @@ static void btrfs_close_one_device(struct btrfs_device 
*device)
+       atomic_set(&device->dev_stats_ccnt, 0);
+       extent_io_tree_release(&device->alloc_state);
+ 
++      /*
++       * Reset the flush error record. We might have a transient flush error
++       * in this mount, and if so we aborted the current transaction and set
++       * the fs to an error state, guaranteeing no super blocks can be further
++       * committed. However that error might be transient and if we unmount 
the
++       * filesystem and mount it again, we should allow the mount to succeed
++       * (btrfs_check_rw_degradable() should not fail) - if after mounting the
++       * filesystem again we still get flush errors, then we will again abort
++       * any transaction and set the error state, guaranteeing no commits of
++       * unsafe super blocks.
++       */
++      device->last_flush_error = 0;
++
+       /* Verify the device is back in a pristine state  */
+       ASSERT(!test_bit(BTRFS_DEV_STATE_FLUSH_SENT, &device->dev_state));
+       ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state));
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index b6d2e35919278..e1739d0135b44 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2398,7 +2398,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int 
*len)
+       buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd);
+       /* Ship the ACL for now. we will copy it into buf later. */
+       aclptr = ptr;
+-      ptr += sizeof(struct cifs_acl);
++      ptr += sizeof(struct smb3_acl);
+ 
+       /* create one ACE to hold the mode embedded in reserved special SID */
+       acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode);
+@@ -2423,7 +2423,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int 
*len)
+       acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */
+       acl.AclSize = cpu_to_le16(acl_size);
+       acl.AceCount = cpu_to_le16(ace_count);
+-      memcpy(aclptr, &acl, sizeof(struct cifs_acl));
++      memcpy(aclptr, &acl, sizeof(struct smb3_acl));
+ 
+       buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
+       *len = roundup(ptr - (__u8 *)buf, 8);
+diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
+index 1f3f4326bf3ce..c17ccc19b938e 100644
+--- a/fs/ext2/balloc.c
++++ b/fs/ext2/balloc.c
+@@ -48,10 +48,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct 
super_block * sb,
+       struct ext2_sb_info *sbi = EXT2_SB(sb);
+ 
+       if (block_group >= sbi->s_groups_count) {
+-              ext2_error (sb, "ext2_get_group_desc",
+-                          "block_group >= groups_count - "
+-                          "block_group = %d, groups_count = %lu",
+-                          block_group, sbi->s_groups_count);
++              WARN(1, "block_group >= groups_count - "
++                   "block_group = %d, groups_count = %lu",
++                   block_group, sbi->s_groups_count);
+ 
+               return NULL;
+       }
+@@ -59,10 +58,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct 
super_block * sb,
+       group_desc = block_group >> EXT2_DESC_PER_BLOCK_BITS(sb);
+       offset = block_group & (EXT2_DESC_PER_BLOCK(sb) - 1);
+       if (!sbi->s_group_desc[group_desc]) {
+-              ext2_error (sb, "ext2_get_group_desc",
+-                          "Group descriptor not loaded - "
+-                          "block_group = %d, group_desc = %lu, desc = %lu",
+-                           block_group, group_desc, offset);
++              WARN(1, "Group descriptor not loaded - "
++                   "block_group = %d, group_desc = %lu, desc = %lu",
++                    block_group, group_desc, offset);
+               return NULL;
+       }
+ 
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 699a08d724c24..675216f7022da 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8648,8 +8648,10 @@ static void io_destroy_buffers(struct io_ring_ctx *ctx)
+       struct io_buffer *buf;
+       unsigned long index;
+ 
+-      xa_for_each(&ctx->io_buffers, index, buf)
++      xa_for_each(&ctx->io_buffers, index, buf) {
+               __io_remove_buffers(ctx, buf, index, -1U);
++              cond_resched();
++      }
+ }
+ 
+ static void io_req_cache_free(struct list_head *list, struct task_struct *tsk)
+@@ -9145,8 +9147,10 @@ static void io_uring_clean_tctx(struct io_uring_task 
*tctx)
+       struct io_tctx_node *node;
+       unsigned long index;
+ 
+-      xa_for_each(&tctx->xa, index, node)
++      xa_for_each(&tctx->xa, index, node) {
+               io_uring_del_tctx_node(index);
++              cond_resched();
++      }
+       if (wq) {
+               /*
+                * Must be after io_uring_del_task_file() (removes nodes under
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 3d805f5b1f5d2..1c33a52558930 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3570,7 +3570,7 @@ static struct nfsd4_conn *__nfsd4_find_conn(struct 
svc_xprt *xpt, struct nfsd4_s
+ }
+ 
+ static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
+-                              struct nfsd4_session *session, u32 req)
++              struct nfsd4_session *session, u32 req, struct nfsd4_conn 
**conn)
+ {
+       struct nfs4_client *clp = session->se_client;
+       struct svc_xprt *xpt = rqst->rq_xprt;
+@@ -3593,6 +3593,8 @@ static __be32 nfsd4_match_existing_connection(struct 
svc_rqst *rqst,
+       else
+               status = nfserr_inval;
+       spin_unlock(&clp->cl_lock);
++      if (status == nfs_ok && conn)
++              *conn = c;
+       return status;
+ }
+ 
+@@ -3617,8 +3619,16 @@ __be32 nfsd4_bind_conn_to_session(struct svc_rqst 
*rqstp,
+       status = nfserr_wrong_cred;
+       if (!nfsd4_mach_creds_match(session->se_client, rqstp))
+               goto out;
+-      status = nfsd4_match_existing_connection(rqstp, session, bcts->dir);
+-      if (status == nfs_ok || status == nfserr_inval)
++      status = nfsd4_match_existing_connection(rqstp, session,
++                      bcts->dir, &conn);
++      if (status == nfs_ok) {
++              if (bcts->dir == NFS4_CDFC4_FORE_OR_BOTH ||
++                              bcts->dir == NFS4_CDFC4_BACK)
++                      conn->cn_flags |= NFS4_CDFC4_BACK;
++              nfsd4_probe_callback(session->se_client);
++              goto out;
++      }
++      if (status == nfserr_inval)
+               goto out;
+       status = nfsd4_map_bcts_dir(&bcts->dir);
+       if (status)
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 3fcd24236793e..cb95d3f3337d5 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -422,6 +422,7 @@ enum {
+       ATA_HORKAGE_NOTRIM      = (1 << 24),    /* don't use TRIM */
+       ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),   /* Limit max sects to 1024 */
+       ATA_HORKAGE_MAX_TRIM_128M = (1 << 26),  /* Limit max trim size to 128M 
*/
++      ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27),  /* Disable NCQ on ATI chipset */
+ 
+        /* DMA mask for user DMA control: User visible values; DO NOT
+           renumber */
+diff --git a/include/linux/mdio.h b/include/linux/mdio.h
+index ffb787d5ebde3..5e6dc38f418e4 100644
+--- a/include/linux/mdio.h
++++ b/include/linux/mdio.h
+@@ -80,6 +80,9 @@ struct mdio_driver {
+ 
+       /* Clears up any memory if needed */
+       void (*remove)(struct mdio_device *mdiodev);
++
++      /* Quiesces the device on system shutdown, turns off interrupts etc */
++      void (*shutdown)(struct mdio_device *mdiodev);
+ };
+ 
+ static inline struct mdio_driver *
+diff --git a/scripts/Makefile.kasan b/scripts/Makefile.kasan
+index 801c415bac59d..b9e94c5e70970 100644
+--- a/scripts/Makefile.kasan
++++ b/scripts/Makefile.kasan
+@@ -33,10 +33,11 @@ else
+       CFLAGS_KASAN := $(CFLAGS_KASAN_SHADOW) \
+        $(call cc-param,asan-globals=1) \
+        $(call 
cc-param,asan-instrumentation-with-call-threshold=$(call_threshold)) \
+-       $(call cc-param,asan-stack=$(stack_enable)) \
+        $(call cc-param,asan-instrument-allocas=1)
+ endif
+ 
++CFLAGS_KASAN += $(call cc-param,asan-stack=$(stack_enable))
++
+ endif # CONFIG_KASAN_GENERIC
+ 
+ ifdef CONFIG_KASAN_SW_TAGS
+diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c
+index c41f95815480d..797699462cd8e 100644
+--- a/tools/arch/x86/lib/insn.c
++++ b/tools/arch/x86/lib/insn.c
+@@ -37,10 +37,10 @@
+       ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
+ 
+ #define __get_next(t, insn)   \
+-      ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); 
leXX_to_cpu(t, r); })
++      ({ t r; memcpy(&r, insn->next_byte, sizeof(t)); insn->next_byte += 
sizeof(t); leXX_to_cpu(t, r); })
+ 
+ #define __peek_nbyte_next(t, insn, n) \
+-      ({ t r = *(t*)((insn)->next_byte + n); leXX_to_cpu(t, r); })
++      ({ t r; memcpy(&r, (insn)->next_byte + n, sizeof(t)); leXX_to_cpu(t, 
r); })
+ 
+ #define get_next(t, insn)     \
+       ({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; 
__get_next(t, insn); })
+diff --git a/tools/testing/selftests/kvm/include/test_util.h 
b/tools/testing/selftests/kvm/include/test_util.h
+index d79be15dd3d20..451fed5ce8e72 100644
+--- a/tools/testing/selftests/kvm/include/test_util.h
++++ b/tools/testing/selftests/kvm/include/test_util.h
+@@ -95,6 +95,8 @@ struct vm_mem_backing_src_alias {
+       uint32_t flag;
+ };
+ 
++#define MIN_RUN_DELAY_NS      200000UL
++
+ bool thp_configured(void);
+ size_t get_trans_hugepagesz(void);
+ size_t get_def_hugetlb_pagesz(void);
+@@ -102,6 +104,7 @@ const struct vm_mem_backing_src_alias 
*vm_mem_backing_src_alias(uint32_t i);
+ size_t get_backing_src_pagesz(uint32_t i);
+ void backing_src_help(void);
+ enum vm_mem_backing_src_type parse_backing_src_type(const char *type_name);
++long get_run_delay(void);
+ 
+ /*
+  * Whether or not the given source type is shared memory (as opposed to
+diff --git a/tools/testing/selftests/kvm/lib/test_util.c 
b/tools/testing/selftests/kvm/lib/test_util.c
+index af1031fed97f7..a9107bfae4021 100644
+--- a/tools/testing/selftests/kvm/lib/test_util.c
++++ b/tools/testing/selftests/kvm/lib/test_util.c
+@@ -11,6 +11,7 @@
+ #include <stdlib.h>
+ #include <time.h>
+ #include <sys/stat.h>
++#include <sys/syscall.h>
+ #include <linux/mman.h>
+ #include "linux/kernel.h"
+ 
+@@ -129,13 +130,16 @@ size_t get_trans_hugepagesz(void)
+ {
+       size_t size;
+       FILE *f;
++      int ret;
+ 
+       TEST_ASSERT(thp_configured(), "THP is not configured in host kernel");
+ 
+       f = fopen("/sys/kernel/mm/transparent_hugepage/hpage_pmd_size", "r");
+       TEST_ASSERT(f != NULL, "Error in opening 
transparent_hugepage/hpage_pmd_size");
+ 
+-      fscanf(f, "%ld", &size);
++      ret = fscanf(f, "%ld", &size);
++      ret = fscanf(f, "%ld", &size);
++      TEST_ASSERT(ret < 1, "Error reading 
transparent_hugepage/hpage_pmd_size");
+       fclose(f);
+ 
+       return size;
+@@ -300,3 +304,19 @@ enum vm_mem_backing_src_type parse_backing_src_type(const 
char *type_name)
+       TEST_FAIL("Unknown backing src type: %s", type_name);
+       return -1;
+ }
++
++long get_run_delay(void)
++{
++      char path[64];
++      long val[2];
++      FILE *fp;
++
++      sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
++      fp = fopen(path, "r");
++      /* Return MIN_RUN_DELAY_NS upon failure just to be safe */
++      if (fscanf(fp, "%ld %ld ", &val[0], &val[1]) < 2)
++              val[1] = MIN_RUN_DELAY_NS;
++      fclose(fp);
++
++      return val[1];
++}
+diff --git a/tools/testing/selftests/kvm/steal_time.c 
b/tools/testing/selftests/kvm/steal_time.c
+index ecec30865a74f..62f2eb9ee3d56 100644
+--- a/tools/testing/selftests/kvm/steal_time.c
++++ b/tools/testing/selftests/kvm/steal_time.c
+@@ -10,7 +10,6 @@
+ #include <sched.h>
+ #include <pthread.h>
+ #include <linux/kernel.h>
+-#include <sys/syscall.h>
+ #include <asm/kvm.h>
+ #include <asm/kvm_para.h>
+ 
+@@ -20,7 +19,6 @@
+ 
+ #define NR_VCPUS              4
+ #define ST_GPA_BASE           (1 << 30)
+-#define MIN_RUN_DELAY_NS      200000UL
+ 
+ static void *st_gva[NR_VCPUS];
+ static uint64_t guest_stolen_time[NR_VCPUS];
+@@ -118,12 +116,12 @@ struct st_time {
+       uint64_t st_time;
+ };
+ 
+-static int64_t smccc(uint32_t func, uint32_t arg)
++static int64_t smccc(uint32_t func, uint64_t arg)
+ {
+       unsigned long ret;
+ 
+       asm volatile(
+-              "mov    x0, %1\n"
++              "mov    w0, %w1\n"
+               "mov    x1, %2\n"
+               "hvc    #0\n"
+               "mov    %0, x0\n"
+@@ -217,20 +215,6 @@ static void steal_time_dump(struct kvm_vm *vm, uint32_t 
vcpuid)
+ 
+ #endif
+ 
+-static long get_run_delay(void)
+-{
+-      char path[64];
+-      long val[2];
+-      FILE *fp;
+-
+-      sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
+-      fp = fopen(path, "r");
+-      fscanf(fp, "%ld %ld ", &val[0], &val[1]);
+-      fclose(fp);
+-
+-      return val[1];
+-}
+-
+ static void *do_steal_time(void *arg)
+ {
+       struct timespec ts, stop;
+diff --git a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c 
b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
+index e6480fd5c4bdc..8039e1eff9388 100644
+--- a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
++++ b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
+@@ -82,7 +82,8 @@ int get_warnings_count(void)
+       FILE *f;
+ 
+       f = popen("dmesg | grep \"WARNING:\" | wc -l", "r");
+-      fscanf(f, "%d", &warnings);
++      if (fscanf(f, "%d", &warnings) < 1)
++              warnings = 0;
+       fclose(f);
+ 
+       return warnings;
+diff --git a/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c 
b/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c
+index 117bf49a3d795..eda0d2a51224b 100644
+--- a/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c
++++ b/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c
+@@ -14,7 +14,6 @@
+ #include <stdint.h>
+ #include <time.h>
+ #include <sched.h>
+-#include <sys/syscall.h>
+ 
+ #define VCPU_ID               5
+ 
+@@ -98,20 +97,6 @@ static void guest_code(void)
+       GUEST_DONE();
+ }
+ 
+-static long get_run_delay(void)
+-{
+-        char path[64];
+-        long val[2];
+-        FILE *fp;
+-
+-        sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
+-        fp = fopen(path, "r");
+-        fscanf(fp, "%ld %ld ", &val[0], &val[1]);
+-        fclose(fp);
+-
+-        return val[1];
+-}
+-
+ static int cmp_timespec(struct timespec *a, struct timespec *b)
+ {
+       if (a->tv_sec > b->tv_sec)
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index fa2ac0e56b43c..fe7ee2b0f29c2 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -48,6 +48,7 @@ ARCH         ?= $(SUBARCH)
+ # When local build is done, headers are installed in the default
+ # INSTALL_HDR_PATH usr/include.
+ .PHONY: khdr
++.NOTPARALLEL:
+ khdr:
+ ifndef KSFT_KHDR_INSTALL_DONE
+ ifeq (1,$(DEFAULT_INSTALL_HDR_PATH))
+diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c
+index ee8208b2f9460..69c3ead25313d 100644
+--- a/tools/usb/testusb.c
++++ b/tools/usb/testusb.c
+@@ -265,12 +265,6 @@ nomem:
+       }
+ 
+       entry->ifnum = ifnum;
+-
+-      /* FIXME update USBDEVFS_CONNECTINFO so it tells about high speed etc */
+-
+-      fprintf(stderr, "%s speed\t%s\t%u\n",
+-              speed(entry->speed), entry->name, entry->ifnum);
+-
+       entry->next = testdevs;
+       testdevs = entry;
+       return 0;
+@@ -299,6 +293,14 @@ static void *handle_testdev (void *arg)
+               return 0;
+       }
+ 
++      status  =  ioctl(fd, USBDEVFS_GET_SPEED, NULL);
++      if (status < 0)
++              fprintf(stderr, "USBDEVFS_GET_SPEED failed %d\n", status);
++      else
++              dev->speed = status;
++      fprintf(stderr, "%s speed\t%s\t%u\n",
++                      speed(dev->speed), dev->name, dev->ifnum);
++
+ restart:
+       for (i = 0; i < TEST_CASES; i++) {
+               if (dev->test != -1 && dev->test != i)
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index 0517c744b04e8..f62f10c988db1 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -1331,7 +1331,7 @@ int main(int argc, char *argv[])
+       if (opt_list && opt_list_mapcnt)
+               kpagecount_fd = checked_open(PROC_KPAGECOUNT, O_RDONLY);
+ 
+-      if (opt_mark_idle && opt_file)
++      if (opt_mark_idle)
+               page_idle_fd = checked_open(SYS_KERNEL_MM_PAGE_IDLE, O_RDWR);
+ 
+       if (opt_list && opt_pid)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index b50dbe269f4bf..1a11dcb670a39 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3053,15 +3053,19 @@ out:
+ 
+ static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
+ {
+-      unsigned int old, val, shrink;
++      unsigned int old, val, shrink, grow_start;
+ 
+       old = val = vcpu->halt_poll_ns;
+       shrink = READ_ONCE(halt_poll_ns_shrink);
++      grow_start = READ_ONCE(halt_poll_ns_grow_start);
+       if (shrink == 0)
+               val = 0;
+       else
+               val /= shrink;
+ 
++      if (val < grow_start)
++              val = 0;
++
+       vcpu->halt_poll_ns = val;
+       trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
+ }

Reply via email to