Merge branch 'android12-5.10' into branch 'android12-5.10-lts'

Catch up on a number of bugfixes and abi updates in the android12-5.10
branch.  This merge contains the following commits:

6af2483a2f BACKPORT: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
d43bb6d288 UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove()
e6ddd6b656 UPSTREAM: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
e39ee80b1a UPSTREAM: net: xfrm: Fix xfrm_address_filter OOB read
40439d12b8 UPSTREAM: igb: set max size RX buffer when store bad packet is enabled
44ddc37b10 UPSTREAM: netfilter: nfnetlink_osf: avoid OOB read
ede2f9b7e5 ANDROID: abi_gki_aarch64_qcom: Add wait_for_device_probe symbol
db2f2cb88d UPSTREAM: netfilter: xt_sctp: validate the flag_info count
cba41df427 UPSTREAM: netfilter: xt_u32: validate user space input
4865c22b17 UPSTREAM: net/sched: Retire rsvp classifier
f8424e6555 UPSTREAM: ipv4: fix null-deref in ipv4_link_failure
cd7744312f UPSTREAM: netfilter: nf_tables: disallow rule removal from chain binding
6cd0cd3893 UPSTREAM: netfilter: nf_tables: report use refcount overflow
99d2841c81 UPSTREAM: usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
3cf9365660 Merge tag 'android12-5.10.189_r00' into android12-5.10
785004172f ANDROID: ABI: Update oplus symbol list
d3961f624b ANDROID: vendor_hooks: Add hooks for oem percpu-rwsem optimaton
180ea0f6d4 UPSTREAM: net: sched: sch_qfq: Fix UAF in qfq_dequeue()
6b6202b762 UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve
ff86e87c7e FROMGIT: f2fs: split initial and dynamic conditions for extent_cache
e22810eb27 ANDROID: GKI:  Update moto symbols list
3718ea1e77 ANDROID: vendor_hook: Add hook to skip swapcache
909a83a97d ANDROID: GKI: Update symbols to symbol list
6356ed35b9 ANDROID: add vendor hook of add/delete/iterate node for swap_avail_heads
bd34b88730 UPSTREAM: tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
7ba85ae103 UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
9f68d2976a UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
88525fa7d9 ANDROID: GKI update xiaomi symbols list
1a6995cf14 UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage().
37d958fa88 UPSTREAM: USB: dwc3: fix use-after-free on core driver unbind
6388400ba5 UPSTREAM: xhci: Fix incorrect tracking of free space on transfer rings
bc78acae08 UPSTREAM: kfence: avoid passing -g for test
b3bad92280 UPSTREAM: coresight: etm4x: Do not access TRCIDR1 for identification
b155bf3086 UPSTREAM: usb: typec: tcpm: fix warning when handle discover_identity message
72a7bbb4a3 UPSTREAM: f2fs: fix to update age extent in f2fs_do_zero_range()
1e1986dd44 UPSTREAM: f2fs: fix to update age extent correctly during truncation
3e9ba88034 BACKPORT: f2fs: fix to do sanity check on extent cache correctly
e95427763f UPSTREAM: net/sched: sch_qfq: refactor parsing of netlink parameters
216e24b08c BACKPORT: f2fs: don't reset unchangable mount option in f2fs_remount()
a96eb7c2ca ANDROID: arm64: dts: qcom: sdm845-db845c: Do not point MDSS to the boot splash memory region
ad067abfe1 BACKPORT: net: nfc: Fix use-after-free caused by nfc_llcp_find_local
00c7bec87c ANDROID: ABI: Update oplus symbol list  ashmem: is_ashmem_file Export is_ashmem_file function which will be used by the minidump module to get ashmem info.
300d1ff660 ANDROID: GKI: Update abi_gki_aarch64_qcom for page_owner symbols
a9c0f62260 ANDROID: mm: Export page_owner_inited and __set_page_owner
d26e92d681 FROMGIT: pstore/ram: Check start of empty przs during init
966df87a17 UPSTREAM: exfat: check if filename entries exceeds max filename length
dcb17f36f3 BACKPORT: FROMGIT: netfilter: nfnetlink_log: always add a timestamp
a8b58500cb FROMGIT: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
8001debfc1 UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer
8e682bb18a UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
14ce45e3c7 ANDROID: ABI: Update oplus symbol list
98a66e87c1 ANDROID: Export symbols to do reverse mapping within memcg in kernel modules.
8af1bc5622 ANDROID: GKI: export symbols to modify lru stats
b019a989a2 UPSTREAM: net: tap_open(): set sk_uid from current_fsuid()
169c9f103f UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid()
819a8605da UPSTREAM: netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
f2545eebf0 BACKPORT: UPSTREAM: usb: dwc3: gadget: Execute gadget stop after halting the controller
6d38ae2f4c UPSTREAM: usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
6f01e099d8 UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
0ebe76176b UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
45edbf4058 UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
e172f5cfc0 ANDROID: GKI: update xiaomi symbol list
28b82089b2 UPSTREAM: netfilter: nf_tables: skip bound chain on rule flush
bad8adda41 UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free
84f8556570 UPSTREAM: tty: n_gsm: fix UAF in gsm_cleanup_mux
0fa8d8cd99 UPSTREAM: netfilter: nft_set_pipapo: fix improper element removal
6efa28db9a BACKPORT: FROMGIT: irqchip/gic-v3: Workaround for GIC-700 erratum 2941627
ec3f57af0a ANDROID: vendor_hook: fix the error record position of mutex
028e0fb3a4 FROMGIT: fs: drop_caches: draining pages before dropping caches
67f65c7764 ANDROID: GKI: Update symbols to symbol list
8e164a95fb ANDROID: GKI: Update symbols to symbol list
c4191be802 ANDROID: GKI: add symbol list file for moto
2427afff1e UPSTREAM: gfs2: Don't deref jdesc in evict
e933b7be1c UPSTREAM: media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()

Change-Id: I7b09cba3db8ae584fd0821bfbecf945e7d0bf9a4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Documentation/arm64/silicon-errata.rst

@@ -113,6 +113,9 @@ stable kernels.
 | ARM            | MMU-500         | #841119,826419  | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | GIC-700         | #2941627        | ARM64_ERRATUM_2941627       |
++----------------+-----------------+-----------------+-----------------------------+
++----------------+-----------------+-----------------+-----------------------------+
 | Broadcom       | Brahma-B53      | N/A             | ARM64_ERRATUM_845719        |
 +----------------+-----------------+-----------------+-----------------------------+
 | Broadcom       | Brahma-B53      | N/A             | ARM64_ERRATUM_843419        |

android/abi_gki_aarch64_moto

@@ -0,0 +1,6 @@
+[abi_symbol_list]
+  swp_swap_info
+  __traceiter_android_vh_skip_swapcache
+  __traceiter_android_vh_tune_mmap_readaround
+  __tracepoint_android_vh_skip_swapcache
+  __tracepoint_android_vh_tune_mmap_readaround

android/abi_gki_aarch64_oplus

@@ -1357,6 +1357,7 @@
   irq_work_queue
   irq_work_queue_on
   irq_work_sync
+  is_ashmem_file
   is_dma_buf_file
   isolate_and_split_free_page
   isolate_anon_lru_page
@@ -1549,6 +1550,7 @@
   __memcat_p
   memcg_kmem_enabled_key
   mem_cgroup_from_id
+  mem_cgroup_update_lru_size
   memchr
   memchr_inv
   memcmp
@@ -1616,6 +1618,7 @@
   mmc_send_tuning
   mmput
   mod_delayed_work_on
+  __mod_lruvec_state
   mod_node_page_state
   mod_timer
   mod_timer_pending
@@ -1815,6 +1818,7 @@
   __page_mapcount
   page_mapping
   __page_pinner_migration_failed
+  page_referenced
   page_symlink
   page_to_lruvec
   panic
@@ -2253,6 +2257,7 @@
   rndis_set_param_vendor
   rndis_signal_connect
   rndis_uninit
+  root_mem_cgroup
   root_task_group
   round_jiffies
   round_jiffies_relative
@@ -2879,6 +2884,7 @@
   __traceiter_android_vh_process_killed
   __traceiter_android_vh_record_mutex_lock_starttime
   __traceiter_android_vh_record_pcpu_rwsem_starttime
+  __traceiter_android_vh_percpu_rwsem_wq_add
   __traceiter_android_vh_record_rtmutex_lock_starttime
   __traceiter_android_vh_record_rwsem_lock_starttime
   __traceiter_android_vh_remove_vmalloc_stack
@@ -3146,6 +3152,7 @@
   __tracepoint_android_vh_process_killed
   __tracepoint_android_vh_record_mutex_lock_starttime
   __tracepoint_android_vh_record_pcpu_rwsem_starttime
+  __tracepoint_android_vh_percpu_rwsem_wq_add
   __tracepoint_android_vh_record_rtmutex_lock_starttime
   __tracepoint_android_vh_record_rwsem_lock_starttime
   __tracepoint_android_vh_remove_vmalloc_stack

android/abi_gki_aarch64_qcom

@@ -1659,6 +1659,7 @@
   overflowuid
   page_endio
   page_mapping
+  page_owner_inited
   __page_pinner_migration_failed
   __pagevec_release
   panic
@@ -2187,6 +2188,7 @@
   set_normalized_timespec64
   set_page_dirty_lock
   __SetPageMovable
+  __set_page_owner
   set_task_cpu
   set_user_nice
   sg_alloc_table
@@ -3041,6 +3043,7 @@
   wait_for_completion_interruptible_timeout
   wait_for_completion_killable
   wait_for_completion_timeout
+  wait_for_device_probe
   wait_on_page_bit
   __wait_rcu_gp
   wait_woken

android/abi_gki_aarch64_transsion

@@ -9,12 +9,16 @@
   swap_alloc_cluster
   swapcache_free_entries
   swap_type_to_swap_info
+  blkcg_schedule_throttle
   __traceiter_android_rvh_alloc_si
   __traceiter_android_rvh_alloc_swap_slot_cache
   __traceiter_android_rvh_drain_slots_cache_cpu
   __traceiter_android_rvh_free_swap_slot
   __traceiter_android_rvh_get_swap_page
   __traceiter_android_rvh_handle_pte_fault_end
+  __traceiter_android_vh_add_to_avail_list
+  __traceiter_android_vh_del_from_avail_list
+  __traceiter_android_vh___cgroup_throttle_swaprate
   __traceiter_android_vh_account_swap_pages
   __traceiter_android_vh_alloc_si
   __traceiter_android_vh_alloc_swap_slot_cache
@@ -28,6 +32,7 @@
   __traceiter_android_vh_get_swap_page
   __traceiter_android_vh_handle_pte_fault_end
   __traceiter_android_vh_inactive_is_low
+  __traceiter_android_vh_swap_avail_heads_init
   __traceiter_android_vh_init_swap_info_struct
   __traceiter_android_vh_migrate_page_states
   __traceiter_android_vh_page_isolated_for_reclaim
@@ -46,6 +51,9 @@
   __tracepoint_android_rvh_free_swap_slot
   __tracepoint_android_rvh_get_swap_page
   __tracepoint_android_rvh_handle_pte_fault_end
+  __tracepoint_android_vh_add_to_avail_list
+  __tracepoint_android_vh_del_from_avail_list
+  __tracepoint_android_vh___cgroup_throttle_swaprate
   __tracepoint_android_vh_account_swap_pages
   __tracepoint_android_vh_alloc_si
   __tracepoint_android_vh_alloc_swap_slot_cache
@@ -59,6 +67,7 @@
   __tracepoint_android_vh_get_swap_page
   __tracepoint_android_vh_handle_pte_fault_end
   __tracepoint_android_vh_inactive_is_low
+  __tracepoint_android_vh_swap_avail_heads_init
   __tracepoint_android_vh_init_swap_info_struct
   __tracepoint_android_vh_migrate_page_states
   __tracepoint_android_vh_page_isolated_for_reclaim

android/abi_gki_aarch64_xiaomi

@@ -62,6 +62,14 @@
   ufshcd_update_evt_hist
   utf16s_to_utf8s
   wait_for_completion_io_timeout
+  nr_free_buffer_pages
+  mmc_set_blocklen
+
+#required by mq-deadline module
+  blk_mq_debugfs_rq_show
+  seq_list_start
+  seq_list_next
+  __blk_mq_debugfs_rq_show
 
 #required by cs35l41 module
   regcache_drop_region

android/abi_gki_aarch64_zebra

@@ -0,0 +1,4 @@
+[abi_symbol_list]
+  __traceiter_android_vh_wakeup_bypass
+  __tracepoint_android_vh_wakeup_bypass
+  tty_termios_hw_change

arch/arm/include/asm/arch_gicv3.h

@@ -48,6 +48,7 @@ static inline u32 read_ ## a64(void)		\
 	return read_sysreg(a32); 		\
 }						\
 
+CPUIF_MAP(ICC_EOIR1, ICC_EOIR1_EL1)
 CPUIF_MAP(ICC_PMR, ICC_PMR_EL1)
 CPUIF_MAP(ICC_AP0R0, ICC_AP0R0_EL1)
 CPUIF_MAP(ICC_AP0R1, ICC_AP0R1_EL1)

arch/arm64/boot/dts/qcom/sdm845-db845c.dts

@@ -85,6 +85,14 @@
 		};
 	};
 
+	reserved-memory {
+		/* Cont splash region set up by the bootloader */
+		cont_splash_mem: framebuffer@9d400000 {
+			reg = <0x0 0x9d400000 0x0 0x2400000>;
+			no-map;
+		};
+	};
+
 	lt9611_1v8: lt9611-vdd18-regulator {
 		compatible = "regulator-fixed";
 		regulator-name = "LT9611_1V8";

block/blk-cgroup.c

@@ -1794,6 +1794,7 @@ void blkcg_schedule_throttle(struct request_queue *q, bool use_memdelay)
 		current->use_memdelay = use_memdelay;
 	set_notify_resume(current);
 }
+EXPORT_SYMBOL_GPL(blkcg_schedule_throttle);
 
 /**
  * blkcg_add_delay - add delay to this blkg

build.config.gki.aarch64

@@ -22,6 +22,7 @@ android/abi_gki_aarch64_hikey960
 android/abi_gki_aarch64_honor
 android/abi_gki_aarch64_imx
 android/abi_gki_aarch64_lenovo
+android/abi_gki_aarch64_moto
 android/abi_gki_aarch64_mtk
 android/abi_gki_aarch64_nothing
 android/abi_gki_aarch64_oplus
@@ -31,6 +32,7 @@ android/abi_gki_aarch64_unisoc
 android/abi_gki_aarch64_virtual_device
 android/abi_gki_aarch64_vivo
 android/abi_gki_aarch64_xiaomi
+android/abi_gki_aarch64_zebra
 android/abi_gki_aarch64_asus
 android/abi_gki_aarch64_transsion
 android/abi_gki_aarch64_tuxera

drivers/android/vendor_hooks.c

@@ -106,6 +106,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_wakeup_ilocked);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_send_sig_info);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_process_killed);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_killed_process);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_percpu_rwsem_wq_add);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_wake);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_write_finished);
@@ -468,12 +469,16 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_free_swap_slot);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_swap_slot);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_get_swap_page);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_get_swap_page);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_add_to_avail_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_del_from_avail_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh___cgroup_throttle_swaprate);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_page_isolated_for_reclaim);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_inactive_is_low);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_snapshot_refaults);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_account_swap_pages);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_unuse_swap_page);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swap_avail_heads_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_init_swap_info_struct);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_si_swapinfo);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_alloc_si);
@@ -492,6 +497,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dma_buf_stats_teardown);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout_abort);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_compact_finished);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_wakeup_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_skip_swapcache);
 /*
  * For type visibility
  */

drivers/hwtracing/coresight/coresight-etm4x-core.c

@@ -960,25 +960,21 @@ static bool etm4_init_iomem_access(struct etmv4_drvdata *drvdata,
 				   struct csdev_access *csa)
 {
 	u32 devarch = readl_relaxed(drvdata->base + TRCDEVARCH);
-	u32 idr1 = readl_relaxed(drvdata->base + TRCIDR1);
 
 	/*
 	 * All ETMs must implement TRCDEVARCH to indicate that
-	 * the component is an ETMv4. To support any broken
-	 * implementations we fall back to TRCIDR1 check, which
-	 * is not really reliable.
+	 * the component is an ETMv4. Even though TRCIDR1 also
+	 * contains the information, it is part of the "Trace"
+	 * register and must be accessed with the OSLK cleared,
+	 * with MMIO. But we cannot touch the OSLK until we are
+	 * sure this is an ETM. So rely only on the TRCDEVARCH.
 	 */
-	if ((devarch & ETM_DEVARCH_ID_MASK) == ETM_DEVARCH_ETMv4x_ARCH) {
-		drvdata->arch = etm_devarch_to_arch(devarch);
-	} else {
-		pr_warn("CPU%d: ETM4x incompatible TRCDEVARCH: %x, falling back to TRCIDR1\n",
-			smp_processor_id(), devarch);
-
-		if (ETM_TRCIDR1_ARCH_MAJOR(idr1) != ETM_TRCIDR1_ARCH_ETMv4)
-			return false;
-		drvdata->arch = etm_trcidr_to_arch(idr1);
+	if ((devarch & ETM_DEVARCH_ID_MASK) != ETM_DEVARCH_ETMv4x_ARCH) {
+		pr_warn_once("TRCDEVARCH doesn't match ETMv4 architecture\n");
+		return false;
 	}
 
+	drvdata->arch = etm_devarch_to_arch(devarch);
 	*csa = CSDEV_ACCESS_IOMEM(drvdata->base);
 	return true;
 }

drivers/hwtracing/coresight/coresight-etm4x.h

@@ -668,14 +668,12 @@
  * TRCDEVARCH	- CoreSight architected register
  *                - Bits[15:12] - Major version
  *                - Bits[19:16] - Minor version
- * TRCIDR1	- ETM architected register
- *                - Bits[11:8] - Major version
- *                - Bits[7:4]  - Minor version
- * We must rely on TRCDEVARCH for the version information,
- * however we don't want to break the support for potential
- * old implementations which might not implement it. Thus
- * we fall back to TRCIDR1 if TRCDEVARCH is not implemented
- * for memory mapped components.
+ *
+ * We must rely only on TRCDEVARCH for the version information. Even though,
+ * TRCIDR1 also provides the architecture version, it is a "Trace" register
+ * and as such must be accessed only with Trace power domain ON. This may
+ * not be available at probe time.
+ *
  * Now to make certain decisions easier based on the version
  * we use an internal representation of the version in the
  * driver, as follows :
@@ -701,12 +699,6 @@ static inline u8 etm_devarch_to_arch(u32 devarch)
 				ETM_DEVARCH_REVISION(devarch));
 }
 
-static inline u8 etm_trcidr_to_arch(u32 trcidr1)
-{
-	return ETM_ARCH_VERSION(ETM_TRCIDR1_ARCH_MAJOR(trcidr1),
-				ETM_TRCIDR1_ARCH_MINOR(trcidr1));
-}
-
 enum etm_impdef_type {
 	ETM4_IMPDEF_HISI_CORE_COMMIT,
 	ETM4_IMPDEF_FEATURE_MAX,

drivers/irqchip/irq-gic-v3.c

@@ -51,6 +51,8 @@ struct redist_region {
 	bool			single_redist;
 };
 
+static DEFINE_STATIC_KEY_FALSE(gic_arm64_2941627_erratum);
+
 static struct gic_chip_data gic_data __read_mostly;
 static DEFINE_STATIC_KEY_TRUE(supports_deactivate_key);
 
@@ -542,9 +544,39 @@ static void gic_irq_nmi_teardown(struct irq_data *d)
 	gic_irq_set_prio(d, GICD_INT_DEF_PRI);
 }
 
+static bool gic_arm64_erratum_2941627_needed(struct irq_data *d)
+{
+	enum gic_intid_range range;
+
+	if (!static_branch_unlikely(&gic_arm64_2941627_erratum))
+		return false;
+
+	range = get_intid_range(d);
+
+	/*
+	 * The workaround is needed if the IRQ is an SPI and
+	 * the target cpu is different from the one we are
+	 * executing on.
+	 */
+	return (range == SPI_RANGE || range == ESPI_RANGE) &&
+		!cpumask_test_cpu(raw_smp_processor_id(),
+				  irq_data_get_effective_affinity_mask(d));
+}
+
 static void gic_eoi_irq(struct irq_data *d)
 {
-	gic_write_eoir(gic_irq(d));
+	write_gicreg(gic_irq(d), ICC_EOIR1_EL1);
+	isb();
+
+	if (gic_arm64_erratum_2941627_needed(d)) {
+		/*
+		 * Make sure the GIC stream deactivate packet
+		 * issued by ICC_EOIR1_EL1 has completed before
+		 * deactivating through GICD_IACTIVER.
+		 */
+		dsb(sy);
+		gic_poke_irq(d, GICD_ICACTIVER);
+	}
 }
 
 static void gic_eoimode1_eoi_irq(struct irq_data *d)
@@ -555,7 +587,11 @@ static void gic_eoimode1_eoi_irq(struct irq_data *d)
 	 */
 	if (gic_irq(d) >= 8192 || irqd_is_forwarded_to_vcpu(d))
 		return;
-	gic_write_dir(gic_irq(d));
+
+	if (!gic_arm64_erratum_2941627_needed(d))
+		gic_write_dir(gic_irq(d));
+	else
+		gic_poke_irq(d, GICD_ICACTIVER);
 }
 
 static int gic_set_type(struct irq_data *d, unsigned int type)
@@ -1642,6 +1678,12 @@ static bool gic_enable_quirk_hip06_07(void *data)
 	return false;
 }
 
+static bool gic_enable_quirk_arm64_2941627(void *data)
+{
+	static_branch_enable(&gic_arm64_2941627_erratum);
+	return true;
+}
+
 static const struct gic_quirk gic_quirks[] = {
 	{
 		.desc	= "GICv3: Qualcomm MSM8996 broken firmware",
@@ -1678,6 +1720,25 @@ static const struct gic_quirk gic_quirks[] = {
 		.mask	= 0xe8f00fff,
 		.init	= gic_enable_quirk_cavium_38539,
 	},
+	{
+		/*
+		 * GIC-700: 2941627 workaround - IP variant [0,1]
+		 *
+		 */
+		.desc	= "GICv3: ARM64 erratum 2941627",
+		.iidr	= 0x0400043b,
+		.mask	= 0xff0e0fff,
+		.init	= gic_enable_quirk_arm64_2941627,
+	},
+	{
+		/*
+		 * GIC-700: 2941627 workaround - IP variant [2]
+		 */
+		.desc	= "GICv3: ARM64 erratum 2941627",
+		.iidr	= 0x0402043b,
+		.mask	= 0xff0f0fff,
+		.init	= gic_enable_quirk_arm64_2941627,
+	},
 	{
 	}
 };

drivers/tty/n_gsm.c

@@ -2179,8 +2179,10 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
 
 	/* Free up any link layer users and finally the control channel */
 	for (i = NUM_DLCI - 1; i >= 0; i--)
-		if (gsm->dlci[i])
+		if (gsm->dlci[i]) {
 			gsm_dlci_release(gsm->dlci[i]);
+			gsm->dlci[i] = NULL;
+		}
 	mutex_unlock(&gsm->mutex);
 	/* Now wipe the queues */
 	tty_ldisc_flush(gsm->tty);

drivers/usb/dwc3/core.c

@@ -1741,6 +1741,11 @@ static int dwc3_remove(struct platform_device *pdev)
 	pm_runtime_allow(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
+	/*
+	 * HACK: Clear the driver data, which is currently accessed by parent
+	 * glue drivers, before allowing the parent to suspend.
+	 */
+	platform_set_drvdata(pdev, NULL);
 	pm_runtime_set_suspended(&pdev->dev);
 
 	dwc3_free_event_buffers(dwc);

drivers/usb/dwc3/gadget.c

@@ -2512,29 +2512,17 @@ static int __dwc3_gadget_start(struct dwc3 *dwc);
 static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
 {
 	unsigned long flags;
+	int ret;
 
 	spin_lock_irqsave(&dwc->lock, flags);
 	dwc->connected = false;
 
 	/*
-	 * Per databook, when we want to stop the gadget, if a control transfer
-	 * is still in process, complete it and get the core into setup phase.
+	 * Attempt to end pending SETUP status phase, and not wait for the
+	 * function to do so.
 	 */
-	if (dwc->ep0state != EP0_SETUP_PHASE) {
-		int ret;
-
-		if (dwc->delayed_status)
-			dwc3_ep0_send_delayed_status(dwc);
-
-		reinit_completion(&dwc->ep0_in_setup);
-
-		spin_unlock_irqrestore(&dwc->lock, flags);
-		ret = wait_for_completion_timeout(&dwc->ep0_in_setup,
-				msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT));
-		spin_lock_irqsave(&dwc->lock, flags);
-		if (ret == 0)
-			dev_warn(dwc->dev, "timed out waiting for SETUP phase\n");
-	}
+	if (dwc->delayed_status)
+		dwc3_ep0_send_delayed_status(dwc);
 
 	/*
 	 * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a
@@ -2544,9 +2532,35 @@ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
 	 * bit.
 	 */
 	dwc3_stop_active_transfers(dwc);
-	__dwc3_gadget_stop(dwc);
 	spin_unlock_irqrestore(&dwc->lock, flags);
 
+	/*
+	 * Per databook, when we want to stop the gadget, if a control transfer
+	 * is still in process, complete it and get the core into setup phase.
+	 * In case the host is unresponsive to a SETUP transaction, forcefully
+	 * stall the transfer, and move back to the SETUP phase, so that any
+	 * pending endxfers can be executed.
+	 */
+	if (dwc->ep0state != EP0_SETUP_PHASE) {
+		reinit_completion(&dwc->ep0_in_setup);
+
+		ret = wait_for_completion_timeout(&dwc->ep0_in_setup,
+				msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT));
+		if (ret == 0) {
+			unsigned int    dir;
+
+			dev_warn(dwc->dev, "wait for SETUP phase timed out\n");
+			spin_lock_irqsave(&dwc->lock, flags);
+			dir = !!dwc->ep0_expect_in;
+			if (dwc->ep0state == EP0_DATA_PHASE)
+				dwc3_ep0_end_control_data(dwc, dwc->eps[dir]);
+			else
+				dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]);
+			dwc3_ep0_stall_and_restart(dwc);
+			spin_unlock_irqrestore(&dwc->lock, flags);
+		}
+	}
+
 	/*
 	 * Note: if the GEVNTCOUNT indicates events in the event buffer, the
 	 * driver needs to acknowledge them before the controller can halt.
@@ -2554,7 +2568,19 @@ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
 	 * remaining event generated by the controller while polling for
 	 * DSTS.DEVCTLHLT.
 	 */
-	return dwc3_gadget_run_stop(dwc, false, false);
+	ret = dwc3_gadget_run_stop(dwc, false, false);
+
+	/*
+	 * Stop the gadget after controller is halted, so that if needed, the
+	 * events to update EP0 state can still occur while the run/stop
+	 * routine polls for the halted state.  DEVTEN is cleared as part of
+	 * gadget stop.
+	 */
+	spin_lock_irqsave(&dwc->lock, flags);
+	__dwc3_gadget_stop(dwc);
+	spin_unlock_irqrestore(&dwc->lock, flags);
+
+	return ret;
 }
 
 static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)

drivers/usb/host/xhci-ring.c

@@ -277,6 +277,26 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring,
 	trace_xhci_inc_enq(ring);
 }
 
+static int xhci_num_trbs_to(struct xhci_segment *start_seg, union xhci_trb *start,
+			    struct xhci_segment *end_seg, union xhci_trb *end,
+			    unsigned int num_segs)
+{
+	union xhci_trb *last_on_seg;
+	int num = 0;
+	int i = 0;
+
+	do {
+		if (start_seg == end_seg && end >= start)
+			return num + (end - start);
+		last_on_seg = &start_seg->trbs[TRBS_PER_SEGMENT - 1];
+		num += last_on_seg - start;
+		start_seg = start_seg->next;
+		start = start_seg->trbs;
+	} while (i++ <= num_segs);
+
+	return -EINVAL;
+}
+
 /*
  * Check to see if there's room to enqueue num_trbs on the ring and make sure
  * enqueue pointer will not advance into dequeue segment. See rules above.
@@ -2209,6 +2229,7 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep,
 		     u32 trb_comp_code)
 {
 	struct xhci_ep_ctx *ep_ctx;
+	int trbs_freed;
 
 	ep_ctx = xhci_get_ep_ctx(xhci, ep->vdev->out_ctx, ep->ep_index);
 
@@ -2280,9 +2301,15 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep,
 	}
 
 	/* Update ring dequeue pointer */
+	trbs_freed = xhci_num_trbs_to(ep_ring->deq_seg, ep_ring->dequeue,
+				      td->last_trb_seg, td->last_trb,
+				      ep_ring->num_segs);
+	if (trbs_freed < 0)
+		xhci_dbg(xhci, "Failed to count freed trbs at TD finish\n");
+	else
+		ep_ring->num_trbs_free += trbs_freed;
 	ep_ring->dequeue = td->last_trb;
 	ep_ring->deq_seg = td->last_trb_seg;
-	ep_ring->num_trbs_free += td->num_trbs - 1;
 	inc_deq(xhci, ep_ring);
 
 	return xhci_td_cleanup(xhci, td, ep_ring, td->status);