Merge aosp/android14-6.1 to aosp/android14-6.1-lts

* aosp/android14-6.1: BACKPORT: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline UPSTREAM: genirq/cpuhotplug: Retry with cpu_online_mask when migration fails UPSTREAM: genirq/cpuhotplug: Skip suspended interrupts when restoring affinity UPSTREAM: scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H UPSTREAM: mm/userfaultfd: UFFDIO_MOVE implementation should use ptep_get() UPSTREAM: f2fs: fix NULL pointer dereference in f2fs_submit_page_write() UPSTREAM: f2fs: zone: fix to wait completion of last bio in zone correctly UPSTREAM: iommu: Don't reserve 0-length IOVA region UPSTREAM: iommu: Fix printk arg in of_iommu_get_resv_regions() UPSTREAM: iommu: Map reserved memory as cacheable if device is coherent BACKPORT: io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval UPSTREAM: wifi: cfg80211: fix assoc response warning on failed links UPSTREAM: usb: typec: tcpm: Add additional checks for contaminant UPSTREAM: mm: remove duplicated vma->vm_flags check when expanding stack ANDROID: Update the ABI symbol list ANDROID: add vendor hook for mapping_shrinkable FROMLIST: sd: Retry START STOP UNIT commands FROMLIST: scsi: core: Retry passthrough commands if SCMD_RETRY_PASSTHROUGH is set ANDROID: GKI: Update symbol list for mtk ANDROID: Update the ABI symbol list ANDROID: GKI: add symbol list for telechips UPSTREAM: ufs: core: bypass quick recovery if need force reset ANDROID: Update the ABI symbol list UPSTREAM: ring-buffer: Fix a race between readers and resize checks UPSTREAM: lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2 compat UPSTREAM: lib/build_OID_registry: don't mention the full path of the script in output ANDROID: GKI: Add symbol list for exynosauto UPSTREAM: erofs: fix race in z_erofs_get_gbuf() ANDROID: fuse: Skip canonical path logic if ENOSYS ANDROID: fsnotify: Do not notify lower fs of open when ENOSYS ANDROID: mm: madvise: Avoid counting swap entry references for migration entries UPSTREAM: scsi: ufs: core: Changing the status to check inflight ANDROID: Update the ABI symbol list ANDROID: power: add vendor hook to handle hibernate failures ANDROID: GKI: remove export of tracing control functions ANDROID: fix kernelci build-break for !CONFIG_ANDROID_VENDOR_OEM_DATA ANDROID: GKI: update symbol list file for xiaomi ANDROID: vendor_hooks: vendor hooks for optimizing the blocking problem caused by rwsem lock contention of reverse mapping during memory recycling. UPSTREAM: of: reserved_mem: Use proper binary prefix BACKPORT: gpio: of: support gpio-ranges for multiple gpiochip devices UPSTREAM: dt-bindings: gpio: brcmstb: add gpio-ranges ANDROID: Incremental fs: Retry page faults on non-fatal errors ANDROID: GKI: Update symbol list for BCMSTB ANDROID: GKI: Update rockchip symbols for dw_hdmi_qp. UPSTREAM: net: usb: ax88179_178a: improve reset check UPSTREAM: net: usb: ax88179_178a: fix link status when link is set to down/up UPSTREAM: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() UPSTREAM: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps UPSTREAM: usb: typec: tcpm: unregister existing source caps before re-registration ANDROID: GKI: Update symbol list for mtk Change-Id: I1b7876def61c1f0a09ec7599aeb64fd2de911619 Signed-off-by: Will McVicker <willmcvicker@google.com>
2026-06-05 02:21:52 +09:00 · 2024-08-20 10:20:58 -07:00
parent 6f4a686ac9 edca080b95
commit cb7d32c26d
49 changed files with 2567 additions and 80 deletions
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -120,6 +120,7 @@ filegroup(
        "android/abi_gki_aarch64_qcom",
        "android/abi_gki_aarch64_rockchip",
        "android/abi_gki_aarch64_sony",
+        "android/abi_gki_aarch64_telechips",
        "android/abi_gki_aarch64_tuxera",
        "android/abi_gki_aarch64_type_visibility",
        "android/abi_gki_aarch64_unisoc",
--- a/Documentation/devicetree/bindings/gpio/brcm,brcmstb-gpio.yaml
+++ b/Documentation/devicetree/bindings/gpio/brcm,brcmstb-gpio.yaml
@@ -62,6 +62,8 @@ properties:

  interrupt-controller: true

+  gpio-ranges: true
+
  wakeup-source:
    type: boolean
    description: >
@@ -88,6 +90,7 @@ examples:
        interrupt-parent = <&irq0_intc>;
        interrupts = <0x6>;
        brcm,gpio-bank-widths = <32 32 32 24>;
+        gpio-ranges = <&pinctrl 0 0 120>;
    };

    upg_gio_aon: gpio@f04172c0 {
--- a/android/abi_gki_aarch64.stg
+++ b/android/abi_gki_aarch64.stg
--- a/android/abi_gki_aarch64_bcmstb
+++ b/android/abi_gki_aarch64_bcmstb
@@ -191,6 +191,8 @@
  gic_nonsecure_priorities
  gpiochip_add_data_with_key
  gpiochip_find
+  gpiochip_generic_free
+  gpiochip_generic_request
  gpiochip_get_data
  gpiochip_remove
  gpiod_get_value_cansleep
@@ -355,6 +357,7 @@
  of_address_to_resource
  of_alias_get_id
  of_clk_get_by_name
+  of_count_phandle_with_args
  of_device_get_match_data
  of_device_is_available
  of_device_is_big_endian
@@ -490,6 +493,7 @@
  register_pernet_device
  register_pernet_subsys
  register_pm_notifier
+  register_reboot_notifier
  register_syscore_ops
  regulator_bulk_disable
  regulator_bulk_enable
@@ -660,6 +664,7 @@
  unregister_pernet_device
  unregister_pernet_subsys
  unregister_pm_notifier
+  unregister_reboot_notifier
  up_read
  up_write
  usb_alloc_urb
@@ -816,7 +821,6 @@
  dma_pool_create
  dma_pool_destroy
  dma_pool_free
-  of_count_phandle_with_args
  usb_add_gadget_udc
  usb_del_gadget_udc
  usb_ep_set_maxpacket_limit
@@ -1353,6 +1357,7 @@
  scsi_remove_device
  scsi_remove_host
  scsi_rescan_device
+  scsi_resume_device
  scsi_schedule_eh
  scsi_sense_desc_find
  scsi_set_sense_field_pointer
@@ -1449,8 +1454,6 @@
  gpiochip_disable_irq
  gpiochip_enable_irq
  gpiochip_generic_config
-  gpiochip_generic_free
-  gpiochip_generic_request
  gpiochip_irq_relres
  gpiochip_irq_reqres
  of_pinctrl_get
@@ -1527,6 +1530,9 @@
  usb_set_configuration
  work_busy

+# required by reboot_data_save.ko
+  ktime_get_real_ts64
+
 # required by rfcomm.ko
  kthread_should_stop
  kthread_stop
@@ -1543,11 +1549,9 @@
 # required by rtc-brcmstb-waketimer.ko
  devm_rtc_allocate_device
  __devm_rtc_register_device
-  register_reboot_notifier
  rtc_time64_to_tm
  rtc_tm_to_time64
  rtc_update_irq
-  unregister_reboot_notifier

 # required by rtl8150.ko
  usb_control_msg_send
--- a/android/abi_gki_aarch64_exynosauto
+++ b/android/abi_gki_aarch64_exynosauto
@@ -440,7 +440,9 @@
  netdev_err
  netdev_info
  netdev_is_rx_handler_busy
+  netdev_master_upper_dev_get
  netdev_warn
+  nla_append
  noop_llseek
  nr_cpu_ids
  nsecs_to_jiffies
--- a/android/abi_gki_aarch64_mtk
+++ b/android/abi_gki_aarch64_mtk
@@ -2261,6 +2261,9 @@
  round_jiffies
  round_jiffies_relative
  round_jiffies_up
+  rpmsg_chrdev_eptdev_create
+  rpmsg_chrdev_eptdev_destroy
+  rpmsg_class
  rpmsg_create_ept
  rpmsg_destroy_ept
  rpmsg_find_device
@@ -2492,6 +2495,7 @@
  snd_soc_bytes_info_ext
  snd_soc_bytes_tlv_callback
  snd_soc_card_jack_new
+  snd_soc_cnew
  snd_soc_component_exit_regmap
  snd_soc_component_init_regmap
  snd_soc_component_read
--- a/android/abi_gki_aarch64_pixel
+++ b/android/abi_gki_aarch64_pixel
@@ -76,6 +76,7 @@
  __bitmap_andnot
  __bitmap_clear
  __bitmap_equal
+  bitmap_find_free_region
  bitmap_find_next_zero_area_off
  bitmap_free
  bitmap_from_arr32
@@ -84,6 +85,7 @@
  bitmap_parselist
  bitmap_parse_user
  bitmap_print_to_pagebuf
+  bitmap_release_region
  __bitmap_set
  __bitmap_subset
  bitmap_to_arr32
@@ -367,6 +369,7 @@
  dev_fetch_sw_netstats
  devfreq_add_device
  devfreq_add_governor
+  devfreq_get_devfreq_by_phandle
  devfreq_monitor_resume
  devfreq_monitor_start
  devfreq_monitor_stop
@@ -1520,6 +1523,7 @@
  of_get_parent
  of_get_property
  of_get_regulator_init_data
+  of_graph_get_endpoint_by_regs
  of_graph_get_next_endpoint
  of_graph_get_port_parent
  of_graph_get_remote_endpoint
@@ -2347,6 +2351,7 @@
  __traceiter_android_rvh_irqs_enable
  __traceiter_android_rvh_madvise_pageout_begin
  __traceiter_android_rvh_madvise_pageout_end
+  __traceiter_android_rvh_mapping_shrinkable
  __traceiter_android_rvh_meminfo_proc_show
  __traceiter_android_rvh_post_init_entity_util_avg
  __traceiter_android_rvh_preempt_disable
@@ -2376,6 +2381,7 @@
  __traceiter_android_rvh_update_misfit_status
  __traceiter_android_rvh_update_rt_rq_load_avg
  __traceiter_android_rvh_usb_dev_suspend
+  __traceiter_android_rvh_util_est_update
  __traceiter_android_rvh_util_fits_cpu
  __traceiter_android_vh_arch_set_freq_scale
  __traceiter_android_vh_audio_usb_offload_connect
@@ -2475,6 +2481,7 @@
  __tracepoint_android_rvh_irqs_enable
  __tracepoint_android_rvh_madvise_pageout_begin
  __tracepoint_android_rvh_madvise_pageout_end
+  __tracepoint_android_rvh_mapping_shrinkable
  __tracepoint_android_rvh_meminfo_proc_show
  __tracepoint_android_rvh_post_init_entity_util_avg
  __tracepoint_android_rvh_preempt_disable
@@ -2504,6 +2511,7 @@
  __tracepoint_android_rvh_update_misfit_status
  __tracepoint_android_rvh_update_rt_rq_load_avg
  __tracepoint_android_rvh_usb_dev_suspend
+  __tracepoint_android_rvh_util_est_update
  __tracepoint_android_rvh_util_fits_cpu
  __tracepoint_android_vh_arch_set_freq_scale
  __tracepoint_android_vh_audio_usb_offload_connect
@@ -2793,6 +2801,7 @@
  vmf_insert_pfn_prot
  vm_iomap_memory
  vm_node_stat
+  vm_unmapped_area
  vm_zone_stat
  vprintk
  vprintk_emit
--- a/android/abi_gki_aarch64_qcom
+++ b/android/abi_gki_aarch64_qcom
@@ -3445,6 +3445,7 @@
  __traceiter_android_vh_ftrace_size_check
  __traceiter_android_vh_gic_v3_suspend
  __traceiter_android_vh_hibernate_save_cmp_len
+  __traceiter_android_vh_hibernate_state
  __traceiter_android_vh_hibernated_do_mem_alloc
  __traceiter_android_vh_ignore_dmabuf_vmap_bounds
  __traceiter_android_vh_init_aes_encrypt
@@ -3597,6 +3598,7 @@
  __tracepoint_android_vh_ftrace_size_check
  __tracepoint_android_vh_gic_v3_suspend
  __tracepoint_android_vh_hibernate_save_cmp_len
+  __tracepoint_android_vh_hibernate_state
  __tracepoint_android_vh_hibernated_do_mem_alloc
  __tracepoint_android_vh_ignore_dmabuf_vmap_bounds
  __tracepoint_android_vh_init_aes_encrypt
--- a/android/abi_gki_aarch64_rockchip
+++ b/android/abi_gki_aarch64_rockchip
@@ -3023,3 +3023,9 @@
 # required by wlan_mt7663_usb.ko
  usb_anchor_empty
  usb_reset_endpoint
+
+# required by dw_hdmi_qp.ko
+  drm_edid_alloc
+  drm_edid_read_ddc
+  drm_edid_raw
+  drm_edid_connector_update
--- a/android/abi_gki_aarch64_telechips
+++ b/android/abi_gki_aarch64_telechips
--- a/android/abi_gki_aarch64_xiaomi
+++ b/android/abi_gki_aarch64_xiaomi
@@ -458,3 +458,16 @@
  __d_lookup_unhash_wake
  __fs_parse
  __filemap_get_folio
+
+#required by mi_async_reclaim.ko
+__traceiter_android_vh_handle_trylock_failed_folio
+__tracepoint_android_vh_handle_trylock_failed_folio
+__traceiter_android_vh_folio_trylock_set
+__tracepoint_android_vh_folio_trylock_set
+__traceiter_android_vh_folio_trylock_clear
+__tracepoint_android_vh_folio_trylock_clear
+__traceiter_android_vh_get_folio_trylock_result
+__tracepoint_android_vh_get_folio_trylock_result
+__traceiter_android_vh_do_folio_trylock
+__tracepoint_android_vh_do_folio_trylock
+reclaim_pages
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -120,8 +120,10 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size)
 	hdr->ttbr1_el1		= __pa_symbol(swapper_pg_dir);
 	hdr->reenter_kernel	= _cpu_resume;

+#ifdef CONFIG_ANDROID_VENDOR_OEM_DATA
 	trace_android_vh_save_cpu_resume(&hdr->android_vendor_data1,
 						__pa(cpu_resume));
+#endif

 	/* We can't use __hyp_get_vectors() because kvm may still be loaded */
 	if (el2_reset_needed())
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -336,6 +336,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_process_madvise_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_madvise_pageout_begin);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_madvise_pageout_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_reclaim_folio_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_mapping_shrinkable);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_smaps_pte_entry);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_show_smap);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_ctl_dirty_rate);
@@ -435,3 +436,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_clear_rwsem_reader_owned);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_rwsem_writer_owned);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_clear_rwsem_writer_owned);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_pr_set_vma_name_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_folio_trylock);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_get_folio_trylock_result);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_folio_trylock_clear);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_folio_trylock_set);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_trylock_failed_folio);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_hibernate_state);
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -895,7 +895,7 @@ static int of_gpiochip_add_pin_range(struct gpio_chip *chip)
 	struct device_node *np = chip->of_node;
 	struct of_phandle_args pinspec;
 	struct pinctrl_dev *pctldev;
-	int index = 0, ret;
+	int index = 0, ret, trim;
 	const char *name;
 	static const char group_names_propname[] = "gpio-ranges-group-names";
 	struct property *group_names;
@@ -921,7 +921,14 @@ static int of_gpiochip_add_pin_range(struct gpio_chip *chip)
 		if (!pctldev)
 			return -EPROBE_DEFER;

+		/* Ignore ranges outside of this GPIO chip */
+		if (pinspec.args[0] >= (chip->offset + chip->ngpio))
+			continue;
+		if (pinspec.args[0] + pinspec.args[2] <= chip->offset)
+			continue;
+
 		if (pinspec.args[2]) {
+			/* npins != 0: linear range */
 			if (group_names) {
 				of_property_read_string_index(np,
 						group_names_propname,
@@ -932,7 +939,19 @@ static int of_gpiochip_add_pin_range(struct gpio_chip *chip)
 					break;
 				}
 			}
-			/* npins != 0: linear range */
+
+			/* Trim the range to fit this GPIO chip */
+			if (chip->offset > pinspec.args[0]) {
+				trim = chip->offset - pinspec.args[0];
+				pinspec.args[2] -= trim;
+				pinspec.args[1] += trim;
+				pinspec.args[0] = 0;
+			} else {
+				pinspec.args[0] -= chip->offset;
+			}
+			if ((pinspec.args[0] + pinspec.args[2]) > chip->ngpio)
+				pinspec.args[2] = chip->ngpio - pinspec.args[0];
+
 			ret = gpiochip_add_pin_range(chip,
 					pinctrl_dev_get_devname(pctldev),
 					pinspec.args[0],
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -198,7 +198,7 @@ iommu_resv_region_get_type(struct device *dev,
 	if (start == phys->start && end == phys->end)
 		return IOMMU_RESV_DIRECT;

-	dev_warn(dev, "treating non-direct mapping [%pr] -> [%pap-%pap] as reservation\n", &phys,
+	dev_warn(dev, "treating non-direct mapping [%pr] -> [%pap-%pap] as reservation\n", phys,
 		 &start, &end);
 	return IOMMU_RESV_RESERVED;
 }
@@ -261,7 +261,14 @@ void of_iommu_get_resv_regions(struct device *dev, struct list_head *list)
 				phys_addr_t iova;
 				size_t length;

+				if (of_dma_is_coherent(dev->of_node))
+					prot |= IOMMU_CACHE;
+
 				maps = of_translate_dma_region(np, maps, &iova, &length);
+				if (length == 0) {
+					dev_warn(dev, "Cannot reserve IOVA region of 0 size\n");
+					continue;
+				}
 				type = iommu_resv_region_get_type(dev, &phys, iova, length);

 				region = iommu_alloc_resv_region(iova, length, prot, type,
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1676,12 +1676,21 @@ static int ax88179_reset(struct usbnet *dev)

 static int ax88179_net_reset(struct usbnet *dev)
 {
-	struct ax88179_data *ax179_data = dev->driver_priv;
+	u16 tmp16;

-	if (ax179_data->initialized)
+	ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, GMII_PHY_PHYSR,
+			 2, &tmp16);
+	if (tmp16) {
+		ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+				 2, 2, &tmp16);
+		if (!(tmp16 & AX_MEDIUM_RECEIVE_EN)) {
+			tmp16 |= AX_MEDIUM_RECEIVE_EN;
+			ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+					  2, 2, &tmp16);
+		}
+	} else {
 		ax88179_reset(dev);
-	else
-		ax179_data->initialized = 1;
+	}

 	return 0;
 }
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -290,7 +290,7 @@ void __init fdt_init_reserved_mem(void)
 				bool reusable =
 					(of_get_flat_dt_prop(node, "reusable", NULL)) != NULL;

-				pr_info("%pa..%pa ( %lu KB ) %s %s %s\n",
+				pr_info("%pa..%pa (%lu KiB) %s %s %s\n",
 					&rmem->base, &end, (unsigned long)(rmem->size / SZ_1K),
 					nomap ? "nomap" : "map",
 					reusable ? "reusable" : "non-reusable",
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1816,7 +1816,10 @@ check_type:
 	 * assume caller has checked sense and determined
 	 * the check condition was retryable.
 	 */
-	if (req->cmd_flags & REQ_FAILFAST_DEV || blk_rq_is_passthrough(req))
+	if (req->cmd_flags & REQ_FAILFAST_DEV)
+		return true;
+	if (blk_rq_is_passthrough(req) &&
+	    !(scmd->flags & SCMD_RETRY_PASSTHROUGH))
 		return true;

 	return false;
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -3626,6 +3626,7 @@ static int sd_start_stop_device(struct scsi_disk *sdkp, int start)
 	const struct scsi_exec_args exec_args = {
 		.sshdr = &sshdr,
 		.req_flags = BLK_MQ_REQ_PM,
+		.scmd_flags = SCMD_RETRY_PASSTHROUGH,
 	};
 	struct scsi_device *sdp = sdkp->device;
 	int res;
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -3035,16 +3035,7 @@ static int ufshcd_compose_dev_cmd(struct ufs_hba *hba,
 */
 bool ufshcd_cmd_inflight(struct scsi_cmnd *cmd)
 {
-	struct request *rq;
-
-	if (!cmd)
-		return false;
-
-	rq = scsi_cmd_to_rq(cmd);
-	if (!blk_mq_request_started(rq))
-		return false;
-
-	return true;
+	return cmd && blk_mq_rq_state(scsi_cmd_to_rq(cmd)) == MQ_RQ_IN_FLIGHT;
 }

 /*
@@ -6581,7 +6572,8 @@ again:
 	if (ufshcd_err_handling_should_stop(hba))
 		goto skip_err_handling;

-	if (hba->dev_quirks & UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) {
+	if ((hba->dev_quirks & UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) &&
+	    !hba->force_reset) {
 		bool ret;

 		spin_unlock_irqrestore(hba->host->host_lock, flags);
@@ -10268,7 +10260,7 @@ int ufshcd_system_restore(struct device *dev)
 	 * are updated with the latest queue addresses. Only after
 	 * updating these addresses, we can queue the new commands.
 	 */
-	mb();
+	ufshcd_readl(hba, REG_UTP_TASK_REQ_LIST_BASE_H);

 	/* Resuming from hibernate, assume that link was OFF */
 	ufshcd_set_link_off(hba);
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -137,9 +137,12 @@ static int usb_string_copy(const char *s, char **s_copy)
 	int ret;
 	char *str;
 	char *copy = *s_copy;
+
 	ret = strlen(s);
 	if (ret > USB_MAX_STRING_LEN)
 		return -EOVERFLOW;
+	if (ret < 1)
+		return -EINVAL;

 	if (copy) {
 		str = copy;
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2425,7 +2425,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
 {
 	struct usb_power_delivery_desc desc = { port->negotiated_rev };
 	struct usb_power_delivery_capabilities_desc caps = { };
-	struct usb_power_delivery_capabilities *cap;
+	struct usb_power_delivery_capabilities *cap = port->partner_source_caps;

 	if (!port->partner_pd)
 		port->partner_pd = usb_power_delivery_register(NULL, &desc);
@@ -2435,6 +2435,11 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
 	memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
 	caps.role = TYPEC_SOURCE;

+	if (cap) {
+		usb_power_delivery_unregister_capabilities(cap);
+		port->partner_source_caps = NULL;
+	}
+
 	cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
 	if (IS_ERR(cap))
 		return PTR_ERR(cap);
@@ -3948,6 +3953,8 @@ static void run_state_machine(struct tcpm_port *port)
 		port->potential_contaminant = ((port->enter_state == SRC_ATTACH_WAIT &&
 						port->state == SRC_UNATTACHED) ||
 					       (port->enter_state == SNK_ATTACH_WAIT &&
+						port->state == SNK_UNATTACHED) ||
+					       (port->enter_state == SNK_DEBOUNCED &&
 						port->state == SNK_UNATTACHED));

 	port->enter_state = port->state;
--- a/fs/erofs/zutil.c
+++ b/fs/erofs/zutil.c
@@ -38,11 +38,13 @@ void *z_erofs_get_gbuf(unsigned int requiredpages)
 {
 	struct z_erofs_gbuf *gbuf;

+	migrate_disable();
 	gbuf = &z_erofs_gbufpool[z_erofs_gbuf_id()];
 	spin_lock(&gbuf->lock);
 	/* check if the buffer is too small */
 	if (requiredpages > gbuf->nrpages) {
 		spin_unlock(&gbuf->lock);
+		migrate_enable();
 		/* (for sparse checker) pretend gbuf->lock is still taken */
 		__acquire(gbuf->lock);
 		return NULL;
@@ -57,6 +59,7 @@ void z_erofs_put_gbuf(void *ptr) __releases(gbuf->lock)
 	gbuf = &z_erofs_gbufpool[z_erofs_gbuf_id()];
 	DBG_BUGON(gbuf->ptr != ptr);
 	spin_unlock(&gbuf->lock);
+	migrate_enable();
 }

 int z_erofs_gbuf_growsize(unsigned int nrpages)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1015,7 +1015,7 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
 	f2fs_bug_on(sbi, is_read_io(fio->op));

 	f2fs_down_write(&io->io_rwsem);
-
+next:
 #ifdef CONFIG_BLK_DEV_ZONED
 	if (f2fs_sb_has_blkzoned(sbi) && btype < META && io->zone_pending_bio) {
 		wait_for_completion_io(&io->zone_wait);
@@ -1025,7 +1025,6 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
 	}
 #endif

-next:
 	if (fio->in_list) {
 		spin_lock(&io->io_lock);
 		if (list_empty(&io->io_list)) {
@@ -1086,10 +1085,6 @@ alloc_new:
 	io->last_block_in_bio = fio->new_blkaddr;

 	trace_f2fs_submit_page_write(fio->page, fio);
-skip:
-	if (fio->in_list)
-		goto next;
-out:
 #ifdef CONFIG_BLK_DEV_ZONED
 	if (f2fs_sb_has_blkzoned(sbi) && btype < META &&
 			is_end_zone_blkaddr(sbi, fio->new_blkaddr)) {
@@ -1102,6 +1097,10 @@ out:
 		__submit_merged_bio(io);
 	}
 #endif
+skip:
+	if (fio->in_list)
+		goto next;
+out:
 	if (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) ||
 				!f2fs_is_checkpoint_ready(sbi))
 		__submit_merged_bio(io);
--- a/fs/incfs/format.h
+++ b/fs/incfs/format.h
@@ -314,6 +314,11 @@ struct backing_file_context {
 	 * there is no need to get/put the creds
 	 */
 	const struct cred *bc_cred;
+
+	/*
+	 * The file has a bad block, i.e. one that has failed checksumming.
+	 */
+	bool bc_has_bad_block;
 };

 struct metadata_handler {
--- a/fs/incfs/sysfs.c
+++ b/fs/incfs/sysfs.c
@@ -35,6 +35,7 @@ DECLARE_FEATURE_FLAG(zstd);
 DECLARE_FEATURE_FLAG(v2);
 DECLARE_FEATURE_FLAG(bugfix_throttling);
 DECLARE_FEATURE_FLAG(bugfix_inode_eviction);
+DECLARE_FEATURE_FLAG(bugfix_retry_page_fault);

 static struct attribute *attributes[] = {
 	&corefs_attr.attr,
@@ -42,6 +43,7 @@ static struct attribute *attributes[] = {
 	&v2_attr.attr,
 	&bugfix_throttling_attr.attr,
 	&bugfix_inode_eviction_attr.attr,
+	&bugfix_retry_page_fault_attr.attr,
 	NULL,
 };

--- a/fs/incfs/vfs.c
+++ b/fs/incfs/vfs.c
@@ -121,7 +121,28 @@ static const struct address_space_operations incfs_address_space_ops = {

 static vm_fault_t incfs_fault(struct vm_fault *vmf)
 {
-	vmf->flags &= ~FAULT_FLAG_ALLOW_RETRY;
+	struct file *file = vmf->vma->vm_file;
+	struct data_file *df = get_incfs_data_file(file);
+	struct backing_file_context *bfc = df ? df->df_backing_file_context : NULL;
+
+	/*
+	 * This is something of a kludge
+	 * We want to retry if the read from the underlying file is interrupted,
+	 * but not if the read fails because the stored data is corrupt since the
+	 * latter causes an infinite loop.
+	 *
+	 * However, whether we wish to retry must be set before we call
+	 * filemap_fault, *and* there is no way of getting the read error code out
+	 * of filemap_fault.
+	 *
+	 * So unless there is a robust solution to both the above problems, we can
+	 * solve the actual issues we have encoutered by retrying unless there is
+	 * known corruption in the backing file. This does mean that we won't retry
+	 * with a corrupt backing file if a (good) read is interrupted, but we
+	 * don't really handle corruption well anyway at this time.
+	 */
+	if (bfc && bfc->bc_has_bad_block)
+		vmf->flags &= ~FAULT_FLAG_ALLOW_RETRY;
 	return filemap_fault(vmf);
 }

@@ -597,6 +618,13 @@ err:
 	if (total_read < PAGE_SIZE)
 		zero_user(page, total_read, PAGE_SIZE - total_read);

+	if (result == -EBADMSG) {
+		struct backing_file_context *bfc = df ? df->df_backing_file_context : NULL;
+
+		if (bfc)
+			bfc->bc_has_bad_block = 1;
+	}
+
 	if (result == 0)
 		SetPageUptodate(page);
 	else
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -786,11 +786,13 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
 		if (path.dentry->d_op->d_canonical_path) {
 			ret = path.dentry->d_op->d_canonical_path(&path,
 							    &alteredpath);
-			if (ret)
-				goto path_put_and_out;
-
-			canonical_path = &alteredpath;
-			path_put(&path);
+			if (ret != -ENOSYS) {
+				if (ret) {
+					goto path_put_and_out;
+				}
+				canonical_path = &alteredpath;
+				path_put(&path);
+			}
 		}
 	}

--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -107,15 +107,17 @@ static inline int fsnotify_file(struct file *file, __u32 mask)

 			ret = path->dentry->d_op->d_canonical_path(path,
 								   &lower_path);
-			if (ret)
-				return ret;
+			if (ret != -ENOSYS) {
+				if (ret)
+					return ret;

-			ret = fsnotify_parent(lower_path.dentry, mask,
-					      &lower_path, FSNOTIFY_EVENT_PATH);
-			path_put(&lower_path);
+				ret = fsnotify_parent(lower_path.dentry, mask,
+						      &lower_path, FSNOTIFY_EVENT_PATH);
+				path_put(&lower_path);

-			if (ret)
-				return ret;
+				if (ret)
+					return ret;
+			}
 		}
 	}

--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -137,6 +137,8 @@ static inline bool mapping_empty(struct address_space *mapping)
 	return xa_empty(&mapping->i_pages);
 }

+extern void _trace_android_rvh_mapping_shrinkable(bool *shrinkable);
+
 /*
 * mapping_shrinkable - test if page cache state allows inode reclaim
 * @mapping: the page cache mapping
@@ -161,7 +163,11 @@ static inline bool mapping_empty(struct address_space *mapping)
 static inline bool mapping_shrinkable(struct address_space *mapping)
 {
 	void *head;
+	bool shrinkable = false;

+	_trace_android_rvh_mapping_shrinkable(&shrinkable);
+	if (shrinkable)
+		return true;
 	/*
 	 * On highmem systems, there could be lowmem pressure from the
 	 * inodes before there is highmem pressure from the page
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -54,8 +54,11 @@ struct scsi_pointer {
 #define SCMD_INITIALIZED	(1 << 1)
 #define SCMD_LAST		(1 << 2)
 #define SCMD_FAIL_IF_RECOVERING	(1 << 4)
+/* If set, retry a passthrough command in case of a unit attention. */
+#define SCMD_RETRY_PASSTHROUGH	(1 << 5)
 /* flags preserved across unprep / reprep */
-#define SCMD_PRESERVED_FLAGS	(SCMD_INITIALIZED | SCMD_FAIL_IF_RECOVERING)
+#define SCMD_PRESERVED_FLAGS	\
+	(SCMD_INITIALIZED | SCMD_FAIL_IF_RECOVERING | SCMD_RETRY_PASSTHROUGH)

 /* for scmd->state */
 #define SCMD_STATE_COMPLETE	0
--- a/include/trace/hooks/mm.h
+++ b/include/trace/hooks/mm.h
@@ -112,6 +112,9 @@ DECLARE_RESTRICTED_HOOK(android_rvh_madvise_pageout_end,
 DECLARE_RESTRICTED_HOOK(android_rvh_reclaim_folio_list,
 			TP_PROTO(struct list_head *folio_list, void *private),
 			TP_ARGS(folio_list, private), 1);
+DECLARE_RESTRICTED_HOOK(android_rvh_mapping_shrinkable,
+			TP_PROTO(bool *shrinkable),
+			TP_ARGS(shrinkable), 1);
 DECLARE_HOOK(android_vh_smaps_pte_entry,
 	TP_PROTO(swp_entry_t entry, unsigned long *writeback,
 		unsigned long *same, unsigned long *huge),
--- a/include/trace/hooks/power.h
+++ b/include/trace/hooks/power.h
@@ -33,6 +33,10 @@ DECLARE_HOOK(android_vh_freq_qos_remove_request,
 		TP_PROTO(struct freq_qos_request *req),
 		TP_ARGS(req));

+DECLARE_HOOK(android_vh_hibernate_state,
+		TP_PROTO(int error),
+		TP_ARGS(error));
+
 #endif /* _TRACE_HOOK_POWER_H */
 /* This part must be outside protection */
 #include <trace/define_trace.h>
--- a/include/trace/hooks/vmscan.h
+++ b/include/trace/hooks/vmscan.h
@@ -53,6 +53,22 @@ DECLARE_HOOK(android_vh_vmscan_kswapd_done,
 	TP_PROTO(int node_id, unsigned int highest_zoneidx, unsigned int alloc_order,
 	        unsigned int reclaim_order),
 	TP_ARGS(node_id, highest_zoneidx, alloc_order, reclaim_order));
+DECLARE_HOOK(android_vh_handle_trylock_failed_folio,
+	TP_PROTO(struct list_head *folio_list),
+	TP_ARGS(folio_list));
+DECLARE_HOOK(android_vh_folio_trylock_set,
+	TP_PROTO(struct folio *folio),
+	TP_ARGS(folio));
+DECLARE_HOOK(android_vh_folio_trylock_clear,
+	TP_PROTO(struct folio *folio),
+	TP_ARGS(folio));
+DECLARE_HOOK(android_vh_get_folio_trylock_result,
+	TP_PROTO(struct folio *folio, bool *trylock_failed),
+	TP_ARGS(folio, trylock_failed));
+DECLARE_HOOK(android_vh_do_folio_trylock,
+	TP_PROTO(struct folio *folio, struct rw_semaphore *sem,
+		bool *got_lock, bool *skip),
+	TP_ARGS(folio, sem, got_lock, skip));
 #endif /* _TRACE_HOOK_VMSCAN_H */
 /* This part must be outside protection */
 #include <trace/define_trace.h>
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -141,13 +141,8 @@ static __cold void __io_uring_show_fdinfo(struct io_ring_ctx *ctx,
 	if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) {
 		struct io_sq_data *sq = ctx->sq_data;

-		if (mutex_trylock(&sq->lock)) {
-			if (sq->thread) {
-				sq_pid = task_pid_nr(sq->thread);
-				sq_cpu = task_cpu(sq->thread);
-			}
-			mutex_unlock(&sq->lock);
-		}
+		sq_pid = sq->task_pid;
+		sq_cpu = sq->sq_cpu;
 	}

 	seq_printf(m, "SqThread:\t%d\n", sq_pid);
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -214,6 +214,7 @@ static bool io_sqd_handle_event(struct io_sq_data *sqd)
 			did_sig = get_signal(&ksig);
 		cond_resched();
 		mutex_lock(&sqd->lock);
+		sqd->sq_cpu = raw_smp_processor_id();
 	}
 	return did_sig || test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
 }
@@ -229,10 +230,15 @@ static int io_sq_thread(void *data)
 	snprintf(buf, sizeof(buf), "iou-sqp-%d", sqd->task_pid);
 	set_task_comm(current, buf);

-	if (sqd->sq_cpu != -1)
+	/* reset to our pid after we've set task_comm, for fdinfo */
+	sqd->task_pid = current->pid;
+
+	if (sqd->sq_cpu != -1) {
 		set_cpus_allowed_ptr(current, cpumask_of(sqd->sq_cpu));
-	else
+	} else {
 		set_cpus_allowed_ptr(current, cpu_online_mask);
+		sqd->sq_cpu = raw_smp_processor_id();
+	}
 	current->flags |= PF_NO_SETAFFINITY;

 	mutex_lock(&sqd->lock);
@@ -262,6 +268,7 @@ static int io_sq_thread(void *data)
 				mutex_unlock(&sqd->lock);
 				cond_resched();
 				mutex_lock(&sqd->lock);
+				sqd->sq_cpu = raw_smp_processor_id();
 			}
 			continue;
 		}
@@ -295,6 +302,7 @@ static int io_sq_thread(void *data)
 				mutex_unlock(&sqd->lock);
 				schedule();
 				mutex_lock(&sqd->lock);
+				sqd->sq_cpu = raw_smp_processor_id();
 			}
 			list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
 				atomic_andnot(IORING_SQ_NEED_WAKEUP,
--- a/kernel/irq/cpuhotplug.c
+++ b/kernel/irq/cpuhotplug.c
@@ -130,6 +130,22 @@ static bool migrate_one_irq(struct irq_desc *desc)
 	 * CPU.
 	 */
 	err = irq_do_set_affinity(d, affinity, false);
+
+	/*
+	 * If there are online CPUs in the affinity mask, but they have no
+	 * vectors left to make the migration work, try to break the
+	 * affinity by migrating to any online CPU.
+	 */
+	if (err == -ENOSPC && !irqd_affinity_is_managed(d) && affinity != cpu_online_mask) {
+		pr_debug("IRQ%u: set affinity failed for %*pbl, re-try with online CPUs\n",
+			 d->irq, cpumask_pr_args(affinity));
+
+		affinity = cpu_online_mask;
+		brokeaff = true;
+
+		err = irq_do_set_affinity(d, affinity, false);
+	}
+
 	if (err) {
 		pr_warn_ratelimited("IRQ%u: set affinity failed(%d).\n",
 				    d->irq, err);
@@ -195,10 +211,15 @@ static void irq_restore_affinity_of_irq(struct irq_desc *desc, unsigned int cpu)
 	    !irq_data_get_irq_chip(data) || !cpumask_test_cpu(cpu, affinity))
 		return;

-	if (irqd_is_managed_and_shutdown(data)) {
-		irq_startup(desc, IRQ_RESEND, IRQ_START_COND);
+	/*
+	 * Don't restore suspended interrupts here when a system comes back
+	 * from S3. They are reenabled via resume_device_irqs().
+	 */
+	if (desc->istate & IRQS_SUSPENDED)
 		return;
-	}
+
+	if (irqd_is_managed_and_shutdown(data))
+		irq_startup(desc, IRQ_RESEND, IRQ_START_COND);

 	/*
 	 * If the interrupt can only be directed to a single target
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -789,10 +789,14 @@ void __enable_irq(struct irq_desc *desc)
 		irq_settings_set_noprobe(desc);
 		/*
 		 * Call irq_startup() not irq_enable() here because the
-		 * interrupt might be marked NOAUTOEN. So irq_startup()
-		 * needs to be invoked when it gets enabled the first
-		 * time. If it was already started up, then irq_startup()
-		 * will invoke irq_enable() under the hood.
+		 * interrupt might be marked NOAUTOEN so irq_startup()
+		 * needs to be invoked when it gets enabled the first time.
+		 * This is also required when __enable_irq() is invoked for
+		 * a managed and shutdown interrupt from the S3 resume
+		 * path.
+		 *
+		 * If it was already started up, then irq_startup() will
+		 * invoke irq_enable() under the hood.
 		 */
 		irq_startup(desc, IRQ_RESEND, IRQ_START_FORCE);
 		break;
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -16,6 +16,8 @@
 #include <linux/suspend.h>
 #include <linux/syscalls.h>
 #include <linux/pm_runtime.h>
+#include <trace/events/power.h>
+#include <trace/hooks/power.h>

 #include "power.h"

@@ -639,6 +641,7 @@ static ssize_t state_store(struct kobject *kobj, struct kobj_attribute *attr,
 		error = pm_suspend(state);
 	} else if (state == PM_SUSPEND_MAX) {
 		error = hibernate();
+		trace_android_vh_hibernate_state(error);
 	} else {
 		error = -EINVAL;
 	}
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -984,7 +984,6 @@ void tracing_on(void)
 {
 	tracer_tracing_on(&global_trace);
 }
-EXPORT_SYMBOL_GPL(tracing_on);


 static __always_inline void
@@ -1493,7 +1492,6 @@ int tracing_is_on(void)
 {
 	return tracer_tracing_is_on(&global_trace);
 }
-EXPORT_SYMBOL_GPL(tracing_is_on);

 static int __init set_buf_size(char *str)
 {
--- a/lib/build_OID_registry
+++ b/lib/build_OID_registry
@@ -8,6 +8,7 @@
 #

 use strict;
+use Cwd qw(abs_path);

 my @names = ();
 my @oids = ();
@@ -17,6 +18,8 @@ if ($#ARGV != 1) {
    exit(2);
 }

+my $abs_srctree = abs_path($ENV{'srctree'});
+
 #
 # Open the file to read from
 #
@@ -35,7 +38,9 @@ close IN_FILE || die;
 #
 open C_FILE, ">$ARGV[1]" or die;
 print C_FILE "/*\n";
-print C_FILE " * Automatically generated by ", $0, ".  Do not edit\n";
+my $scriptname = $0;
+$scriptname =~ s#^\Q$abs_srctree/\E##;
+print C_FILE " * Automatically generated by ", $scriptname, ".  Do not edit\n";
 print C_FILE " */\n";

 #
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -60,6 +60,12 @@

 #include <asm/mman.h>

+void _trace_android_rvh_mapping_shrinkable(bool *shrinkable)
+{
+	trace_android_rvh_mapping_shrinkable(shrinkable);
+}
+EXPORT_SYMBOL_GPL(_trace_android_rvh_mapping_shrinkable);
+
 /*
 * Shared mappings implemented 30.11.1994. It's not fully working yet,
 * though.
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -450,7 +450,8 @@ regular_page:

 		if (!pte_present(ptent)) {
 			entry = pte_to_swp_entry(ptent);
-			trace_android_vh_madvise_pageout_swap_entry(entry,
+			if (!is_migration_entry(entry))
+				trace_android_vh_madvise_pageout_swap_entry(entry,
 					swp_swapcount(entry));
 			continue;
 		}
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2232,8 +2232,6 @@ struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, unsigned lon
 #else
 int expand_stack_locked(struct vm_area_struct *vma, unsigned long address)
 {
-	if (unlikely(!(vma->vm_flags & VM_GROWSDOWN)))
-		return -EINVAL;
 	return expand_downwards(vma, address);
 }

--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -83,6 +83,7 @@
 #include <trace/events/migrate.h>
 #undef CREATE_TRACE_POINTS
 #include <trace/hooks/mm.h>
+#include <trace/hooks/vmscan.h>

 #include "internal.h"

@@ -2518,6 +2519,18 @@ static void rmap_walk_file(struct folio *folio,
 	pgoff_start = folio_pgoff(folio);
 	pgoff_end = pgoff_start + folio_nr_pages(folio) - 1;
 	if (!locked) {
+		bool got_lock = false;
+		bool skip = false;
+
+		trace_android_vh_do_folio_trylock(folio,
+			&mapping->i_mmap_rwsem, &got_lock, &skip);
+		if (skip) {
+			if (!got_lock)
+				return;
+			else
+				goto lookup;
+		}
+
 		if (i_mmap_trylock_read(mapping))
 			goto lookup;

--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -941,8 +941,8 @@ static int move_present_pte(struct mm_struct *mm,

 	double_pt_lock(dst_ptl, src_ptl);

-	if (!pte_same(*src_pte, orig_src_pte) ||
-	    !pte_same(*dst_pte, orig_dst_pte)) {
+	if (!pte_same(ptep_get(src_pte), orig_src_pte) ||
+	    !pte_same(ptep_get(dst_pte), orig_dst_pte)) {
 		err = -EAGAIN;
 		goto out;
 	}
@@ -985,8 +985,8 @@ static int move_swap_pte(struct mm_struct *mm,

 	double_pt_lock(dst_ptl, src_ptl);

-	if (!pte_same(*src_pte, orig_src_pte) ||
-	    !pte_same(*dst_pte, orig_dst_pte)) {
+	if (!pte_same(ptep_get(src_pte), orig_src_pte) ||
+	    !pte_same(ptep_get(dst_pte), orig_dst_pte)) {
 		double_pt_unlock(dst_ptl, src_ptl);
 		return -EAGAIN;
 	}
@@ -1085,7 +1085,7 @@ retry:
 	}

 	spin_lock(dst_ptl);
-	orig_dst_pte = *dst_pte;
+	orig_dst_pte = ptep_get(dst_pte);
 	spin_unlock(dst_ptl);
 	if (!pte_none(orig_dst_pte)) {
 		err = -EEXIST;
@@ -1093,7 +1093,7 @@ retry:
 	}

 	spin_lock(src_ptl);
-	orig_src_pte = *src_pte;
+	orig_src_pte = ptep_get(src_pte);
 	spin_unlock(src_ptl);
 	if (pte_none(orig_src_pte)) {
 		if (!(mode & UFFDIO_MOVE_MODE_ALLOW_SRC_HOLES))
@@ -1131,7 +1131,7 @@ retry:
 			 * page isn't freed under us
 			 */
 			spin_lock(src_ptl);
-			if (!pte_same(orig_src_pte, *src_pte)) {
+			if (!pte_same(orig_src_pte, ptep_get(src_pte))) {
 				spin_unlock(src_ptl);
 				err = -EAGAIN;
 				goto out;
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1476,14 +1476,19 @@ static enum folio_references folio_check_references(struct folio *folio,
 	int referenced_ptes, referenced_folio;
 	unsigned long vm_flags;
 	int ret = 0;
+	bool trylock_failed = false;

 	trace_android_vh_check_folio_look_around_ref(folio, &ret);
 	if (ret)
 		return ret;

+	trace_android_vh_folio_trylock_set(folio);
 	referenced_ptes = folio_referenced(folio, 1, sc->target_mem_cgroup,
 					   &vm_flags);
 	referenced_folio = folio_test_clear_referenced(folio);
+	trace_android_vh_get_folio_trylock_result(folio, &trylock_failed);
+	if (trylock_failed)
+		return FOLIOREF_KEEP;

 	/*
 	 * The supposedly reclaimable folio was found to be in a VM_LOCKED vma.
@@ -1905,6 +1910,8 @@ retry:
 			if (folio_test_pmd_mappable(folio))
 				flags |= TTU_SPLIT_HUGE_PMD;

+			if (!ignore_references)
+				trace_android_vh_folio_trylock_set(folio);
 			try_to_unmap(folio, flags);
 			if (folio_mapped(folio)) {
 				stat->nr_unmap_fail += nr_pages;
@@ -2035,6 +2042,7 @@ retry:
 					 * increment nr_reclaimed here (and
 					 * leave it off the LRU).
 					 */
+					trace_android_vh_folio_trylock_clear(folio);
 					nr_reclaimed += nr_pages;
 					continue;
 				}
@@ -2071,6 +2079,7 @@ free_it:
 		 * Is there need to periodically free_folio_list? It would
 		 * appear not as the counts should be low
 		 */
+		trace_android_vh_folio_trylock_clear(folio);
 		if (unlikely(folio_test_large(folio)))
 			destroy_large_folio(folio);
 		else
@@ -2549,6 +2558,7 @@ static unsigned long shrink_inactive_list(unsigned long nr_to_scan,
 		return 0;

 	nr_reclaimed = shrink_folio_list(&folio_list, pgdat, sc, &stat, false);
+	trace_android_vh_handle_trylock_failed_folio(&folio_list);

 	spin_lock_irq(&lruvec->lru_lock);
 	move_folios_to_lru(lruvec, &folio_list);
@@ -2673,6 +2683,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
 			}
 		}

+		trace_android_vh_folio_trylock_set(folio);
 		/* Referenced or rmap lock contention: rotate */
 		if (folio_referenced(folio, 0, sc->target_mem_cgroup,
 				     &vm_flags) != 0) {
@@ -2686,12 +2697,13 @@ static void shrink_active_list(unsigned long nr_to_scan,
 			 * so we ignore them here.
 			 */
 			if ((vm_flags & VM_EXEC) && folio_is_file_lru(folio)) {
+				trace_android_vh_folio_trylock_clear(folio);
 				nr_rotated += folio_nr_pages(folio);
 				list_add(&folio->lru, &l_active);
 				continue;
 			}
 		}
-
+		trace_android_vh_folio_trylock_clear(folio);
 		folio_clear_active(folio);	/* we are de-activating */
 		folio_set_workingset(folio);
 		list_add(&folio->lru, &l_inactive);
@@ -2780,6 +2792,7 @@ unsigned long __reclaim_pages(struct list_head *folio_list, void *private)

 	return nr_reclaimed;
 }
+EXPORT_SYMBOL_GPL(reclaim_pages);

 unsigned long reclaim_pages(struct list_head *folio_list)
 {
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -43,10 +43,11 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,

 	for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
 		cr.links[link_id].status = data->links[link_id].status;
+		cr.links[link_id].bss = data->links[link_id].bss;
+
 		WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS &&
 			     (!cr.ap_mld_addr || !cr.links[link_id].bss));

-		cr.links[link_id].bss = data->links[link_id].bss;
 		if (!cr.links[link_id].bss)
 			continue;
 		cr.links[link_id].bssid = data->links[link_id].bss->bssid;
--- a/tools/testing/selftests/filesystems/incfs/Makefile
+++ b/tools/testing/selftests/filesystems/incfs/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
-CFLAGS += -D_FILE_OFFSET_BITS=64 -Wall -Werror -I../.. -I../../../../.. -fno-omit-frame-pointer -fsanitize=address -g
-LDLIBS := -llz4 -lzstd -lcrypto -lpthread -fsanitize=address
+CFLAGS += -D_FILE_OFFSET_BITS=64 -Wall -Wno-deprecated-declarations -Werror -I../.. -I../../../../.. -fno-omit-frame-pointer -g
+LDLIBS := -llz4 -lzstd -lcrypto -lpthread
 TEST_GEN_PROGS := incfs_test incfs_stress incfs_perf

 include ../../lib.mk