Merge branch 'android14-6.1' into branch 'android14-6.1-lts'

Sync up the android14-6.1-lts branch with recent android14-6.1 changes.
This includes the following commits:

* 74c507aab1 UPSTREAM: USB: gadget: core: create sysfs link between udc and gadget
* 92704e00b5 ANDROID: GKI: add tegra20-cpufreq.ko to rockpi4 build
* 8498700531 ANDROID: GKI: update symbol list for db845c
* 1e4532a4a3 ANDROID: Build some tegra configs as vendor module
* 974a6f430e ANDROID: gki_defconfig: Enable Tegra SoCs
* 6b75fd4835 ANDROID: Update the ABI symbol list
* c6427490ab Revert^2 "BACKPORT: FROMGIT: module: allow UNUSED_KSYMS_WHITELIST ..."
* 87a4e67740 Merge tag 'android14-6.1.78_r00' into branch android14-6.1
* a6358098da ANDROID: binder: fix KMI-break due to alloc->lock
* 1c5fb0ebd8 ANDROID: binder: fix ptrdiff_t printk-format issue
* d30de4c7b0 ANDROID: binder: fix KMI-break due to address type change
* 81054a4507 Reapply "ANDROID: vendor_hooks: Add hook for binder_detect_low_async_space"
* 7e855d1492 Reapply "ANDROID: Add vendor hooks for binder perf tuning"
* a091f9709e UPSTREAM: binder: switch alloc->mutex to spinlock_t
* a4abaacdab UPSTREAM: binder: reverse locking order in shrinker callback
* 112ca28d26 UPSTREAM: binder: avoid user addresses in debug logs
* 0402339efb UPSTREAM: binder: refactor binder_delete_free_buffer()
* aacaa36eaa UPSTREAM: binder: collapse print_binder_buffer() into caller
* baef4637fc UPSTREAM: binder: document the final page calculation
* 19d966c1c6 BACKPORT: UPSTREAM: binder: rename lru shrinker utilities
* aac2b2c731 UPSTREAM: binder: make oversized buffer code more readable
* de86cd1e00 UPSTREAM: binder: remove redundant debug log
* 78dfa69547 UPSTREAM: binder: perform page installation outside of locks
* 2b6af2f338 UPSTREAM: binder: initialize lru pages in mmap callback
* 48554214a7 UPSTREAM: binder: malloc new_buffer outside of locks
* 796a1cae7b UPSTREAM: binder: refactor page range allocation
* 568a63be9a UPSTREAM: binder: relocate binder_alloc_clear_buf()
* e4ee73a682 UPSTREAM: binder: relocate low space calculation
* 919daae2b6 UPSTREAM: binder: separate the no-space debugging logic
* a37caf8d4c UPSTREAM: binder: remove pid param in binder_alloc_new_buf()
* a880c450b7 UPSTREAM: binder: do unlocked work in binder_alloc_new_buf()
* e5fae62ffb UPSTREAM: binder: split up binder_update_page_range()
* b66dacff3d UPSTREAM: binder: keep vma addresses type as unsigned long
* 8b2c4f7ab3 UPSTREAM: binder: remove extern from function prototypes
* 6a29f5fb4b Revert "ANDROID: Add vendor hooks for binder perf tuning"
* 9e2c184da1 Revert "ANDROID: vendor_hooks: Add hook for binder_detect_low_async_space_locked"
* 6c17e786e7 Revert "ANDROID: vendor_hook: rename the the name of hooks"
* dd875b6366 ANDROID: GKI: Update rockchip symbols for some usb wifi bt.
* d3c340f987 UPSTREAM: selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
* e302f3a21b ANDROID: incremental-fs: Make work with 16k pages
* 3f13972470 Revert "BACKPORT: FROMGIT: module: allow UNUSED_KSYMS_WHITELIST ..."
* 29f2af3ce7 BACKPORT: FROMGIT: module: allow UNUSED_KSYMS_WHITELIST to be relative against objtree.
* 6820762b5e FROMLIST: kheaders: explicitly define file modes for archived headers
* 47a00e599b ANDROID: pahole -J -j1 for reproducible BTF
* 68c821783c UPSTREAM: epoll: be better about file lifetimes
* 84574a4ee9 FROMLIST: usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
* 2755f25d0c UPSTREAM: usb: gadget: ncm: Fix handling of zero block length packets

Change-Id: I7db1d28fffc94dff8549e532e204253528c26bb5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

BUILD.bazel

@@ -586,6 +586,7 @@ _ROCKPI4_MODULE_OUTS = [
     "drivers/char/hw_random/virtio-rng.ko",
     "drivers/clk/clk-rk808.ko",
     "drivers/cpufreq/cpufreq-dt.ko",
+    "drivers/cpufreq/tegra20-cpufreq.ko",
     "drivers/dma/pl330.ko",
     "drivers/gpu/drm/bridge/analogix/analogix_dp.ko",
     "drivers/gpu/drm/bridge/synopsys/dw-hdmi.ko",

android/abi_gki_aarch64_db845c

@@ -865,6 +865,7 @@
   device_get_dma_attr
   device_match_fwnode
   devm_krealloc
+  devm_tegra_memory_controller_get
   driver_find_device
   generic_device_group
   iommu_alloc_resv_region
@@ -881,6 +882,7 @@
   pci_device_group
   platform_irq_count
   report_iommu_fault
+  tegra_mc_probe_device
 
 # required by ath10k_core.ko
   cpu_latency_qos_add_request

android/abi_gki_aarch64_pixel

@@ -82,6 +82,7 @@
   __bitmap_or
   bitmap_parse
   bitmap_parselist
+  bitmap_parse_user
   bitmap_print_to_pagebuf
   __bitmap_set
   __bitmap_subset

android/abi_gki_aarch64_rockchip

@@ -2995,3 +2995,10 @@
 
 # required by vl6180.ko
   iio_read_const_attr
+
+# required by aic_btusb.ko
+  usb_disable_autosuspend
+
+# required by wlan_mt7663_usb.ko
+  usb_anchor_empty
+  usb_reset_endpoint

arch/arm64/configs/gki_defconfig

@@ -48,6 +48,7 @@ CONFIG_PROFILING=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_ARCH_HISI=y
 CONFIG_ARCH_QCOM=y
+CONFIG_ARCH_TEGRA=y
 CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=32
 CONFIG_PARAVIRT_TIME_ACCOUNTING=y
@@ -57,6 +58,7 @@ CONFIG_ARMV8_DEPRECATED=y
 CONFIG_SWP_EMULATION=y
 CONFIG_CP15_BARRIER_EMULATION=y
 CONFIG_SETEND_EMULATION=y
+CONFIG_ARM64_PMEM=y
 # CONFIG_ARM64_BTI_KERNEL is not set
 CONFIG_RANDOMIZE_BASE=y
 # CONFIG_RANDOMIZE_MODULE_REGION_FULL is not set
@@ -399,6 +401,7 @@ CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_SAMSUNG=y
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
+CONFIG_SERIAL_TEGRA_TCU=y
 CONFIG_SERIAL_QCOM_GENI=y
 CONFIG_SERIAL_QCOM_GENI_CONSOLE=y
 CONFIG_SERIAL_SPRD=y
@@ -569,22 +572,22 @@ CONFIG_COMMON_CLK_SCPI=y
 # CONFIG_SUNXI_CCU is not set
 CONFIG_HWSPINLOCK=y
 # CONFIG_SUN50I_ERRATUM_UNKNOWN1 is not set
-CONFIG_MAILBOX=y
 CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
 CONFIG_REMOTEPROC=y
 CONFIG_REMOTEPROC_CDEV=y
 CONFIG_RPMSG_CHAR=y
 CONFIG_QCOM_GENI_SE=y
+CONFIG_ARCH_TEGRA_234_SOC=y
 CONFIG_DEVFREQ_GOV_PERFORMANCE=y
 CONFIG_DEVFREQ_GOV_POWERSAVE=y
 CONFIG_DEVFREQ_GOV_USERSPACE=y
 CONFIG_DEVFREQ_GOV_PASSIVE=y
 CONFIG_PM_DEVFREQ_EVENT=y
+CONFIG_MEMORY=y
 CONFIG_IIO=y
 CONFIG_IIO_BUFFER=y
 CONFIG_IIO_TRIGGER=y
 CONFIG_PWM=y
-CONFIG_GENERIC_PHY=y
 CONFIG_POWERCAP=y
 CONFIG_IDLE_INJECT=y
 CONFIG_ANDROID_BINDER_IPC=y
@@ -593,7 +596,6 @@ CONFIG_ANDROID_DEBUG_SYMBOLS=y
 CONFIG_ANDROID_VENDOR_HOOKS=y
 CONFIG_ANDROID_DEBUG_KINFO=y
 CONFIG_LIBNVDIMM=y
-CONFIG_INTERCONNECT=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y

drivers/amba/Kconfig

@@ -6,7 +6,6 @@ if ARM_AMBA
 
 config TEGRA_AHB
 	bool
-	default y if ARCH_TEGRA
 	help
 	  Adds AHB configuration functionality for NVIDIA Tegra SoCs,
 	  which controls AHB bus master arbitration and some performance

drivers/android/binder.c

@@ -3458,7 +3458,7 @@ static void binder_transaction(struct binder_proc *proc,
 
 	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
 		tr->offsets_size, extra_buffers_size,
-		!reply && (t->flags & TF_ONE_WAY), current->tgid);
+		!reply && (t->flags & TF_ONE_WAY));
 	if (IS_ERR(t->buffer)) {
 		char *s;
 
@@ -5165,6 +5165,7 @@ static struct binder_thread *binder_get_thread(struct binder_proc *proc)
 
 static void binder_free_proc(struct binder_proc *proc)
 {
+	struct binder_proc_wrap *proc_wrap;
 	struct binder_device *device;
 
 	BUG_ON(!list_empty(&proc->todo));
@@ -5182,7 +5183,8 @@ static void binder_free_proc(struct binder_proc *proc)
 	put_cred(proc->cred);
 	binder_stats_deleted(BINDER_STAT_PROC);
 	trace_android_vh_binder_free_proc(proc);
-	kfree(proc);
+	proc_wrap = binder_proc_wrap_entry(proc);
+	kfree(proc_wrap);
 }
 
 static void binder_free_thread(struct binder_thread *thread)
@@ -5888,6 +5890,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 
 static int binder_open(struct inode *nodp, struct file *filp)
 {
+	struct binder_proc_wrap *proc_wrap;
 	struct binder_proc *proc, *itr;
 	struct binder_device *binder_dev;
 	struct binderfs_info *info;
@@ -5897,9 +5900,11 @@ static int binder_open(struct inode *nodp, struct file *filp)
 	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
 		     current->group_leader->pid, current->pid);
 
-	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
+	proc_wrap = kzalloc(sizeof(*proc_wrap), GFP_KERNEL);
-	if (proc == NULL)
+	if (proc_wrap == NULL)
 		return -ENOMEM;
+	proc = &proc_wrap->proc;
+
 	spin_lock_init(&proc->inner_lock);
 	spin_lock_init(&proc->outer_lock);
 	get_task_struct(current->group_leader);
@@ -6266,9 +6271,9 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
 	}
 	if (buffer->target_node)
 		seq_printf(m, " node %d", buffer->target_node->debug_id);
-	seq_printf(m, " size %zd:%zd data %pK\n",
+	seq_printf(m, " size %zd:%zd offset %tx\n",
 		   buffer->data_size, buffer->offsets_size,
-		   buffer->user_data);
+		   proc->alloc.buffer - buffer->user_data);
 }
 
 static void print_binder_work_ilocked(struct seq_file *m,

drivers/android/binder_alloc.h

@@ -15,7 +15,7 @@
 #include <linux/list_lru.h>
 #include <uapi/linux/android/binder.h>
 
-extern struct list_lru binder_alloc_lru;
+extern struct list_lru binder_freelist;
 struct binder_transaction;
 
 /**
@@ -49,21 +49,19 @@ struct binder_buffer {
 	unsigned async_transaction:1;
 	unsigned oneway_spam_suspect:1;
 	unsigned debug_id:27;
-
 	struct binder_transaction *transaction;
-
 	struct binder_node *target_node;
 	size_t data_size;
 	size_t offsets_size;
 	size_t extra_buffers_size;
 	void __user *user_data;
-	int    pid;
+	int pid;
 };
 
 /**
  * struct binder_lru_page - page object used for binder shrinker
  * @page_ptr: pointer to physical page in mmap'd space
- * @lru:      entry in binder_alloc_lru
+ * @lru:      entry in binder_freelist
  * @alloc:    binder_alloc for a proc
  */
 struct binder_lru_page {
@@ -74,7 +72,7 @@ struct binder_lru_page {
 
 /**
  * struct binder_alloc - per-binder proc state for binder allocator
- * @mutex:              protects binder_alloc fields
+ * @lock:               protects binder_alloc fields
  * @vma:                vm_area_struct passed to mmap_handler
  *                      (invariant after mmap)
  * @mm:                 copy of task->mm (invariant after open)
@@ -121,47 +119,29 @@ static inline void binder_selftest_alloc(struct binder_alloc *alloc) {}
 enum lru_status binder_alloc_free_page(struct list_head *item,
 				       struct list_lru_one *lru,
 				       spinlock_t *lock, void *cb_arg);
-extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
+struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
-						  size_t data_size,
+					   size_t data_size,
-						  size_t offsets_size,
+					   size_t offsets_size,
-						  size_t extra_buffers_size,
+					   size_t extra_buffers_size,
-						  int is_async,
+					   int is_async);
-						  int pid);
+void binder_alloc_init(struct binder_alloc *alloc);
-extern void binder_alloc_init(struct binder_alloc *alloc);
+int binder_alloc_shrinker_init(void);
-extern int binder_alloc_shrinker_init(void);
+void binder_alloc_shrinker_exit(void);
-extern void binder_alloc_shrinker_exit(void);
+void binder_alloc_vma_close(struct binder_alloc *alloc);
-extern void binder_alloc_vma_close(struct binder_alloc *alloc);
+struct binder_buffer *
-extern struct binder_buffer *
 binder_alloc_prepare_to_free(struct binder_alloc *alloc,
-			     uintptr_t user_ptr);
+			     unsigned long user_ptr);
-extern void binder_alloc_free_buf(struct binder_alloc *alloc,
+void binder_alloc_free_buf(struct binder_alloc *alloc,
-				  struct binder_buffer *buffer);
+			   struct binder_buffer *buffer);
-extern int binder_alloc_mmap_handler(struct binder_alloc *alloc,
+int binder_alloc_mmap_handler(struct binder_alloc *alloc,
-				     struct vm_area_struct *vma);
+			      struct vm_area_struct *vma);
-extern void binder_alloc_deferred_release(struct binder_alloc *alloc);
+void binder_alloc_deferred_release(struct binder_alloc *alloc);
-extern int binder_alloc_get_allocated_count(struct binder_alloc *alloc);
+int binder_alloc_get_allocated_count(struct binder_alloc *alloc);
-extern void binder_alloc_print_allocated(struct seq_file *m,
+void binder_alloc_print_allocated(struct seq_file *m,
-					 struct binder_alloc *alloc);
+				  struct binder_alloc *alloc);
 void binder_alloc_print_pages(struct seq_file *m,
 			      struct binder_alloc *alloc);
 
-/**
- * binder_alloc_get_free_async_space() - get free space available for async
- * @alloc:	binder_alloc for this proc
- *
- * Return:	the bytes remaining in the address-space for async transactions
- */
-static inline size_t
-binder_alloc_get_free_async_space(struct binder_alloc *alloc)
-{
-	size_t free_async_space;
-
-	mutex_lock(&alloc->mutex);
-	free_async_space = alloc->free_async_space;
-	mutex_unlock(&alloc->mutex);
-	return free_async_space;
-}
-
 unsigned long
 binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
 				 struct binder_buffer *buffer,

drivers/android/binder_alloc_selftest.c

@@ -93,14 +93,14 @@ static bool check_buffer_pages_allocated(struct binder_alloc *alloc,
 					 struct binder_buffer *buffer,
 					 size_t size)
 {
-	void __user *page_addr;
+	unsigned long page_addr;
-	void __user *end;
+	unsigned long end;
 	int page_index;
 
-	end = (void __user *)PAGE_ALIGN((uintptr_t)buffer->user_data + size);
+	end = PAGE_ALIGN((uintptr_t)buffer->user_data + size);
-	page_addr = buffer->user_data;
+	page_addr = (uintptr_t)buffer->user_data;
 	for (; page_addr < end; page_addr += PAGE_SIZE) {
-		page_index = (page_addr - alloc->buffer) / PAGE_SIZE;
+		page_index = (page_addr - (uintptr_t)alloc->buffer) / PAGE_SIZE;
 		if (!alloc->pages[page_index].page_ptr ||
 		    !list_empty(&alloc->pages[page_index].lru)) {
 			pr_err("expect alloc but is %s at page index %d\n",
@@ -119,7 +119,7 @@ static void binder_selftest_alloc_buf(struct binder_alloc *alloc,
 	int i;
 
 	for (i = 0; i < BUFFER_NUM; i++) {
-		buffers[i] = binder_alloc_new_buf(alloc, sizes[i], 0, 0, 0, 0);
+		buffers[i] = binder_alloc_new_buf(alloc, sizes[i], 0, 0, 0);
 		if (IS_ERR(buffers[i]) ||
 		    !check_buffer_pages_allocated(alloc, buffers[i],
 						  sizes[i])) {
@@ -158,8 +158,8 @@ static void binder_selftest_free_page(struct binder_alloc *alloc)
 	int i;
 	unsigned long count;
 
-	while ((count = list_lru_count(&binder_alloc_lru))) {
+	while ((count = list_lru_count(&binder_freelist))) {
-		list_lru_walk(&binder_alloc_lru, binder_alloc_free_page,
+		list_lru_walk(&binder_freelist, binder_alloc_free_page,
 			      NULL, count);
 	}
 
@@ -183,7 +183,7 @@ static void binder_selftest_alloc_free(struct binder_alloc *alloc,
 
 	/* Allocate from lru. */
 	binder_selftest_alloc_buf(alloc, buffers, sizes, seq);
-	if (list_lru_count(&binder_alloc_lru))
+	if (list_lru_count(&binder_freelist))
 		pr_err("lru list should be empty but is not\n");
 
 	binder_selftest_free_buf(alloc, buffers, sizes, seq, end);

drivers/android/binder_internal.h

@@ -461,6 +461,66 @@ struct binder_proc {
 	bool oneway_spam_detection_enabled;
 };
 
+struct binder_proc_wrap {
+	struct binder_proc proc;
+	spinlock_t lock;
+};
+
+static inline struct binder_proc *
+binder_proc_entry(struct binder_alloc *alloc)
+{
+	return container_of(alloc, struct binder_proc, alloc);
+}
+
+static inline struct binder_proc_wrap *
+binder_proc_wrap_entry(struct binder_proc *proc)
+{
+	return container_of(proc, struct binder_proc_wrap, proc);
+}
+
+static inline struct binder_proc_wrap *
+binder_alloc_to_proc_wrap(struct binder_alloc *alloc)
+{
+	return binder_proc_wrap_entry(binder_proc_entry(alloc));
+}
+
+static inline void binder_alloc_lock_init(struct binder_alloc *alloc)
+{
+	spin_lock_init(&binder_alloc_to_proc_wrap(alloc)->lock);
+}
+
+static inline void binder_alloc_lock(struct binder_alloc *alloc)
+{
+	spin_lock(&binder_alloc_to_proc_wrap(alloc)->lock);
+}
+
+static inline void binder_alloc_unlock(struct binder_alloc *alloc)
+{
+	spin_unlock(&binder_alloc_to_proc_wrap(alloc)->lock);
+}
+
+static inline int binder_alloc_trylock(struct binder_alloc *alloc)
+{
+	return spin_trylock(&binder_alloc_to_proc_wrap(alloc)->lock);
+}
+
+/**
+ * binder_alloc_get_free_async_space() - get free space available for async
+ * @alloc:	binder_alloc for this proc
+ *
+ * Return:	the bytes remaining in the address-space for async transactions
+ */
+static inline size_t
+binder_alloc_get_free_async_space(struct binder_alloc *alloc)
+{
+	size_t free_async_space;
+
+	binder_alloc_lock(alloc);
+	free_async_space = alloc->free_async_space;
+	binder_alloc_unlock(alloc);
+	return free_async_space;
+}
+
 /**
  * struct binder_thread - binder thread bookkeeping
  * @proc:                 binder process for this thread

drivers/android/binder_trace.h

@@ -341,7 +341,7 @@ DEFINE_EVENT(binder_buffer_class, binder_transaction_update_buffer_release,
 
 TRACE_EVENT(binder_update_page_range,
 	TP_PROTO(struct binder_alloc *alloc, bool allocate,
-		 void __user *start, void __user *end),
+		 unsigned long start, unsigned long end),
 	TP_ARGS(alloc, allocate, start, end),
 	TP_STRUCT__entry(
 		__field(int, proc)
@@ -352,7 +352,7 @@ TRACE_EVENT(binder_update_page_range,
 	TP_fast_assign(
 		__entry->proc = alloc->pid;
 		__entry->allocate = allocate;
-		__entry->offset = start - alloc->buffer;
+		__entry->offset = start - (uintptr_t)alloc->buffer;
 		__entry->size = end - start;
 	),
 	TP_printk("proc=%d allocate=%d offset=%zu size=%zu",

drivers/gpio/Kconfig

@@ -633,7 +633,6 @@ config GPIO_TB10X
 
 config GPIO_TEGRA
 	tristate "NVIDIA Tegra GPIO support"
-	default ARCH_TEGRA
 	depends on ARCH_TEGRA || COMPILE_TEST
 	depends on OF_GPIO
 	select GPIOLIB_IRQCHIP

drivers/i2c/busses/Kconfig

@@ -1121,7 +1121,6 @@ config I2C_TEGRA
 config I2C_TEGRA_BPMP
 	tristate "NVIDIA Tegra BPMP I2C controller"
 	depends on TEGRA_BPMP || COMPILE_TEST
-	default y if TEGRA_BPMP
 	help
 	  If you say yes to this option, support will be included for the I2C
 	  controller embedded in NVIDIA Tegra SoCs accessed via the BPMP.

drivers/tty/serial/8250/Kconfig

@@ -522,7 +522,6 @@ config SERIAL_8250_PXA
 
 config SERIAL_8250_TEGRA
 	tristate "8250 support for Tegra serial ports"
-	default SERIAL_8250
 	depends on SERIAL_8250
 	depends on ARCH_TEGRA || COMPILE_TEST
 	help

drivers/usb/gadget/udc/core.c

@@ -1394,8 +1394,16 @@ int usb_add_gadget(struct usb_gadget *gadget)
 	if (ret)
 		goto err_free_id;
 
+	ret = sysfs_create_link(&udc->dev.kobj,
+				&gadget->dev.kobj, "gadget");
+	if (ret)
+		goto err_del_gadget;
+
 	return 0;
 
+ err_del_gadget:
+	device_del(&gadget->dev);
+
  err_free_id:
 	ida_free(&gadget_id_numbers, gadget->id_number);
 
@@ -1504,6 +1512,7 @@ void usb_del_gadget(struct usb_gadget *gadget)
 	mutex_unlock(&udc_lock);
 
 	kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
+	sysfs_remove_link(&udc->dev.kobj, "gadget");
 	flush_work(&gadget->work);
 	device_del(&gadget->dev);
 	ida_free(&gadget_id_numbers, gadget->id_number);

drivers/usb/typec/tcpm/tcpm.c

@@ -5467,6 +5467,7 @@ static void _tcpm_pd_hard_reset(struct tcpm_port *port)
 		port->tcpc->set_bist_data(port->tcpc, false);
 
 	switch (port->state) {
+	case TOGGLING:
 	case ERROR_RECOVERY:
 	case PORT_RESET:
 	case PORT_RESET_WAIT_OFF:

fs/eventpoll.c

@@ -878,6 +878,34 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep
 	return res;
 }
 
+/*
+ * The ffd.file pointer may be in the process of being torn down due to
+ * being closed, but we may not have finished eventpoll_release() yet.
+ *
+ * Normally, even with the atomic_long_inc_not_zero, the file may have
+ * been free'd and then gotten re-allocated to something else (since
+ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU).
+ *
+ * But for epoll, users hold the ep->mtx mutex, and as such any file in
+ * the process of being free'd will block in eventpoll_release_file()
+ * and thus the underlying file allocation will not be free'd, and the
+ * file re-use cannot happen.
+ *
+ * For the same reason we can avoid a rcu_read_lock() around the
+ * operation - 'ffd.file' cannot go away even if the refcount has
+ * reached zero (but we must still not call out to ->poll() functions
+ * etc).
+ */
+static struct file *epi_fget(const struct epitem *epi)
+{
+	struct file *file;
+
+	file = epi->ffd.file;
+	if (!atomic_long_inc_not_zero(&file->f_count))
+		file = NULL;
+	return file;
+}
+
 /*
  * Differs from ep_eventpoll_poll() in that internal callers already have
  * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested()
@@ -886,14 +914,22 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep
 static __poll_t ep_item_poll(const struct epitem *epi, poll_table *pt,
 				 int depth)
 {
-	struct file *file = epi->ffd.file;
+	struct file *file = epi_fget(epi);
 	__poll_t res;
 
+	/*
+	 * We could return EPOLLERR | EPOLLHUP or something, but let's
+	 * treat this more as "file doesn't exist, poll didn't happen".
+	 */
+	if (!file)
+		return 0;
+
 	pt->_key = epi->event.events;
 	if (!is_file_epoll(file))
 		res = vfs_poll(file, pt);
 	else
 		res = __ep_eventpoll_poll(file, pt, depth);
+	fput(file);
 	return res & epi->event.events;
 }
 

fs/incfs/pseudo_files.c

@@ -1073,7 +1073,7 @@ static ssize_t log_read(struct file *f, char __user *buf, size_t len,
 	int rl_size;
 	ssize_t result = 0;
 	bool report_uid;
-	unsigned long page = 0;
+	void *page = 0;
 	struct incfs_pending_read_info *reads_buf = NULL;
 	struct incfs_pending_read_info2 *reads_buf2 = NULL;
 	size_t record_size;
@@ -1086,13 +1086,13 @@ static ssize_t log_read(struct file *f, char __user *buf, size_t len,
 	report_uid = mi->mi_options.report_uid;
 	record_size = report_uid ? sizeof(*reads_buf2) : sizeof(*reads_buf);
 	reads_to_collect = len / record_size;
-	reads_per_page = PAGE_SIZE / record_size;
+	reads_per_page = INCFS_DATA_FILE_BLOCK_SIZE / record_size;
 
 	rl_size = READ_ONCE(mi->mi_log.rl_size);
 	if (rl_size == 0)
 		return 0;
 
-	page = __get_free_page(GFP_NOFS);
+	page = kzalloc(INCFS_DATA_FILE_BLOCK_SIZE, GFP_NOFS);
 	if (!page)
 		return -ENOMEM;
 
@@ -1116,7 +1116,7 @@ static ssize_t log_read(struct file *f, char __user *buf, size_t len,
 				       reads_collected;
 			goto out;
 		}
-		if (copy_to_user(buf, (void *)page,
+		if (copy_to_user(buf, page,
 				 reads_collected * record_size)) {
 			result = total_reads_collected ?
 				       total_reads_collected * record_size :
@@ -1133,7 +1133,7 @@ static ssize_t log_read(struct file *f, char __user *buf, size_t len,
 	result = total_reads_collected * record_size;
 	*ppos = 0;
 out:
-	free_page(page);
+	kfree(page);
 	return result;
 }
 

fs/incfs/verity.c

@@ -303,8 +303,8 @@ static int incfs_build_merkle_tree(struct file *f, struct data_file *df,
 	struct mem_range buf = {.len = INCFS_DATA_FILE_BLOCK_SIZE};
 	struct mem_range tmp = {.len = 2 * INCFS_DATA_FILE_BLOCK_SIZE};
 
-	buf.data = (u8 *)__get_free_pages(GFP_NOFS, get_order(buf.len));
+	buf.data = (u8 *)kzalloc(buf.len, GFP_NOFS);
-	tmp.data = (u8 *)__get_free_pages(GFP_NOFS, get_order(tmp.len));
+	tmp.data = (u8 *)kzalloc(tmp.len, GFP_NOFS);
 	if (!buf.data || !tmp.data) {
 		error = -ENOMEM;
 		goto out;
@@ -372,8 +372,8 @@ static int incfs_build_merkle_tree(struct file *f, struct data_file *df,
 	}
 
 out:
-	free_pages((unsigned long)tmp.data, get_order(tmp.len));
+	kfree(tmp.data);
-	free_pages((unsigned long)buf.data, get_order(buf.len));
+	kfree(buf.data);
 	return error;
 }
 

fs/incfs/vfs.c

@@ -541,13 +541,15 @@ static int read_folio(struct file *f, struct folio *folio)
 	struct page *page = &folio->page;
 	loff_t offset = 0;
 	loff_t size = 0;
-	ssize_t bytes_to_read = 0;
+	ssize_t total_read = 0;
-	ssize_t read_result = 0;
 	struct data_file *df = get_incfs_data_file(f);
 	int result = 0;
 	void *page_start;
 	int block_index;
 	unsigned int delayed_min_us = 0;
+	struct mem_range tmp = {
+		.len = 2 * INCFS_DATA_FILE_BLOCK_SIZE
+	};
 
 	if (!df) {
 		SetPageError(page);
@@ -561,32 +563,39 @@ static int read_folio(struct file *f, struct folio *folio)
 		INCFS_DATA_FILE_BLOCK_SIZE;
 	size = df->df_size;
 
-	if (offset < size) {
+	tmp.data = kzalloc(tmp.len, GFP_NOFS);
-		struct mem_range tmp = {
+	if (!tmp.data) {
-			.len = 2 * INCFS_DATA_FILE_BLOCK_SIZE
+		result = -ENOMEM;
-		};
+		goto err;
-		tmp.data = (u8 *)__get_free_pages(GFP_NOFS, get_order(tmp.len));
-		if (!tmp.data) {
-			read_result = -ENOMEM;
-			goto err;
-		}
-		bytes_to_read = min_t(loff_t, size - offset, PAGE_SIZE);
-
-		read_result = read_single_page_timeouts(df, f, block_index,
-					range(page_start, bytes_to_read), tmp,
-					&delayed_min_us);
-
-		free_pages((unsigned long)tmp.data, get_order(tmp.len));
-	} else {
-		bytes_to_read = 0;
-		read_result = 0;
 	}
 
+	while (offset + total_read < size) {
+		ssize_t bytes_to_read = min_t(loff_t,
+					      size - offset - total_read,
+					      INCFS_DATA_FILE_BLOCK_SIZE);
+
+		result = read_single_page_timeouts(df, f, block_index,
+				range(page_start + total_read, bytes_to_read),
+				tmp, &delayed_min_us);
+		if (result < 0)
+			break;
+
+		total_read += result;
+		block_index++;
+
+		if (result < INCFS_DATA_FILE_BLOCK_SIZE)
+			break;
+		if (total_read == PAGE_SIZE)
+			break;
+	}
+	kfree(tmp.data);
 err:
-	if (read_result < 0)
+	if (result < 0)
-		result = read_result;
+		total_read = 0;
-	else if (read_result < PAGE_SIZE)
+	else
-		zero_user(page, read_result, PAGE_SIZE - read_result);
+		result = 0;
+	if (total_read < PAGE_SIZE)
+		zero_user(page, total_read, PAGE_SIZE - total_read);
 
 	if (result == 0)
 		SetPageUptodate(page);
@@ -770,8 +779,7 @@ static long ioctl_fill_blocks(struct file *f, void __user *arg)
 		return -EFAULT;
 
 	usr_fill_block_array = u64_to_user_ptr(fill_blocks.fill_blocks);
-	data_buf = (u8 *)__get_free_pages(GFP_NOFS | __GFP_COMP,
+	data_buf = (u8 *)kzalloc(data_buf_size, GFP_NOFS);
-					  get_order(data_buf_size));
 	if (!data_buf)
 		return -ENOMEM;
 
@@ -806,8 +814,7 @@ static long ioctl_fill_blocks(struct file *f, void __user *arg)
 			break;
 	}
 
-	if (data_buf)
+	kfree(data_buf);
-		free_pages((unsigned long)data_buf, get_order(data_buf_size));
 
 	if (complete)
 		handle_file_completed(f, df);
@@ -1807,8 +1814,6 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
 	sb->s_blocksize_bits = blksize_bits(sb->s_blocksize);
 	sb->s_xattr = incfs_xattr_ops;
 
-	BUILD_BUG_ON(PAGE_SIZE != INCFS_DATA_FILE_BLOCK_SIZE);
-
 	if (!dev_name) {
 		pr_err("incfs: Backing dir is not set, filesystem can't be mounted.\n");
 		error = -ENOENT;

include/trace/hooks/binder.h

@@ -82,7 +82,6 @@ DECLARE_HOOK(android_vh_binder_select_special_worklist,
 DECLARE_HOOK(android_vh_binder_alloc_new_buf_locked,
 	TP_PROTO(size_t size, size_t *free_async_space, int is_async),
 	TP_ARGS(size, free_async_space, is_async));
-
 DECLARE_HOOK(android_vh_binder_detect_low_async_space,
 	TP_PROTO(int is_async, size_t *free_async_space, int pid, bool *should_fail),
 	TP_ARGS(is_async, free_async_space, pid, should_fail));

kernel/gen_kheaders.sh

@@ -85,7 +85,7 @@ find $cpio_dir -type f -print0 |
 # pre-sorted, as --sort=name might not be available.
 find $cpio_dir -printf "./%P\n" | LC_ALL=C sort | \
     tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
-    --owner=0 --group=0 --numeric-owner --no-recursion \
+    --owner=0 --group=0 --numeric-owner --no-recursion --mode=u=rw,go=r,a+X \
     -I $XZ -cf $tarfile -C $cpio_dir/ -T - > /dev/null
 
 echo $headers_md5 > kernel/kheaders.md5

kernel/module/Kconfig

@@ -311,7 +311,7 @@ config UNUSED_KSYMS_WHITELIST
 	  exported at all times, even in absence of in-tree users. The value to
 	  set here is the path to a text file containing the list of symbols,
 	  one per line. The path can be absolute, or relative to the kernel
-	  source tree.
+	  source or obj tree.
 
 config MODULES_TREE_LOOKUP
 	def_bool y

scripts/gen_autoksyms.sh

@@ -31,7 +31,7 @@ fi
 
 ksym_wl=$(sed -n 's/^CONFIG_UNUSED_KSYMS_WHITELIST=\(.*\)$/\1/p' include/config/auto.conf)
 if [ -n "$ksym_wl" ]; then
-	[ "${ksym_wl}" != "${ksym_wl#/}" ] || ksym_wl="$abs_srctree/$ksym_wl"
+	[ "${ksym_wl}" != "${ksym_wl#/}" ] || [ -f "$ksym_wl" ] || ksym_wl="$abs_srctree/$ksym_wl"
 	if [ ! -f "$ksym_wl" ] || [ ! -r "$ksym_wl" ]; then
 		echo "ERROR: '$ksym_wl' whitelist file not found" >&2
 		exit 1

scripts/pahole-flags.sh

@@ -17,7 +17,7 @@ if [ "${pahole_ver}" -ge "121" ]; then
 	extra_paholeopt="${extra_paholeopt} --btf_gen_floats"
 fi
 if [ "${pahole_ver}" -ge "122" ]; then
-	extra_paholeopt="${extra_paholeopt} -j"
+	extra_paholeopt="${extra_paholeopt} -j1"
 fi
 if [ "${pahole_ver}" -ge "124" ]; then
 	# see PAHOLE_HAS_LANG_EXCLUDE

tools/testing/selftests/timers/valid-adjtimex.c

@@ -21,9 +21,6 @@
  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *   GNU General Public License for more details.
  */
-
-
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -62,45 +59,47 @@ int clear_time_state(void)
 #define NUM_FREQ_OUTOFRANGE 4
 #define NUM_FREQ_INVALID 2
 
+#define SHIFTED_PPM (1 << 16)
+
 long valid_freq[NUM_FREQ_VALID] = {
-	-499<<16,
+	 -499 * SHIFTED_PPM,
-	-450<<16,
+	 -450 * SHIFTED_PPM,
-	-400<<16,
+	 -400 * SHIFTED_PPM,
-	-350<<16,
+	 -350 * SHIFTED_PPM,
-	-300<<16,
+	 -300 * SHIFTED_PPM,
-	-250<<16,
+	 -250 * SHIFTED_PPM,
-	-200<<16,
+	 -200 * SHIFTED_PPM,
-	-150<<16,
+	 -150 * SHIFTED_PPM,
-	-100<<16,
+	 -100 * SHIFTED_PPM,
-	-75<<16,
+	  -75 * SHIFTED_PPM,
-	-50<<16,
+	  -50 * SHIFTED_PPM,
-	-25<<16,
+	  -25 * SHIFTED_PPM,
-	-10<<16,
+	  -10 * SHIFTED_PPM,
-	-5<<16,
+	   -5 * SHIFTED_PPM,
-	-1<<16,
+	   -1 * SHIFTED_PPM,
 	-1000,
-	1<<16,
+	    1 * SHIFTED_PPM,
-	5<<16,
+	    5 * SHIFTED_PPM,
-	10<<16,
+	   10 * SHIFTED_PPM,
-	25<<16,
+	   25 * SHIFTED_PPM,
-	50<<16,
+	   50 * SHIFTED_PPM,
-	75<<16,
+	   75 * SHIFTED_PPM,
-	100<<16,
+	  100 * SHIFTED_PPM,
-	150<<16,
+	  150 * SHIFTED_PPM,
-	200<<16,
+	  200 * SHIFTED_PPM,
-	250<<16,
+	  250 * SHIFTED_PPM,
-	300<<16,
+	  300 * SHIFTED_PPM,
-	350<<16,
+	  350 * SHIFTED_PPM,
-	400<<16,
+	  400 * SHIFTED_PPM,
-	450<<16,
+	  450 * SHIFTED_PPM,
-	499<<16,
+	  499 * SHIFTED_PPM,
 };
 
 long outofrange_freq[NUM_FREQ_OUTOFRANGE] = {
-	-1000<<16,
+	-1000 * SHIFTED_PPM,
-	-550<<16,
+	 -550 * SHIFTED_PPM,
-	550<<16,
+	  550 * SHIFTED_PPM,
-	1000<<16,
+	 1000 * SHIFTED_PPM,
 };
 
 #define LONG_MAX (~0UL>>1)