Merge tag 'android14-6.1.93_r00' into android14-6.1

This merges up to the 6.1.93 LTS release into android14-6.1.  Included
in here are the following commits:

* 9d37e2aae7 ANDROID: add __module_get to db854c symbol list.
* 5ccfb1bf19 Revert "drm/mipi-dsi: use correct return type for the DSC functions"
* d201efdaa4 Revert "media: cec: core: avoid recursive cec_claim_log_addrs"
* dcb51feb27 Revert "Bluetooth: compute LE flow credits based on recvbuf space"
*   a4d90a8f3c Merge 6.1.93 into android14-6.1-lts
|\
| * ae9f2a70d6 Linux 6.1.93
| * ec5c95f0e7 net: ena: Fix DMA syncing in XDP path when SWIOTLB is on
| * ceab795a67 ALSA: timer: Set lower bound of start tick time
| * ea22d4195c riscv: prevent pt_regs corruption for secondary idle threads
| * b2c98bec4d hwmon: (shtc1) Fix property misspelling
| * 786d1639db powerpc/pseries/lparcfg: drop error message from guest name lookup
| * cb53706a34 ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
| * f694cc31e7 net: ena: Fix redundant device NUMA node override
| * 3bb51b20dd net: ena: Reduce lines with longer column width boundary
| * d230da7d5d net: ena: Add dynamic recycling mechanism for rx buffers
| * 852035aba3 net: dsa: microchip: fix RGMII error in KSZ DSA driver
| * 0e355a3ce2 spi: stm32: Don't warn about spurious interrupts
| * 0713e0d191 drm/i915/guc: avoid FIELD_PREP warning
| * 4b338844af kconfig: fix comparison to constant symbols, 'm', 'n'
| * c98af7fd2f netfilter: nft_fib: allow from forward/input without iif selector
| * caf3a8afb5 netfilter: tproxy: bail out if IP has been disabled on the device
| * e017b87660 netfilter: nft_payload: skbuff vlan metadata mangle support
| * cffee0b578 netfilter: nft_payload: rebuild vlan header on h_proto access
| * 96f261d56c netfilter: nft_payload: rebuild vlan header when needed
| * de47cbfc86 netfilter: nft_payload: move struct nft_payload_set definition where it belongs
| * 07cbc55120 ice: fix accounting if a VLAN already exists
| * 50bb204a6b net:fec: Add fec_enet_deinit()
| * 6693b172f0 bpf: Allow delete from sockmap/sockhash only if update is allowed
| * f52bb074e4 net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
| * ba61b44379 af_unix: Read sk->sk_hash under bindlock during bind().
| * 7077c22f84 enic: Validate length of nl attributes in enic_set_vf_port
| * ce913fd361 ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
| * 995f447cd3 ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
| * ac35c81bcb ALSA: hda/realtek: Add quirk for ASUS ROG G634Z
| * 1834922d44 ALSA: core: Remove debugfs at disconnection
| * a8dda2c105 ALSA: jack: Use guard() for locking
| * 105624d7f6 bpf: Fix potential integer overflow in resolve_btfids
| * 242b304668 dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
| * 42c79364df net/mlx5e: Fix UDP GSO for encapsulated packets
| * 3aa5734570 net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
| * 1b4ab44129 net/mlx5e: Fix IPsec tunnel mode offload feature check
| * 666e19a247 net/mlx5: Lag, do bond only if slaves agree on roce state
| * 25222a9899 net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
| * ca7ad37b60 nvmet: fix ns enable/disable possible hang
| * 8e1ba9df9a dma-mapping: benchmark: handle NUMA_NO_NODE correctly
| * c57874265a dma-mapping: benchmark: fix node id validation
| * 729fdbfc18 spi: Don't mark message DMA mapped when no transfer in it is
| * 8dfcd7780d netfilter: nft_payload: restore vlan q-in-q match support
| * 68f40354a3 netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
| * 5ef3a27c61 ice: Interpret .set_channels() input differently
| * 5d626f2b87 drivers/xen: Improve the late XenStore init protocol
| * 8d65890c94 nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
| * 20c4691a06 nfc: nci: Fix kcov check in nci_rx_work()
| * c09ddc6058 net: relax socket state check at accept time.
| * e1e80e7ff2 inet: factor out locked section of inet_accept() in a new helper
| * 335c8f1566 tls: fix missing memory barrier in tls_init
| * 4f11834e6b net: fec: avoid lock evasion when reading pps_enable
| * eeae2526e8 Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
| * 2ae3749f37 riscv: stacktrace: fixed walk_stackframe()
| * 62bcc5c9f5 riscv: stacktrace: Make walk_stackframe cross pt_regs frame
| * abf001651a virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
| * e63c10851f rv: Update rv_en(dis)able_monitor doc to match kernel-doc
| * 3fd487ffaa arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
| * b4ff9af8e7 openvswitch: Set the skbuff pkt_type for proper pmtud support.
| * 1d20ba6017 pNFS/filelayout: fixup pNfs allocation modes
| * e65d13ec00 tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
| * 599a565421 ipv6: sr: fix memleak in seg6_hmac_init_algo
| * 4bf6964451 af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
| * cdc0234964 rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
| * 3c92f3a59d sunrpc: fix NFSACL RPC retry on soft mount
| * 99530e42e1 nfs: keep server info for remounts
| * b72a3a25c2 NFSv4: Fixup smatch warning for ambiguous return
| * 7995b66f4f ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
| * e8c8e0d0d2 nfc: nci: Fix uninit-value in nci_rx_work
| * 47c5707d44 selftests: net: kill smcrouted in the cleanup logic in amt.sh
| * 8f1fc3b86e ipv6: sr: fix missing sk_buff release in seg6_input_core
| * d2223fd3dd net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
| * fde26c4ae3 x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
| * f23f182baa perf/arm-dmc620: Fix lockdep assert in ->event_init()
| * e9774d1531 regulator: bd71828: Don't overwrite runtime voltages
| * 60c406bb08 ASoC: mediatek: mt8192: fix register configuration for tdm
| * 191dc1b2ff ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
| * 1056e52028 null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
| * 247849eeb3 drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
| * 7904aee9cc drm/msm: Enable clamp_to_idle for 7c3
| * ac9de7b29e Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
| * 3f56c18a39 media: cec: core: avoid confusing "transmit timed out" message
| * 302077d270 media: cec: core: avoid recursive cec_claim_log_addrs
| * 6d6ddabcec media: cec: cec-api: add locking in cec_release()
| * 1e1e7a6ec2 media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
| * a19d05e18d media: sunxi: a83-mips-csi2: also select GENERIC_PHY
| * 1ffee510fa um: Fix the declaration of kasan_map_memory
| * 68bc383a75 um: Fix the -Wmissing-prototypes warning for get_thread_reg
| * b6eda6dee3 um: Fix the -Wmissing-prototypes warning for __switch_mm
| * 1d168e682c powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
| * 64c0cbc5a5 media: flexcop-usb: fix sanity check of bNumEndpoints
| * 9400caf566 Input: cyapa - add missing input core locking to suspend/resume functions
| * 4693aea93c scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
| * b504518a39 media: stk1160: fix bounds checking in stk1160_copy_video()
| * fe1d4a8a60 drm/bridge: tc358775: fix support for jeida-18 and jeida-24
| * 3839a9b19a fs/ntfs3: Use variable length array instead of fixed size
| * 98db3155b5 fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
| * 42c5571981 um: vector: fix bpfflash parameter evaluation
| * 0c02d425a2 um: Add winch to winch_handlers before registering winch IRQ
| * a62a85b29c um: Fix return value in ubd_init()
| * a9ef192c48 drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
| * 93ac25c29f drm/mediatek: dp: Add support for embedded DisplayPort aux-bus
| * a5bd618458 drm/mediatek: dp: Move PHY registration to new function
| * 0f2c694d69 drm/msm/dpu: Always flush the slave INTF on the CTL
| * 5e3aa39154 drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
| * ce0503f825 Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
| * a8951a036b mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
| * 2251a6af08 mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
| * 3465401e7e mmc: sdhci_am654: Add OTAP/ITAP delay enable
| * 9b8590cb9f mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
| * 3eb2922ba9 mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
| * 3c436cc8ab mmc: sdhci_am654: Add tuning algorithm for delay chain
| * f172f4fa22 Input: ioc3kbd - add device table
| * 767daf9c71 Input: ioc3kbd - convert to platform remove callback returning void
| * df9ce976d6 Input: ims-pcu - fix printf string overflow
| * 0a88433d60 s390/boot: Remove alt_stfle_fac_list from decompressor
| * 34ab36f9f3 s390/ipl: Fix incorrect initialization of nvme dump block
| * a88e11b97b s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
| * a9e6068190 s390/vdso: Use standard stack frame layout
| * 8a598bf5ac s390/vdso: Generate unwind information for C modules
| * c7a162b3ae s390/vdso64: filter out munaligned-symbols flag for vdso
| * 926f7fea26 s390/vdso: filter out mno-pic-data-is-text-relative cflag
| * 886f9ee3c5 LoongArch: Fix callchain parse error with kernel tracepoint events again
| * 2477cc49c8 perf stat: Don't display metric header for non-leader uncore events
| * 4b3d568d40 f2fs: fix to add missing iput() in gc_data_segment()
| * 14cdd01c7b perf daemon: Fix file leak in daemon_session__control
| * f192396d5b libsubcmd: Fix parse-options memory leak
| * 3cb6516b84 serial: sh-sci: protect invalidating RXDMA on shutdown
| * 3ccf5210dc f2fs: compress: don't allow unaligned truncation on released compress inode
| * a61d0d6648 f2fs: fix to release node block count in error path of f2fs_new_node_page()
| * 5d47d63883 f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
| * ea394c8698 f2fs: compress: fix to update i_compr_blocks correctly
| * d939659ef9 perf report: Avoid SEGV in report__setup_sample_type()
| * 8641d8d39d perf ui browser: Avoid SEGV on title
| * afb634b085 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
| * bdfaba14d8 PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
| * 01f7e5732f extcon: max8997: select IRQ_DOMAIN instead of depending on it
| * 598eb7d520 perf ui browser: Don't save pointer to stack memory
| * b84c5140fd perf bench internals inject-build-id: Fix trap divide when collecting just one DSO
| * df9329247d ppdev: Add an error check in register_device
| * 27181d7119 ppdev: Remove usage of the deprecated ida_simple_xx() API
| * 4bfd48bb6e stm class: Fix a double free in stm_register_device()
| * 469f34d984 usb: gadget: u_audio: Clear uac pointer when freed.
| * 89e6680968 usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
| * 5aae3129c3 watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
| * 1c991befa1 watchdog: bd9576: Drop "always-running" property
| * d2bfc8ee11 dt-bindings: pinctrl: mediatek: mt7622: fix array properties
| * 91bc100044 VMCI: Fix an error handling path in vmci_guest_probe_device()
| * 049680a943 ovl: remove upper umask handling from ovl_create_upper()
| * a65ca8a943 perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
| * 1c4ce8d08f microblaze: Remove early printk call from cpuinfo-static.c
| * 1cd87f3854 microblaze: Remove gcc flag for non existing early_printk.c file
| * 75a001914a fpga: region: add owner module and take its refcount
| * 44dccf7eb4 coresight: etm4x: Fix access to resource selector registers
| * 3a8a24cbdd coresight: etm4x: Safe access for TRCQCLTR
| * cf9a077ab5 coresight: etm4x: Do not save/restore Data trace control registers
| * ecbfb465f5 coresight: etm4x: Do not hardcode IOMEM access for register restore
| * d3ea59a95d iio: pressure: dps310: support negative temperature values
| * 08ccc5d4d1 perf docs: Document bpf event modifier
| * 4df97442a0 coresight: etm4x: Fix unbalanced pm_runtime_enable()
| * b6eb572f38 iio: adc: stm32: Fixing err code to not indicate success
| * d52358d6da f2fs: fix to check pinfile flag in f2fs_move_file_range()
| * 89548270b0 f2fs: fix to relocate check condition in f2fs_fallocate()
| * aaeab70ad2 f2fs: fix typos in comments
| * 0661153777 f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file()
| * 3192c383f3 f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
| * b8f7a95d23 dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
| * b9a1acadd0 dt-bindings: PCI: rcar-pci-host: Add optional regulators
| * e80cc8298e perf tests: Make "test data symbol" more robust on Neoverse N1
| * da665815cf perf test: Add 'datasym' test workload
| * 587edbeab8 perf test: Add 'brstack' test workload
| * 33b33bd5b7 perf test: Add 'sqrtloop' test workload
| * a80152003a perf test: Add 'leafloop' test workload
| * ee9d68456c perf test: Add 'thloop' test workload
| * e46035c226 perf test: Add -w/--workload option
| * 338656b35f arm64: dts: meson: fix S4 power-controller node
| * 66a7e9aade interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
| * 3c080bd43b serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
| * 905ec77eda PCI: tegra194: Fix probe path for Endpoint mode
| * b54f3b1682 greybus: arche-ctrl: move device table to its right location
| * cb3cc5e92a serial: max3100: Fix bitwise types
| * b6eb7aff23 serial: max3100: Update uart_driver_registered on driver removal
| * 8296bb9e59 serial: max3100: Lock port->lock when calling uart_handle_cts_change()
| * 758c5d1451 firmware: dmi-id: add a release callback function
| * 1aceff5b77 dmaengine: idma64: Add check for dma_set_max_seg_size
| * 2ebcaa0e5d soundwire: cadence: fix invalid PDI offset
| * 03bf7d260f perf annotate: Get rid of duplicate --group option item
| * d9b7185811 counter: linux/counter.h: fix Excess kernel-doc description warning
| * 49642cc366 f2fs: fix to wait on page writeback in __clone_blkaddrs()
| * 1a9225fdd0 f2fs: multidev: fix to recognize valid zero block address
| * 9b41a9b9c8 greybus: lights: check return of get_channel_from_mode
| * 77eec3e2fa iio: core: Leave private pointer NULL when no private data supplied
| * 416b6aad33 perf probe: Add missing libgen.h header needed for using basename()
| * 4086a7af96 perf record: Delete session after stopping sideband thread
| * 3f9e48b104 scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
| * be6e713226 sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write()
| * e72a3ebf80 sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
| * 04e907c4ae af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
| * 3db2fc45d1 netrom: fix possible dead-lock in nr_rt_ioctl()
| * e448d1bad7 net: qrtr: ns: Fix module refcnt
| * 8ca9a750fc net: bridge: mst: fix vlan use-after-free
| * f3ffa269a4 selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval
| * 28126b83f8 net: bridge: xmit: make sure we have at least eth header len bytes
| * ce83060743 net: add pskb_may_pull_reason() helper
| * 43504dae4d RDMA/IPoIB: Fix format truncation compilation errors
| * f5f95901a3 selftests/kcmp: remove unused open mode
| * 879fe60fcc SUNRPC: Fix gss_free_in_token_pages()
| * 7504fb57af ext4: fix potential unnitialized variable
| * 332f8c289b ext4: remove unused parameter from ext4_mb_new_blocks_simple()
| * 910ce50de7 ext4: try all groups in ext4_mb_new_blocks_simple
| * 227a4fa4a0 ext4: fix unit mismatch in ext4_mb_new_blocks_simple
| * 0d82a01cfa ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
| * 00b079e990 sunrpc: removed redundant procp check
| * afeb0e6962 drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
| * 96256f749a virt: acrn: stop using follow_pfn
| * 68b41ff1d8 ext4: avoid excessive credit estimate in ext4_tmpfile()
| * c884b2f721 x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
| * c88a803ed3 x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
| * b4825f5d21 clk: qcom: mmcc-msm8998: fix venus clock issue
| * b8bf481f58 clk: qcom: dispcc-sm6350: fix DisplayPort clocks
| * 49e7685aba clk: qcom: dispcc-sm8450: fix DisplayPort clocks
| * 1a21fdeea5 lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
| * 5582914f2b clk: renesas: r9a07g043: Add clock and reset entry for PLIC
| * 1b6bd01c33 clk: renesas: r8a779a0: Fix CANFD parent clock
| * 9f41ba1dff IB/mlx5: Use __iowrite64_copy() for write combining stores
| * de144d4522 RDMA/rxe: Fix incorrect rxe_put in error path
| * 4c0d0a653a RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c
| * faa8d0ecf6 RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
| * 8f50d295dd clk: rs9: fix wrong default value for clock amplitude
| * 0dd8a16724 clk: mediatek: mt8365-mm: fix DPI0 parent
| * 17f3741c65 RDMA/hns: Modify the print level of CQE error
| * b767e511ce RDMA/hns: Use complete parentheses in macros
| * e88f5ea8db RDMA/hns: Fix GMV table pagesize
| * 763780ef03 RDMA/hns: Fix UAF for cq async event
| * 756ddbe665 RDMA/hns: Fix deadlock on SRQ async events.
| * 755b313811 RDMA/hns: Fix return value in hns_roce_map_mr_sg
| * ad35e397e4 RDMA/mlx5: Adding remote atomic access flag to updatable flags
| * 9302afe52d clk: samsung: exynosautov9: fix wrong pll clock id value
| * e08f0cc0af drm/rockchip: vop2: Do not divide height twice for YUV
| * 26f73934ee drm/mipi-dsi: use correct return type for the DSC functions
| * 2dd1b312b4 drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
| * ed9713f81e drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
| * f0d232de73 drm/bridge: dpc3433: Don't log an error when DSI host can't be found
| * 6eb119ab4f drm/bridge: tc358775: Don't log an error when DSI host can't be found
| * b121737428 drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
| * 9cc53e34a9 drm/bridge: lt9611: Don't log an error when DSI host can't be found
| * 59176fbabe drm/bridge: lt8912b: Don't log an error when DSI host can't be found
| * 195760a41e drm/bridge: icn6211: Don't log an error when DSI host can't be found
| * 9ce1954f80 drm/bridge: anx7625: Don't log an error when DSI host can't be found
| * bf16f6e5ea ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
| * 80431ea363 drm: vc4: Fix possible null pointer dereference
| * e4b52d4938 drm/arm/malidp: fix a possible null pointer dereference
| * a1ab99dcc8 media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
| * ba8b4180f0 fbdev: sh7760fb: allow modular build
| * 673a409b6b media: dt-bindings: ovti,ov2680: Fix the power supply names
| * a6f2f5f762 media: ipu3-cio2: Request IRQ earlier
| * d57bc62491 drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
| * 3ede49a75a drm/msm/dp: Return IRQ_NONE for unhandled interrupts
| * 24e810b9b1 drm/msm/dp: allow voltage swing / pre emphasis of 3
| * ca53b7efd4 drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
| * d33fbb62fb media: radio-shark2: Avoid led_names truncations
| * ff29277c3e media: rcar-vin: work around -Wenum-compare-conditional warning
| * 62fd155f2a media: ngene: Add dvb_ca_en50221_init return value check
| * 1ca59f0a20 ASoC: Intel: avs: Fix potential integer overflow
| * 3e35eb8449 ASoC: Intel: avs: Fix ASRC module initialization
| * c923f05b01 fbdev: sisfb: hide unused variables
| * f9974f9035 powerpc/fsl-soc: hide unused const variable
| * 13562c2d48 drm/mediatek: Add 0 size check to mtk_drm_gem_obj
| * 96e47f2b2f drm/meson: vclk: fix calculation of 59.94 fractional rates
| * de9987cec6 ASoC: kirkwood: Fix potential NULL dereference
| * 55dd7caeeb fbdev: shmobile: fix snprintf truncation
| * 3115fb2cc5 mtd: rawnand: hynix: fixed typo
| * 534fd7770b mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()
| * a4b95e6681 ASoC: Intel: avs: ssm4567: Do not ignore route checks
| * e9fe6e6671 ASoC: Intel: Disable route checks for Skylake boards
| * 98b8a6bfd3 drm/amd/display: Fix potential index out of bounds in color transformation function
| * 743ce5a1f2 drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert
| * 90bd113e65 drm/dp: Don't attempt AUX transfers when eDP panels are not powered
| * 083f305020 drm/panel-samsung-atna33xc20: Use ktime_get_boottime for delays
| * 9843feb28f drm/lcdif: Do not disable clocks on already suspended hardware
| * e48c88d08e dev_printk: Add and use dev_no_printk()
| * 87436e6919 printk: Let no_printk() use _printk()
| * fc61bce6ec drm/bridge: Fix improper bridge init order with pre_enable_prev_first
| * e0c379bd58 Bluetooth: qca: Fix error code in qca_read_fw_build_info()
| * 632b63f127 Bluetooth: compute LE flow credits based on recvbuf space
| * 1cfc3ab941 Bluetooth: Consolidate code around sk_alloc into a helper function
| * 80dea5ae7c mptcp: SO_KEEPALIVE: fix getsockopt support
| * 3ec437f9bb ax25: Fix reference count leak issue of net_device
| * ae467750a3 ax25: Fix reference count leak issues of ax25_dev
| * 46cdb2bee4 ax25: Use kernel universal linked list to implement ax25_dev_list
| * 01fdc6a9d1 riscv, bpf: make some atomic operations fully ordered
| * 913ad7113f s390/bpf: Emit a barrier for BPF_FETCH instructions
| * bf8aaf0ae0 net/mlx5: Discard command completions in internal error
| * 4baae687a2 net/mlx5: Add a timeout to acquire the command queue semaphore
| * e77a3ec7ad ipv6: sr: fix invalid unregister error path
| * e82d8b708c ipv6: sr: fix incorrect unregister order
| * f08ce703af ipv6: sr: add missing seg6_local_exit
| * 9ec8b0ccad net: openvswitch: fix overwriting ct original tuple for ICMPv6
| * 517e64bcc9 net: usb: smsc95xx: stop lying about skb->truesize
| * 8299e4d778 af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
| * 63470d2044 net: ethernet: cortina: Locking fixes
| * 4e3d60b618 selftests: net: move amt to socat for better compatibility
| * 476adb3bbb eth: sungem: remove .ndo_poll_controller to avoid deadlocks
| * 6758bf27a7 net: ipv6: fix wrong start position when receive hop-by-hop fragment
| * 2ceac7eac0 m68k: mac: Fix reboot hang on Mac IIci
| * 0d9ae12535 m68k: Fix spinlock race in kernel thread creation
| * 3e3f283c0b net: usb: sr9700: stop lying about skb->truesize
| * 439d2db44d usb: aqc111: stop lying about skb->truesize
| * decf64daf4 HID: amd_sfh: Handle "no sensors" in PM operations
| * a9f11a226b wifi: mwl8k: initialize cmd->addr[] properly
| * 3869da766b x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
| * e39d630be9 kernel/numa.c: Move logging out of numa.h
| * 888c05a172 scsi: qla2xxx: Fix debugfs output for fw_resource_count
| * d93318f19d scsi: qedf: Ensure the copied buf is NUL terminated
| * 7d3e694c4f scsi: bfa: Ensure the copied buf is NUL terminated
| * 3848c9f889 HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
| * 1f2ebd3758 kunit: Fix kthread reference
| * b48efc18de selftests: default to host arch for LLVM builds
| * 9118e77618 selftests/resctrl: fix clang build failure: use LOCAL_HDRS
| * 63e48e33ea selftests/binderfs: use the Makefile's rules, not Make's implicit rules
| * fa6b979c86 libbpf: Fix error message in attach_kprobe_multi
| * 48e88dc8b0 wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
| * e091545b16 Revert "sh: Handle calling csum_partial with misaligned data"
| * 1b682bd726 sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
| * 34f7ebff1b wifi: ar5523: enable proper endpoint verification
| * 265c3cda47 wifi: carl9170: add a proper sanity check for endpoints
| * 787fb79efc macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
| * c74b33b4f5 net: give more chances to rcu in netdev_wait_allrefs_any()
| * 1491a01ef5 drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
| * 3669baf308 drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
| * 3d1face00e drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
| * 10e9ecf9dd pwm: sti: Simplify probe function using devm functions
| * e07184f033 pwm: sti: Prepare removing pwm_chip from driver data
| * e173bd3ca0 pwm: sti: Convert to platform remove callback returning void
| * 131490afa2 tcp: avoid premature drops in tcp_add_backlog()
| * 3616b4e1f1 net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches
| * be16a7fd4b net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers
| * f81c15d86b wifi: ath10k: populate board data for WCN3990
| * 540fe85ed8 selftests/bpf: Fix a fd leak in error paths in open_netns
| * 16e4d6b72c wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
| * 11c731386e thermal/drivers/tsens: Fix null pointer dereference
| * c8d23a7e9b x86/purgatory: Switch to the position-independent small code model
| * cf36b66875 scsi: hpsa: Fix allocation size for Scsi_Host private data
| * c0fcc7838b scsi: libsas: Fix the failure of adding phy with zero-address to port
| * 769c4f355b cppc_cpufreq: Fix possible null pointer dereference
| * 606dc69d6f udp: Avoid call to compute_score on multiple sites
| * 789afa3e00 net: remove duplicate reuseport_lookup functions
| * 1191892924 net: export inet_lookup_reuseport and inet6_lookup_reuseport
| * 0f67a567be x86/pat: Fix W^X violation false-positives when running as Xen PV guest
| * 66109531c1 x86/pat: Restructure _lookup_address_cpa()
| * 1ed308ba7b x86/pat: Introduce lookup_address_in_pgd_attr()
| * 8bc9546805 cpufreq: exit() callback is optional
| * ce087f5088 selftests/bpf: Fix umount cgroup2 error in test_sockmap
| * e2ce84ae6e x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
| * 15b1f35a11 gfs2: Fix "ignore unlock failures after withdraw"
| * 4b10a59fb6 gfs2: Don't forget to complete delayed withdraw
| * 39a12a9ba8 ACPI: disable -Wstringop-truncation
| * 3eecd40d13 irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
| * 10a52dc487 irqchip/alpine-msi: Fix off-by-one in allocation error path
| * 4ade4cfe23 ACPI: LPSS: Advertise number of chip selects via property
| * 6eae7a54cc scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
| * 00e7b0eb92 scsi: ufs: core: Perform read back after disabling interrupts
| * 5ec91312a5 scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
| * ec6be64a14 scsi: ufs: qcom: Perform read back after writing CGC enable
| * 44db6b5888 scsi: ufs: qcom: Perform read back after writing unipro mode
| * 9c4e9090af scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
| * 1e33175a8c scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
| * b52ce65b46 scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
| * bfda254ceb scsi: ufs: qcom: Perform read back after writing reset bit
| * 90098f0a16 bpf: Pack struct bpf_fib_lookup
| * 1385768312 wifi: carl9170: re-fix fortified-memset warning
| * a353cd9ff7 bitops: add missing prototype check
| * 542598a559 mlx5: stop warning for 64KB pages
| * f3141f00f3 net/mlx5e: Fail with messages when params are not valid for XSK
| * 82bb344ff3 qed: avoid truncating work queue length
| * b752f7fc15 ACPI: Fix Generic Initiator Affinity _OSC bit
| * 94833a31d7 sched/fair: Add EAS checks before updating root_domain::overutilized
| * 388eb05c27 x86/boot: Ignore relocations in .notes sections in walk_relocs() too
| * 75d015f2f1 bpftool: Fix missing pids during link show
| * 4d753cf502 wifi: ath11k: don't force enable power save on non-running vdevs
| * 0eb2c0528e wifi: brcmfmac: pcie: handle randbuf allocation failure
| * 0c94d93b5d wifi: ath10k: poll service ready message before failing
| * 9a97008dbf block: support to account io_ticks precisely
| * 56aacead05 block: open code __blk_account_io_done()
| * 4e4c9bf71a block: open code __blk_account_io_start()
| * 71e8e4f288 md: fix resync softlockup when bitmap size is less than array size
| * 8b5405bf0d null_blk: Fix missing mutex_destroy() at module removal
| * 3603c03acd soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
| * f06969df2e jffs2: prevent xattr node from overflowing the eraseblock
| * 36840a727c ARM: configs: sunxi: Enable DRM_DW_HDMI
| * e2228ed3fe rcu: Fix buffer overflow in print_cpu_stall_info()
| * 08186d0c5f rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
| * 91f1edfa38 io_uring: use the right type for work_llist empty check
| * 0c9ce8f239 io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of task_work
| * 007a23d38a s390/cio: fix tracepoint subchannel type field
| * 891b2c9d39 crypto: x86/sha512-avx2 - add missing vzeroupper
| * f8daeb40b4 crypto: x86/sha256-avx2 - add missing vzeroupper
| * c38667181b crypto: x86/nh-avx2 - add missing vzeroupper
| * eeaf1f604f crypto: ccp - drop platform ifdef checks
| * ecebbacac1 parisc: add missing export of __cmpxchg_u8()
| * 6f48c67414 nilfs2: fix out-of-range warning
| * 0d0f8ba042 ecryptfs: Fix buffer size for tag 66 packet
| * a89bece5a6 firmware: raspberrypi: Use correct device for DMA mappings
| * 4d8e9c2aa6 mm/slub, kunit: Use inverted data to corrupt kmem cache
| * 49833a8da6 crypto: bcm - Fix pointer arithmetic
| * 24119acfc7 openpromfs: finish conversion to the new mount API
| * de9bf32eab nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
| * 559214eb4e epoll: be better about file lifetimes
| * ae63c25cb0 nvmet: fix nvme status code when namespace is disabled
| * 11f62e1818 nvmet-tcp: fix possible memory leak when tearing down a controller
| * 8244dfd22c nvmet-auth: replace pr_debug() with pr_err() to report an error.
| * 068095539a nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
| * 226a12bf62 nvme: find numa distance only if controller has valid numa id
| * e8b799f42a x86/mm: Remove broken vsyscall emulation code from the page fault code
| * 6ce4f190f0 drm/amdkfd: Flush the process wq before creating a kfd_process
| * 6170ef8490 drm/amd/display: Add VCO speed parameter for DCN31 FPU
| * 3fa799b54a drm/amd/display: Add dtbclk access to dcn315
| * 68195bb960 ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
| * 32b4a8888f ASoC: da7219-aad: fix usage of device_get_named_child_node()
| * 805ef55a82 softirq: Fix suspicious RCU usage in __do_softirq()
| * 1572a4a3b8 fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
| * e9c96d01d5 genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
| * 117e7a43cd KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
| * b8938d6f57 efi: libstub: only free priv.runtime_map when allocated
| * 6f9881cb4d x86/efistub: Omit physical KASLR when memory reservations exist
| * ce4e200f37 KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
| * b3c8774eb2 ASoC: rt715-sdca: volume step modification
| * ac6c005a55 ASoC: rt715: add vendor clear control register
| * ee8363381f regulator: vqmmc-ipq4019: fix module autoloading
| * 7341c2c685 ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
| * b26f1c63e6 ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
| * d611f95f97 regulator: irq_helpers: duplicate IRQ name
| * ff6e684326 ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
| * e3decad6ab sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
| * e477e2e426 selftests: sud_test: return correct emulated syscall value on RISC-V
| * 1c4ee6acdb LoongArch: Lately init pmu after smp is online
| * 70b1bf6d9e drm/amdgpu/mes: fix use-after-free issue
| * 4e68e749a8 drm/amdgpu: Fix the ring buffer size for queue VM flush
| * 3bec2fc83b drm/amdgpu: Update BO eviction priorities
| * 85a37f59d7 drm/amd/display: Set color_mgmt_changed to true on unsuspend
| * b7dd8659df net: usb: qmi_wwan: add Telit FN920C04 compositions
| * e032c4cfb1 dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
| * ac260a819a wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
| * f5273fe5f6 wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field
| * 79b1584879 wifi: mac80211: don't use rate mask for scanning
| * 2f01314049 KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
| * c2fb439f4f ALSA: Fix deadlocks with kctl removals at disconnection
| * e007476725 ALSA: core: Fix NULL module pointer assignment at card init
| * c0d7ab900c ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
| * a734ec0654 ksmbd: ignore trailing slashes in share paths
| * 14bcd802aa ksmbd: avoid to send duplicate oplock break notifications
| * 8f54c5f3c6 fs/ntfs3: Break dir enumeration if directory contents error
| * c494fe4ccd fs/ntfs3: Fix case when index is reused during tree transformation
| * df40783dc3 fs/ntfs3: Taking DOS names into account during link counting
| * 1c29c6287a fs/ntfs3: Remove max link count info display during driver init
| * 1c3844c5f4 nilfs2: fix potential hang in nilfs_detach_log_writer()
| * 61196139d7 nilfs2: fix unexpected freezing of nilfs_segctor_sync()
| * 35471c0ff1 net: smc91x: Fix m68k kernel compilation for ColdFire CPU
| * 5996b2b2da tools/nolibc/stdlib: fix memory error in realloc()
| * b7a0a5cf9e tools/latency-collector: Fix -Wformat-security compile warns
| * 54c64967ba ring-buffer: Fix a race between readers and resize checks
| * 0c48185a95 r8169: Fix possible ring buffer corruption on fragmented Tx packets.
| * 69ed8fc12b Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already"
| * 0db279c7c2 io_uring: fail NOP if non-zero op flags is passed in
| * 28cbe126ce serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
| * 78a933a618 serial: 8250_bcm7271: use default_mux_rate if possible
| * 3726f75a1c speakup: Fix sizeof() vs ARRAY_SIZE() bug
| * 8a6e6b1644 tty: n_gsm: fix missing receive state reset after mode switch
| * 46f52c89a7 tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
| * dbff5f0bfb ftrace: Fix possible use-after-free issue in ftrace_location()
| * af542630b7 x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
| * f9977e4e0c SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
* | 2061a20382 Revert "xfs: use iomap_valid method to detect stale cached iomaps"
* | ca48ea3afb Revert "iomap: write iomap validity checks"
* | c1eefaf65b Revert "binder: fix max_thread type inconsistency"
* | e4ceb55393 Merge 6.1.92 into android14-6.1-lts
|\|
| * 88690811da Linux 6.1.92
| * b1c74dad43 docs: kernel_include.py: Cope with docutils 0.21
| * cd82e9620e admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
| * 681935009f KEYS: trusted: Do not use WARN when encode fails
| * 1d9e2de245 remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
| * a6b9c5de4a serial: kgdboc: Fix NMI-safety problems from keyboard reset code
| * 3f4be9dbef usb: typec: tipd: fix event checking for tps6598x
| * f099b8127d usb: typec: ucsi: displayport: Fix potential deadlock
| * 17466488ae net: usb: ax88179_178a: fix link status when link is set to down/up
| * 341eb08dbc usb: dwc3: Wait unconditionally after issuing EndXfer command
| * e78531e8ca binder: fix max_thread type inconsistency
| * 92cb363d16 drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
| * a94cf76604 arm64: atomics: lse: remove stale dependency on JUMP_LABEL
| * d9a85a8d82 xfs: short circuit xfs_growfs_data_private() if delta is zero
| * fbdf080691 xfs: get root inode correctly at bulkstat
| * 7430ff84c2 xfs: fix log recovery when unknown rocompat bits are set
| * 4db0e08ef9 xfs: allow inode inactivation during a ro mount log recovery
| * 2cc027623e xfs: invalidate xfs_bufs when allocating cow extents
| * 537baedb3e xfs: estimate post-merge refcounts correctly
| * 131a854c09 xfs: hoist refcount record merge predicates
| * 0d889ae85f xfs: fix super block buf log item UAF during force shutdown
| * 2f1eb71ae8 xfs: wait iclog complete before tearing down AIL
| * e62c784a56 xfs: attach dquots to inode before reading data/cow fork mappings
| * 5465403341 xfs: invalidate block device page cache during unmount
| * 781f80e519 xfs: fix incorrect i_nlink caused by inode racing
| * 42163ff6c6 xfs: fix sb write verify for lazysbcount
| * 77d31f0c70 xfs: fix incorrect error-out in xfs_remove
| * e2ae64993c xfs: fix off-by-one-block in xfs_discard_folio()
| * e811fec51c xfs: drop write error injection is unfixable, remove it
| * ea67e73129 xfs: use iomap_valid method to detect stale cached iomaps
| * 54a37e5d07 iomap: write iomap validity checks
| * 580f40b4c9 xfs: xfs_bmap_punch_delalloc_range() should take a byte range
| * 38be53c3fd iomap: buffered write failure should not truncate the page cache
| * 12339ec6fe xfs,iomap: move delalloc punching to iomap
| * 8b6afad39b xfs: use byte ranges for write cleanup ranges
| * 142eafd24d xfs: punching delalloc extents on write failure is racy
| * 495e934c66 xfs: write page faults in iomap are not buffered writes
| * 493a8172e5 mmc: core: Add HS400 tuning in HS400es initialization
| * 5d91238b59 KEYS: trusted: Fix memory leak in tpm2_key_encode()
| * 104ef3d8cd nfsd: don't allow nfsd threads to be signalled.
| * cf8e6ae857 mfd: stpmic1: Fix swapped mask/unmask in irq chip
| * 026caf92c6 pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()
| * 90cbd4c081 ice: remove unnecessary duplicate checks for VF VSI ID
| * 59161a21ca ice: pass VSI pointer into ice_vc_isvalid_q_id
| * 8a94fc9d20 net: ks8851: Fix another TX stall caused by wrong ISR flag handling
| * 91402e0e5d drm/amd/display: Fix division by zero in setup_dsc_config
* | 6b10c7f4b9 ANDROID: GKI: add wait_for_completion_interruptible_timeout to db845c symbol list
* | e757b335e0 Revert "Reapply "timers: Rename del_timer_sync() to timer_delete_sync()""
* | 2587385ace Revert "timers: Rename del_timer() to timer_delete()"
* | 38eb9de84b Revert "Bluetooth: qca: add support for QCA2066"
* | 0bf7f66897 Revert "spi: introduce new helpers with using modern naming"
* | 6971d8bfbd Revert "spi: axi-spi-engine: Convert to platform remove callback returning void"
* | 31e3fe5faa Revert "spi: spi-axi-spi-engine: switch to use modern name"
* | 97cb39500a Revert "spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()"
* | b0e59b447d Revert "spi: axi-spi-engine: simplify driver data allocation"
* | 948d41cbb2 Revert "spi: axi-spi-engine: use devm_spi_alloc_host()"
* | 3a5b2c1e21 Revert "spi: axi-spi-engine: move msg state to new struct"
* | 44b32d88b0 Revert "spi: axi-spi-engine: use common AXI macros"
* | af6c59d699 Revert "spi: axi-spi-engine: fix version format string"
* | f66f5edf10 Revert "spi: Merge spi_controller.{slave,target}_abort()"
* | c313757fce Revert "mm/hugetlb: add folio support to hugetlb specific flag macros"
* | 323d7963f9 Revert "mm: add private field of first tail to struct page and struct folio"
* | edd74f93c0 Revert "mm/hugetlb: add hugetlb_folio_subpool() helpers"
* | 366b3a6494 Revert "mm/hugetlb: add folio_hstate()"
* | 6d38b404ee Revert "mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios"
* | d1bebbc8ed Revert "mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios"
* | 563a9907e2 Revert "mm/hugetlb: convert free_huge_page to folios"
* | dd84aa68cd Revert "mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios"
* | 00ebd8ec69 Revert "mm/hugetlb: fix missing hugetlb_lock for resv uncharge"
* | 0010b838db Merge 6.1.91 into android14-6.1-lts
|\|
| * 4078fa637f Linux 6.1.91
| * 8064a711c4 net: bcmgenet: synchronize UMAC_CMD access
| * 9ed299be99 net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
| * 714e053565 net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
| * ed804e9d8b net: bcmgenet: Clear RGMII_LINK upon link down
| * beaf11969f md: fix kmemleak of rdev->serial
| * ea92809e29 mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
| * 2effe407f7 mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
| * 0391c9085a btrfs: do not wait for short bulk allocation
| * e4519a0166 keys: Fix overwrite of key expiration on instantiation
| * 5056d23893 dmaengine: idxd: add a write() method for applications to submit work
| * 3e4368832e dmaengine: idxd: add a new security check to deal with a hardware erratum
| * 9ff3c42aa3 VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
| * 064688d70c Bluetooth: qca: fix firmware check error path
| * 57062aa13e Bluetooth: qca: fix info leak when fetching fw build id
| * bcccdc947d Bluetooth: qca: fix info leak when fetching board id
| * 29a475688a Bluetooth: qca: fix NVM configuration parsing
| * 1caceadfb5 Bluetooth: qca: add missing firmware sanity checks
| * 94eb9f83a4 ksmbd: do not grant v2 lease if parent lease key and epoch are not set
| * 3ae4f87ac2 ksmbd: avoid to send duplicate lease break notifications
| * a86743458b ksmbd: off ipv6only for both ipv4/ipv6 binding
| * 4e73c01b61 spi: microchip-core-qspi: fix setting spi bus clock rate
| * 07b933a1b6 regulator: core: fix debugfs creation regression
| * 7629ef6dda mm: use memalloc_nofs_save() in page_cache_ra_order()
| * a2740fe937 hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
| * 2d60ff5874 net: fix out-of-bounds access in ops_init
| * ce740545c0 drm/amd/display: Handle Y carry-over in VCP X.Y calculation
| * d8cdbd0f6c drm/i915/bios: Fix parsing backlight BDB data
| * 0dbfc73670 drm/vmwgfx: Fix invalid reads in fence signaled events
| * 89fffbdf53 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
| * c42a8c6baa mei: me: add lunar lake point M DID
| * eedaabee28 slimbus: qcom-ngd-ctrl: Add timeout for wait operation
| * a66c869b17 dyndbg: fix old BUG_ON in >control parser
| * 0b47bbc91f ASoC: ti: davinci-mcasp: Fix race condition during probe
| * 9c301fd3b0 ASoC: tegra: Fix DSPK 16-bit playback
| * 21ea04aad8 tipc: fix UAF in error path
| * 50a436d05f kmsan: compiler_types: declare __no_sanitize_or_inline
| * b56d4991cf iio: accel: mxc4005: Interrupt handling fixes
| * 50fa09df1a iio:imu: adis16475: Fix sync mode setting
| * 4b71dbe482 dt-bindings: iio: health: maxim,max30102: fix compatible check
| * 39ca83ed73 mptcp: ensure snd_nxt is properly initialized on connect
| * 9f6eb0ab4f mm/slab: make __free(kfree) accept error pointers
| * 25090e9bb0 btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
| * f0c6aae9e4 ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
| * d56d2ca03c usb: typec: tcpm: Check for port partner validity before consuming it
| * cfcd544a99 usb: typec: tcpm: unregister existing source caps before re-registration
| * d9efd3c899 usb: dwc3: core: Prevent phy suspend during init
| * bf3b0ab6fb usb: xhci-plat: Don't include xhci.h
| * 4e2ae9ff79 usb: gadget: f_fs: Fix a race condition when processing setup packets.
| * 9dac7678e1 usb: gadget: composite: fix OS descriptors w_value logic
| * 5f1d68ef5d USB: core: Fix access violation during port device removal
| * 3e7bbab8bb usb: ohci: Prevent missed ohci interrupts
| * 32a22b9f6c usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
| * 85e6aa4f6e usb: typec: ucsi: Fix connector check on init
| * 91a7af8cb3 usb: typec: ucsi: Check for notifications after init
| * 398248fc45 rust: macros: fix soundness issue in `module!` macro
| * ca99731c13 rust: module: place generated init_module() function in .init.text
| * 15eb8edb09 btf, scripts: rust: drop is_rust_module.sh
| * 0a0464cd41 rust: fix regexp in scripts/is_rust_module.sh
| * 8762bf944a rust: error: Rename to_kernel_errno() -> to_errno()
| * b548c53bc3 Reapply "drm/qxl: simplify qxl_fence_wait"
| * 4ee0941da1 firewire: nosy: ensure user_length is taken into account when fetching packet contents
| * 53f2bfce46 btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
| * 5c25b169f9 drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
| * f82f7220af MAINTAINERS: add leah to 6.1 MAINTAINERS file
| * 02f5300f68 drm/amd/display: Atom Integrated System Info v2_2 for DCN35
| * 1a51e24404 gpiolib: cdev: fix uninitialised kfifo
| * 9ed256d294 gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
| * a35ebde68c gpiolib: cdev: Add missing header(s)
| * 12bb8b6a2e dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users
| * 58cf43f758 drm/connector: Add \n to message about demoting connector force-probes
| * 35c614caea drm/meson: dw-hdmi: add bandgap setting for g12
| * be9b56b034 drm/meson: dw-hdmi: power up phy on device init
| * 72ede790f5 net: hns3: fix kernel crash when devlink reload during initialization
| * fa2c7e7646 net: hns3: fix port vlan filter not disabled issue
| * 98987f7808 net: hns3: use appropriate barrier function after setting a bit value
| * 0bb8751de1 net: hns3: release PTP resources if pf initialization failed
| * 549a2179de net: hns3: change type of numa_node_mask as nodemask_t
| * 5daf064afe net: hns3: direct return when receive a unknown mailbox message
| * 7d90032f7c net: hns3: using user configure after hardware reset
| * d5a466ab6e net/smc: fix neighbour and rtable leak in smc_ib_find_route()
| * ea0cb87402 ipv6: prevent NULL dereference in ip6_output()
| * d7ae8e8502 ipv6: annotate data-races around cnf.disable_ipv6
| * 5136ea7fa5 hsr: Simplify code for announcing HSR nodes timer setup
| * ca4e781f15 net-sysfs: convert dev->operstate reads to lockless ones
| * b086d1e82f timers: Rename del_timer() to timer_delete()
| * e2591243ce timers: Get rid of del_singleshot_timer_sync()
| * 7e3242c139 ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
| * bd78696348 net: bridge: fix corrupted ethernet header on multicast-to-unicast
| * 728a83160f phonet: fix rtm_phonet_notify() skb allocation
| * 544895ba02 hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
| * a6c70251c9 hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
| * 95c5fc8835 hwmon: (corsair-cpro) Use a separate buffer for sending commands
| * 6e4c719395 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
| * 8a3ff43dcb net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
| * 8960ff650a Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
| * e3880b531b Bluetooth: msft: fix slab-use-after-free in msft_do_close()
| * bfab2c1f79 Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
| * 13ed7cdf07 tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
| * 3fe4ef0568 tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
| * ad702338fe ARM: 9381/1: kasan: clear stale stack poison
| * 179db49d7e xfrm: Preserve vlan tags for transport mode software GRO
| * bd8f78c71d qibfs: fix dentry leak
| * f269a8ce52 perf unwind-libdw: Handle JIT-generated DSOs properly
| * cf731a5dce perf unwind-libunwind: Fix base address for .eh_frame
| * 2f5e8322cd spi: Merge spi_controller.{slave,target}_abort()
| * 53ce433a6d kbuild: rust: avoid creating temporary files
| * 56633a5e15 net:usb:qmi_wwan: support Rolling modules
| * 04fa2cfc26 drm/nouveau/dp: Don't probe eDP ports twice harder
| * ba2adb4422 fs/9p: drop inodes immediately on non-.L too
| * d063d13af7 clk: Don't hold prepare_lock when calling kref_put()
| * e4e82ef35a gpio: crystalcove: Use -ENOTSUPP consistently
| * 8ebcd16238 gpio: wcove: Use -ENOTSUPP consistently
| * f3b0226fc9 9p: explicitly deny setlease attempts
| * 5d74f4d80a fs/9p: translate O_TRUNC into OTRUNC
| * ca9b5c81f0 fs/9p: only translate RWX permissions for plain 9P2000
| * 3aba6c4ec5 iommu: mtk: fix module autoloading
| * 2f622008bf Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
| * dabf12bf99 uio_hv_generic: Don't free decrypted memory
| * 1999644d95 Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
| * 1f3484dec9 selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
| * 45289683c7 drm/amdgpu: Refine IB schedule error logging
| * a513ccd915 tools/power/turbostat: Fix uncore frequency file string
| * b002a1b321 MIPS: scall: Save thread_info.syscall unconditionally on entry
| * df541b658d gpu: host1x: Do not setup DMA for virtual devices
| * f6add0a6f7 blk-iocost: avoid out of bounds shift
| * 62b8582d93 scsi: target: Fix SELinux error when systemd-modules loads the target module
| * d38ca15be1 memblock tests: fix undefined reference to `BIT'
| * 223550f0e9 memblock tests: fix undefined reference to `panic'
| * 701248485b memblock tests: fix undefined reference to `early_pfn_to_nid'
| * e04539f513 btrfs: always clear PERTRANS metadata during commit
| * 66619d8ad3 btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
| * bc40c15851 tools/power turbostat: Fix Bzy_MHz documentation typo
| * fcdeb34d14 tools/power turbostat: Increase the limit for fd opened
| * 768b167281 tools/power turbostat: Fix added raw MSR output
| * 6fafe36617 firewire: ohci: mask bus reset interrupts between ISR and bottom half
| * 337f84a0ef ata: sata_gemini: Check clk_enable() result
| * 9c08b9a943 net: bcmgenet: Reset RBUF on first open
| * 8a26198186 block: fix overflow in blk_ioctl_discard()
| * 07e72fe943 ALSA: line6: Zero-initialize message buffers
| * c30a4ca93d scsi: ufs: core: WLUN suspend dev/link state error recovery
| * 7ec2581823 kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
| * fa6995eeb6 bpf: Check bloom filter map value size
| * 681fb3c25d btrfs: return accurate error code on open failure in open_fs_devices()
| * 1150606d47 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
| * 5f0266044d scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
| * 2a1dc2e942 net: mark racy access on sk->sk_rcvbuf
| * d6275e1028 wifi: cfg80211: fix rdev_dump_mpp() arguments order
| * ec9727406e wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
| * 5f1d833429 gfs2: Fix invalid metadata access in punch_hole
| * 6503c39398 scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
| * e25dca8db0 scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
| * 645b6a5e02 scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
| * 0936809d96 scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
| * 3a5b0378ac KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
| * a2184f533f KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
| * 7fb5793c53 powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
| * 15e1f8425f powerpc/pseries: make max polling consistent for longer H_CALLs
| * 0b59ae6b5f powerpc/pseries: Move PLPKS constants to header file
| * 5aa59e14ec powerpc/pseries: replace kmalloc with kzalloc in PLPKS driver
| * 70f64cb290 clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
| * 463c15af49 net: gro: add flush check in udp_gro_receive_segment
| * 3a1ea8a265 drm/panel: ili9341: Use predefined error codes
| * f51181ac91 drm/panel: ili9341: Respect deferred probe
| * 10cb803aff s390/qeth: Fix kernel panic after setting hsuid
| * 51ad57c9b0 vxlan: Pull inner IP header in vxlan_rcv().
| * d03a82f4f8 tipc: fix a possible memleak in tipc_buf_append
| * 989bf6fd1e net: core: reject skb_copy(_expand) for fraglist GSO skbs
| * cd37a5a08c net: bridge: fix multicast-to-unicast with fraglist GSO
| * e005d6754e spi: fix null pointer dereference within spi_sync
| * 7e52c09c28 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
| * 3636dcdafb cxgb4: Properly lock TX queue for the selftest.
| * 10452edd17 s390/cio: Ensure the copied buf is NUL terminated
| * 722d33c442 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
| * 21d458ecf4 ASoC: meson: cards: select SND_DYNAMIC_MINORS
| * 46071eeb0b ASoC: meson: axg-tdm-interface: manage formatters in trigger
| * f0f8ec97ac ASoC: meson: axg-card: make links nonatomic
| * d41a1d5c45 ASoC: meson: axg-fifo: use threaded irq to check periods
| * 821b719884 ASoC: meson: axg-fifo: use FIELD helpers
| * 52f6ac8639 net: qede: use return from qede_parse_actions()
| * 3f4a70e2ff net: qede: use return from qede_parse_flow_attr() for flow_spec
| * de5f3a63a9 net: qede: use return from qede_parse_flow_attr() for flower
| * 3b588a16ac net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
| * 160e19b95b s390/vdso: Add CFI for RA register to asm macro vdso_func
| * 39a055e607 net l2tp: drop flow hash on forward
| * 37ed6f244e nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
| * 8f11fe3ea3 octeontx2-af: avoid off-by-one read from userspace
| * 06cb37e2ba bna: ensure the copied buf is NUL terminated
| * 272bfb019f xdp: use flags field to disambiguate broadcast redirect
| * a4b30f548a s390/mm: Fix clearing storage keys for huge pages
| * 5dbc158805 s390/mm: Fix storage key clearing for guest huge pages
| * 67a8dbe10b bpf, arm64: Fix incorrect runtime stats
| * d97e7ab8c8 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
| * 5d6e336b9e spi: axi-spi-engine: fix version format string
| * 0308cf64a1 spi: axi-spi-engine: use common AXI macros
| * cde20c4150 spi: axi-spi-engine: move msg state to new struct
| * 657f211713 spi: axi-spi-engine: use devm_spi_alloc_host()
| * be632e909c spi: axi-spi-engine: simplify driver data allocation
| * aec8b34ec0 spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
| * d8309051f7 spi: spi-axi-spi-engine: switch to use modern name
| * 4a680d305e spi: axi-spi-engine: Convert to platform remove callback returning void
| * 1a8183ccf0 spi: introduce new helpers with using modern naming
| * 77fe00227f bpf: Fix a verifier verbose message
| * 264327b716 nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
| * 39dc9e1442 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
| * a81bcc6abf bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
| * a4a645d96b regulator: change devm_regulator_get_enable_optional() stub to return Ok
| * 2ec0e92dc5 regulator: change stubbed devm_regulator_get_enable to return Ok
| * ed6877bce6 regulator: mt6360: De-capitalize devicetree regulator subnodes
| * 518d5ddafe pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
| * 22975a1eb6 power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
| * 030017a83d power: rt9455: hide unused rt9455_boost_voltage_values
| * 39460d43df pinctrl: baytrail: Fix selecting gpio pinctrl state
| * 91a0840a3c pinctrl: intel: Make use of struct pinfunction and PINCTRL_PINFUNCTION()
| * 6322e368f0 pinctrl: Introduce struct pinfunction and PINCTRL_PINFUNCTION() macro
| * 8ae63bd858 nfs: Handle error of rpc_proc_register() in nfs_net_init().
| * 2b7f2d663a nfs: make the rpc_stat per net namespace
| * 9dd86e9d34 nfs: expose /proc/net/sunrpc/nfs in net namespaces
| * 5720cd5264 sunrpc: add a struct rpc_stats arg to rpc_create_args
| * 8a6c8f2876 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
| * 4880cc2233 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
| * ac7d657958 pinctrl: core: delete incorrect free in pinctrl_enable()
| * 8d93303fd0 pinctrl/meson: fix typo in PDM's pin name
| * ee2b22d388 pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
| * 98c7ed29cd smb3: missing lock when picking channel
| * ff03a8b422 cifs: use the least loaded channel for sending requests
| * fe73628b30 kbuild: specify output names separately for each emission type from rustc
| * d73ba54dad kbuild: refactor host*_flags
| * 4c806333ef mm/hugetlb: fix missing hugetlb_lock for resv uncharge
| * cc8f0d90ba mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios
| * 10de76f4cd mm/hugetlb: convert free_huge_page to folios
| * fc50e09b8b mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios
| * 8080591648 mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios
| * 6b27a1f253 mm/hugetlb: add folio_hstate()
| * 6a8af731a1 mm/hugetlb: add hugetlb_folio_subpool() helpers
| * 271227f13f mm: add private field of first tail to struct page and struct folio
| * 3283a9894d mm/hugetlb: add folio support to hugetlb specific flag macros
| * ad643241d4 Bluetooth: qca: add support for QCA2066
| * c43e5028f5 eeprom: at24: fix memory corruption race condition
| * 8a9ae7e741 eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
| * 7b05bb82ac eeprom: at24: Use dev_err_probe for nvmem register failure
| * e26c2fadef rust: kernel: require `Send` for `Module` implementations
| * b0db4caa10 wifi: nl80211: don't free NULL coalescing rule
| * c376f7ab28 dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
| * 24369172a0 dmaengine: pl330: issue_pending waits until WFP state
* f35d32242b Reapply "timers: Rename del_timer_sync() to timer_delete_sync()"
* 5b7c58806e Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
* 2b896ed3a2 Merge branch 'android14-6.1' into branch 'android14-6.1-lts'

Change-Id: I0ccb668b0bd397871bf4cdf9b68176edb682cd7a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Documentation/admin-guide/hw-vuln/core-scheduling.rst

@@ -67,8 +67,8 @@ arg4:
     will be performed for all tasks in the task group of ``pid``.
 
 arg5:
-    userspace pointer to an unsigned long for storing the cookie returned by
+    userspace pointer to an unsigned long long for storing the cookie returned
-    ``PR_SCHED_CORE_GET`` command. Should be 0 for all other commands.
+    by ``PR_SCHED_CORE_GET`` command. Should be 0 for all other commands.
 
 In order for a process to push a cookie to, or pull a cookie from a process, it
 is required to have the ptrace access mode: `PTRACE_MODE_READ_REALCREDS` to the

Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml

@@ -42,7 +42,7 @@ allOf:
       properties:
         compatible:
           contains:
-            const: maxim,max30100
+            const: maxim,max30102
     then:
       properties:
         maxim,green-led-current-microamp: false

Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml

@@ -37,15 +37,15 @@ properties:
       active low.
     maxItems: 1
 
-  dovdd-supply:
+  DOVDD-supply:
     description:
       Definition of the regulator used as interface power supply.
 
-  avdd-supply:
+  AVDD-supply:
     description:
       Definition of the regulator used as analog power supply.
 
-  dvdd-supply:
+  DVDD-supply:
     description:
       Definition of the regulator used as digital power supply.
 
@@ -59,9 +59,9 @@ required:
   - reg
   - clocks
   - clock-names
-  - dovdd-supply
+  - DOVDD-supply
-  - avdd-supply
+  - AVDD-supply
-  - dvdd-supply
+  - DVDD-supply
   - reset-gpios
   - port
 
@@ -82,9 +82,9 @@ examples:
                 clock-names = "xvclk";
                 reset-gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
 
-                dovdd-supply = <&sw2_reg>;
+                DOVDD-supply = <&sw2_reg>;
-                dvdd-supply = <&sw2_reg>;
+                DVDD-supply = <&sw2_reg>;
-                avdd-supply = <&reg_peri_3p15v>;
+                AVDD-supply = <&reg_peri_3p15v>;
 
                 port {
                         ov2680_to_mipi: endpoint {

Documentation/devicetree/bindings/pci/rcar-pci-host.yaml

@@ -68,6 +68,18 @@ properties:
   phy-names:
     const: pcie
 
+  vpcie1v5-supply:
+    description: The 1.5v regulator to use for PCIe.
+
+  vpcie3v3-supply:
+    description: The 3.3v regulator to use for PCIe.
+
+  vpcie12v-supply:
+    description: The 12v regulator to use for PCIe.
+
+  iommu-map: true
+  iommu-map-mask: true
+
 required:
   - compatible
   - reg
@@ -121,5 +133,7 @@ examples:
              clock-names = "pcie", "pcie_bus";
              power-domains = <&sysc R8A7791_PD_ALWAYS_ON>;
              resets = <&cpg 319>;
+             vpcie3v3-supply = <&pcie_3v3>;
+             vpcie12v-supply = <&pcie_12v>;
          };
     };

Documentation/devicetree/bindings/pinctrl/mediatek,mt7622-pinctrl.yaml

@@ -97,7 +97,8 @@ patternProperties:
             then:
               properties:
                 groups:
-                  enum: [emmc, emmc_rst]
+                  items:
+                    enum: [emmc, emmc_rst]
           - if:
               properties:
                 function:
@@ -105,8 +106,9 @@ patternProperties:
             then:
               properties:
                 groups:
-                  enum: [esw, esw_p0_p1, esw_p2_p3_p4, rgmii_via_esw,
+                  items:
-                         rgmii_via_gmac1, rgmii_via_gmac2, mdc_mdio]
+                    enum: [esw, esw_p0_p1, esw_p2_p3_p4, rgmii_via_esw,
+                           rgmii_via_gmac1, rgmii_via_gmac2, mdc_mdio]
           - if:
               properties:
                 function:
@@ -123,10 +125,11 @@ patternProperties:
             then:
               properties:
                 groups:
-                  enum: [i2s_in_mclk_bclk_ws, i2s1_in_data, i2s2_in_data,
+                  items:
-                         i2s3_in_data, i2s4_in_data, i2s_out_mclk_bclk_ws,
+                    enum: [i2s_in_mclk_bclk_ws, i2s1_in_data, i2s2_in_data,
-                         i2s1_out_data, i2s2_out_data, i2s3_out_data,
+                           i2s3_in_data, i2s4_in_data, i2s_out_mclk_bclk_ws,
-                         i2s4_out_data]
+                           i2s1_out_data, i2s2_out_data, i2s3_out_data,
+                           i2s4_out_data]
           - if:
               properties:
                 function:
@@ -159,10 +162,11 @@ patternProperties:
             then:
               properties:
                 groups:
-                  enum: [pcie0_0_waken, pcie0_1_waken, pcie1_0_waken,
+                  items:
-                         pcie0_0_clkreq, pcie0_1_clkreq, pcie1_0_clkreq,
+                    enum: [pcie0_0_waken, pcie0_1_waken, pcie1_0_waken,
-                         pcie0_pad_perst, pcie1_pad_perst, pcie_pereset,
+                           pcie0_0_clkreq, pcie0_1_clkreq, pcie1_0_clkreq,
-                         pcie_wake, pcie_clkreq]
+                           pcie0_pad_perst, pcie1_pad_perst, pcie_pereset,
+                           pcie_wake, pcie_clkreq]
           - if:
               properties:
                 function:
@@ -178,11 +182,12 @@ patternProperties:
             then:
               properties:
                 groups:
-                  enum: [pwm_ch1_0, pwm_ch1_1, pwm_ch1_2, pwm_ch2_0, pwm_ch2_1,
+                  items:
-                         pwm_ch2_2, pwm_ch3_0, pwm_ch3_1, pwm_ch3_2, pwm_ch4_0,
+                    enum: [pwm_ch1_0, pwm_ch1_1, pwm_ch1_2, pwm_ch2_0, pwm_ch2_1,
-                         pwm_ch4_1, pwm_ch4_2, pwm_ch4_3, pwm_ch5_0, pwm_ch5_1,
+                           pwm_ch2_2, pwm_ch3_0, pwm_ch3_1, pwm_ch3_2, pwm_ch4_0,
-                         pwm_ch5_2, pwm_ch6_0, pwm_ch6_1, pwm_ch6_2, pwm_ch6_3,
+                           pwm_ch4_1, pwm_ch4_2, pwm_ch4_3, pwm_ch5_0, pwm_ch5_1,
-                         pwm_ch7_0, pwm_0, pwm_1]
+                           pwm_ch5_2, pwm_ch6_0, pwm_ch6_1, pwm_ch6_2, pwm_ch6_3,
+                           pwm_ch7_0, pwm_0, pwm_1]
           - if:
               properties:
                 function:
@@ -260,33 +265,34 @@ patternProperties:
           pins:
             description: |
               An array of strings. Each string contains the name of a pin.
-            enum: [GPIO_A, I2S1_IN, I2S1_OUT, I2S_BCLK, I2S_WS, I2S_MCLK, TXD0,
+            items:
-                   RXD0, SPI_WP, SPI_HOLD, SPI_CLK, SPI_MOSI, SPI_MISO, SPI_CS,
+              enum: [GPIO_A, I2S1_IN, I2S1_OUT, I2S_BCLK, I2S_WS, I2S_MCLK, TXD0,
-                   I2C_SDA, I2C_SCL, I2S2_IN, I2S3_IN, I2S4_IN, I2S2_OUT,
+                     RXD0, SPI_WP, SPI_HOLD, SPI_CLK, SPI_MOSI, SPI_MISO, SPI_CS,
-                   I2S3_OUT, I2S4_OUT, GPIO_B, MDC, MDIO, G2_TXD0, G2_TXD1,
+                     I2C_SDA, I2C_SCL, I2S2_IN, I2S3_IN, I2S4_IN, I2S2_OUT,
-                   G2_TXD2, G2_TXD3, G2_TXEN, G2_TXC, G2_RXD0, G2_RXD1, G2_RXD2,
+                     I2S3_OUT, I2S4_OUT, GPIO_B, MDC, MDIO, G2_TXD0, G2_TXD1,
-                   G2_RXD3, G2_RXDV, G2_RXC, NCEB, NWEB, NREB, NDL4, NDL5, NDL6,
+                     G2_TXD2, G2_TXD3, G2_TXEN, G2_TXC, G2_RXD0, G2_RXD1, G2_RXD2,
-                   NDL7, NRB, NCLE, NALE, NDL0, NDL1, NDL2, NDL3, MDI_TP_P0,
+                     G2_RXD3, G2_RXDV, G2_RXC, NCEB, NWEB, NREB, NDL4, NDL5, NDL6,
-                   MDI_TN_P0, MDI_RP_P0, MDI_RN_P0, MDI_TP_P1, MDI_TN_P1,
+                     NDL7, NRB, NCLE, NALE, NDL0, NDL1, NDL2, NDL3, MDI_TP_P0,
-                   MDI_RP_P1, MDI_RN_P1, MDI_RP_P2, MDI_RN_P2, MDI_TP_P2,
+                     MDI_TN_P0, MDI_RP_P0, MDI_RN_P0, MDI_TP_P1, MDI_TN_P1,
-                   MDI_TN_P2, MDI_TP_P3, MDI_TN_P3, MDI_RP_P3, MDI_RN_P3,
+                     MDI_RP_P1, MDI_RN_P1, MDI_RP_P2, MDI_RN_P2, MDI_TP_P2,
-                   MDI_RP_P4, MDI_RN_P4, MDI_TP_P4, MDI_TN_P4, PMIC_SCL,
+                     MDI_TN_P2, MDI_TP_P3, MDI_TN_P3, MDI_RP_P3, MDI_RN_P3,
-                   PMIC_SDA, SPIC1_CLK, SPIC1_MOSI, SPIC1_MISO, SPIC1_CS,
+                     MDI_RP_P4, MDI_RN_P4, MDI_TP_P4, MDI_TN_P4, PMIC_SCL,
-                   GPIO_D, WATCHDOG, RTS3_N, CTS3_N, TXD3, RXD3, PERST0_N,
+                     PMIC_SDA, SPIC1_CLK, SPIC1_MOSI, SPIC1_MISO, SPIC1_CS,
-                   PERST1_N, WLED_N, EPHY_LED0_N, AUXIN0, AUXIN1, AUXIN2,
+                     GPIO_D, WATCHDOG, RTS3_N, CTS3_N, TXD3, RXD3, PERST0_N,
-                   AUXIN3, TXD4, RXD4, RTS4_N, CST4_N, PWM1, PWM2, PWM3, PWM4,
+                     PERST1_N, WLED_N, EPHY_LED0_N, AUXIN0, AUXIN1, AUXIN2,
-                   PWM5, PWM6, PWM7, GPIO_E, TOP_5G_CLK, TOP_5G_DATA,
+                     AUXIN3, TXD4, RXD4, RTS4_N, CST4_N, PWM1, PWM2, PWM3, PWM4,
-                   WF0_5G_HB0, WF0_5G_HB1, WF0_5G_HB2, WF0_5G_HB3, WF0_5G_HB4,
+                     PWM5, PWM6, PWM7, GPIO_E, TOP_5G_CLK, TOP_5G_DATA,
-                   WF0_5G_HB5, WF0_5G_HB6, XO_REQ, TOP_RST_N, SYS_WATCHDOG,
+                     WF0_5G_HB0, WF0_5G_HB1, WF0_5G_HB2, WF0_5G_HB3, WF0_5G_HB4,
-                   EPHY_LED0_N_JTDO, EPHY_LED1_N_JTDI, EPHY_LED2_N_JTMS,
+                     WF0_5G_HB5, WF0_5G_HB6, XO_REQ, TOP_RST_N, SYS_WATCHDOG,
-                   EPHY_LED3_N_JTCLK, EPHY_LED4_N_JTRST_N, WF2G_LED_N,
+                     EPHY_LED0_N_JTDO, EPHY_LED1_N_JTDI, EPHY_LED2_N_JTMS,
-                   WF5G_LED_N, GPIO_9, GPIO_10, GPIO_11, GPIO_12, UART1_TXD,
+                     EPHY_LED3_N_JTCLK, EPHY_LED4_N_JTRST_N, WF2G_LED_N,
-                   UART1_RXD, UART1_CTS, UART1_RTS, UART2_TXD, UART2_RXD,
+                     WF5G_LED_N, GPIO_9, GPIO_10, GPIO_11, GPIO_12, UART1_TXD,
-                   UART2_CTS, UART2_RTS, SMI_MDC, SMI_MDIO, PCIE_PERESET_N,
+                     UART1_RXD, UART1_CTS, UART1_RTS, UART2_TXD, UART2_RXD,
-                   PWM_0, GPIO_0, GPIO_1, GPIO_2, GPIO_3, GPIO_4, GPIO_5,
+                     UART2_CTS, UART2_RTS, SMI_MDC, SMI_MDIO, PCIE_PERESET_N,
-                   GPIO_6, GPIO_7, GPIO_8, UART0_TXD, UART0_RXD, TOP_2G_CLK,
+                     PWM_0, GPIO_0, GPIO_1, GPIO_2, GPIO_3, GPIO_4, GPIO_5,
-                   TOP_2G_DATA, WF0_2G_HB0, WF0_2G_HB1, WF0_2G_HB2, WF0_2G_HB3,
+                     GPIO_6, GPIO_7, GPIO_8, UART0_TXD, UART0_RXD, TOP_2G_CLK,
-                   WF0_2G_HB4, WF0_2G_HB5, WF0_2G_HB6]
+                     TOP_2G_DATA, WF0_2G_HB0, WF0_2G_HB1, WF0_2G_HB2, WF0_2G_HB3,
+                     WF0_2G_HB4, WF0_2G_HB5, WF0_2G_HB6]
 
           bias-disable: true
 

Documentation/devicetree/bindings/soc/rockchip/grf.yaml

@@ -151,6 +151,7 @@ allOf:
           unevaluatedProperties: false
 
         pcie-phy:
+          type: object
           description:
             Documentation/devicetree/bindings/phy/rockchip-pcie-phy.txt
 

Documentation/devicetree/bindings/sound/rt5645.txt

@@ -20,6 +20,11 @@ Optional properties:
   a GPIO spec for the external headphone detect pin. If jd-mode = 0,
   we will get the JD status by getting the value of hp-detect-gpios.
 
+- cbj-sleeve-gpios:
+  a GPIO spec to control the external combo jack circuit to tie the sleeve/ring2
+  contacts to the ground or floating. It could avoid some electric noise from the
+  active speaker jacks.
+
 - realtek,in2-differential
   Boolean. Indicate MIC2 input are differential, rather than single-ended.
 
@@ -68,6 +73,7 @@ codec: rt5650@1a {
 	compatible = "realtek,rt5650";
 	reg = <0x1a>;
 	hp-detect-gpios = <&gpio 19 0>;
+	cbj-sleeve-gpios = <&gpio 20 0>;
 	interrupt-parent = <&gpio>;
 	interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
 	realtek,dmic-en = "true";

Documentation/driver-api/fpga/fpga-region.rst

@@ -46,13 +46,16 @@ API to add a new FPGA region
 ----------------------------
 
 * struct fpga_region - The FPGA region struct
-* struct fpga_region_info - Parameter structure for fpga_region_register_full()
+* struct fpga_region_info - Parameter structure for __fpga_region_register_full()
-* fpga_region_register_full() -  Create and register an FPGA region using the
+* __fpga_region_register_full() -  Create and register an FPGA region using the
   fpga_region_info structure to provide the full flexibility of options
-* fpga_region_register() -  Create and register an FPGA region using standard
+* __fpga_region_register() -  Create and register an FPGA region using standard
   arguments
 * fpga_region_unregister() -  Unregister an FPGA region
 
+Helper macros ``fpga_region_register()`` and ``fpga_region_register_full()``
+automatically set the module that registers the FPGA region as the owner.
+
 The FPGA region's probe function will need to get a reference to the FPGA
 Manager it will be using to do the programming.  This usually would happen
 during the region's probe function.
@@ -82,10 +85,10 @@ following APIs to handle building or tearing down that list.
    :functions: fpga_region_info
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_register_full
+   :functions: __fpga_region_register_full
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_register
+   :functions: __fpga_region_register
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
    :functions: fpga_region_unregister

Documentation/networking/device_drivers/ethernet/amazon/ena.rst

@@ -205,6 +205,7 @@ Adaptive coalescing can be switched on/off through `ethtool(8)`'s
 More information about Adaptive Interrupt Moderation (DIM) can be found in
 Documentation/networking/net_dim.rst
 
+.. _`RX copybreak`:
 RX copybreak
 ============
 The rx_copybreak is initialized by default to ENA_DEFAULT_RX_COPYBREAK
@@ -315,3 +316,34 @@ Rx
 - The new SKB is updated with the necessary information (protocol,
   checksum hw verify result, etc), and then passed to the network
   stack, using the NAPI interface function :code:`napi_gro_receive()`.
+
+Dynamic RX Buffers (DRB)
+------------------------
+
+Each RX descriptor in the RX ring is a single memory page (which is either 4KB
+or 16KB long depending on system's configurations).
+To reduce the memory allocations required when dealing with a high rate of small
+packets, the driver tries to reuse the remaining RX descriptor's space if more
+than 2KB of this page remain unused.
+
+A simple example of this mechanism is the following sequence of events:
+
+::
+
+        1. Driver allocates page-sized RX buffer and passes it to hardware
+                +----------------------+
+                |4KB RX Buffer         |
+                +----------------------+
+
+        2. A 300Bytes packet is received on this buffer
+
+        3. The driver increases the ref count on this page and returns it back to
+           HW as an RX buffer of size 4KB - 300Bytes = 3796 Bytes
+               +----+--------------------+
+               |****|3796 Bytes RX Buffer|
+               +----+--------------------+
+
+This mechanism isn't used when an XDP program is loaded, or when the
+RX packet is less than rx_copybreak bytes (in which case the packet is
+copied out of the RX buffer into the linear part of a new skb allocated
+for it and the RX buffer remains the same size, see `RX copybreak`_).

Documentation/sphinx/kernel_include.py

@@ -97,7 +97,6 @@ class KernelInclude(Include):
         # HINT: this is the only line I had to change / commented out:
         #path = utils.relative_path(None, path)
 
-        path = nodes.reprunicode(path)
         encoding = self.options.get(
             'encoding', self.state.document.settings.input_encoding)
         e_handler=self.state.document.settings.input_encoding_error_handler

MAINTAINERS

@@ -22599,6 +22599,7 @@ F:	include/xen/swiotlb-xen.h
 
 XFS FILESYSTEM
 C:	irc://irc.oftc.net/xfs
+M:	Leah Rumancik <leah.rumancik@gmail.com>
 M:	Darrick J. Wong <djwong@kernel.org>
 L:	linux-xfs@vger.kernel.org
 S:	Supported

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 90
+SUBLEVEL = 93
 EXTRAVERSION =
 NAME = Curry Ramen
 

android/abi_gki_aarch64_db845c

@@ -447,6 +447,7 @@
   misc_register
   mod_delayed_work_on
   mod_timer
+  __module_get
   module_layout
   __msecs_to_jiffies
   msleep
@@ -848,6 +849,7 @@
   vunmap
   vzalloc
   wait_for_completion_interruptible
+  wait_for_completion_interruptible_timeout
   wait_for_completion_timeout
   __wake_up
   wake_up_process

arch/arm/configs/sunxi_defconfig

@@ -110,6 +110,7 @@ CONFIG_DRM_PANEL_LVDS=y
 CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_DRM_PANEL_EDP=y
 CONFIG_DRM_SIMPLE_BRIDGE=y
+CONFIG_DRM_DW_HDMI=y
 CONFIG_DRM_LIMA=y
 CONFIG_FB_SIMPLE=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y

arch/arm/kernel/sleep.S

@@ -127,6 +127,10 @@ cpu_resume_after_mmu:
 	instr_sync
 #endif
 	bl	cpu_init		@ restore the und/abt/irq banked regs
+#if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK)
+	mov	r0, sp
+	bl	kasan_unpoison_task_stack_below
+#endif
 	mov	r0, #0			@ return zero on success
 	ldmfd	sp!, {r4 - r11, pc}
 ENDPROC(cpu_resume_after_mmu)

arch/arm64/Kconfig

@@ -1756,7 +1756,6 @@ config ARM64_LSE_ATOMICS
 
 config ARM64_USE_LSE_ATOMICS
 	bool "Atomic instructions"
-	depends on JUMP_LABEL
 	default y
 	help
 	  As part of the Large System Extensions, ARMv8.1 introduces new

arch/arm64/boot/dts/amlogic/meson-s4.dtsi

@@ -61,10 +61,15 @@
 		#clock-cells = <0>;
 	};
 
-	pwrc: power-controller {
+	firmware {
-		compatible = "amlogic,meson-s4-pwrc";
+		sm: secure-monitor {
-		#power-domain-cells = <1>;
+			compatible = "amlogic,meson-gxbb-sm";
-		status = "okay";
+
+			pwrc: power-controller {
+				compatible = "amlogic,meson-s4-pwrc";
+				#power-domain-cells = <1>;
+			};
+		};
 	};
 
 	soc {

arch/arm64/include/asm/asm-bug.h

@@ -28,6 +28,7 @@
 	14470:	.long 14471f - .;			\
 _BUGVERBOSE_LOCATION(__FILE__, __LINE__)		\
 		.short flags; 				\
+		.align 2;				\
 		.popsection;				\
 	14471:
 #else

arch/arm64/include/asm/lse.h

@@ -10,7 +10,6 @@
 
 #include <linux/compiler_types.h>
 #include <linux/export.h>
-#include <linux/jump_label.h>
 #include <linux/stringify.h>
 #include <asm/alternative.h>
 #include <asm/alternative-macros.h>

arch/arm64/kvm/vgic/vgic-kvm-device.c

@@ -337,16 +337,12 @@ int kvm_register_vgic_device(unsigned long type)
 int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr,
 		       struct vgic_reg_attr *reg_attr)
 {
-	int cpuid;
+	int cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
 
-	cpuid = (attr->attr & KVM_DEV_ARM_VGIC_CPUID_MASK) >>
-		 KVM_DEV_ARM_VGIC_CPUID_SHIFT;
-
-	if (cpuid >= atomic_read(&dev->kvm->online_vcpus))
-		return -EINVAL;
-
-	reg_attr->vcpu = kvm_get_vcpu(dev->kvm, cpuid);
 	reg_attr->addr = attr->attr & KVM_DEV_ARM_VGIC_OFFSET_MASK;
+	reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
+	if (!reg_attr->vcpu)
+		return -EINVAL;
 
 	return 0;
 }

arch/arm64/net/bpf_jit_comp.c

@@ -1679,15 +1679,15 @@ static void invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,
 
 	emit_call(enter_prog, ctx);
 
+	/* save return value to callee saved register x20 */
+	emit(A64_MOV(1, A64_R(20), A64_R(0)), ctx);
+
 	/* if (__bpf_prog_enter(prog) == 0)
 	 *         goto skip_exec_of_prog;
 	 */
 	branch = ctx->image + ctx->idx;
 	emit(A64_NOP, ctx);
 
-	/* save return value to callee saved register x20 */
-	emit(A64_MOV(1, A64_R(20), A64_R(0)), ctx);
-
 	emit(A64_ADD_I(1, A64_R(0), A64_SP, args_off), ctx);
 	if (!p->jited)
 		emit_addr_mov_i64(A64_R(1), (const u64)p->insnsi, ctx);

arch/loongarch/include/asm/perf_event.h

@@ -13,8 +13,7 @@
 
 #define perf_arch_fetch_caller_regs(regs, __ip) { \
 	(regs)->csr_era = (__ip); \
-	(regs)->regs[3] = current_stack_pointer; \
+	(regs)->regs[3] = (unsigned long) __builtin_frame_address(0); \
-	(regs)->regs[22] = (unsigned long) __builtin_frame_address(0); \
 }
 
 #endif /* __LOONGARCH_PERF_EVENT_H__ */

arch/loongarch/kernel/perf_event.c

@@ -884,4 +884,4 @@ static int __init init_hw_perf_events(void)
 
 	return 0;
 }
-early_initcall(init_hw_perf_events);
+pure_initcall(init_hw_perf_events);

arch/m68k/kernel/entry.S

@@ -430,7 +430,9 @@ resume:
 	movec	%a0,%dfc
 
 	/* restore status register */
-	movew	%a1@(TASK_THREAD+THREAD_SR),%sr
+	movew	%a1@(TASK_THREAD+THREAD_SR),%d0
+	oriw	#0x0700,%d0
+	movew	%d0,%sr
 
 	rts
 

arch/m68k/mac/misc.c

@@ -451,30 +451,18 @@ void mac_poweroff(void)
 
 void mac_reset(void)
 {
-	if (macintosh_config->adb_type == MAC_ADB_II &&
-	    macintosh_config->ident != MAC_MODEL_SE30) {
-		/* need ROMBASE in booter */
-		/* indeed, plus need to MAP THE ROM !! */
-
-		if (mac_bi_data.rombase == 0)
-			mac_bi_data.rombase = 0x40800000;
-
-		/* works on some */
-		rom_reset = (void *) (mac_bi_data.rombase + 0xa);
-
-		local_irq_disable();
-		rom_reset();
 #ifdef CONFIG_ADB_CUDA
-	} else if (macintosh_config->adb_type == MAC_ADB_EGRET ||
+	if (macintosh_config->adb_type == MAC_ADB_EGRET ||
-	           macintosh_config->adb_type == MAC_ADB_CUDA) {
+	    macintosh_config->adb_type == MAC_ADB_CUDA) {
 		cuda_restart();
+	} else
 #endif
 #ifdef CONFIG_ADB_PMU
-	} else if (macintosh_config->adb_type == MAC_ADB_PB2) {
+	if (macintosh_config->adb_type == MAC_ADB_PB2) {
 		pmu_restart();
+	} else
 #endif
-	} else if (CPU_IS_030) {
+	if (CPU_IS_030) {
-
 		/* 030-specific reset routine.  The idea is general, but the
 		 * specific registers to reset are '030-specific.  Until I
 		 * have a non-030 machine, I can't test anything else.
@@ -522,6 +510,18 @@ void mac_reset(void)
 		    "jmp %/a0@\n\t" /* jump to the reset vector */
 		    ".chip 68k"
 		    : : "r" (offset), "a" (rombase) : "a0");
+	} else {
+		/* need ROMBASE in booter */
+		/* indeed, plus need to MAP THE ROM !! */
+
+		if (mac_bi_data.rombase == 0)
+			mac_bi_data.rombase = 0x40800000;
+
+		/* works on some */
+		rom_reset = (void *)(mac_bi_data.rombase + 0xa);
+
+		local_irq_disable();
+		rom_reset();
 	}
 
 	/* should never get here */

arch/microblaze/kernel/Makefile

@@ -7,7 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
 # Do not trace early boot code and low level code
 CFLAGS_REMOVE_timer.o = -pg
 CFLAGS_REMOVE_intc.o = -pg
-CFLAGS_REMOVE_early_printk.o = -pg
 CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_process.o = -pg
 endif

arch/microblaze/kernel/cpu/cpuinfo-static.c

@@ -18,7 +18,7 @@ static const char family_string[] = CONFIG_XILINX_MICROBLAZE0_FAMILY;
 static const char cpu_ver_string[] = CONFIG_XILINX_MICROBLAZE0_HW_VER;
 
 #define err_printk(x) \
-	early_printk("ERROR: Microblaze " x "-different for kernel and DTS\n");
+	pr_err("ERROR: Microblaze " x "-different for kernel and DTS\n");
 
 void __init set_cpuinfo_static(struct cpuinfo *ci, struct device_node *cpu)
 {

arch/mips/include/asm/ptrace.h

@@ -157,7 +157,7 @@ static inline long regs_return_value(struct pt_regs *regs)
 #define instruction_pointer(regs) ((regs)->cp0_epc)
 #define profile_pc(regs) instruction_pointer(regs)
 
-extern asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall);
+extern asmlinkage long syscall_trace_enter(struct pt_regs *regs);
 extern asmlinkage void syscall_trace_leave(struct pt_regs *regs);
 
 extern void die(const char *, struct pt_regs *) __noreturn;

arch/mips/kernel/asm-offsets.c

@@ -98,6 +98,7 @@ void output_thread_info_defines(void)
 	OFFSET(TI_CPU, thread_info, cpu);
 	OFFSET(TI_PRE_COUNT, thread_info, preempt_count);
 	OFFSET(TI_REGS, thread_info, regs);
+	OFFSET(TI_SYSCALL, thread_info, syscall);
 	DEFINE(_THREAD_SIZE, THREAD_SIZE);
 	DEFINE(_THREAD_MASK, THREAD_MASK);
 	DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);

arch/mips/kernel/ptrace.c

@@ -1309,16 +1309,13 @@ long arch_ptrace(struct task_struct *child, long request,
  * Notification of system call entry/exit
  * - triggered by current->work.syscall_trace
  */
-asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
+asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 {
 	user_exit();
 
-	current_thread_info()->syscall = syscall;
-
 	if (test_thread_flag(TIF_SYSCALL_TRACE)) {
 		if (ptrace_report_syscall_entry(regs))
 			return -1;
-		syscall = current_thread_info()->syscall;
 	}
 
 #ifdef CONFIG_SECCOMP
@@ -1327,7 +1324,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
 		struct seccomp_data sd;
 		unsigned long args[6];
 
-		sd.nr = syscall;
+		sd.nr = current_thread_info()->syscall;
 		sd.arch = syscall_get_arch(current);
 		syscall_get_arguments(current, regs, args);
 		for (i = 0; i < 6; i++)
@@ -1337,23 +1334,23 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
 		ret = __secure_computing(&sd);
 		if (ret == -1)
 			return ret;
-		syscall = current_thread_info()->syscall;
 	}
 #endif
 
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(syscall, regs->regs[4], regs->regs[5],
+	audit_syscall_entry(current_thread_info()->syscall,
+			    regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but
 	 * won't have had the return value set appropriately, so we do so now.
 	 */
-	if (syscall < 0)
+	if (current_thread_info()->syscall < 0)
 		syscall_set_return_value(current, regs, -ENOSYS, 0);
-	return syscall;
+	return current_thread_info()->syscall;
 }
 
 /*

arch/mips/kernel/scall32-o32.S

@@ -77,6 +77,18 @@ loads_done:
 	PTR_WD	load_a7, bad_stack_a7
 	.previous
 
+	/*
+	 * syscall number is in v0 unless we called syscall(__NR_###)
+	 * where the real syscall number is in a0
+	 */
+	subu	t2, v0,  __NR_O32_Linux
+	bnez	t2, 1f /* __NR_syscall at offset 0 */
+	LONG_S	a0, TI_SYSCALL($28)	# Save a0 as syscall number
+	b	2f
+1:
+	LONG_S	v0, TI_SYSCALL($28)	# Save v0 as syscall number
+2:
+
 	lw	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	and	t0, t1
@@ -114,16 +126,7 @@ syscall_trace_entry:
 	SAVE_STATIC
 	move	a0, sp
 
-	/*
+	jal	syscall_trace_enter
-	 * syscall number is in v0 unless we called syscall(__NR_###)
-	 * where the real syscall number is in a0
-	 */
-	move	a1, v0
-	subu	t2, v0,  __NR_O32_Linux
-	bnez	t2, 1f /* __NR_syscall at offset 0 */
-	lw	a1, PT_R4(sp)
-
-1:	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 

arch/mips/kernel/scall64-n32.S

@@ -44,6 +44,8 @@ NESTED(handle_sysn32, PT_SIZE, sp)
 
 	sd	a3, PT_R26(sp)		# save a3 for syscall restarting
 
+	LONG_S	v0, TI_SYSCALL($28)     # Store syscall number
+
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	LONG_L	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	and	t0, t1, t0
@@ -72,7 +74,6 @@ syscall_common:
 n32_syscall_trace_entry:
 	SAVE_STATIC
 	move	a0, sp
-	move	a1, v0
 	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall

arch/mips/kernel/scall64-n64.S

@@ -46,6 +46,8 @@ NESTED(handle_sys64, PT_SIZE, sp)
 
 	sd	a3, PT_R26(sp)		# save a3 for syscall restarting
 
+	LONG_S	v0, TI_SYSCALL($28)     # Store syscall number
+
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	LONG_L	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	and	t0, t1, t0
@@ -82,7 +84,6 @@ n64_syscall_exit:
 syscall_trace_entry:
 	SAVE_STATIC
 	move	a0, sp
-	move	a1, v0
 	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall

arch/mips/kernel/scall64-o32.S

@@ -79,6 +79,22 @@ loads_done:
 	PTR_WD	load_a7, bad_stack_a7
 	.previous
 
+	/*
+	 * absolute syscall number is in v0 unless we called syscall(__NR_###)
+	 * where the real syscall number is in a0
+	 * note: NR_syscall is the first O32 syscall but the macro is
+	 * only defined when compiling with -mabi=32 (CONFIG_32BIT)
+	 * therefore __NR_O32_Linux is used (4000)
+	 */
+
+	subu	t2, v0,  __NR_O32_Linux
+	bnez	t2, 1f /* __NR_syscall at offset 0 */
+	LONG_S	a0, TI_SYSCALL($28)	# Save a0 as syscall number
+	b	2f
+1:
+	LONG_S	v0, TI_SYSCALL($28)	# Save v0 as syscall number
+2:
+
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	LONG_L	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	and	t0, t1, t0
@@ -113,22 +129,7 @@ trace_a_syscall:
 	sd	a7, PT_R11(sp)		# For indirect syscalls
 
 	move	a0, sp
-	/*
+	jal	syscall_trace_enter
-	 * absolute syscall number is in v0 unless we called syscall(__NR_###)
-	 * where the real syscall number is in a0
-	 * note: NR_syscall is the first O32 syscall but the macro is
-	 * only defined when compiling with -mabi=32 (CONFIG_32BIT)
-	 * therefore __NR_O32_Linux is used (4000)
-	 */
-	.set	push
-	.set	reorder
-	subu	t1, v0,  __NR_O32_Linux
-	move	a1, v0
-	bnez	t1, 1f /* __NR_syscall at offset 0 */
-	ld	a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
-	.set	pop
-
-1:	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 

arch/parisc/kernel/parisc_ksyms.c

@@ -21,6 +21,7 @@ EXPORT_SYMBOL(memset);
 #include <linux/atomic.h>
 EXPORT_SYMBOL(__xchg8);
 EXPORT_SYMBOL(__xchg32);
+EXPORT_SYMBOL(__cmpxchg_u8);
 EXPORT_SYMBOL(__cmpxchg_u32);
 EXPORT_SYMBOL(__cmpxchg_u64);
 #ifdef CONFIG_SMP

arch/powerpc/include/asm/hvcall.h

@@ -539,7 +539,7 @@ struct hvcall_mpp_data {
 	unsigned long backing_mem;
 };
 
-int h_get_mpp(struct hvcall_mpp_data *);
+long h_get_mpp(struct hvcall_mpp_data *mpp_data);
 
 struct hvcall_mpp_x_data {
 	unsigned long coalesced_bytes;

arch/powerpc/platforms/pseries/iommu.c

@@ -781,8 +781,16 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus)
 	 * parent bus. During reboot, there will be ibm,dma-window property to
 	 * define DMA window. For kdump, there will at least be default window or DDW
 	 * or both.
+	 * There is an exception to the above. In case the PE goes into frozen
+	 * state, firmware may not provide ibm,dma-window property at the time
+	 * of LPAR boot up.
 	 */
 
+	if (!pdn) {
+		pr_debug("  no ibm,dma-window property !\n");
+		return;
+	}
+
 	ppci = PCI_DN(pdn);
 
 	pr_debug("  parent is %pOF, iommu_table: 0x%p\n",

arch/powerpc/platforms/pseries/lpar.c

@@ -1904,10 +1904,10 @@ out:
  * h_get_mpp
  * H_GET_MPP hcall returns info in 7 parms
  */
-int h_get_mpp(struct hvcall_mpp_data *mpp_data)
+long h_get_mpp(struct hvcall_mpp_data *mpp_data)
 {
-	int rc;
+	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
-	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+	long rc;
 
 	rc = plpar_hcall9(H_GET_MPP, retbuf);
 

arch/powerpc/platforms/pseries/lparcfg.c

@@ -112,8 +112,8 @@ struct hvcall_ppp_data {
  */
 static unsigned int h_get_ppp(struct hvcall_ppp_data *ppp_data)
 {
-	unsigned long rc;
+	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
-	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+	long rc;
 
 	rc = plpar_hcall9(H_GET_PPP, retbuf);
 
@@ -192,7 +192,7 @@ static void parse_ppp_data(struct seq_file *m)
 	struct hvcall_ppp_data ppp_data;
 	struct device_node *root;
 	const __be32 *perf_level;
-	int rc;
+	long rc;
 
 	rc = h_get_ppp(&ppp_data);
 	if (rc)
@@ -393,8 +393,8 @@ static int read_dt_lpar_name(struct seq_file *m)
 
 static void read_lpar_name(struct seq_file *m)
 {
-	if (read_rtas_lpar_name(m) && read_dt_lpar_name(m))
+	if (read_rtas_lpar_name(m))
-		pr_err_once("Error can't get the LPAR name");
+		read_dt_lpar_name(m);
 }
 
 #define SPLPAR_CHARACTERISTICS_TOKEN 20

arch/powerpc/platforms/pseries/plpks.c

@@ -21,19 +21,6 @@
 
 #include "plpks.h"
 
-#define PKS_FW_OWNER	     0x1
-#define PKS_BOOTLOADER_OWNER 0x2
-#define PKS_OS_OWNER	     0x3
-
-#define LABEL_VERSION	    0
-#define MAX_LABEL_ATTR_SIZE 16
-#define MAX_NAME_SIZE	    239
-#define MAX_DATA_SIZE	    4000
-
-#define PKS_FLUSH_MAX_TIMEOUT 5000 //msec
-#define PKS_FLUSH_SLEEP	      10 //msec
-#define PKS_FLUSH_SLEEP_RANGE 400
-
 static u8 *ospassword;
 static u16 ospasswordlength;
 
@@ -60,7 +47,7 @@ struct label_attr {
 
 struct label {
 	struct label_attr attr;
-	u8 name[MAX_NAME_SIZE];
+	u8 name[PLPKS_MAX_NAME_SIZE];
 	size_t size;
 };
 
@@ -123,7 +110,7 @@ static int pseries_status_to_err(int rc)
 static int plpks_gen_password(void)
 {
 	unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
-	u8 *password, consumer = PKS_OS_OWNER;
+	u8 *password, consumer = PLPKS_OS_OWNER;
 	int rc;
 
 	password = kzalloc(maxpwsize, GFP_KERNEL);
@@ -159,22 +146,18 @@ static struct plpks_auth *construct_auth(u8 consumer)
 {
 	struct plpks_auth *auth;
 
-	if (consumer > PKS_OS_OWNER)
+	if (consumer > PLPKS_OS_OWNER)
 		return ERR_PTR(-EINVAL);
 
-	auth = kmalloc(struct_size(auth, password, maxpwsize), GFP_KERNEL);
+	auth = kzalloc(struct_size(auth, password, maxpwsize), GFP_KERNEL);
 	if (!auth)
 		return ERR_PTR(-ENOMEM);
 
 	auth->version = 1;
 	auth->consumer = consumer;
-	auth->rsvd0 = 0;
-	auth->rsvd1 = 0;
 
-	if (consumer == PKS_FW_OWNER || consumer == PKS_BOOTLOADER_OWNER) {
+	if (consumer == PLPKS_FW_OWNER || consumer == PLPKS_BOOTLOADER_OWNER)
-		auth->passwordlength = 0;
 		return auth;
-	}
 
 	memcpy(auth->password, ospassword, ospasswordlength);
 
@@ -193,7 +176,7 @@ static struct label *construct_label(char *component, u8 varos, u8 *name,
 	struct label *label;
 	size_t slen;
 
-	if (!name || namelen > MAX_NAME_SIZE)
+	if (!name || namelen > PLPKS_MAX_NAME_SIZE)
 		return ERR_PTR(-EINVAL);
 
 	slen = strlen(component);
@@ -207,9 +190,9 @@ static struct label *construct_label(char *component, u8 varos, u8 *name,
 	if (component)
 		memcpy(&label->attr.prefix, component, slen);
 
-	label->attr.version = LABEL_VERSION;
+	label->attr.version = PLPKS_LABEL_VERSION;
 	label->attr.os = varos;
-	label->attr.length = MAX_LABEL_ATTR_SIZE;
+	label->attr.length = PLPKS_MAX_LABEL_ATTR_SIZE;
 	memcpy(&label->name, name, namelen);
 
 	label->size = sizeof(struct label_attr) + namelen;
@@ -271,10 +254,9 @@ static int plpks_confirm_object_flushed(struct label *label,
 		if (!rc && status == 1)
 			break;
 
-		usleep_range(PKS_FLUSH_SLEEP,
+		fsleep(PLPKS_FLUSH_SLEEP);
-			     PKS_FLUSH_SLEEP + PKS_FLUSH_SLEEP_RANGE);
+		timeout = timeout + PLPKS_FLUSH_SLEEP;
-		timeout = timeout + PKS_FLUSH_SLEEP;
+	} while (timeout < PLPKS_MAX_TIMEOUT);
-	} while (timeout < PKS_FLUSH_MAX_TIMEOUT);
 
 	rc = pseries_status_to_err(rc);
 
@@ -289,13 +271,13 @@ int plpks_write_var(struct plpks_var var)
 	int rc;
 
 	if (!var.component || !var.data || var.datalen <= 0 ||
-	    var.namelen > MAX_NAME_SIZE || var.datalen > MAX_DATA_SIZE)
+	    var.namelen > PLPKS_MAX_NAME_SIZE || var.datalen > PLPKS_MAX_DATA_SIZE)
 		return -EINVAL;
 
-	if (var.policy & SIGNEDUPDATE)
+	if (var.policy & PLPKS_SIGNEDUPDATE)
 		return -EINVAL;
 
-	auth = construct_auth(PKS_OS_OWNER);
+	auth = construct_auth(PLPKS_OS_OWNER);
 	if (IS_ERR(auth))
 		return PTR_ERR(auth);
 
@@ -331,10 +313,10 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
 	struct label *label;
 	int rc;
 
-	if (!component || vname.namelen > MAX_NAME_SIZE)
+	if (!component || vname.namelen > PLPKS_MAX_NAME_SIZE)
 		return -EINVAL;
 
-	auth = construct_auth(PKS_OS_OWNER);
+	auth = construct_auth(PLPKS_OS_OWNER);
 	if (IS_ERR(auth))
 		return PTR_ERR(auth);
 
@@ -370,14 +352,14 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
 	u8 *output;
 	int rc;
 
-	if (var->namelen > MAX_NAME_SIZE)
+	if (var->namelen > PLPKS_MAX_NAME_SIZE)
 		return -EINVAL;
 
 	auth = construct_auth(consumer);
 	if (IS_ERR(auth))
 		return PTR_ERR(auth);
 
-	if (consumer == PKS_OS_OWNER) {
+	if (consumer == PLPKS_OS_OWNER) {
 		label = construct_label(var->component, var->os, var->name,
 					var->namelen);
 		if (IS_ERR(label)) {
@@ -392,7 +374,7 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
 		goto out_free_label;
 	}
 
-	if (consumer == PKS_OS_OWNER)
+	if (consumer == PLPKS_OS_OWNER)
 		rc = plpar_hcall(H_PKS_READ_OBJECT, retbuf, virt_to_phys(auth),
 				 virt_to_phys(label), label->size, virt_to_phys(output),
 				 maxobjsize);
@@ -434,17 +416,17 @@ out_free_auth:
 
 int plpks_read_os_var(struct plpks_var *var)
 {
-	return plpks_read_var(PKS_OS_OWNER, var);
+	return plpks_read_var(PLPKS_OS_OWNER, var);
 }
 
 int plpks_read_fw_var(struct plpks_var *var)
 {
-	return plpks_read_var(PKS_FW_OWNER, var);
+	return plpks_read_var(PLPKS_FW_OWNER, var);
 }
 
 int plpks_read_bootloader_var(struct plpks_var *var)
 {
-	return plpks_read_var(PKS_BOOTLOADER_OWNER, var);
+	return plpks_read_var(PLPKS_BOOTLOADER_OWNER, var);
 }
 
 static __init int pseries_plpks_init(void)

arch/powerpc/platforms/pseries/plpks.h

@@ -12,14 +12,39 @@
 #include <linux/types.h>
 #include <linux/list.h>
 
-#define OSSECBOOTAUDIT 0x40000000
+// Object policy flags from supported_policies
-#define OSSECBOOTENFORCE 0x20000000
+#define PLPKS_OSSECBOOTAUDIT	PPC_BIT32(1) // OS secure boot must be audit/enforce
-#define WORLDREADABLE 0x08000000
+#define PLPKS_OSSECBOOTENFORCE	PPC_BIT32(2) // OS secure boot must be enforce
-#define SIGNEDUPDATE 0x01000000
+#define PLPKS_PWSET		PPC_BIT32(3) // No access without password set
+#define PLPKS_WORLDREADABLE	PPC_BIT32(4) // Readable without authentication
+#define PLPKS_IMMUTABLE		PPC_BIT32(5) // Once written, object cannot be removed
+#define PLPKS_TRANSIENT		PPC_BIT32(6) // Object does not persist through reboot
+#define PLPKS_SIGNEDUPDATE	PPC_BIT32(7) // Object can only be modified by signed updates
+#define PLPKS_HVPROVISIONED	PPC_BIT32(28) // Hypervisor has provisioned this object
 
-#define PLPKS_VAR_LINUX	0x02
+// Signature algorithm flags from signed_update_algorithms
+#define PLPKS_ALG_RSA2048	PPC_BIT(0)
+#define PLPKS_ALG_RSA4096	PPC_BIT(1)
+
+// Object label OS metadata flags
+#define PLPKS_VAR_LINUX		0x02
 #define PLPKS_VAR_COMMON	0x04
 
+// Flags for which consumer owns an object is owned by
+#define PLPKS_FW_OWNER			0x1
+#define PLPKS_BOOTLOADER_OWNER		0x2
+#define PLPKS_OS_OWNER			0x3
+
+// Flags for label metadata fields
+#define PLPKS_LABEL_VERSION		0
+#define PLPKS_MAX_LABEL_ATTR_SIZE	16
+#define PLPKS_MAX_NAME_SIZE		239
+#define PLPKS_MAX_DATA_SIZE		4000
+
+// Timeouts for PLPKS operations
+#define PLPKS_MAX_TIMEOUT		(5 * USEC_PER_SEC)
+#define PLPKS_FLUSH_SLEEP		10000 // usec
+
 struct plpks_var {
 	char *component;
 	u8 *name;

arch/powerpc/sysdev/fsl_msi.c

@@ -567,10 +567,12 @@ static const struct fsl_msi_feature ipic_msi_feature = {
 	.msiir_offset = 0x38,
 };
 
+#ifdef CONFIG_EPAPR_PARAVIRT
 static const struct fsl_msi_feature vmpic_msi_feature = {
 	.fsl_pic_ip = FSL_PIC_IP_VMPIC,
 	.msiir_offset = 0,
 };
+#endif
 
 static const struct of_device_id fsl_of_msi_ids[] = {
 	{

arch/riscv/kernel/cpu_ops_sbi.c

@@ -72,7 +72,7 @@ static int sbi_cpu_start(unsigned int cpuid, struct task_struct *tidle)
 	/* Make sure tidle is updated */
 	smp_mb();
 	bdata->task_ptr = tidle;
-	bdata->stack_ptr = task_stack_page(tidle) + THREAD_SIZE;
+	bdata->stack_ptr = task_pt_regs(tidle);
 	/* Make sure boot data is updated */
 	smp_mb();
 	hsm_data = __pa(bdata);

arch/riscv/kernel/cpu_ops_spinwait.c

@@ -34,8 +34,7 @@ static void cpu_update_secondary_bootdata(unsigned int cpuid,
 
 	/* Make sure tidle is updated */
 	smp_mb();
-	WRITE_ONCE(__cpu_spinwait_stack_pointer[hartid],
+	WRITE_ONCE(__cpu_spinwait_stack_pointer[hartid], task_pt_regs(tidle));
-		   task_stack_page(tidle) + THREAD_SIZE);
 	WRITE_ONCE(__cpu_spinwait_task_pointer[hartid], tidle);
 }
 

arch/riscv/kernel/entry.S

@@ -248,7 +248,7 @@ ret_from_syscall_rejected:
 	andi t0, t0, _TIF_SYSCALL_WORK
 	bnez t0, handle_syscall_trace_exit
 
-ret_from_exception:
+SYM_CODE_START_NOALIGN(ret_from_exception)
 	REG_L s0, PT_STATUS(sp)
 	csrc CSR_STATUS, SR_IE
 #ifdef CONFIG_TRACE_IRQFLAGS
@@ -262,6 +262,7 @@ ret_from_exception:
 	andi s0, s0, SR_SPP
 #endif
 	bnez s0, resume_kernel
+SYM_CODE_END(ret_from_exception)
 
 	/* Interrupts must be disabled here so flags are checked atomically */
 	REG_L s0, TASK_TI_FLAGS(tp) /* current_thread_info->flags */

arch/riscv/kernel/stacktrace.c

@@ -16,6 +16,18 @@
 
 #ifdef CONFIG_FRAME_POINTER
 
+extern asmlinkage void ret_from_exception(void);
+
+static inline int fp_is_valid(unsigned long fp, unsigned long sp)
+{
+	unsigned long low, high;
+
+	low = sp + sizeof(struct stackframe);
+	high = ALIGN(sp, THREAD_SIZE);
+
+	return !(fp < low || fp > high || fp & 0x07);
+}
+
 void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
 			     bool (*fn)(void *, unsigned long), void *arg)
 {
@@ -39,27 +51,32 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
 	}
 
 	for (;;) {
-		unsigned long low, high;
 		struct stackframe *frame;
 
 		if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc))))
 			break;
 
-		/* Validate frame pointer */
+		if (unlikely(!fp_is_valid(fp, sp)))
-		low = sp + sizeof(struct stackframe);
-		high = ALIGN(sp, THREAD_SIZE);
-		if (unlikely(fp < low || fp > high || fp & 0x7))
 			break;
+
 		/* Unwind stack frame */
 		frame = (struct stackframe *)fp - 1;
 		sp = fp;
-		if (regs && (regs->epc == pc) && (frame->fp & 0x7)) {
+		if (regs && (regs->epc == pc) && fp_is_valid(frame->ra, sp)) {
+			/* We hit function where ra is not saved on the stack */
 			fp = frame->ra;
 			pc = regs->ra;
 		} else {
 			fp = frame->fp;
 			pc = ftrace_graph_ret_addr(current, NULL, frame->ra,
 						   &frame->ra);
+			if (pc == (unsigned long)ret_from_exception) {
+				if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc)))
+					break;
+
+				pc = ((struct pt_regs *)sp)->epc;
+				fp = ((struct pt_regs *)sp)->s0;
+			}
 		}
 
 	}

arch/riscv/net/bpf_jit_comp64.c

@@ -503,33 +503,33 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64,
 		break;
 	/* src_reg = atomic_fetch_<op>(dst_reg + off16, src_reg) */
 	case BPF_ADD | BPF_FETCH:
-		emit(is64 ? rv_amoadd_d(rs, rs, rd, 0, 0) :
+		emit(is64 ? rv_amoadd_d(rs, rs, rd, 1, 1) :
-		     rv_amoadd_w(rs, rs, rd, 0, 0), ctx);
+		     rv_amoadd_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	case BPF_AND | BPF_FETCH:
-		emit(is64 ? rv_amoand_d(rs, rs, rd, 0, 0) :
+		emit(is64 ? rv_amoand_d(rs, rs, rd, 1, 1) :
-		     rv_amoand_w(rs, rs, rd, 0, 0), ctx);
+		     rv_amoand_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	case BPF_OR | BPF_FETCH:
-		emit(is64 ? rv_amoor_d(rs, rs, rd, 0, 0) :
+		emit(is64 ? rv_amoor_d(rs, rs, rd, 1, 1) :
-		     rv_amoor_w(rs, rs, rd, 0, 0), ctx);
+		     rv_amoor_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	case BPF_XOR | BPF_FETCH:
-		emit(is64 ? rv_amoxor_d(rs, rs, rd, 0, 0) :
+		emit(is64 ? rv_amoxor_d(rs, rs, rd, 1, 1) :
-		     rv_amoxor_w(rs, rs, rd, 0, 0), ctx);
+		     rv_amoxor_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	/* src_reg = atomic_xchg(dst_reg + off16, src_reg); */
 	case BPF_XCHG:
-		emit(is64 ? rv_amoswap_d(rs, rs, rd, 0, 0) :
+		emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) :
-		     rv_amoswap_w(rs, rs, rd, 0, 0), ctx);
+		     rv_amoswap_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;

arch/s390/boot/startup.c

@@ -30,7 +30,6 @@ int __bootdata(is_full_image) = 1;
 struct initrd_data __bootdata(initrd_data);
 
 u64 __bootdata_preserved(stfle_fac_list[16]);
-u64 __bootdata_preserved(alt_stfle_fac_list[16]);
 struct oldmem_data __bootdata_preserved(oldmem_data);
 
 void error(char *x)

arch/s390/include/asm/dwarf.h

@@ -9,6 +9,7 @@
 #define CFI_DEF_CFA_OFFSET	.cfi_def_cfa_offset
 #define CFI_ADJUST_CFA_OFFSET	.cfi_adjust_cfa_offset
 #define CFI_RESTORE		.cfi_restore
+#define CFI_REL_OFFSET		.cfi_rel_offset
 
 #ifdef CONFIG_AS_CFI_VAL_OFFSET
 #define CFI_VAL_OFFSET		.cfi_val_offset

arch/s390/kernel/ipl.c

@@ -834,8 +834,8 @@ static ssize_t reipl_nvme_scpdata_write(struct file *filp, struct kobject *kobj,
 		scpdata_len += padding;
 	}
 
-	reipl_block_nvme->hdr.len = IPL_BP_FCP_LEN + scpdata_len;
+	reipl_block_nvme->hdr.len = IPL_BP_NVME_LEN + scpdata_len;
-	reipl_block_nvme->nvme.len = IPL_BP0_FCP_LEN + scpdata_len;
+	reipl_block_nvme->nvme.len = IPL_BP0_NVME_LEN + scpdata_len;
 	reipl_block_nvme->nvme.scp_data_len = scpdata_len;
 
 	return count;
@@ -1604,9 +1604,9 @@ static int __init dump_nvme_init(void)
 	}
 	dump_block_nvme->hdr.len = IPL_BP_NVME_LEN;
 	dump_block_nvme->hdr.version = IPL_PARM_BLOCK_VERSION;
-	dump_block_nvme->fcp.len = IPL_BP0_NVME_LEN;
+	dump_block_nvme->nvme.len = IPL_BP0_NVME_LEN;
-	dump_block_nvme->fcp.pbt = IPL_PBT_NVME;
+	dump_block_nvme->nvme.pbt = IPL_PBT_NVME;
-	dump_block_nvme->fcp.opt = IPL_PB0_NVME_OPT_DUMP;
+	dump_block_nvme->nvme.opt = IPL_PB0_NVME_OPT_DUMP;
 	dump_capabilities |= DUMP_TYPE_NVME;
 	return 0;
 }

arch/s390/kernel/setup.c

@@ -155,7 +155,7 @@ unsigned int __bootdata_preserved(zlib_dfltcc_support);
 EXPORT_SYMBOL(zlib_dfltcc_support);
 u64 __bootdata_preserved(stfle_fac_list[16]);
 EXPORT_SYMBOL(stfle_fac_list);
-u64 __bootdata_preserved(alt_stfle_fac_list[16]);
+u64 alt_stfle_fac_list[16];
 struct oldmem_data __bootdata_preserved(oldmem_data);
 
 unsigned long VMALLOC_START;

arch/s390/kernel/vdso32/Makefile

@@ -20,7 +20,10 @@ KBUILD_AFLAGS_32 := $(filter-out -m64,$(KBUILD_AFLAGS))
 KBUILD_AFLAGS_32 += -m31 -s
 
 KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
-KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin
+KBUILD_CFLAGS_32 := $(filter-out -mpacked-stack,$(KBUILD_CFLAGS))
+KBUILD_CFLAGS_32 := $(filter-out -mno-pic-data-is-text-relative,$(KBUILD_CFLAGS_32))
+KBUILD_CFLAGS_32 := $(filter-out -fno-asynchronous-unwind-tables,$(KBUILD_CFLAGS_32))
+KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin -fasynchronous-unwind-tables
 
 LDFLAGS_vdso32.so.dbg += -shared -soname=linux-vdso32.so.1 \
 	--hash-style=both --build-id=sha1 -melf_s390 -T

arch/s390/kernel/vdso64/Makefile

@@ -25,7 +25,11 @@ KBUILD_AFLAGS_64 := $(filter-out -m64,$(KBUILD_AFLAGS))
 KBUILD_AFLAGS_64 += -m64 -s
 
 KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
-KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin
+KBUILD_CFLAGS_64 := $(filter-out -mpacked-stack,$(KBUILD_CFLAGS_64))
+KBUILD_CFLAGS_64 := $(filter-out -mno-pic-data-is-text-relative,$(KBUILD_CFLAGS_64))
+KBUILD_CFLAGS_64 := $(filter-out -munaligned-symbols,$(KBUILD_CFLAGS_64))
+KBUILD_CFLAGS_64 := $(filter-out -fno-asynchronous-unwind-tables,$(KBUILD_CFLAGS_64))
+KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin -fasynchronous-unwind-tables
 ldflags-y := -shared -soname=linux-vdso64.so.1 \
 	     --hash-style=both --build-id=sha1 -T
 

arch/s390/kernel/vdso64/vdso_user_wrapper.S

@@ -23,8 +23,10 @@ __kernel_\func:
 	CFI_DEF_CFA_OFFSET (STACK_FRAME_OVERHEAD + WRAPPER_FRAME_SIZE)
 	CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
 	stg	%r14,STACK_FRAME_OVERHEAD(%r15)
+	CFI_REL_OFFSET 14, STACK_FRAME_OVERHEAD
 	brasl	%r14,__s390_vdso_\func
 	lg	%r14,STACK_FRAME_OVERHEAD(%r15)
+	CFI_RESTORE 14
 	aghi	%r15,WRAPPER_FRAME_SIZE
 	CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
 	CFI_RESTORE 15

arch/s390/mm/gmap.c

@@ -2647,7 +2647,7 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
 		return 0;
 
 	start = pmd_val(*pmd) & HPAGE_MASK;
-	end = start + HPAGE_SIZE - 1;
+	end = start + HPAGE_SIZE;
 	__storage_key_init_range(start, end);
 	set_bit(PG_arch_1, &page->flags);
 	cond_resched();

arch/s390/mm/hugetlbpage.c

@@ -139,7 +139,7 @@ static void clear_huge_pte_skeys(struct mm_struct *mm, unsigned long rste)
 	}
 
 	if (!test_and_set_bit(PG_arch_1, &page->flags))
-		__storage_key_init_range(paddr, paddr + size - 1);
+		__storage_key_init_range(paddr, paddr + size);
 }
 
 void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,

arch/s390/net/bpf_jit_comp.c

@@ -1207,8 +1207,12 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 	EMIT6_DISP_LH(0xeb000000, is32 ? (op32) : (op64),		\
 		      (insn->imm & BPF_FETCH) ? src_reg : REG_W0,	\
 		      src_reg, dst_reg, off);				\
-	if (is32 && (insn->imm & BPF_FETCH))				\
+	if (insn->imm & BPF_FETCH) {					\
-		EMIT_ZERO(src_reg);					\
+		/* bcr 14,0 - see atomic_fetch_{add,and,or,xor}() */	\
+		_EMIT2(0x07e0);						\
+		if (is32)                                               \
+			EMIT_ZERO(src_reg);				\
+	}								\
 } while (0)
 		case BPF_ADD:
 		case BPF_ADD | BPF_FETCH:

arch/sh/kernel/kprobes.c

@@ -44,17 +44,12 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
 	if (OPCODE_RTE(opcode))
 		return -EFAULT;	/* Bad breakpoint */
 
+	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
 	p->opcode = opcode;
 
 	return 0;
 }
 
-void __kprobes arch_copy_kprobe(struct kprobe *p)
-{
-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-	p->opcode = *p->addr;
-}
-
 void __kprobes arch_arm_kprobe(struct kprobe *p)
 {
 	*p->addr = BREAKPOINT_INSTRUCTION;

arch/sh/lib/checksum.S

@@ -33,7 +33,8 @@
  */
 
 /*	
- * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum);
+ * unsigned int csum_partial(const unsigned char *buf, int len,
+ *                           unsigned int sum);
  */
 
 .text
@@ -45,31 +46,11 @@ ENTRY(csum_partial)
 	   * Fortunately, it is easy to convert 2-byte alignment to 4-byte
 	   * alignment for the unrolled loop.
 	   */
+	mov	r5, r1
 	mov	r4, r0
-	tst	#3, r0		! Check alignment.
+	tst	#2, r0		! Check alignment.
-	bt/s	2f		! Jump if alignment is ok.
+	bt	2f		! Jump if alignment is ok.
-	 mov	r4, r7		! Keep a copy to check for alignment
 	!
-	tst	#1, r0		! Check alignment.
-	bt	21f		! Jump if alignment is boundary of 2bytes.
-
-	! buf is odd
-	tst	r5, r5
-	add	#-1, r5
-	bt	9f
-	mov.b	@r4+, r0
-	extu.b	r0, r0
-	addc	r0, r6		! t=0 from previous tst
-	mov	r6, r0
-	shll8	r6
-	shlr16	r0
-	shlr8	r0
-	or	r0, r6
-	mov	r4, r0
-	tst	#2, r0
-	bt	2f
-21:
-	! buf is 2 byte aligned (len could be 0)
 	add	#-2, r5		! Alignment uses up two bytes.
 	cmp/pz	r5		!
 	bt/s	1f		! Jump if we had at least two bytes.
@@ -77,17 +58,16 @@ ENTRY(csum_partial)
 	bra	6f
 	 add	#2, r5		! r5 was < 2.  Deal with it.
 1:
+	mov	r5, r1		! Save new len for later use.
 	mov.w	@r4+, r0
 	extu.w	r0, r0
 	addc	r0, r6
 	bf	2f
 	add	#1, r6
 2:
-	! buf is 4 byte aligned (len could be 0)
-	mov	r5, r1
 	mov	#-5, r0
-	shld	r0, r1
+	shld	r0, r5
-	tst	r1, r1
+	tst	r5, r5
 	bt/s	4f		! if it's =0, go to 4f
 	 clrt
 	.align	2
@@ -109,31 +89,30 @@ ENTRY(csum_partial)
 	addc	r0, r6
 	addc	r2, r6
 	movt	r0
-	dt	r1
+	dt	r5
 	bf/s	3b
 	 cmp/eq	#1, r0
-	! here, we know r1==0
+	! here, we know r5==0
-	addc	r1, r6			! add carry to r6
+	addc	r5, r6			! add carry to r6
 4:
-	mov	r5, r0
+	mov	r1, r0
 	and	#0x1c, r0
 	tst	r0, r0
-	bt	6f
+	bt/s	6f
-	! 4 bytes or more remaining
+	 mov	r0, r5
-	mov	r0, r1
+	shlr2	r5
-	shlr2	r1
 	mov	#0, r2
 5:
 	addc	r2, r6
 	mov.l	@r4+, r2
 	movt	r0
-	dt	r1
+	dt	r5
 	bf/s	5b
 	 cmp/eq	#1, r0
 	addc	r2, r6
-	addc	r1, r6		! r1==0 here, so it means add carry-bit
+	addc	r5, r6		! r5==0 here, so it means add carry-bit
 6:
-	! 3 bytes or less remaining
+	mov	r1, r5
 	mov	#3, r0
 	and	r0, r5
 	tst	r5, r5
@@ -159,16 +138,6 @@ ENTRY(csum_partial)
 	mov	#0, r0
 	addc	r0, r6
 9:
-	! Check if the buffer was misaligned, if so realign sum
-	mov	r7, r0
-	tst	#1, r0
-	bt	10f
-	mov	r6, r0
-	shll8	r6
-	shlr16	r0
-	shlr8	r0
-	or	r0, r6
-10:
 	rts
 	 mov	r6, r0
 

arch/um/drivers/line.c

@@ -673,24 +673,26 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_port *port,
 		goto cleanup;
 	}
 
-	*winch = ((struct winch) { .list  	= LIST_HEAD_INIT(winch->list),
+	*winch = ((struct winch) { .fd  	= fd,
-				   .fd  	= fd,
 				   .tty_fd 	= tty_fd,
 				   .pid  	= pid,
 				   .port 	= port,
 				   .stack	= stack });
 
+	spin_lock(&winch_handler_lock);
+	list_add(&winch->list, &winch_handlers);
+	spin_unlock(&winch_handler_lock);
+
 	if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
 			   IRQF_SHARED, "winch", winch) < 0) {
 		printk(KERN_ERR "register_winch_irq - failed to register "
 		       "IRQ\n");
+		spin_lock(&winch_handler_lock);
+		list_del(&winch->list);
+		spin_unlock(&winch_handler_lock);
 		goto out_free;
 	}
 
-	spin_lock(&winch_handler_lock);
-	list_add(&winch->list, &winch_handlers);
-	spin_unlock(&winch_handler_lock);
-
 	return;
 
  out_free:

arch/um/drivers/ubd_kern.c

@@ -1099,7 +1099,7 @@ static int __init ubd_init(void)
 
 	if (irq_req_buffer == NULL) {
 		printk(KERN_ERR "Failed to initialize ubd buffering\n");
-		return -1;
+		return -ENOMEM;
 	}
 	io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
 				      sizeof(struct io_thread_req *),
@@ -1110,7 +1110,7 @@ static int __init ubd_init(void)
 
 	if (io_req_buffer == NULL) {
 		printk(KERN_ERR "Failed to initialize ubd buffering\n");
-		return -1;
+		return -ENOMEM;
 	}
 	platform_driver_register(&ubd_driver);
 	mutex_lock(&ubd_lock);

arch/um/drivers/vector_kern.c

@@ -141,7 +141,7 @@ static bool get_bpf_flash(struct arglist *def)
 
 	if (allow != NULL) {
 		if (kstrtoul(allow, 10, &result) == 0)
-			return (allow > 0);
+			return result > 0;
 	}
 	return false;
 }

arch/um/include/asm/kasan.h

@@ -24,7 +24,6 @@
 
 #ifdef CONFIG_KASAN
 void kasan_init(void);
-void kasan_map_memory(void *start, unsigned long len);
 extern int kasan_um_is_ready;
 
 #ifdef CONFIG_STATIC_LINK

arch/um/include/asm/mmu.h

@@ -15,8 +15,6 @@ typedef struct mm_context {
 	struct page *stub_pages[2];
 } mm_context_t;
 
-extern void __switch_mm(struct mm_id * mm_idp);
-
 /* Avoid tangled inclusion with asm/ldt.h */
 extern long init_new_ldt(struct mm_context *to_mm, struct mm_context *from_mm);
 extern void free_ldt(struct mm_context *mm);

arch/um/include/asm/processor-generic.h

@@ -95,7 +95,6 @@ extern struct cpuinfo_um boot_cpu_data;
 #define current_cpu_data boot_cpu_data
 #define cache_line_size()	(boot_cpu_data.cache_alignment)
 
-extern unsigned long get_thread_reg(int reg, jmp_buf *buf);
 #define KSTK_REG(tsk, reg) get_thread_reg(reg, &tsk->thread.switch_buf)
 extern unsigned long __get_wchan(struct task_struct *p);
 

arch/um/include/shared/kern_util.h

@@ -67,4 +67,6 @@ extern void fatal_sigsegv(void) __attribute__ ((noreturn));
 
 void um_idle_sleep(void);
 
+void kasan_map_memory(void *start, size_t len);
+
 #endif

arch/um/include/shared/skas/mm_id.h

@@ -15,4 +15,6 @@ struct mm_id {
 	int kill;
 };
 
+void __switch_mm(struct mm_id *mm_idp);
+
 #endif

arch/um/os-Linux/mem.c

@@ -15,6 +15,7 @@
 #include <sys/vfs.h>
 #include <linux/magic.h>
 #include <init.h>
+#include <kern_util.h>
 #include <os.h>
 
 /*

arch/x86/Kconfig.debug

@@ -248,6 +248,7 @@ config UNWINDER_ORC
 
 config UNWINDER_FRAME_POINTER
 	bool "Frame pointer unwinder"
+	select ARCH_WANT_FRAME_POINTERS
 	select FRAME_POINTER
 	help
 	  This option enables the frame pointer unwinder for unwinding kernel
@@ -271,7 +272,3 @@ config UNWINDER_GUESS
 	  overhead.
 
 endchoice
-
-config FRAME_POINTER
-	depends on !UNWINDER_ORC && !UNWINDER_GUESS
-	bool

arch/x86/boot/compressed/head_64.S

@@ -390,6 +390,11 @@ SYM_CODE_START(startup_64)
 	call	sev_enable
 #endif
 
+	/* Preserve only the CR4 bits that must be preserved, and clear the rest */
+	movq	%cr4, %rax
+	andl	$(X86_CR4_PAE | X86_CR4_MCE | X86_CR4_LA57), %eax
+	movq	%rax, %cr4
+
 	/*
 	 * configure_5level_paging() updates the number of paging levels using
 	 * a trampoline in 32-bit addressable memory if the current number does

arch/x86/crypto/nh-avx2-x86_64.S

@@ -153,5 +153,6 @@ SYM_FUNC_START(nh_avx2)
 	vpaddq		T1, T0, T0
 	vpaddq		T4, T0, T0
 	vmovdqu		T0, (HASH)
+	vzeroupper
 	RET
 SYM_FUNC_END(nh_avx2)

arch/x86/crypto/sha256-avx2-asm.S

@@ -711,6 +711,7 @@ done_hash:
 	popq	%r13
 	popq	%r12
 	popq	%rbx
+	vzeroupper
 	RET
 SYM_FUNC_END(sha256_transform_rorx)
 

arch/x86/crypto/sha512-avx2-asm.S

@@ -680,6 +680,7 @@ done_hash:
 	pop	%r12
 	pop	%rbx
 
+	vzeroupper
 	RET
 SYM_FUNC_END(sha512_transform_rorx)
 

arch/x86/entry/vsyscall/vsyscall_64.c

@@ -98,11 +98,6 @@ static int addr_to_vsyscall_nr(unsigned long addr)
 
 static bool write_ok_or_segv(unsigned long ptr, size_t size)
 {
-	/*
-	 * XXX: if access_ok, get_user, and put_user handled
-	 * sig_on_uaccess_err, this could go away.
-	 */
-
 	if (!access_ok((void __user *)ptr, size)) {
 		struct thread_struct *thread = &current->thread;
 
@@ -120,10 +115,8 @@ static bool write_ok_or_segv(unsigned long ptr, size_t size)
 bool emulate_vsyscall(unsigned long error_code,
 		      struct pt_regs *regs, unsigned long address)
 {
-	struct task_struct *tsk;
 	unsigned long caller;
 	int vsyscall_nr, syscall_nr, tmp;
-	int prev_sig_on_uaccess_err;
 	long ret;
 	unsigned long orig_dx;
 
@@ -172,8 +165,6 @@ bool emulate_vsyscall(unsigned long error_code,
 		goto sigsegv;
 	}
 
-	tsk = current;
-
 	/*
 	 * Check for access_ok violations and find the syscall nr.
 	 *
@@ -234,12 +225,8 @@ bool emulate_vsyscall(unsigned long error_code,
 		goto do_ret;  /* skip requested */
 
 	/*
-	 * With a real vsyscall, page faults cause SIGSEGV.  We want to
+	 * With a real vsyscall, page faults cause SIGSEGV.
-	 * preserve that behavior to make writing exploits harder.
 	 */
-	prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err;
-	current->thread.sig_on_uaccess_err = 1;
-
 	ret = -EFAULT;
 	switch (vsyscall_nr) {
 	case 0:
@@ -262,23 +249,12 @@ bool emulate_vsyscall(unsigned long error_code,
 		break;
 	}
 
-	current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err;
-
 check_fault:
 	if (ret == -EFAULT) {
 		/* Bad news -- userspace fed a bad pointer to a vsyscall. */
 		warn_bad_vsyscall(KERN_INFO, regs,
 				  "vsyscall fault (exploit attempt?)");
-
+		goto sigsegv;
-		/*
-		 * If we failed to generate a signal for any reason,
-		 * generate one here.  (This should be impossible.)
-		 */
-		if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
-				 !sigismember(&tsk->pending.signal, SIGSEGV)))
-			goto sigsegv;
-
-		return true;  /* Don't emulate the ret. */
 	}
 
 	regs->ax = ret;

arch/x86/include/asm/pgtable_types.h

@@ -544,6 +544,8 @@ static inline void update_page_count(int level, unsigned long pages) { }
 extern pte_t *lookup_address(unsigned long address, unsigned int *level);
 extern pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
 				    unsigned int *level);
+pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
+				  unsigned int *level, bool *nx, bool *rw);
 extern pmd_t *lookup_pmd_address(unsigned long address);
 extern phys_addr_t slow_virt_to_phys(void *__address);
 extern int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn,

arch/x86/include/asm/processor.h

@@ -519,7 +519,6 @@ struct thread_struct {
 	unsigned long		iopl_emul;
 
 	unsigned int		iopl_warn:1;
-	unsigned int		sig_on_uaccess_err:1;
 
 	/*
 	 * Protection Keys Register for Userspace.  Loaded immediately on

arch/x86/include/asm/sparsemem.h

@@ -37,8 +37,6 @@ extern int phys_to_target_node(phys_addr_t start);
 #define phys_to_target_node phys_to_target_node
 extern int memory_add_physaddr_to_nid(u64 start);
 #define memory_add_physaddr_to_nid memory_add_physaddr_to_nid
-extern int numa_fill_memblks(u64 start, u64 end);
-#define numa_fill_memblks numa_fill_memblks
 #endif
 #endif /* __ASSEMBLY__ */
 

arch/x86/kernel/tsc_sync.c

@@ -192,11 +192,9 @@ bool tsc_store_and_check_tsc_adjust(bool bootcpu)
 	cur->warned = false;
 
 	/*
-	 * If a non-zero TSC value for socket 0 may be valid then the default
+	 * The default adjust value cannot be assumed to be zero on any socket.
-	 * adjusted value cannot assumed to be zero either.
 	 */
-	if (tsc_async_resets)
+	cur->adjusted = bootval;
-		cur->adjusted = bootval;
 
 	/*
 	 * Check whether this CPU is the first in a package to come up. In

arch/x86/kvm/cpuid.c

@@ -1157,9 +1157,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
 		entry->eax = entry->ebx = entry->ecx = 0;
 		break;
 	case 0x80000008: {
-		unsigned g_phys_as = (entry->eax >> 16) & 0xff;
+		unsigned int virt_as = max((entry->eax >> 8) & 0xff, 48U);
-		unsigned virt_as = max((entry->eax >> 8) & 0xff, 48U);
+		unsigned int phys_as;
-		unsigned phys_as = entry->eax & 0xff;
 
 		/*
 		 * If TDP (NPT) is disabled use the adjusted host MAXPHYADDR as
@@ -1167,16 +1166,16 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
 		 * reductions in MAXPHYADDR for memory encryption affect shadow
 		 * paging, too.
 		 *
-		 * If TDP is enabled but an explicit guest MAXPHYADDR is not
+		 * If TDP is enabled, use the raw bare metal MAXPHYADDR as
-		 * provided, use the raw bare metal MAXPHYADDR as reductions to
+		 * reductions to the HPAs do not affect GPAs.
-		 * the HPAs do not affect GPAs.
 		 */
-		if (!tdp_enabled)
+		if (!tdp_enabled) {
-			g_phys_as = boot_cpu_data.x86_phys_bits;
+			phys_as = boot_cpu_data.x86_phys_bits;
-		else if (!g_phys_as)
+		} else {
-			g_phys_as = phys_as;
+			phys_as = entry->eax & 0xff;
+		}
 
-		entry->eax = g_phys_as | (virt_as << 8);
+		entry->eax = phys_as | (virt_as << 8);
 		entry->ecx &= ~(GENMASK(31, 16) | GENMASK(11, 8));
 		entry->edx = 0;
 		cpuid_entry_override(entry, CPUID_8000_0008_EBX);

arch/x86/lib/x86-opcode-map.txt

@@ -148,7 +148,7 @@ AVXcode:
 65: SEG=GS (Prefix)
 66: Operand-Size (Prefix)
 67: Address-Size (Prefix)
-68: PUSH Iz (d64)
+68: PUSH Iz
 69: IMUL Gv,Ev,Iz
 6a: PUSH Ib (d64)
 6b: IMUL Gv,Ev,Ib
@@ -698,10 +698,10 @@ AVXcode: 2
 4d: vrcp14ss/d Vsd,Hpd,Wsd (66),(ev)
 4e: vrsqrt14ps/d Vpd,Wpd (66),(ev)
 4f: vrsqrt14ss/d Vsd,Hsd,Wsd (66),(ev)
-50: vpdpbusd Vx,Hx,Wx (66),(ev)
+50: vpdpbusd Vx,Hx,Wx (66)
-51: vpdpbusds Vx,Hx,Wx (66),(ev)
+51: vpdpbusds Vx,Hx,Wx (66)
-52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66),(ev) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev)
+52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev)
-53: vpdpwssds Vx,Hx,Wx (66),(ev) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev)
+53: vpdpwssds Vx,Hx,Wx (66) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev)
 54: vpopcntb/w Vx,Wx (66),(ev)
 55: vpopcntd/q Vx,Wx (66),(ev)
 58: vpbroadcastd Vx,Wx (66),(v)

arch/x86/mm/fault.c

@@ -738,39 +738,8 @@ kernelmode_fixup_or_oops(struct pt_regs *regs, unsigned long error_code,
 	WARN_ON_ONCE(user_mode(regs));
 
 	/* Are we prepared to handle this kernel fault? */
-	if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) {
+	if (fixup_exception(regs, X86_TRAP_PF, error_code, address))
-		/*
-		 * Any interrupt that takes a fault gets the fixup. This makes
-		 * the below recursive fault logic only apply to a faults from
-		 * task context.
-		 */
-		if (in_interrupt())
-			return;
-
-		/*
-		 * Per the above we're !in_interrupt(), aka. task context.
-		 *
-		 * In this case we need to make sure we're not recursively
-		 * faulting through the emulate_vsyscall() logic.
-		 */
-		if (current->thread.sig_on_uaccess_err && signal) {
-			sanitize_error_code(address, &error_code);
-
-			set_signal_archinfo(address, error_code);
-
-			if (si_code == SEGV_PKUERR) {
-				force_sig_pkuerr((void __user *)address, pkey);
-			} else {
-				/* XXX: hwpoison faults will set the wrong code. */
-				force_sig_fault(signal, si_code, (void __user *)address);
-			}
-		}
-
-		/*
-		 * Barring that, we can do the fixup and be happy.
-		 */
 		return;
-	}
 
 	/*
 	 * AMD erratum #91 manifests as a spurious page fault on a PREFETCH

arch/x86/mm/numa.c

@@ -956,6 +956,8 @@ int memory_add_physaddr_to_nid(u64 start)
 }
 EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
 
+#endif
+
 static int __init cmp_memblk(const void *a, const void *b)
 {
 	const struct numa_memblk *ma = *(const struct numa_memblk **)a;
@@ -1028,5 +1030,3 @@ int __init numa_fill_memblks(u64 start, u64 end)
 	}
 	return 0;
 }
-
-#endif

arch/x86/mm/pat/set_memory.c

@@ -583,7 +583,8 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
  * Validate strict W^X semantics.
  */
 static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start,
-				  unsigned long pfn, unsigned long npg)
+				  unsigned long pfn, unsigned long npg,
+				  bool nx, bool rw)
 {
 	unsigned long end;
 
@@ -609,6 +610,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
 	if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW)
 		return new;
 
+	/* Non-leaf translation entries can disable writing or execution. */
+	if (!rw || nx)
+		return new;
+
 	end = start + npg * PAGE_SIZE - 1;
 	WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
 		  (unsigned long long)pgprot_val(old),
@@ -625,20 +630,26 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
 
 /*
  * Lookup the page table entry for a virtual address in a specific pgd.
- * Return a pointer to the entry and the level of the mapping.
+ * Return a pointer to the entry, the level of the mapping, and the effective
+ * NX and RW bits of all page table levels.
  */
-pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
+pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
-			     unsigned int *level)
+				  unsigned int *level, bool *nx, bool *rw)
 {
 	p4d_t *p4d;
 	pud_t *pud;
 	pmd_t *pmd;
 
 	*level = PG_LEVEL_NONE;
+	*nx = false;
+	*rw = true;
 
 	if (pgd_none(*pgd))
 		return NULL;
 
+	*nx |= pgd_flags(*pgd) & _PAGE_NX;
+	*rw &= pgd_flags(*pgd) & _PAGE_RW;
+
 	p4d = p4d_offset(pgd, address);
 	if (p4d_none(*p4d))
 		return NULL;
@@ -647,6 +658,9 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
 	if (p4d_large(*p4d) || !p4d_present(*p4d))
 		return (pte_t *)p4d;
 
+	*nx |= p4d_flags(*p4d) & _PAGE_NX;
+	*rw &= p4d_flags(*p4d) & _PAGE_RW;
+
 	pud = pud_offset(p4d, address);
 	if (pud_none(*pud))
 		return NULL;
@@ -655,6 +669,9 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
 	if (pud_large(*pud) || !pud_present(*pud))
 		return (pte_t *)pud;
 
+	*nx |= pud_flags(*pud) & _PAGE_NX;
+	*rw &= pud_flags(*pud) & _PAGE_RW;
+
 	pmd = pmd_offset(pud, address);
 	if (pmd_none(*pmd))
 		return NULL;
@@ -663,11 +680,26 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
 	if (pmd_large(*pmd) || !pmd_present(*pmd))
 		return (pte_t *)pmd;
 
+	*nx |= pmd_flags(*pmd) & _PAGE_NX;
+	*rw &= pmd_flags(*pmd) & _PAGE_RW;
+
 	*level = PG_LEVEL_4K;
 
 	return pte_offset_kernel(pmd, address);
 }
 
+/*
+ * Lookup the page table entry for a virtual address in a specific pgd.
+ * Return a pointer to the entry and the level of the mapping.
+ */
+pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
+			     unsigned int *level)
+{
+	bool nx, rw;
+
+	return lookup_address_in_pgd_attr(pgd, address, level, &nx, &rw);
+}
+
 /*
  * Lookup the page table entry for a virtual address. Return a pointer
  * to the entry and the level of the mapping.
@@ -683,13 +715,16 @@ pte_t *lookup_address(unsigned long address, unsigned int *level)
 EXPORT_SYMBOL_GPL(lookup_address);
 
 static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address,
-				  unsigned int *level)
+				  unsigned int *level, bool *nx, bool *rw)
 {
-	if (cpa->pgd)
+	pgd_t *pgd;
-		return lookup_address_in_pgd(cpa->pgd + pgd_index(address),
-					       address, level);
 
-	return lookup_address(address, level);
+	if (!cpa->pgd)
+		pgd = pgd_offset_k(address);
+	else
+		pgd = cpa->pgd + pgd_index(address);
+
+	return lookup_address_in_pgd_attr(pgd, address, level, nx, rw);
 }
 
 /*
@@ -813,12 +848,13 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
 	pgprot_t old_prot, new_prot, req_prot, chk_prot;
 	pte_t new_pte, *tmp;
 	enum pg_level level;
+	bool nx, rw;
 
 	/*
 	 * Check for races, another CPU might have split this page
 	 * up already:
 	 */
-	tmp = _lookup_address_cpa(cpa, address, &level);
+	tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
 	if (tmp != kpte)
 		return 1;
 
@@ -929,7 +965,8 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
 	new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
 				      psize, CPA_DETECT);
 
-	new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages);
+	new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages,
+			      nx, rw);
 
 	/*
 	 * If there is a conflict, split the large page.
@@ -1010,6 +1047,7 @@ __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address,
 	pte_t *pbase = (pte_t *)page_address(base);
 	unsigned int i, level;
 	pgprot_t ref_prot;
+	bool nx, rw;
 	pte_t *tmp;
 
 	spin_lock(&pgd_lock);
@@ -1017,7 +1055,7 @@ __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address,
 	 * Check for races, another CPU might have split this page
 	 * up for us already:
 	 */
-	tmp = _lookup_address_cpa(cpa, address, &level);
+	tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
 	if (tmp != kpte) {
 		spin_unlock(&pgd_lock);
 		return 1;
@@ -1558,10 +1596,11 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
 	int do_split, err;
 	unsigned int level;
 	pte_t *kpte, old_pte;
+	bool nx, rw;
 
 	address = __cpa_addr(cpa, cpa->curpage);
 repeat:
-	kpte = _lookup_address_cpa(cpa, address, &level);
+	kpte = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
 	if (!kpte)
 		return __cpa_process_fault(cpa, address, primary);
 
@@ -1583,7 +1622,8 @@ repeat:
 		new_prot = static_protections(new_prot, address, pfn, 1, 0,
 					      CPA_PROTECT);
 
-		new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1);
+		new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1,
+				      nx, rw);
 
 		new_prot = pgprot_clear_protnone_bits(new_prot);
 

arch/x86/purgatory/Makefile

@@ -42,7 +42,8 @@ KCOV_INSTRUMENT := n
 # make up the standalone purgatory.ro
 
 PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
-PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0
+PURGATORY_CFLAGS := -mcmodel=small -ffreestanding -fno-zero-initialized-in-bss -g0
+PURGATORY_CFLAGS += -fpic -fvisibility=hidden
 PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING
 PURGATORY_CFLAGS += -fno-stack-protector
 

arch/x86/tools/relocs.c

@@ -746,6 +746,15 @@ static void walk_relocs(int (*process)(struct section *sec, Elf_Rel *rel,
 		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
 			continue;
 		}
+
+		/*
+		 * Do not perform relocations in .notes sections; any
+		 * values there are meant for pre-boot consumption (e.g.
+		 * startup_xen).
+		 */
+		if (sec_applies->shdr.sh_type == SHT_NOTE)
+			continue;
+
 		sh_symtab = sec_symtab->symtab;
 		sym_strtab = sec_symtab->link->strtab;
 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {

arch/x86/um/shared/sysdep/archsetjmp.h

@@ -1,6 +1,13 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __X86_UM_SYSDEP_ARCHSETJMP_H
+#define __X86_UM_SYSDEP_ARCHSETJMP_H
+
 #ifdef __i386__
 #include "archsetjmp_32.h"
 #else
 #include "archsetjmp_64.h"
 #endif
+
+unsigned long get_thread_reg(int reg, jmp_buf *buf);
+
+#endif /* __X86_UM_SYSDEP_ARCHSETJMP_H */

block/blk-core.c

@@ -942,10 +942,11 @@ void update_io_ticks(struct block_device *part, unsigned long now, bool end)
 	unsigned long stamp;
 again:
 	stamp = READ_ONCE(part->bd_stamp);
-	if (unlikely(time_after(now, stamp))) {
+	if (unlikely(time_after(now, stamp)) &&
-		if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now)))
+	    likely(try_cmpxchg(&part->bd_stamp, &stamp, now)) &&
-			__part_stat_add(part, io_ticks, end ? now - stamp : 1);
+	    (end || part_in_flight(part)))
-	}
+		__part_stat_add(part, io_ticks, now - stamp);
+
 	if (part->bd_partno) {
 		part = bdev_whole(part);
 		goto again;

block/blk-iocost.c

@@ -1331,7 +1331,7 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)
 {
 	struct ioc *ioc = iocg->ioc;
 	struct blkcg_gq *blkg = iocg_to_blkg(iocg);
-	u64 tdelta, delay, new_delay;
+	u64 tdelta, delay, new_delay, shift;
 	s64 vover, vover_pct;
 	u32 hwa;
 
@@ -1346,8 +1346,9 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)
 
 	/* calculate the current delay in effect - 1/2 every second */
 	tdelta = now->now - iocg->delay_at;
-	if (iocg->delay)
+	shift = div64_u64(tdelta, USEC_PER_SEC);
-		delay = iocg->delay >> div64_u64(tdelta, USEC_PER_SEC);
+	if (iocg->delay && shift < BITS_PER_LONG)
+		delay = iocg->delay >> shift;
 	else
 		delay = 0;
 

block/blk-merge.c

@@ -783,6 +783,8 @@ static void blk_account_io_merge_request(struct request *req)
 	if (blk_do_io_stat(req)) {
 		part_stat_lock();
 		part_stat_inc(req->part, merges[op_stat_group(req_op(req))]);
+		part_stat_local_dec(req->part,
+				    in_flight[op_is_write(req_op(req))]);
 		part_stat_unlock();
 	}
 }

block/blk-mq.c

@@ -971,17 +971,6 @@ bool blk_update_request(struct request *req, blk_status_t error,
 }
 EXPORT_SYMBOL_GPL(blk_update_request);
 
-static void __blk_account_io_done(struct request *req, u64 now)
-{
-	const int sgrp = op_stat_group(req_op(req));
-
-	part_stat_lock();
-	update_io_ticks(req->part, jiffies, true);
-	part_stat_inc(req->part, ios[sgrp]);
-	part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns);
-	part_stat_unlock();
-}
-
 static inline void blk_account_io_done(struct request *req, u64 now)
 {
 	/*
@@ -990,32 +979,39 @@ static inline void blk_account_io_done(struct request *req, u64 now)
 	 * containing request is enough.
 	 */
 	if (blk_do_io_stat(req) && req->part &&
-	    !(req->rq_flags & RQF_FLUSH_SEQ))
+	    !(req->rq_flags & RQF_FLUSH_SEQ)) {
-		__blk_account_io_done(req, now);
+		const int sgrp = op_stat_group(req_op(req));
-}
 
-static void __blk_account_io_start(struct request *rq)
+		part_stat_lock();
-{
+		update_io_ticks(req->part, jiffies, true);
-	/*
+		part_stat_inc(req->part, ios[sgrp]);
-	 * All non-passthrough requests are created from a bio with one
+		part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns);
-	 * exception: when a flush command that is part of a flush sequence
+		part_stat_local_dec(req->part,
-	 * generated by the state machine in blk-flush.c is cloned onto the
+				    in_flight[op_is_write(req_op(req))]);
-	 * lower device by dm-multipath we can get here without a bio.
+		part_stat_unlock();
-	 */
+	}
-	if (rq->bio)
-		rq->part = rq->bio->bi_bdev;
-	else
-		rq->part = rq->q->disk->part0;
-
-	part_stat_lock();
-	update_io_ticks(rq->part, jiffies, false);
-	part_stat_unlock();
 }
 
 static inline void blk_account_io_start(struct request *req)
 {
-	if (blk_do_io_stat(req))
+	if (blk_do_io_stat(req)) {
-		__blk_account_io_start(req);
+		/*
+		 * All non-passthrough requests are created from a bio with one
+		 * exception: when a flush command that is part of a flush sequence
+		 * generated by the state machine in blk-flush.c is cloned onto the
+		 * lower device by dm-multipath we can get here without a bio.
+		 */
+		if (req->bio)
+			req->part = req->bio->bi_bdev;
+		else
+			req->part = req->q->disk->part0;
+
+		part_stat_lock();
+		update_io_ticks(req->part, jiffies, false);
+		part_stat_local_inc(req->part,
+				    in_flight[op_is_write(req_op(req))]);
+		part_stat_unlock();
+	}
 }
 
 static inline void __blk_mq_end_request_acct(struct request *rq, u64 now)

block/blk.h

@@ -373,6 +373,7 @@ static inline bool blk_do_io_stat(struct request *rq)
 }
 
 void update_io_ticks(struct block_device *part, unsigned long now, bool end);
+unsigned int part_in_flight(struct block_device *part);
 
 static inline void req_set_nomerge(struct request_queue *q, struct request *req)
 {

block/genhd.c

@@ -125,7 +125,7 @@ static void part_stat_read_all(struct block_device *part,
 	}
 }
 
-static unsigned int part_in_flight(struct block_device *part)
+unsigned int part_in_flight(struct block_device *part)
 {
 	unsigned int inflight = 0;
 	int cpu;

block/ioctl.c

@@ -89,7 +89,7 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode,
 		unsigned long arg)
 {
 	uint64_t range[2];
-	uint64_t start, len;
+	uint64_t start, len, end;
 	struct inode *inode = bdev->bd_inode;
 	int err;
 
@@ -110,7 +110,8 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode,
 	if (len & 511)
 		return -EINVAL;
 
-	if (start + len > bdev_nr_bytes(bdev))
+	if (check_add_overflow(start, len, &end) ||
+	    end > bdev_nr_bytes(bdev))
 		return -EINVAL;
 
 	filemap_invalidate_lock(inode->i_mapping);

crypto/asymmetric_keys/Kconfig

@@ -84,5 +84,7 @@ config FIPS_SIGNATURE_SELFTEST
 	depends on KEYS
 	depends on ASYMMETRIC_KEY_TYPE
 	depends on PKCS7_MESSAGE_PARSER
+	depends on CRYPTO_RSA
+	depends on CRYPTO_SHA256
 
 endif # ASYMMETRIC_KEY_TYPE

drivers/accessibility/speakup/main.c

@@ -573,7 +573,7 @@ static u_long get_word(struct vc_data *vc)
 	}
 	attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr);
 	buf[cnt++] = attr_ch;
-	while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) {
+	while (tmpx < vc->vc_cols - 1 && cnt < ARRAY_SIZE(buf) - 1) {
 		tmp_pos += 2;
 		tmpx++;
 		ch = get_char(vc, (u_short *)tmp_pos, &temp);

drivers/acpi/acpi_lpss.c

@@ -319,6 +319,7 @@ static const struct lpss_device_desc bsw_i2c_dev_desc = {
 
 static const struct property_entry bsw_spi_properties[] = {
 	PROPERTY_ENTRY_U32("intel,spi-pxa2xx-type", LPSS_BSW_SSP),
+	PROPERTY_ENTRY_U32("num-cs", 2),
 	{ }
 };
 

drivers/acpi/acpica/Makefile

@@ -5,6 +5,7 @@
 
 ccflags-y			:= -D_LINUX -DBUILDING_ACPICA
 ccflags-$(CONFIG_ACPI_DEBUG)	+= -DACPI_DEBUG_OUTPUT
+CFLAGS_tbfind.o 		+= $(call cc-disable-warning, stringop-truncation)
 
 # use acpi.o to put all files here into acpi.o modparam namespace
 obj-y	+= acpi.o

drivers/acpi/numa/srat.c

@@ -206,6 +206,11 @@ int __init srat_disabled(void)
 	return acpi_numa < 0;
 }
 
+__weak int __init numa_fill_memblks(u64 start, u64 end)
+{
+	return NUMA_NO_MEMBLK;
+}
+
 #if defined(CONFIG_X86) || defined(CONFIG_ARM64) || defined(CONFIG_LOONGARCH)
 /*
  * Callback for SLIT parsing.  pxm_to_node() returns NUMA_NO_NODE for

drivers/ata/sata_gemini.c

@@ -201,7 +201,10 @@ int gemini_sata_start_bridge(struct sata_gemini *sg, unsigned int bridge)
 		pclk = sg->sata0_pclk;
 	else
 		pclk = sg->sata1_pclk;
-	clk_enable(pclk);
+	ret = clk_enable(pclk);
+	if (ret)
+		return ret;
+
 	msleep(10);
 
 	/* Do not keep clocking a bridge that is not online */

drivers/block/null_blk/main.c

@@ -2311,10 +2311,13 @@ static void __exit null_exit(void)
 
 	if (g_queue_mode == NULL_Q_MQ && shared_tags)
 		blk_mq_free_tag_set(&tag_set);
+
+	mutex_destroy(&lock);
 }
 
 module_init(null_init);
 module_exit(null_exit);
 
 MODULE_AUTHOR("Jens Axboe <axboe@kernel.dk>");
+MODULE_DESCRIPTION("multi queue aware block test driver");
 MODULE_LICENSE("GPL");