Merge tag 'android14-6.1.134_r00' into android14-6.1

This merges the android14-6.1.134_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 5a2ca52ae4 Revert "of: property: Increase NR_FWNODE_REFERENCE_ARGS"
* f6e3f07621 Revert "can: statistics: use atomic access in hot path"
*   522ff9a1db Merge 6.1.134 into android14-6.1-lts
|\
| * 4201028358 Linux 6.1.134
| * 1a84c0be74 tracing: Do not use PERF enums when perf is not defined
| * 14a6b65c83 NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
| * d96587cc93 nfsd: put dl_stid if fail to queue dl_recall
| * 30ef7cfee7 media: streamzap: fix race between device disconnection and urb callback
| * 78f06805cf jfs: add index corruption check to DT_GETPAGE()
| * 46e2c031aa jfs: fix slab-out-of-bounds read in ea_get()
| * 89503e5eae ext4: fix OOB read when checking dotdot dir
| * c07ec83be7 ext4: don't over-report free space or inodes in statvfs
| * cf18760105 arm64: Don't call NULL in do_compat_alignment_fixup()
| * 8f4d099504 tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
| * e9564aa7b8 tracing: Fix synth event printk format for str fields
| * bb9616ba5b tracing: Ensure module defining synth event cannot be unloaded while tracing
| * a2cce54c17 tracing: Fix use-after-free in print_graph_function_flags during tracer switching
| * 3ac65de111 ksmbd: validate zero num_subauth before sub_auth is accessed
| * 596407adb9 ksmbd: fix session use-after-free in multichannel connection
| * f0eb3f5751 ksmbd: fix use-after-free in ksmbd_sessions_deregister()
| * 629dd37acc ksmbd: add bounds check for create lease context
| * 8857a956f7 mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
| * 91f33558db mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
| * 0bb9c96faf ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
| * bae5b55e0f acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
| * 0708fd6bd8 x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
| * 39e32fe65e x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
| * 9c8237021b btrfs: handle errors from btrfs_dec_ref() properly
| * cacce7faa7 kunit/overflow: Fix UB in overflow_allocation_test
| * 781b2db0eb perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
| * 0a416b4c53 perf/x86/intel: Apply static call for drain_pebs
| * 5b36f9e8fa ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
| * 16d6b2527f platform/x86: ISST: Correct command storage data length
| * c498c117c4 LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
| * e9ccb262b3 LoongArch: BPF: Fix off-by-one error in build_prologue()
| * f39af67f03 LoongArch: Increase ARCH_DMA_MINALIGN up to 16
| * 0f10f83acf usbnet:fix NPE during rx_complete
| * bbadf50383 tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers
| * a824c44e4b tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32 platform
| * 0628ee3bfb drm/amdgpu/gfx11: fix num_mec
| * ddd2752899 io_uring/filetable: ensure node switch is always done, if needed
| * be8a0decd0 arcnet: Add NULL check in com20020pci_probe()
| * d10bd910d3 ipv6: Do not consider link down nexthops in path selection
| * 6d1e50a73d ipv6: Start path selection from the first nexthop
| * 21748669c5 net: fix geneve_opt length integer overflow
| * 5eaa143ba3 net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
| * b9039d61f8 ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
| * a263d31c8c netfilter: nft_tunnel: fix geneve_opt type confusion addition
| * b88786ea2c tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
| * f3b75e0a06 vsock: avoid timeout during connect() if the socket is closing
| * 9122fec396 udp: Fix memory accounting leak.
| * b3f48a41a0 net: mvpp2: Prevent parser TCAM memory corruption
| * 1dcc144c32 net_sched: skbprio: Remove overly strict queue assertions
| * 797e5371cf netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
| * 3f620f0a29 netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
| * 38253922a8 ASoC: imx-card: Add NULL check in imx_card_probe()
| * 8d78931a15 ntb: intel: Fix using link status DB's
| * 7ed22f8d8b ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
| * fb5069d017 riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
| * a333f223e5 spufs: fix a leak in spufs_create_context()
| * 880e7b3da2 spufs: fix gang directory lifetimes
| * 96de7fbdc2 spufs: fix a leak on spufs_new_file() failure
| * ad387704e9 hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
| * a8184b1930 memory: omap-gpmc: drop no compatible check
| * 4b07ce83e9 can: statistics: use atomic access in hot path
| * 1a8bae6723 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
| * e733877c5e drm/amd: Keep display off while going into S4
| * 34988d2e0c x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
| * 8630709ebd locking/semaphore: Use wake_q to wake up processes outside lock critical section
| * e73917f9e0 sched/deadline: Use online cpus for validating runtime
| * 223f2ababb ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
| * de04d49417 ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA
| * b31a7802d4 HID: i2c-hid: improve i2c_hid_get_report error message
| * 70bb0d7129 platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
| * 3f3a07fcb5 ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
| * 2dab4e83fc ALSA: hda/realtek: Fix Asus Z13 2025 audio
| * 6387243bfe affs: don't write overlarge OFS data block size fields
| * 395041688b affs: generate OFS sequence numbers starting at 1
| * 499d26188a wifi: brcmfmac: keep power during suspend if board requires it
| * ff0c8508eb nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
| * 159ef31d18 nvme-pci: clean up CMBMSC when registering CMB fails
| * 6fca3c84f1 nvme-tcp: fix possible UAF in nvme_tcp_poll
| * 157c80e4ea wifi: iwlwifi: mvm: use the right version of the rate API
| * c0a4cbdadc wifi: iwlwifi: fw: allocate chained SG tables for dump
| * c195e1eac0 rcu-tasks: Always inline rcu_irq_work_resched()
| * 4c467a4ba7 context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
| * ad05c9379b sched/smt: Always inline sched_smt_active()
| * 1e49787b45 octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
| * 013a3c7eca octeontx2-af: Fix mbox INTR handler when num VFs > 64
| * 9b435afa49 ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
| * 63d23e3976 LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
| * 6fc6fa800e ring-buffer: Fix bytes_dropped calculation issue
| * 3420c27121 net/mlx5e: SHAMPO, Make reserved size independent of page size
| * 128a0f437e ksmbd: fix multichannel connection failure
| * a6b5948682 ksmbd: use aead_request_free to match aead_request_alloc
| * 717587fbc8 rndis_host: Flag RNDIS modems as WWAN devices
| * 5fed5f6de3 rtnetlink: Allocate vfinfo size for VF GUIDs when supported
| * 83048539a7 exfat: fix the infinite loop in exfat_find_last_cluster()
| * b9249da6b0 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
| * 546685793f perf tools: annotate asm_pure_loop.S
| * 1ff7116624 fs/procfs: fix the comment above proc_pid_wchan()
| * 62f6af0a12 staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
| * c8b28c1276 perf python: Check if there is space to copy all the event
| * 5a393187e5 perf python: Don't keep a raw_data pointer to consumed ring buffer space
| * 5cf553ae38 perf python: Decrement the refcount of just created event on failure
| * e95f1c106d perf python: Fixup description of sample.id event member
| * 3d38144225 i3c: master: svc: Fix missing the IBI rules
| * b0686d0d76 um: remove copy_from_kernel_nofault_allowed
| * 142f89201e fuse: fix dax truncate/punch_hole fault path
| * a285180873 NFSv4: Don't trigger uneccessary scans for return-on-close delegations
| * a34f52b7d5 arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
| * 11e24802e7 ocfs2: validate l_tree_depth to avoid out-of-bounds access
| * 7b9d5f73e7 kexec: initialize ELF lowest address to ULONG_MAX
| * 314f8fb911 perf units: Fix insufficient array space
| * b303aff1c5 perf evlist: Add success path to evlist__create_syswide_maps
| * 7098ae7ee2 iio: adc: ad7124: Fix comparison of channel configs
| * 1a14e9718a fs/ntfs3: Fix a couple integer overflows on 32bit systems
| * 1c80787ecd usb: xhci: correct debug message page size calculation
| * 7214c53e3c iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
| * 8bd1e85254 iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
| * cb385b93c8 coresight-etm4x: add isb() before reading the TRCSTATR
| * 90b7ad7678 coresight: catu: Fix number of pages while using 64k pages
| * b0201583c1 soundwire: slave: fix an OF node reference leak in soundwire slave device
| * 46b78bf04a isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
| * be8a5aeccc clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
| * d5c51c6445 crypto: hisilicon/sec2 - fix for aead auth key length
| * d224ed6e90 x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
| * d77be51484 mfd: sm501: Switch to BIT() to mitigate integer overflows
| * f1b9566851 pinctrl: renesas: rzv2m: Fix missing of_node_put() call
| * dc7139b703 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
| * 837adafac3 crypto: nx - Fix uninitialised hv_nxc on error
| * 37a73de168 power: supply: max77693: Fix wrong conversion of charge input threshold value
| * b92e9f7565 x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
| * bb2cb55064 clk: amlogic: g12a: fix mmc A peripheral clock
| * 99db751579 selftests/bpf: Select NUMA_NO_NODE to create map
| * 6ded8c22af clk: amlogic: gxbb: drop non existing 32k clock parent
| * 1f3fc107c8 clk: amlogic: g12b: fix cluster A parent data
| * 77fedd8ae4 pinctrl: tegra: Set SFIO mode to Mux Register
| * ae450da3e9 IB/mad: Check available slots before posting receive WRs
| * 29cb659bcf remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
| * bc1db4d8f1 RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
| * 7844932c18 RDMA/mlx5: Fix calculation of total invalidated pages
| * d5212b9964 RDMA/core: Don't expose hw_counters outside of init net namespace
| * 816ce9f46d clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
| * 7c9abc455b pinctrl: renesas: rzg2l: Fix missing of_node_put() call
| * dd5c97e4ed pinctrl: renesas: rza2: Fix missing of_node_put() call
| * 5a45035b09 lib: 842: Improve error handling in sw842_compress()
| * 8c6980c96d bpf: Use preempt_count() directly in bpf_send_signal_common()
| * 119bc7ed16 clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
| * 0fef48f4a7 clk: samsung: Fix UBSAN panic in samsung_clk_init()
| * 54380eea1f selftests/bpf: Fix string read in strncmp benchmark
| * 0144376d20 libbpf: Fix hypothetical STT_SECTION extern NULL deref case
| * 43ac40302d remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
| * 062de5f4e4 of: property: Increase NR_FWNODE_REFERENCE_ARGS
| * e6015ca453 remoteproc: core: Clear table_sz when rproc_shutdown
| * 68e13ab1a0 crypto: hisilicon/sec2 - fix for aead authsize alignment
| * cb688aed24 clk: amlogic: gxbb: drop incorrect flag on 32k clock
| * 5170a857ce fbdev: sm501fb: Add some geometry checks.
| * b2f79f85b8 mdacon: rework dependency list
| * 2841dcc36f fbdev: au1100fb: Move a variable assignment behind a null pointer check
| * be78c69ca7 PCI: pciehp: Don't enable HPIE when resuming in poll mode
| * d953e2cd59 drm/amd/display: avoid NPD when ASIC does not support DMUB
| * 8dcd8b4210 drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
| * a4d0b76c65 PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
| * defab1c652 PCI: Remove stray put_device() in pci_register_host_bridge()
| * 1cabe832e7 drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
| * 32d12502d5 PCI: Avoid reset when disabled via sysfs
| * 933322e51a PCI/portdrv: Only disable pciehp interrupts early when needed
| * d68c455954 PCI: brcmstb: Fix potential premature regulator disabling
| * 99a0efba9f PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
| * 5bb237a1f6 PCI: brcmstb: Use internal register to change link capability
| * 9ce67aa3c6 PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
| * 07e7a7334e drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
| * cd4b075077 PCI/ASPM: Fix link state exit during switch upstream function removal
| * 4e9cefe830 drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
| * 61270882c5 drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
| * c08869bf69 PCI: Use downstream bridges for distributing resources
| * 79d138d137 drm/vkms: Fix use after free and double free on init error
| * f3ce74cdee drm: xlnx: zynqmp: Fix max dma segment size
| * e713b514d2 drm/bridge: it6505: fix HDCP V match check is not performed correctly
| * 21daa13f7b drm/dp_mst: Fix drm RAD print
| * 1ef7b8c1be drm/bridge: ti-sn65dsi86: Fix multiple instances
| * 072833f1cb ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
| * c9c4db9307 ALSA: hda/realtek: Always honor no_shutup_pins
| * cb6d6a008e HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
| * 67ec1fea52 ASoC: cs35l41: check the return value from spi_setup()
| * 2606757693 media: platform: allgro-dvt: unregister v4l2_device on the error path
| * aa5af83b2e media: verisilicon: HEVC: Initialize start_bit field
| * e7a2a34d34 x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
| * 214965d1a6 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
| * 4210ca861f lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
| * 72520ca5f9 PM: sleep: Fix handling devices with direct_complete set on errors
| * 6a810c462f thermal: int340x: Add NULL check for adev
| * 0e44e88754 EDAC/ie31200: Fix the error path order of ie31200_init()
| * 13479cf576 EDAC/ie31200: Fix the DIMM size mask for several SoCs
| * 0d6f98d27d EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
| * 89f6691cae selinux: Chain up tool resolving errors in install_policy.sh
| * 528a06fe98 PM: sleep: Adjust check before setting power.must_resume
| * 53d472f972 lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
| * 2380b9f5aa x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
| * cbcd6c852c x86/platform: Only allow CONFIG_EISA for 32-bit
| * 92ce1ccbad x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
| * feec6cd973 x86/fpu: Fix guest FPU state buffer allocation size
| * a33ab15c5b cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
| * d6937b1b4a smack: dont compile ipv6 code unless ipv6 is configured
| * c678f0831b cpufreq: scpi: compare kHz instead of Hz
| * f33c3cb0c9 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
| * d40e353726 watch_queue: fix pipe accounting mismatch
* | 4878fe79fa Merge 6.1.133 into android14-6.1-lts
|\|
| * 3dfebb87d7 Linux 6.1.133
| * f6c086a79d ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6
| * 04d1086a62 media: i2c: et8ek8: Don't strip remove function when driver is builtin
| * 7a735a8a46 usb: typec: ucsi: Fix NULL pointer access
| * 03fa71e97e usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
| * 1a8d68ca77 serial: 8250_dma: terminate correct DMA in tx_dma_flush()
| * 52d942a530 memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
| * 07f8bdce68 net: usb: usbnet: restore usb%d name exception for local mac addresses
| * 794aad077c net: usb: qmi_wwan: add Telit Cinterion FE990B composition
| * 8d333fc96c net: usb: qmi_wwan: add Telit Cinterion FN990B composition
| * eb7cfa77f5 tty: serial: 8250: Add Brainboxes XC devices
| * ded9ea3814 tty: serial: 8250: Add some more device IDs
| * 79aafdf639 counter: microchip-tcb-capture: Fix undefined counter channel state on probe
| * e0d57d078b counter: stm32-lptimer-cnt: fix error handling when enabling
| * ccd744ac54 ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
| * 1ec43100f7 netfilter: socket: Lookup orig tuple for IPv6 SNAT
| * 04805efe86 drm/amd/display: Check denominator crb_pipes before used
| * 79e5030717 ARM: Remove address checking for MMUless devices
| * 01469773db ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
| * 756992b8d5 ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
| * 0ef6e49881 atm: Fix NULL pointer dereference
| * 7582e135f5 HID: hid-plantronics: Add mic mute mapping and generalize quirks
| * e43621ca43 ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
* | e3b905a701 Merge 6.1.132 into android14-6.1-lts
|\|
| * 8e60a714ba Linux 6.1.132
| * 662254a334 xfs: give xfs_extfree_intent its own perag reference
| * 7400fa1729 block, bfq: fix re-introduced UAF in bic_set_bfqq()
| * 49100c0b07 mm/migrate: fix shmem xarray update during migration
| * 4903303f25 wifi: iwlwifi: mvm: ensure offloading TID queue exists
| * 406a037d93 fs/ntfs3: Change new sparse cluster processing
| * 2e13f88e01 drm/amdgpu: fix use-after-free bug
| * 5cfcd32b23 arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S
| * 4e0713c79c media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
| * a12bd67510 drm/mediatek: Fix coverity issue with unintentional integer overflow
| * 2d4a7a091f netfilter: nft_counter: Use u64_stats_t for statistic.
| * 4375eee347 mptcp: Fix data stream corruption in the address announcement
| * 19e85e06a0 drm/amd/display: Use HW lock mgr for PSR1 when only one eDP
| * 9c4e202abf ksmbd: fix incorrect validation for num_aces field of smb_acl
| * a94ad20b07 drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
| * 78b07dada3 drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
| * 0a566a79ac soc: qcom: pdr: Fix the potential deadlock
| * 7993ad7722 batman-adv: Ignore own maximum aggregation size during RX
| * 205649d642 xsk: fix an integer overflow in xp_create_and_assign_umem()
| * ccb4aef2e7 efi/libstub: Avoid physical address 0x0 when doing random allocation
| * 1091f78287 ARM: shmobile: smp: Enforce shmobile_smp_* alignment
| * 966f331403 proc: fix UAF in proc_get_inode()
| * b9a1c6e888 mmc: atmel-mci: Add missing clk_disable_unprepare()
| * be320c2666 mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops
| * ea034e2469 arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card
| * 270fe5c090 regulator: check that dummy regulator has been probed before using it
| * 83387073e5 drm/v3d: Don't run jobs that have errors flagged in its fence
| * 0bd1486e4b can: flexcan: disable transceiver during system PM
| * 06ffbb4d98 can: flexcan: only change CAN state when link up in system PM
| * a8a89a6d37 can: rcar_canfd: Fix page entries in the AFL list
| * 78f6d8f8fc i2c: omap: fix IRQ storms
| * 18f162e1de Revert "gre: Fix IPv6 link-local address generation."
| * 04c3f729cf net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
| * 47e88c6c3c net: lwtunnel: fix recursion loops
| * 51e8be9578 net: atm: fix use after free in lec_send()
| * 9dac3f194a ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
| * 77c41cdbe6 ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
| * 788ae2ae4c Bluetooth: Fix error code in chan_alloc_skb_cb()
| * 2c160e6868 RDMA/hns: Fix wrong value of max_sge_rd
| * 7b2603ab2f RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()
| * 21c3be4924 RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
| * 4104b0023f RDMA/hns: Fix soft lockup during bt pages loop
| * 652393caf0 RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
| * 3a86ceccad ARM: dts: bcm2711: Don't mark timer regs unconfigured
| * 8c936723a4 ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP
| * eb0b0b729a RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
| * 06c5caadc5 ARM: dts: bcm2711: PL011 UARTs are actually r1p5
| * e4ab889d8b soc: imx8m: Unregister cpufreq and soc dev in cleanup path
| * 296d16538d soc: imx8m: Use devm_* to simplify probe failure handling
| * 44f9ffc1fe soc: imx8m: Remove global soc_uid
| * e7d05cf159 xfrm_output: Force software GSO only in tunnel mode
| * 0f80c9692a arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply
| * 177deffb75 firmware: imx-scu: fix OF node leak in .probe()
| * f4a60d360d smb: client: fix potential UAF in cifs_dump_full_key()
| * e0a545bb4a nvme-tcp: Fix a C2HTermReq error message
| * 66d148204e HID: apple: disable Fn key handling on the Omoton KB066
| * dda134d117 smb: client: Fix match_session bug preventing session reuse
| * 98bbcf4cca smb3: add support for IAKerb
| * 0f928c11e7 arm64: mm: Populate vmemmap at the page level if not section aligned
| * b801f52437 i2c: sis630: Fix an error handling path in sis630_probe()
| * f5955987f4 i2c: ali15x3: Fix an error handling path in ali15x3_probe()
| * aa1788edee i2c: ali1535: Fix an error handling path in ali1535_probe()
| * 9968fcf02c cifs: Fix integer overflow while processing closetimeo mount option
| * 531cebb515 cifs: Fix integer overflow while processing actimeo mount option
| * 39d086bb35 cifs: Fix integer overflow while processing acdirmax mount option
| * dd190168e6 cifs: Fix integer overflow while processing acregmax mount option
| * 78cc9c3304 scripts: generate_rust_analyzer: add missing macros deps
| * d7cfc1a42f scripts: generate_rust_analyzer: provide `cfg`s for `core` and `alloc`
| * 88a96a6fb1 scripts: `make rust-analyzer` for out-of-tree modules
| * d266fc89bc scripts: generate_rust_analyzer: Handle sub-modules with no Makefile
* | 919facc02c Merge 99ddc1491b ("ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()") into android14-6.1-lts
|\|
| * 99ddc1491b ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
| * 0f0302c5fe drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
| * 694110bc24 ASoC: ops: Consistently treat platform_max as control value
| * 618c6ce834 leds: mlxreg: Use devm_mutex_init() for mutex initialization
* | 6151e5151b Revert "tcp: fix races in tcp_abort()"
* | 0f8bbe98f1 Revert "tcp: fix forever orphan socket caused by tcp_abort"
* | c5f96457ad Merge b753821e06 ("tcp: fix forever orphan socket caused by tcp_abort") into android14-6.1-lts
|\|
| * b753821e06 tcp: fix forever orphan socket caused by tcp_abort
* | 1231f555d1 Merge cae9d2b162 ("tcp: fix races in tcp_abort()") into android14-6.1-lts
|\|
| * cae9d2b162 tcp: fix races in tcp_abort()
* | e6079359f7 Merge f9d0a13727 ("lib/buildid: Handle memfd_secret() files in build_id_parse()") into android14-6.1-lts
|\|
| * f9d0a13727 lib/buildid: Handle memfd_secret() files in build_id_parse()
| * 52229ebbe0 rust: Disallow BTF generation with Rust + LTO
| * d8bc07d16b qlcnic: fix memory leak issues in qlcnic_sriov_common.c
| * 7c461a5fb8 ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
| * fa0809bb2a clk: samsung: update PLL locktime for PLL142XX used on FSD platform
* | b2b62f9ec8 Merge 4964dbc419 ("drm/amd/display: Fix slab-use-after-free on hdcp_work") into android14-6.1-lts
|\|
| * 4964dbc419 drm/amd/display: Fix slab-use-after-free on hdcp_work
| * dc831b3868 drm/amd/display: Assign normalized_pix_clk when color depth = 14
| * 889e55f2fa drm/amd/display: Restore correct backlight brightness after a GPU reset
| * e8aeee0d12 drm/dp_mst: Fix locking when skipping CSN before topology probing
| * d2ab95b8c3 drm/atomic: Filter out redundant DPMS calls
| * ec52240622 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
| * 61a9561642 USB: serial: option: match on interface class for Telit FN990B
| * 7dad504810 USB: serial: option: fix Telit Cinterion FE990A name
| * bb03a80e67 USB: serial: option: add Telit Cinterion FE990B compositions
| * 58f4fbe6d6 USB: serial: ftdi_sio: add support for Altera USB Blaster 3
* | 39fddf40eb Merge 870e3066fe ("Input: i8042 - swap old quirk combination with new quirk for more devices") into android14-6.1-lts
|\|
| * 870e3066fe Input: i8042 - swap old quirk combination with new quirk for more devices
| * e2ff9a5f7a Input: i8042 - swap old quirk combination with new quirk for several devices
| * c08785b0bd Input: i8042 - add required quirks for missing old boardnames
| * 24af158fe2 Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
| * dd889e6a4e xfs: remove conditional building of rt geometry validator functions
| * 23b8ab0c8e xfs: reset XFS_ATTR_INCOMPLETE filter on node removal
| * 858c9d5278 xfs: update dir3 leaf block metadata after swap
| * a904118d7b xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real
| * 6c20890ebf xfs: fix perag leak when growfs fails
| * 4f4e046caa xfs: add lock protection when remove perag from radix tree
| * 6587549b08 xfs: initialise di_crc in xfs_log_dinode
| * 87988e80b6 xfs: force all buffers to be written during btree bulk load
| * ec1d3a6899 xfs: recompute growfsrtfree transaction reservation while growing rt volume
| * 072a9c45d2 xfs: remove unused fields from struct xbtree_ifakeroot
| * 5c29b06524 xfs: don't allow overly small or large realtime volumes
| * 7d568f9d0f xfs: fix 32-bit truncation in xfs_compute_rextslog
| * 6a258245c5 xfs: make rextslog computation consistent with mkfs
| * f7a1233bb0 xfs: don't leak recovered attri intent items
| * c3c049984c xfs: consider minlen sized extents in xfs_rtallocate_extent_block
| * e377031115 xfs: convert rt bitmap extent lengths to xfs_rtbxlen_t
| * 6744e7b06c xfs: move the xfs_rtbitmap.c declarations to xfs_rtbitmap.h
| * a64e7b6cd1 xfs: reserve less log space when recovering log intent items
| * 5d6f3d30a4 xfs: use deferred frees for btree block freeing
| * ec35f7567b xfs: fix bounds check in xfs_defer_agfl_block()
| * fa91c6969d xfs: validate block number being freed before adding to xefi
| * ec81c519e7 xfs: pass per-ag references to xfs_free_extent
| * ab3b2a70c4 xfs: pass the xfs_bmbt_irec directly through the log intent code
| * e0e440bfea xfs: fix confusing xfs_extent_item variable names
| * 5b99dcc147 xfs: pass xfs_extent_free_item directly through the log intent code
| * 80cca6ecc9 xfs: pass refcount intent directly through the log intent code
* | 01ad57e248 Merge 9135df0218 ("io_uring: fix corner case forgetting to vunmap") into android14-6.1-lts
|\|
| * 9135df0218 io_uring: fix corner case forgetting to vunmap
| * 50edea7d4c io_uring: don't attempt to mmap larger than what the user asks for
* | abd5ee4e51 ANDROID: GKI: Update .stg file based on io_ring_ctx internal change
* | 4076744180 ANDROID: GKI: fix build breakage in io_uring during 6.1.132 merge
* | e561be4096 Merge 9aeb68337a ("io_uring: get rid of remap_pfn_range() for mapping rings/sqes") into android14-6.1-lts
|\|
| * 9aeb68337a io_uring: get rid of remap_pfn_range() for mapping rings/sqes
* | 1627bf5242 Merge 7710c04d34 ("mm: add nommu variant of vm_insert_pages()") into android14-6.1-lts
|\|
| * 7710c04d34 mm: add nommu variant of vm_insert_pages()
* | efc6c26b16 Merge a00113dc99 ("io_uring: add ring freeing helper") into android14-6.1-lts
|\|
| * a00113dc99 io_uring: add ring freeing helper
* | 468df534e5 Merge 63e6dc6172 ("io_uring: return error pointer from io_mem_alloc()") into android14-6.1-lts
|\|
| * 63e6dc6172 io_uring: return error pointer from io_mem_alloc()
* | bcca1a4a2a Merge 8cc4da21a2 ("block: fix 'kmem_cache of name 'bio-108' already exists'") into android14-6.1-lts
|\|
| * 8cc4da21a2 block: fix 'kmem_cache of name 'bio-108' already exists'
| * 82be3cb72b drm/nouveau: Do not override forced connector status
| * 3c6e077b2a mptcp: safety check before fallback
| * 452382b273 x86/irq: Define trace events conditionally
| * 9bd4fa7b52 perf/x86/intel: Use better start period for frequency mode
| * 3cb53dd557 fuse: don't truncate cached, mutated symlink
| * 5c5194a096 ASoC: tas2764: Set the SDOUT polarity correctly
| * 12566097c9 ASoC: tas2764: Fix power control mask
| * 55132107fa ASoC: tas2770: Fix volume scale
| * 8c6715b24a nvme: only allow entering LIVE from CONNECTING state
| * 638ffdc4ad sctp: Fix undefined behavior in left shift operation
| * cd3f60e499 nvmet-rdma: recheck queue state is LIVE in state lock in recv done
| * 6eea8a5c1c nvme-tcp: add basic support for the C2HTermReq PDU
| * f404cc4cde nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
| * d81ee62948 net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
| * e6607c7008 ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
| * 5d2ca607ad ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
| * 17458c1193 ASoC: rsnd: adjust convert rate limitation
| * 1ffc9e9423 ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
| * ce0bdc1a74 ALSA: hda/realtek: Limit mic boost on Positivo ARN50
| * 1a95cff6e1 Xen/swiotlb: mark xen_swiotlb_fixup() __init
| * 6c31c8761a thermal/cpufreq_cooling: Remove structure member documentation
| * 4d293411ad s390/cio: Fix CHPID "configure" attribute caching
| * 4209d21f6f platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
| * 96850a2a90 platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
| * 5932970c3f sched: Clarify wake_up_q()'s write to task->wake_q.next
| * 62a4c7ac84 HID: apple: fix up the F6 key on the Omoton KB066 keyboard
| * b3047f4c4a HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
| * 9acdb0059f HID: ignore non-functional sensor in HP 5MP Camera
| * 3358a3dee6 HID: intel-ish-hid: Send clock sync message immediately after reset
| * fc16b17906 HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
| * 89811c6208 vboxsf: fix building with GCC 15
| * 936041b69a alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
| * 6bbed0b3ad smb: client: fix noisy when tree connecting to DFS interlink targets
| * ae45fe47cc ACPI: resource: IRQ override for Eluktronics MECH-17
| * 24602e2664 scsi: qla1280: Fix kernel oops when debug level > 2
| * 6d816086d7 scsi: core: Use GFP_NOIO to avoid circular locking dependency
| * 9bfa80c8aa iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
| * e4beb8aa35 powercap: call put_device() on an error path in powercap_register_control_type()
| * 86f653f37b hrtimers: Mark is_migration_base() with __always_inline
| * db1daaca25 nvme-fc: go straight to connecting state when initializing
| * 39e507d4f4 net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
| * 86ff45f5f6 net/mlx5: Bridge, fix the crash caused by LAG state check
| * 2532adbfe9 net: openvswitch: remove misbehaving actions length check
| * b309e75426 gre: Fix IPv6 link-local address generation.
| * 42d5b131da netfilter: nft_exthdr: fix offset with ipv4_find_option()
| * e5ee00607b net_sched: Prevent creation of classes with TC_H_ROOT
| * 917e520430 ipvs: prevent integer overflow in do_ip_vs_get_ctl()
| * a62a25c6ad netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
| * 418119dd3f bonding: fix incorrect MAC address setting to receive NS messages
| * af757f5ee3 net: switchdev: Convert blocking notification chain to a raw one
| * e8e3e03d69 eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
| * 1598307c91 net/mlx5: handle errors in mlx5_chains_create_table()
| * 1c954950f8 Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
| * c40cd24bfb drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
| * 486033f577 netpoll: hold rcu read lock in __netpoll_send_skb()
| * c49e91520d net: mctp i2c: Copy headers if cloned
| * 95b5304073 net: dsa: mv88e6xxx: Verify after ATU Load ops
| * 55a173e49f Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
| * 79d50ce658 Bluetooth: hci_event: Fix enabling passive scanning
| * 0272d4af7f wifi: cfg80211: cancel wiphy_work before freeing wiphy
| * d02c9acd68 sched: address a potential NULL pointer dereference in the GRED scheduler.
| * 4fe9566512 netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
| * fcbacc47d1 ice: fix memory leak in aRFS after reset
| * 7a91926c76 netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
| * 5f7f8d9d46 pinctrl: bcm281xx: Fix incorrect regmap max_registers value
| * 01e8a8111b fbdev: hyperv_fb: iounmap() the correct memory when removing a device
| * f9c572d02f fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super
| * 4c3712c15f hrtimer: Use and report correct timerslack values for realtime tasks
| * ba181019d1 sched/isolation: Prevent boot crash when the boot CPU is nohz_full
| * 65ae99b51e clockevents/drivers/i8253: Fix stop sequence for timer 0
* | 7c1a694998 Merge 6.1.131 into android14-6.1-lts
|\|
| * 344a096597 Linux 6.1.131
| * 5c0729c4c5 kbuild: userprogs: use correct lld when linking through clang
| * 631e00fdac vsock: Orphan socket after transport release
| * 42b33381e5 vsock: Keep the binding until socket destruction
| * 13a4362ab8 bpf, vsock: Invoke proto::close on close()
| * effac69091 fs/ntfs3: Add rough attr alloc_size check
| * dbd3e4adb9 media: mediatek: vcodec: Handle invalid decoder vsi
| * 30652c8ceb scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
| * 1ee2d454ba nilfs2: handle errors that nilfs_prepare_chunk() may return
| * 982319391e nilfs2: eliminate staggered calls to kunmap in nilfs_rename
| * c38a305f2b nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link
| * c07bfa44f9 spi-mxs: Fix chipselect glitch
| * 260c0566e1 x86/mm: Don't disable PCID when INVLPG has been fixed by microcode
| * de03a57b5c uprobes: Fix race in uprobe_free_utask
| * 0084a61db6 Revert "KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()"
| * 20228df372 Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock"
| * 44603dee08 Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
| * e7d343986a Revert "KVM: e500: always restore irqs"
| * 3fa1370826 ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
| * 8427e0b5c1 iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
| * a4ee0bee3d iio: dac: ad3552r: clear reset status flag
| * 22638b6fc1 iio: filter: admv8818: Force initialization of SDO
| * 524f29d78c drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
| * bbfb0cfdfd eeprom: digsy_mtc: Make GPIO lookup table match the device
| * 7a5ffadd54 bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
| * 18ae4cee05 slimbus: messaging: Free transaction ID in delayed interrupt scenario
| * dbd2dc4716 drivers: core: fix device leak in __fw_devlink_relax_cycles()
| * e130e85633 intel_th: pci: Add Panther Lake-P/U support
| * 926c07237e intel_th: pci: Add Panther Lake-H support
| * f630ab2c95 intel_th: pci: Add Arrow Lake support
| * f42cd9f2c2 mei: me: add panther lake P DID
| * 0ce61dbca7 KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value
| * 4a12b6c062 usb: xhci: Enable the TRB overfetch quirk on VIA VL805
| * 9692a67062 xhci: pci: Fix indentation in the PCI device ID definitions
| * 18f827128b usb: gadget: Check bmAttributes only if configuration is valid
| * 79d07d7f30 usb: gadget: Fix setting self-powered state on suspend
| * b589d49945 usb: gadget: Set self-powered based on MaxPower and bmAttributes
| * ceafde7ce3 usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
| * 871d6eaaff usb: typec: ucsi: increase timeout for PPM reset operations
| * a9fa9f461f usb: dwc3: gadget: Prevent irq storm when TH re-executes
| * d8e4783444 usb: dwc3: Set SUSPENDENABLE soon after phy init
| * 197e78076c usb: atm: cxacru: fix a flaw in existing endpoint checks
| * 4ca078084c usb: renesas_usbhs: Flush the notify_hotplug_work
| * ad379788a5 usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
| * bd7072aefd usb: hub: lack of clearing xHC resources
| * f2ae16f71b usb: renesas_usbhs: Use devm_usb_get_phy()
| * 3d7f7a149c usb: renesas_usbhs: Call clk_put()
| * a55aa36d45 Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
| * 1f59fc0d00 gpio: rcar: Fix missing of_node_put() call
| * 09418e5946 net: ipv6: fix missing dst ref drop in ila lwtunnel
| * e8defaef4c net: ipv6: fix dst ref loop in ila lwtunnel
| * 000c9ee439 sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
| * 6aae16a973 ublk: set_params: properly check if parameters can be applied
| * acbcb74ee0 net-timestamp: support TCP GSO case for a few missing flags
| * bb08e1d61b exfat: fix soft lockup in exfat_clear_bitmap
| * 2b0cbcf852 x86/sgx: Fix size overflows in sgx_encl_create()
| * 5a515d13e1 vlan: enforce underlying device type
| * 3de809a768 ppp: Fix KMSAN uninit-value warning with bpf
| * 33244e98aa net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
| * 4393452e6c be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
| * 957d8036f8 drm/sched: Fix preprocessor guard
| * f463358c61 hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
| * 17f86e2543 llc: do not use skb_get() before dev_queue_xmit()
| * 48eb7e67c1 ALSA: usx2y: validate nrpacks module parameter on probe
| * 7d0f113aad hwmon: (ad7314) Validate leading zero bits and return error
| * 2903c12261 hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
| * afaf7f4516 hwmon: (pmbus) Initialise page count in pmbus_identify()
| * 29e0cd296c caif_virtio: fix wrong pointer check in cfv_probe()
| * e8db705378 net: gso: fix ownership in __udp_gso_segment
| * 4d1a05cc0b nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
| * f5631307e3 bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
| * cf1a6015d2 HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
| * 52488583e7 HID: google: fix unused variable warning under !CONFIG_ACPI
| * 88ed69f924 wifi: iwlwifi: limit printed string from FW file
| * 90c30bed20 mm: don't skip arch_sync_kernel_mappings() in error paths
| * d0f491ccfd mm/page_alloc: fix uninitialized variable
| * 30f67c1048 block: fix conversion of GPT partition name to 7-bit
| * d09cf51421 s390/traps: Fix test_monitor_call() inline assembly
| * 469761d254 dma: kmsan: export kmsan_handle_dma() for modules
| * a5f5e520e8 rapidio: fix an API misues when rio_add_net() fails
| * ad82be4298 rapidio: add check for rio_add_net() in rio_scan_alloc_net()
| * 236f41ca72 wifi: nl80211: reject cooked mode if it is set along with other flags
| * f4112cb477 wifi: cfg80211: regulatory: improve invalid hints checking
| * dc516e66fb Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
| * 37785a0104 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
| * f1404f368c mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
| * 9ccee498a8 x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
| * 336ab3ea08 x86/cpu: Validate CPUID leaf 0x2 EDX output
| * cfe0ecf6ce x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
| * 85e3d5ba5d platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
| * 15e3a8cc4e drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
| * c1e54752dc drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
| * 010cd94654 ALSA: hda/realtek: update ALC222 depop optimize
| * dc209114b2 ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
| * 4115d28c04 ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
| * 9334c88fc2 gpio: aggregator: protect driver attr handlers against module unload
| * 3e300913c4 gpio: rcar: Use raw_spinlock to protect register access
| * 11e0e74e14 ksmbd: fix bug on trap in smb2_lock
| * 410ce35a2e ksmbd: fix use-after-free in smb2_lock
| * 6321bbda42 ksmbd: fix type confusion via race condition when using ipc_msg_send_request
| * 8d39eb8c5e HID: appleir: Fix potential NULL dereference at raw event handle
| * 12333d3362 LoongArch: Convert unreachable() to BUG()
| * 4b46c6e1ed Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
| * 0c65d13bdc x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
| * 2ff298cca9 x86/speculation: Add __update_spec_ctrl() helper
| * d2d7ee96cc cpuidle, intel_idle: Fix CPUIDLE_FLAG_IBRS
| * b3b35ff81e drm/amdgpu: disable BAR resize on Dell G5 SE
| * b0b6f8b533 drm/amdgpu: Check extended configuration space register when system uses large bar
| * c2b3f2af0a ibmvnic: Inspect header requirements before using scrq direct
| * 30875b69e3 ibmvnic: Perform tx CSO during send scrq direct
* | 727d125cb5 ANDROID: GKI: fix crc change in __icmp_send
* | 193ff8b1d4 Merge branch 'android14-6.1' into android14-6.1-lts
* | a54c40cad2 Merge 6.1.130 into android14-6.1-lts
|\|
| * 6ae7ac5c42 Linux 6.1.130
| * eeb62bb4ca media: mtk-vcodec: potential null pointer deference in SCP
| * 020ecb7681 pfifo_tail_enqueue: Drop new packet when sch->limit == 0
| * 5b99dea796 Squashfs: check the inode number is not the invalid value of zero
| * c72eda07d1 mm/memory: Use exception ip to search exception tables
| * 7b425f542f ptrace: Introduce exception_ip arch hook
| * ef3bc90758 intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly
| * b6eac41932 amdgpu/pm/legacy: fix suspend/resume issues
| * 070fda699d drm/amd/display: fixed integer types and null check locations
| * ee3ab05cf7 riscv/futex: sign extend compare value in atomic cmpxchg
| * 84586322e0 sched/core: Prevent rescheduling when interrupts are disabled
| * 8ada478c44 vmlinux.lds: Ensure that const vars with relocations are mapped R/O
| * 1489b2dd23 mptcp: reset when MPTCP opts are dropped after join
| * 8116fb4acd mptcp: always handle address removal under msk socket lock
| * f19009e4c7 phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
| * 14d1a86563 phy: tegra: xusb: reset VBUS & ID OVERRIDE
| * 39f843e486 net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs()
| * 45b8d6ce93 net: enetc: correct the xdp_tx statistics
| * 88304bb7b3 net: enetc: update UDP checksum when updating originTimestamp field
| * c55a98def7 net: enetc: keep track of correct Tx BD count in enetc_map_tx_tso_buffs()
| * 046e2669e9 net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
| * 67ebc3391c usbnet: gl620a: fix endpoint checking in genelink_bind()
| * 545b563eb0 i2c: npcm: disable interrupt enable bit before devm_request_irq
| * abb00a9a85 drm/amd/display: Fix HPD after gpu reset
| * 64f3a3523d drm/amd/display: Disable PSR-SU on eDP panels
| * 295fadbd3e perf/core: Fix low freq setting via IOC_PERIOD
| * 25a9171d9a perf/x86: Fix low freqency setting issue
| * 3b8c444e5d ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2
| * 9927752278 ftrace: Avoid potential division by zero in function_stat_show()
| * 5ae1b18f05 tracing: Fix bad hist from corrupting named_triggers list
| * 950866c9a1 phy: rockchip: naneng-combphy: compatible reset with old DT
| * 776eaba5b6 x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
| * 93cff66ff0 io_uring/net: save msg_control for compat
| * c4cb2bfa99 uprobes: Reject the shared zeropage in uprobe_write_opcode()
| * 476c1dfefa mm: Don't pin ZERO_PAGE in pin_user_pages()
| * cffd76d4e9 net: ipv6: fix dst ref loop on input in rpl lwt
| * 4c12c3c8ab net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
| * 7f9aabbadf net: ipv6: fix dst ref loop on input in seg6 lwt
| * c447c5a9c4 net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
| * daff29e076 include: net: add static inline dst_dev_overhead() to dst.h
| * cd60e8edfc net/mlx5: IRQ, Fix null string in debug print
| * 36c72334bf net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
| * 320cb2d549 net: Clear old fragment checksum value in napi_reuse_skb
| * 57cf8c5a7a tcp: Defer ts_recent changes until req is owned
| * be5a87bd83 ipvs: Always clear ipvs_property flag in skb_scrub_packet()
| * 09e9fe147e ASoC: es8328: fix route from DAC to output
| * 90ed67b03a net: cadence: macb: Synchronize stats calculations
| * 5b8dea8d16 ipvlan: ensure network headers are in skb linear part
| * 7a62b1e441 ipvlan: Prepare ipvlan_process_v4_outbound() to future .flowi4_tos conversion.
| * 3e8520bca5 ipv4: Convert ip_route_input() to dscp_t.
| * 671fcbf9d1 ipv4: Convert icmp_route_lookup() to dscp_t.
| * ab5c0db825 ipvlan: Unmask upper DSCP bits in ipvlan_process_v4_outbound()
| * eaba5f6743 ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup()
| * 28e46a8c21 ipv4: icmp: Pass full DS field to ip_route_input()
| * 524c341cb1 net/ipv4: add tracepoint for icmp_send
| * 1774ba1faa net: set the minimum for net_hotdata.netdev_budget_usecs
| * 461fb89121 net: loopback: Avoid sending IP packets without an Ethernet header
| * 3f0ecb5b1b afs: Fix the server_list to unuse a displaced server rather than putting it
| * 1dac4025eb afs: Make it possible to find the volumes that are using a server
| * 916e5a561e afs: remove variable nr_servers
| * 31caad0f59 Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response
| * 4eb6de4176 ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
| * ddb610241b sunrpc: suppress warnings for unused procfs functions
| * 7051b8df67 RDMA/mlx5: Fix bind QP error cleanup flow
| * 0282f5afe0 scsi: core: Clear driver private data when retrying request
| * 65344e7363 SUNRPC: Prevent looping due to rpc_signal_task() races
| * 6f0e029ead SUNRPC: convert RPC_TASK_* constants to enum
| * a7c41830ff ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
| * a18dc2d702 IB/mlx5: Set and get correct qp_num for a DCT QP
| * 3fa58a6fbd netfilter: allow exp not to be removed in nf_ct_find_expectation
| * cd29155818 spi: atmel-quadspi: Fix wrong register value written to MR
| * 02225f59a0 spi: atmel-quadspi: Avoid overwriting delay register settings
| * d48890ef87 media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
| * ada4ca5fd5 block, bfq: fix bfqq uaf in bfq_limit_depth()
| * eca0025faa block, bfq: split sync bfq_queues on a per-actuator basis
| * cd78b738bc x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
| * aecca7b459 ftrace: Do not add duplicate entries in subops manager ops
| * 8096f2de05 ftrace: Correct preemption accounting for function tracing.
| * d42364dd66 EDAC/qcom: Correct interrupt enable register configuration
| * 24e8e4523d smb: client: Add check for next_buffer in receive_encrypted_standard()
| * 5801ed1c0b mtd: rawnand: cadence: fix incorrect device in dma_unmap_single
| * e630d32162 mtd: rawnand: cadence: use dma_map_resource for sdma address
| * 51a8a44e56 mtd: rawnand: cadence: fix error code in cadence_nand_init()
| * 0a0c255c39 mm,madvise,hugetlb: check for 0-length range after end address adjustment
| * 1ffa1bfc56 acct: block access to kernel internal filesystems
| * 5ee8da9bea acct: perform last write from workqueue
| * e2b7b9e4a4 ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
| * 1bb8c9cd59 ALSA: hda: Add error check for snd_ctl_rename_id() in snd_hda_create_dig_out_ctls()
| * fde718a585 ASoC: fsl_micfil: Enable default case in micfil_set_quality()
| * 1358d8e07a nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
| * fcfc00bfec drop_monitor: fix incorrect initialization order
| * ec18520f5e tee: optee: Fix supplicant wait loop
| * 64d31ab8c4 drm/i915: Make sure all planes in use by the joiner have their crtc included
| * 7e75ccfba9 drm/msm/dpu: Disable dither in phys encoder cleanup
| * 36c22125e5 bpf: skip non exist keys in generic_map_lookup_batch
| * 85f5a43484 nvme/ioctl: add missing space in err message
| * b5065a10b9 drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields
| * 7f7f3f42e8 nouveau/svm: fix missing folio unlock + put after make_device_exclusive_range()
| * 51ae6861c4 power: supply: da9150-fg: fix potential overflow
| * de9be9c3ec bpf: Fix wrong copied_seq calculation
| * e410fd6004 strparser: Add read_sock callback
| * f615fccfc6 bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
| * 16985c0980 drm/rcar-du: dsi: Fix PHY lock bit check
| * ff319c9f22 drm/tidss: Fix race condition while handling interrupt registers
| * 36a6e21706 drm/tidss: Add simple K2G manual reset
* | 2785dc9dde ANDROID: GKI: Fix CRC issue with change to include/net/tcp.h
* | 87c6ad8371 Merge 87858bbf21 ("tcp: drop secpath at the same time as we currently drop dst") into android14-6.1-lts
|\|
| * 87858bbf21 tcp: drop secpath at the same time as we currently drop dst
* | 3a51c14aa9 Merge cb7bea9887 ("net: axienet: Set mac_managed_pm") into android14-6.1-lts
|\|
| * cb7bea9887 net: axienet: Set mac_managed_pm
| * a0bad5c7c2 arp: switch to dev_getbyhwaddr() in arp_req_set_public()
| * 0f038b9454 net: Add non-RCU dev_getbyhwaddr() helper
| * cce3ccc0ab flow_dissector: Fix port range key handling in BPF conversion
| * 8d984c604d flow_dissector: Fix handling of mixed port and port-range keys
| * 20825e9c4c geneve: Suppress list corruption splat in geneve_destroy_tunnels().
| * b70fa591b0 gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
| * 501ac6a7e2 ibmvnic: Don't reference skb after sending to VIOS
| * c9543af809 ibmvnic: Add stat for tx direct vs tx batched
| * a6a19d29fb ibmvnic: Introduce send sub-crq direct
| * b92f24529e ibmvnic: Return error code on TX scrq flush fail
| * 36069c768f ALSA: hda/cirrus: Correct the full scale volume set logic
| * 904e746b2e geneve: Fix use-after-free in geneve_find_dev().
| * c905a30535 powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
| * f67713b216 ALSA: hda/realtek: Fixup ALC225 depop procedure
| * 10a293b085 powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
| * e574bf58c3 powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
| * 5a0b0bc44f ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB]
| * 24a942610e USB: gadget: f_midi: f_midi_complete to call queue_work
| * e3bc1a9a67 usb: gadget: core: flush gadget workqueue after device removal
| * 7fb673f0f1 USB: gadget: core: create sysfs link between udc and gadget
* | 208e9672db Merge ac18d78146 ("media: uvcvideo: Remove dangling pointers") into android14-6.1-lts
|\|
| * ac18d78146 media: uvcvideo: Remove dangling pointers
| * b4d266503d media: uvcvideo: Only save async fh if success
| * 9b3e69b5a9 media: uvcvideo: Refactor iterators
| * 3c00e94d00 media: uvcvideo: Fix crash during unbind if gpio unit is in use
| * ce8d2e914b media: Switch to use dev_err_probe() helper
| * 4a7c475137 soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
| * 9b9375831d soc/mediatek: mtk-devapc: Convert to platform remove callback returning void
| * ae86c01537 soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
| * 69fa8a45eb soc: mediatek: mtk-devapc: Switch to devm_clk_get_enabled()
| * 77779d1258 tpm: Change to kvalloc() in eventlog/acpi.c
| * 7a72242c9b tpm: Use managed allocation for bios event log
| * 19bb4fc2ab arm64: dts: qcom: sm8450: Fix CDSP memory length
| * 8ae7a709f6 arm64: dts: qcom: trim addresses to 8 digits
| * 257fa56e89 arm64: dts: mediatek: mt8183: Disable DSI display output by default
| * 4cc8b0110c scsi: core: Do not retry I/Os during depopulation
| * 79a43ee6ec scsi: core: Handle depopulation and restoration in progress
| * 5c1e84bc75 ASoC: renesas: rz-ssi: Add a check for negative sample_space
| * f39ec4e62c clk: mediatek: mt2701-img: add missing dummy clk
| * 67e7bcc0bb clk: mediatek: mt2701-bdp: add missing dummy clk
| * dc7378acd6 clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
| * 58af6b786a clk: mediatek: clk-mtk: Add dummy clock ops
| * 5c5b0e363b Bluetooth: qca: Fix poor RF performance for WCN6855
| * 55d69a2d2a Bluetooth: qca: Update firmware-name to support board specific nvm
| * e3c4cc00e1 Bluetooth: qca: Support downloading board id specific NVM for WCN7850
* | e9df7dc25a Merge 0986efc3c7 ("spi: atmel-qspi: Memory barriers after memory-mapped I/O") into android14-6.1-lts
|\|
| * 0986efc3c7 spi: atmel-qspi: Memory barriers after memory-mapped I/O
| * c788bfef89 spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
| * 756bb7c73f spi: atmel-quadspi: switch to use modern name
| * baaad6765a spi: atmel-quadspi: Add support for configuring CS timing
* | 9212df9856 Merge 0a09d56e16 ("memcg: fix soft lockup in the OOM process") into android14-6.1-lts
|/
* 0a09d56e16 memcg: fix soft lockup in the OOM process
* 2ea4658783 mm: update mark_victim tracepoints fields
* 032fa54f48 md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
* 249d9b9da2 md/md-bitmap: add 'sync_size' into struct md_bitmap_stats
* e83e6ea589 md/md-cluster: fix spares warnings for __le64
* e5c4b7b19b md/md-bitmap: replace md_bitmap_status() with a new helper md_bitmap_get_stats()
* a27c597f26 arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

Change-Id: I49eabb79ab13e7f138664d9fb38f9b3e0f9c116a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Documentation/core-api/pin_user_pages.rst

@@ -113,6 +113,12 @@ pages:
 This also leads to limitations: there are only 31-10==21 bits available for a
 counter that increments 10 bits at a time.
 
+* Because of that limitation, special handling is applied to the zero pages
+  when using FOLL_PIN.  We only pretend to pin a zero page - we don't alter its
+  refcount or pincount at all (it is permanent, so there's no need).  The
+  unpinning functions also don't do anything to a zero page.  This is
+  transparent to the caller.
+
 * Callers must specifically request "dma-pinned tracking of pages". In other
   words, just calling get_user_pages() will not suffice; a new set of functions,
   pin_user_page() and related, must be used.

Documentation/networking/strparser.rst

@@ -112,7 +112,7 @@ Functions
 Callbacks
 =========
 
-There are six callbacks:
+There are seven callbacks:
 
     ::
 
@@ -182,6 +182,13 @@ There are six callbacks:
     the length of the message. skb->len - offset may be greater
     then full_len since strparser does not trim the skb.
 
+    ::
+
+	int (*read_sock)(struct strparser *strp, read_descriptor_t *desc,
+                     sk_read_actor_t recv_actor);
+
+    The read_sock callback is used by strparser instead of
+    sock->ops->read_sock, if provided.
     ::
 
 	int (*read_sock_done)(struct strparser *strp, int err);

Documentation/timers/no_hz.rst

@@ -129,11 +129,8 @@ adaptive-tick CPUs:  At least one non-adaptive-tick CPU must remain
 online to handle timekeeping tasks in order to ensure that system
 calls like gettimeofday() returns accurate values on adaptive-tick CPUs.
 (This is not an issue for CONFIG_NO_HZ_IDLE=y because there are no running
-user processes to observe slight drifts in clock rate.)  Therefore, the
+user processes to observe slight drifts in clock rate.) Note that this
-boot CPU is prohibited from entering adaptive-ticks mode.  Specifying a
+means that your system must have at least two CPUs in order for
-"nohz_full=" mask that includes the boot CPU will result in a boot-time
-error message, and the boot CPU will be removed from the mask.  Note that
-this means that your system must have at least two CPUs in order for
 CONFIG_NO_HZ_FULL=y to do anything for you.
 
 Finally, adaptive-ticks CPUs must have their RCU callbacks offloaded.

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 129
+SUBLEVEL = 134
 EXTRAVERSION =
 NAME = Curry Ramen
 
@@ -1155,6 +1155,11 @@ endif
 KBUILD_USERCFLAGS  += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS))
 KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS))
 
+# userspace programs are linked via the compiler, use the correct linker
+ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy)
+KBUILD_USERLDFLAGS += $(call cc-option, --ld-path=$(LD))
+endif
+
 # make the checker run with the right architecture
 CHECKFLAGS += --arch=$(ARCH)
 
@@ -1887,11 +1892,6 @@ rustfmt:
 rustfmtcheck: rustfmt_flags = --check
 rustfmtcheck: rustfmt
 
-# IDE support targets
-PHONY += rust-analyzer
-rust-analyzer:
-	$(Q)$(MAKE) $(build)=rust $@
-
 # Misc
 # ---------------------------------------------------------------------------
 
@@ -1946,6 +1946,7 @@ help:
 	@echo  '  headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'
 	@echo  '                    (default: $(abspath $(INSTALL_HDR_PATH)))'
 	@echo  '  clean           - remove generated files in module directory only'
+	@echo  '  rust-analyzer	  - generate rust-project.json rust-analyzer support file'
 	@echo  ''
 
 endif # KBUILD_EXTMOD
@@ -2084,6 +2085,11 @@ quiet_cmd_tags = GEN     $@
 tags TAGS cscope gtags: FORCE
 	$(call cmd,tags)
 
+# IDE support targets
+PHONY += rust-analyzer
+rust-analyzer:
+	$(Q)$(MAKE) $(build)=rust $@
+
 # Script to generate missing namespace dependencies
 # ---------------------------------------------------------------------------
 

android/abi_gki_aarch64.stg

@@ -133625,6 +133625,12 @@ member {
   type_id: 0x6720d32f
   offset: 128
 }
+member {
+  id: 0xffaa3920
+  name: "n_ring_pages"
+  type_id: 0xc93e017b
+  offset: 10624
+}
 member {
   id: 0xeebfc981
   name: "n_rules"
@@ -133648,6 +133654,12 @@ member {
   type_id: 0x295c7202
   offset: 304
 }
+member {
+  id: 0x3543ba34
+  name: "n_sqe_pages"
+  type_id: 0xc93e017b
+  offset: 10640
+}
 member {
   id: 0x998218ab
   name: "n_ssids"
@@ -170604,6 +170616,12 @@ member {
   name: "ring_mask"
   type_id: 0xc9082b19
 }
+member {
+  id: 0x44db695c
+  name: "ring_pages"
+  type_id: 0x0b30ee00
+  offset: 10688
+}
 member {
   id: 0x44db6fdd
   name: "ring_pages"
@@ -185184,6 +185202,12 @@ member {
   type_id: 0xb914bfab
   offset: 64
 }
+member {
+  id: 0xce17811e
+  name: "sqe_pages"
+  type_id: 0x0b30ee00
+  offset: 10752
+}
 member {
   id: 0xe005d64f
   name: "sqo_sq_wait"
@@ -241540,7 +241564,7 @@ struct_union {
   kind: STRUCT
   name: "io_ring_ctx"
   definition {
-    bytesize: 1344
+    bytesize: 1408
     member_id: 0x2c717118
     member_id: 0x246f2632
     member_id: 0x7adfc058
@@ -241582,6 +241606,10 @@ struct_union {
     member_id: 0x31444ba6
     member_id: 0x1d068fc6
     member_id: 0xd2c00a64
+    member_id: 0xffaa3920
+    member_id: 0x3543ba34
+    member_id: 0x44db695c
+    member_id: 0xce17811e
   }
 }
 struct_union {

android/abi_gki_aarch64.stg.allowed_breaks

@@ -137,3 +137,10 @@ type 'struct geni_wrapper' changed
   member 'struct clk_bulk_data clks[2]' was added
   member 'unsigned int num_clks' was added
 
+type 'struct io_ring_ctx' changed
+  byte size changed from 1344 to 1408
+  member 'unsigned short n_ring_pages' was added
+  member 'unsigned short n_sqe_pages' was added
+  member 'struct page** ring_pages' was added
+  member 'struct page** sqe_pages' was added
+

arch/alpha/include/asm/elf.h

@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
 /*
  * This is used to ensure we don't load something for the wrong architecture.
  */
-#define elf_check_arch(x) ((x)->e_machine == EM_ALPHA)
+#define elf_check_arch(x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT))
 
 /*
  * These are used to set parameters in the core dumps.
@@ -145,10 +145,6 @@ extern int dump_elf_task_fp(elf_fpreg_t *dest, struct task_struct *task);
 	: amask (AMASK_CIX) ? "ev6" : "ev67");	\
 })
 
-#define SET_PERSONALITY(EX)					\
-	set_personality(((EX).e_flags & EF_ALPHA_32BIT)		\
-	   ? PER_LINUX_32BIT : PER_LINUX)
-
 extern int alpha_l1i_cacheshape;
 extern int alpha_l1d_cacheshape;
 extern int alpha_l2_cacheshape;

arch/alpha/include/asm/pgtable.h

@@ -322,7 +322,7 @@ extern inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
 
 extern void paging_init(void);
 
-/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT.  */
+/* We have our own get_unmapped_area */
 #define HAVE_ARCH_UNMAPPED_AREA
 
 #endif /* _ALPHA_PGTABLE_H */

arch/alpha/include/asm/processor.h

@@ -8,23 +8,19 @@
 #ifndef __ASM_ALPHA_PROCESSOR_H
 #define __ASM_ALPHA_PROCESSOR_H
 
-#include <linux/personality.h>	/* for ADDR_LIMIT_32BIT */
-
 /*
  * We have a 42-bit user address space: 4TB user VM...
  */
 #define TASK_SIZE (0x40000000000UL)
 
-#define STACK_TOP \
+#define STACK_TOP (0x00120000000UL)
-  (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL)
 
 #define STACK_TOP_MAX	0x00120000000UL
 
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE \
+#define TASK_UNMAPPED_BASE (TASK_SIZE / 2)
-  ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2)
 
 /* This is dead.  Everything has been moved to thread_info.  */
 struct thread_struct { };

arch/alpha/kernel/osf_sys.c

@@ -1213,8 +1213,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
 	return ret;
 }
 
-/* Get an address range which is currently unmapped.  Similar to the
+/* Get an address range which is currently unmapped. */
-   generic version except that we know how to honor ADDR_LIMIT_32BIT.  */
 
 static unsigned long
 arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
@@ -1236,13 +1235,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 		       unsigned long len, unsigned long pgoff,
 		       unsigned long flags)
 {
-	unsigned long limit;
+	unsigned long limit = TASK_SIZE;
-
-	/* "32 bit" actually means 31 bit, since pointers sign extend.  */
-	if (current->personality & ADDR_LIMIT_32BIT)
-		limit = 0x80000000;
-	else
-		limit = TASK_SIZE;
 
 	if (len > limit)
 		return -ENOMEM;

arch/arm/boot/dts/bcm2711.dtsi

@@ -134,7 +134,7 @@
 			clocks = <&clocks BCM2835_CLOCK_UART>,
 				 <&clocks BCM2835_CLOCK_VPU>;
 			clock-names = "uartclk", "apb_pclk";
-			arm,primecell-periphid = <0x00241011>;
+			arm,primecell-periphid = <0x00341011>;
 			status = "disabled";
 		};
 
@@ -145,7 +145,7 @@
 			clocks = <&clocks BCM2835_CLOCK_UART>,
 				 <&clocks BCM2835_CLOCK_VPU>;
 			clock-names = "uartclk", "apb_pclk";
-			arm,primecell-periphid = <0x00241011>;
+			arm,primecell-periphid = <0x00341011>;
 			status = "disabled";
 		};
 
@@ -156,7 +156,7 @@
 			clocks = <&clocks BCM2835_CLOCK_UART>,
 				 <&clocks BCM2835_CLOCK_VPU>;
 			clock-names = "uartclk", "apb_pclk";
-			arm,primecell-periphid = <0x00241011>;
+			arm,primecell-periphid = <0x00341011>;
 			status = "disabled";
 		};
 
@@ -167,7 +167,7 @@
 			clocks = <&clocks BCM2835_CLOCK_UART>,
 				 <&clocks BCM2835_CLOCK_VPU>;
 			clock-names = "uartclk", "apb_pclk";
-			arm,primecell-periphid = <0x00241011>;
+			arm,primecell-periphid = <0x00341011>;
 			status = "disabled";
 		};
 
@@ -451,8 +451,6 @@
 					  IRQ_TYPE_LEVEL_LOW)>,
 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) |
 					  IRQ_TYPE_LEVEL_LOW)>;
-		/* This only applies to the ARMv7 stub */
-		arm,cpu-registers-not-fw-configured;
 	};
 
 	cpus: cpus {
@@ -1154,6 +1152,7 @@
 };
 
 &uart0 {
+	arm,primecell-periphid = <0x00341011>;
 	interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
 };
 

arch/arm/boot/dts/imx6qdl-apalis.dtsi

@@ -101,6 +101,11 @@
 		};
 	};
 
+	poweroff {
+		compatible = "regulator-poweroff";
+		cpu-supply = <&vgen2_reg>;
+	};
+
 	reg_module_3v3: regulator-module-3v3 {
 		compatible = "regulator-fixed";
 		regulator-always-on;
@@ -220,10 +225,6 @@
 	status = "disabled";
 };
 
-&clks {
-	fsl,pmic-stby-poweroff;
-};
-
 /* Apalis SPI1 */
 &ecspi1 {
 	cs-gpios = <&gpio5 25 GPIO_ACTIVE_LOW>;
@@ -511,7 +512,6 @@
 
 	pmic: pmic@8 {
 		compatible = "fsl,pfuze100";
-		fsl,pmic-stby-poweroff;
 		reg = <0x08>;
 
 		regulators {

arch/arm/mach-omap1/Kconfig

@@ -9,6 +9,7 @@ menuconfig ARCH_OMAP1
 	select ARCH_OMAP
 	select CLKSRC_MMIO
 	select FORCE_PCI if PCCARD
+	select GENERIC_IRQ_CHIP
 	select GPIOLIB
 	help
 	  Support for older TI OMAP1 (omap7xx, omap15xx or omap16xx)

arch/arm/mach-shmobile/headsmp.S

@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep)
 	.long	shmobile_smp_arg - 1b
 
 	.bss
+	.align	2
 	.globl	shmobile_smp_mpidr
 shmobile_smp_mpidr:
 	.space	NR_CPUS * 4

arch/arm/mm/fault.c

@@ -27,6 +27,13 @@
 
 #ifdef CONFIG_MMU
 
+bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
+{
+	unsigned long addr = (unsigned long)unsafe_src;
+
+	return addr >= TASK_SIZE && ULONG_MAX - addr >= size;
+}
+
 /*
  * This is useful to dump out the page tables associated with
  * 'addr' in mm 'mm'.
@@ -552,6 +559,7 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
 	if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
 		return;
 
+	pr_alert("8<--- cut here ---\n");
 	pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
 		inf->name, ifsr, addr);
 

arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi

@@ -16,10 +16,10 @@
 			"Headphone Jack", "HPOUTR",
 			"IN2L", "Line In Jack",
 			"IN2R", "Line In Jack",
-			"Headphone Jack", "MICBIAS",
+			"Microphone Jack", "MICBIAS",
-			"IN1L", "Headphone Jack";
+			"IN1L", "Microphone Jack";
 		simple-audio-card,widgets =
-			"Microphone", "Headphone Jack",
+			"Microphone", "Microphone Jack",
 			"Headphone", "Headphone Jack",
 			"Line", "Line In Jack";
 

arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 /*
- * Copyright 2021-2022 TQ-Systems GmbH
+ * Copyright 2021-2025 TQ-Systems GmbH <linux@ew.tq-group.com>,
- * Author: Alexander Stein <alexander.stein@tq-group.com>
+ * D-82229 Seefeld, Germany.
+ * Author: Alexander Stein
  */
 
 #include "imx8mp.dtsi"
@@ -23,15 +24,6 @@
 		regulator-max-microvolt = <3300000>;
 		regulator-always-on;
 	};
-
-	/* e-MMC IO, needed for HS modes */
-	reg_vcc1v8: regulator-vcc1v8 {
-		compatible = "regulator-fixed";
-		regulator-name = "VCC1V8";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <1800000>;
-		regulator-always-on;
-	};
 };
 
 &A53_0 {
@@ -194,7 +186,7 @@
 	no-sd;
 	no-sdio;
 	vmmc-supply = <&reg_vcc3v3>;
-	vqmmc-supply = <&reg_vcc1v8>;
+	vqmmc-supply = <&buck5_reg>;
 	status = "okay";
 };
 

arch/arm64/boot/dts/mediatek/mt8183.dtsi

@@ -1753,6 +1753,7 @@
 			resets = <&mmsys MT8183_MMSYS_SW0_RST_B_DISP_DSI0>;
 			phys = <&mipi_tx0>;
 			phy-names = "dphy";
+			status = "disabled";
 		};
 
 		mutex: mutex@14016000 {

arch/arm64/boot/dts/qcom/sm8350.dtsi

@@ -2226,7 +2226,7 @@
 
 		cdsp: remoteproc@98900000 {
 			compatible = "qcom,sm8350-cdsp-pas";
-			reg = <0 0x098900000 0 0x1400000>;
+			reg = <0 0x98900000 0 0x1400000>;
 
 			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
 					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,

arch/arm64/boot/dts/qcom/sm8450.dtsi

@@ -2093,7 +2093,7 @@
 
 		remoteproc_adsp: remoteproc@30000000 {
 			compatible = "qcom,sm8450-adsp-pas";
-			reg = <0 0x030000000 0 0x100>;
+			reg = <0 0x30000000 0 0x100>;
 
 			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
@@ -2159,7 +2159,7 @@
 
 		remoteproc_cdsp: remoteproc@32300000 {
 			compatible = "qcom,sm8450-cdsp-pas";
-			reg = <0 0x032300000 0 0x1400000>;
+			reg = <0 0x32300000 0 0x10000>;
 
 			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,

arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts

@@ -117,7 +117,7 @@
 };
 
 &u2phy1_host {
-	status = "disabled";
+	phy-supply = <&vdd_5v>;
 };
 
 &uart0 {

arch/arm64/include/asm/mman.h

@@ -33,9 +33,12 @@ static inline unsigned long arch_calc_vm_flag_bits(struct file *file,
 	 * backed by tags-capable memory. The vm_flags may be overridden by a
 	 * filesystem supporting MTE (RAM-based).
 	 */
-	if (system_supports_mte() &&
+	if (system_supports_mte()) {
-	    ((flags & MAP_ANONYMOUS) || shmem_file(file)))
+		if ((flags & MAP_ANONYMOUS) && !(flags & MAP_HUGETLB))
-		return VM_MTE_ALLOWED;
+			return VM_MTE_ALLOWED;
+		if (shmem_file(file))
+			return VM_MTE_ALLOWED;
+	}
 
 	return 0;
 }

arch/arm64/kernel/compat_alignment.c

@@ -368,6 +368,8 @@ int do_compat_alignment_fixup(unsigned long addr, struct pt_regs *regs)
 		return 1;
 	}
 
+	if (!handler)
+		return 1;
 	type = handler(addr, instr, regs);
 
 	if (type == TYPE_ERROR || type == TYPE_FAULT)

arch/arm64/mm/mmu.c

@@ -1209,8 +1209,11 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 	pmd_t *pmdp;
 
 	WARN_ON((start < VMEMMAP_START) || (end > VMEMMAP_END));
+	/* [start, end] should be within one section */
+	WARN_ON_ONCE(end - start > PAGES_PER_SECTION * sizeof(struct page));
 
-	if (!ARM64_KERNEL_USES_PMD_MAPS)
+	if (!ARM64_KERNEL_USES_PMD_MAPS ||
+	    (end - start < PAGES_PER_SECTION * sizeof(struct page)))
 		return vmemmap_populate_basepages(start, end, node, altmap);
 
 	do {

arch/loongarch/Kconfig

@@ -310,8 +310,8 @@ config CMDLINE_BOOTLOADER
 config CMDLINE_EXTEND
 	bool "Use built-in to extend bootloader kernel arguments"
 	help
-	  The command-line arguments provided during boot will be
+	  The built-in command line will be appended to the command-
-	  appended to the built-in command line. This is useful in
+	  line arguments provided during boot. This is useful in
 	  cases where the provided arguments are insufficient and
 	  you don't want to or cannot modify them.
 

arch/loongarch/include/asm/cache.h

@@ -8,6 +8,8 @@
 #define L1_CACHE_SHIFT		CONFIG_L1_CACHE_SHIFT
 #define L1_CACHE_BYTES		(1 << L1_CACHE_SHIFT)
 
+#define ARCH_DMA_MINALIGN	(16)
+
 #define __read_mostly __section(".data..read_mostly")
 
 #endif /* _ASM_CACHE_H */

arch/loongarch/kernel/machine_kexec.c

@@ -126,14 +126,14 @@ void kexec_reboot(void)
 	/* All secondary cpus go to kexec_smp_wait */
 	if (smp_processor_id() > 0) {
 		relocated_kexec_smp_wait(NULL);
-		unreachable();
+		BUG();
 	}
 #endif
 
 	do_kexec = (void *)reboot_code_buffer;
 	do_kexec(efi_boot, cmdline_ptr, systable_ptr, start_addr, first_ind_entry);
 
-	unreachable();
+	BUG();
 }
 
 

arch/loongarch/net/bpf_jit.c

@@ -142,6 +142,8 @@ static void build_prologue(struct jit_ctx *ctx)
 	 */
 	if (seen_tail_call(ctx) && seen_call(ctx))
 		move_reg(ctx, TCC_SAVED, REG_TCC);
+	else
+		emit_insn(ctx, nop);
 
 	ctx->stack_size = stack_adjust;
 }
@@ -808,7 +810,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
 	{
 		const u64 imm64 = (u64)(insn + 1)->imm << 32 | (u32)insn->imm;
 
-		move_imm(ctx, dst, imm64, is32);
+		if (bpf_pseudo_func(insn))
+			move_addr(ctx, dst, imm64);
+		else
+			move_imm(ctx, dst, imm64, is32);
 		return 1;
 	}
 

arch/loongarch/net/bpf_jit.h

@@ -25,6 +25,11 @@ struct jit_data {
 	struct jit_ctx ctx;
 };
 
+static inline void emit_nop(union loongarch_instruction *insn)
+{
+	insn->word = INSN_NOP;
+}
+
 #define emit_insn(ctx, func, ...)						\
 do {										\
 	if (ctx->image != NULL) {						\

arch/mips/include/asm/ptrace.h

@@ -155,6 +155,8 @@ static inline long regs_return_value(struct pt_regs *regs)
 }
 
 #define instruction_pointer(regs) ((regs)->cp0_epc)
+extern unsigned long exception_ip(struct pt_regs *regs);
+#define exception_ip(regs) exception_ip(regs)
 #define profile_pc(regs) instruction_pointer(regs)
 
 extern asmlinkage long syscall_trace_enter(struct pt_regs *regs);

arch/mips/kernel/ptrace.c

@@ -31,6 +31,7 @@
 #include <linux/seccomp.h>
 #include <linux/ftrace.h>
 
+#include <asm/branch.h>
 #include <asm/byteorder.h>
 #include <asm/cpu.h>
 #include <asm/cpu-info.h>
@@ -48,6 +49,12 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/syscalls.h>
 
+unsigned long exception_ip(struct pt_regs *regs)
+{
+	return exception_epc(regs);
+}
+EXPORT_SYMBOL(exception_ip);
+
 /*
  * Called by kernel/ptrace.c when detaching..
  *

arch/powerpc/configs/mpc885_ads_defconfig

@@ -78,4 +78,4 @@ CONFIG_DEBUG_VM_PGTABLE=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BDI_SWITCH=y
 CONFIG_PPC_EARLY_DEBUG=y
-CONFIG_GENERIC_PTDUMP=y
+CONFIG_PTDUMP_DEBUGFS=y

arch/powerpc/include/asm/book3s/64/hash-4k.h

@@ -89,6 +89,34 @@ static inline int hash__hugepd_ok(hugepd_t hpd)
 }
 #endif
 
+/*
+ * With 4K page size the real_pte machinery is all nops.
+ */
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset)
+{
+	return (real_pte_t){pte};
+}
+
+#define __rpte_to_pte(r)	((r).pte)
+
+static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
+{
+	return pte_val(__rpte_to_pte(rpte)) >> H_PAGE_F_GIX_SHIFT;
+}
+
+#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift)       \
+	do {							         \
+		index = 0;					         \
+		shift = mmu_psize_defs[psize].shift;		         \
+
+#define pte_iterate_hashed_end() } while(0)
+
+/*
+ * We expect this to be called only for user addresses or kernel virtual
+ * addresses other than the linear mapping.
+ */
+#define pte_pagesize_index(mm, addr, pte)	MMU_PAGE_4K
+
 /*
  * 4K PTE format is different from 64K PTE format. Saving the hash_slot is just
  * a matter of returning the PTE bits that need to be modified. On 64K PTE,

arch/powerpc/include/asm/book3s/64/pgtable.h

@@ -318,32 +318,6 @@ extern unsigned long pci_io_base;
 
 #ifndef __ASSEMBLY__
 
-/*
- * This is the default implementation of various PTE accessors, it's
- * used in all cases except Book3S with 64K pages where we have a
- * concept of sub-pages
- */
-#ifndef __real_pte
-
-#define __real_pte(e, p, o)		((real_pte_t){(e)})
-#define __rpte_to_pte(r)	((r).pte)
-#define __rpte_to_hidx(r,index)	(pte_val(__rpte_to_pte(r)) >> H_PAGE_F_GIX_SHIFT)
-
-#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift)       \
-	do {							         \
-		index = 0;					         \
-		shift = mmu_psize_defs[psize].shift;		         \
-
-#define pte_iterate_hashed_end() } while(0)
-
-/*
- * We expect this to be called only for user addresses or kernel virtual
- * addresses other than the linear mapping.
- */
-#define pte_pagesize_index(mm, addr, pte)	MMU_PAGE_4K
-
-#endif /* __real_pte */
-
 static inline unsigned long pte_update(struct mm_struct *mm, unsigned long addr,
 				       pte_t *ptep, unsigned long clr,
 				       unsigned long set, int huge)

arch/powerpc/kvm/e500_mmu_host.c

@@ -242,7 +242,7 @@ static inline int tlbe_is_writable(struct kvm_book3e_206_tlb_entry *tlbe)
 	return tlbe->mas7_3 & (MAS3_SW|MAS3_UW);
 }
 
-static inline bool kvmppc_e500_ref_setup(struct tlbe_ref *ref,
+static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref,
 					 struct kvm_book3e_206_tlb_entry *gtlbe,
 					 kvm_pfn_t pfn, unsigned int wimg)
 {
@@ -252,7 +252,11 @@ static inline bool kvmppc_e500_ref_setup(struct tlbe_ref *ref,
 	/* Use guest supplied MAS2_G and MAS2_E */
 	ref->flags |= (gtlbe->mas2 & MAS2_ATTRIB_MASK) | wimg;
 
-	return tlbe_is_writable(gtlbe);
+	/* Mark the page accessed */
+	kvm_set_pfn_accessed(pfn);
+
+	if (tlbe_is_writable(gtlbe))
+		kvm_set_pfn_dirty(pfn);
 }
 
 static inline void kvmppc_e500_ref_release(struct tlbe_ref *ref)
@@ -322,7 +326,6 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 {
 	struct kvm_memory_slot *slot;
 	unsigned long pfn = 0; /* silence GCC warning */
-	struct page *page = NULL;
 	unsigned long hva;
 	int pfnmap = 0;
 	int tsize = BOOK3E_PAGESZ_4K;
@@ -334,7 +337,6 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 	unsigned int wimg = 0;
 	pgd_t *pgdir;
 	unsigned long flags;
-	bool writable = false;
 
 	/* used to check for invalidations in progress */
 	mmu_seq = kvm->mmu_invalidate_seq;
@@ -444,7 +446,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 
 	if (likely(!pfnmap)) {
 		tsize_pages = 1UL << (tsize + 10 - PAGE_SHIFT);
-		pfn = __kvm_faultin_pfn(slot, gfn, FOLL_WRITE, NULL, &page);
+		pfn = gfn_to_pfn_memslot(slot, gfn);
 		if (is_error_noslot_pfn(pfn)) {
 			if (printk_ratelimit())
 				pr_err("%s: real page not found for gfn %lx\n",
@@ -479,6 +481,7 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 		if (pte_present(pte)) {
 			wimg = (pte_val(pte) >> PTE_WIMGE_SHIFT) &
 				MAS2_WIMGE_MASK;
+			local_irq_restore(flags);
 		} else {
 			local_irq_restore(flags);
 			pr_err_ratelimited("%s: pte not present: gfn %lx,pfn %lx\n",
@@ -487,9 +490,8 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 			goto out;
 		}
 	}
-	local_irq_restore(flags);
+	kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg);
 
-	writable = kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg);
 	kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize,
 				ref, gvaddr, stlbe);
 
@@ -497,8 +499,11 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 	kvmppc_mmu_flush_icache(pfn);
 
 out:
-	kvm_release_faultin_page(kvm, page, !!ret, writable);
 	spin_unlock(&kvm->mmu_lock);
+
+	/* Drop refcount on page, so that mmu notifiers can clear it */
+	kvm_release_pfn_clean(pfn);
+
 	return ret;
 }
 

arch/powerpc/lib/code-patching.c

@@ -53,7 +53,7 @@ static int text_area_cpu_up(unsigned int cpu)
 	unsigned long addr;
 	int err;
 
-	area = get_vm_area(PAGE_SIZE, VM_ALLOC);
+	area = get_vm_area(PAGE_SIZE, 0);
 	if (!area) {
 		WARN_ONCE(1, "Failed to create text area for cpu %d\n",
 			cpu);

arch/powerpc/platforms/cell/spufs/gang.c

@@ -25,6 +25,7 @@ struct spu_gang *alloc_spu_gang(void)
 	mutex_init(&gang->aff_mutex);
 	INIT_LIST_HEAD(&gang->list);
 	INIT_LIST_HEAD(&gang->aff_list_head);
+	gang->alive = 1;
 
 out:
 	return gang;

arch/powerpc/platforms/cell/spufs/inode.c

@@ -191,13 +191,32 @@ static int spufs_fill_dir(struct dentry *dir,
 			return -ENOMEM;
 		ret = spufs_new_file(dir->d_sb, dentry, files->ops,
 					files->mode & mode, files->size, ctx);
-		if (ret)
+		if (ret) {
+			dput(dentry);
 			return ret;
+		}
 		files++;
 	}
 	return 0;
 }
 
+static void unuse_gang(struct dentry *dir)
+{
+	struct inode *inode = dir->d_inode;
+	struct spu_gang *gang = SPUFS_I(inode)->i_gang;
+
+	if (gang) {
+		bool dead;
+
+		inode_lock(inode); // exclusion with spufs_create_context()
+		dead = !--gang->alive;
+		inode_unlock(inode);
+
+		if (dead)
+			simple_recursive_removal(dir, NULL);
+	}
+}
+
 static int spufs_dir_close(struct inode *inode, struct file *file)
 {
 	struct inode *parent;
@@ -212,6 +231,7 @@ static int spufs_dir_close(struct inode *inode, struct file *file)
 	inode_unlock(parent);
 	WARN_ON(ret);
 
+	unuse_gang(dir->d_parent);
 	return dcache_dir_close(inode, file);
 }
 
@@ -404,7 +424,7 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
 {
 	int ret;
 	int affinity;
-	struct spu_gang *gang;
+	struct spu_gang *gang = SPUFS_I(inode)->i_gang;
 	struct spu_context *neighbor;
 	struct path path = {.mnt = mnt, .dentry = dentry};
 
@@ -419,11 +439,15 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
 	if ((flags & SPU_CREATE_ISOLATE) && !isolated_loader)
 		return -ENODEV;
 
-	gang = NULL;
+	if (gang) {
+		if (!gang->alive)
+			return -ENOENT;
+		gang->alive++;
+	}
+
 	neighbor = NULL;
 	affinity = flags & (SPU_CREATE_AFFINITY_MEM | SPU_CREATE_AFFINITY_SPU);
 	if (affinity) {
-		gang = SPUFS_I(inode)->i_gang;
 		if (!gang)
 			return -EINVAL;
 		mutex_lock(&gang->aff_mutex);
@@ -435,8 +459,11 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
 	}
 
 	ret = spufs_mkdir(inode, dentry, flags, mode & 0777);
-	if (ret)
+	if (ret) {
+		if (neighbor)
+			put_spu_context(neighbor);
 		goto out_aff_unlock;
+	}
 
 	if (affinity) {
 		spufs_set_affinity(flags, SPUFS_I(d_inode(dentry))->i_ctx,
@@ -452,6 +479,8 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
 out_aff_unlock:
 	if (affinity)
 		mutex_unlock(&gang->aff_mutex);
+	if (ret && gang)
+		gang->alive--; // can't reach 0
 	return ret;
 }
 
@@ -481,6 +510,7 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode)
 	inode->i_fop = &simple_dir_operations;
 
 	d_instantiate(dentry, inode);
+	dget(dentry);
 	inc_nlink(dir);
 	inc_nlink(d_inode(dentry));
 	return ret;
@@ -491,6 +521,21 @@ out:
 	return ret;
 }
 
+static int spufs_gang_close(struct inode *inode, struct file *file)
+{
+	unuse_gang(file->f_path.dentry);
+	return dcache_dir_close(inode, file);
+}
+
+static const struct file_operations spufs_gang_fops = {
+	.open		= dcache_dir_open,
+	.release	= spufs_gang_close,
+	.llseek		= dcache_dir_lseek,
+	.read		= generic_read_dir,
+	.iterate_shared	= dcache_readdir,
+	.fsync		= noop_fsync,
+};
+
 static int spufs_gang_open(const struct path *path)
 {
 	int ret;
@@ -510,7 +555,7 @@ static int spufs_gang_open(const struct path *path)
 		return PTR_ERR(filp);
 	}
 
-	filp->f_op = &simple_dir_operations;
+	filp->f_op = &spufs_gang_fops;
 	fd_install(ret, filp);
 	return ret;
 }
@@ -525,10 +570,8 @@ static int spufs_create_gang(struct inode *inode,
 	ret = spufs_mkgang(inode, dentry, mode & 0777);
 	if (!ret) {
 		ret = spufs_gang_open(&path);
-		if (ret < 0) {
+		if (ret < 0)
-			int err = simple_rmdir(inode, dentry);
+			unuse_gang(dentry);
-			WARN_ON(err);
-		}
 	}
 	return ret;
 }

arch/powerpc/platforms/cell/spufs/spufs.h

@@ -151,6 +151,8 @@ struct spu_gang {
 	int aff_flags;
 	struct spu *aff_ref_spu;
 	atomic_t aff_sched_count;
+
+	int alive;
 };
 
 /* Flag bits for spu_gang aff_flags */

arch/riscv/include/asm/ftrace.h

@@ -82,7 +82,7 @@ struct dyn_arch_ftrace {
 #define make_call_t0(caller, callee, call)				\
 do {									\
 	unsigned int offset =						\
-		(unsigned long) callee - (unsigned long) caller;	\
+		(unsigned long) (callee) - (unsigned long) (caller);	\
 	call[0] = to_auipc_t0(offset);					\
 	call[1] = to_jalr_t0(offset);					\
 } while (0)
@@ -98,7 +98,7 @@ do {									\
 #define make_call_ra(caller, callee, call)				\
 do {									\
 	unsigned int offset =						\
-		(unsigned long) callee - (unsigned long) caller;	\
+		(unsigned long) (callee) - (unsigned long) (caller);	\
 	call[0] = to_auipc_ra(offset);					\
 	call[1] = to_jalr_ra(offset);					\
 } while (0)

arch/riscv/include/asm/futex.h

@@ -93,7 +93,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
 		_ASM_EXTABLE_UACCESS_ERR(1b, 3b, %[r])	\
 		_ASM_EXTABLE_UACCESS_ERR(2b, 3b, %[r])	\
 	: [r] "+r" (ret), [v] "=&r" (val), [u] "+m" (*uaddr), [t] "=&r" (tmp)
-	: [ov] "Jr" (oldval), [nv] "Jr" (newval)
+	: [ov] "Jr" ((long)(int)oldval), [nv] "Jr" (newval)
 	: "memory");
 	__disable_user_access();
 

arch/s390/kernel/traps.c

@@ -276,10 +276,10 @@ static void __init test_monitor_call(void)
 		return;
 	asm volatile(
 		"	mc	0,0\n"
-		"0:	xgr	%0,%0\n"
+		"0:	lhi	%[val],0\n"
 		"1:\n"
-		EX_TABLE(0b,1b)
+		EX_TABLE(0b, 1b)
-		: "+d" (val));
+		: [val] "+d" (val));
 	if (!val)
 		panic("Monitor call doesn't work!\n");
 }

arch/um/include/shared/os.h

@@ -211,7 +211,6 @@ extern int os_protect_memory(void *addr, unsigned long len,
 extern int os_unmap_memory(void *addr, int len);
 extern int os_drop_memory(void *addr, int length);
 extern int can_drop_memory(void);
-extern int os_mincore(void *addr, unsigned long len);
 
 /* execvp.c */
 extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);

arch/um/kernel/Makefile

@@ -17,7 +17,7 @@ extra-y := vmlinux.lds
 obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \
 	physmem.o process.o ptrace.o reboot.o sigio.o \
 	signal.o sysrq.o time.o tlb.o trap.o \
-	um_arch.o umid.o maccess.o kmsg_dump.o capflags.o skas/
+	um_arch.o umid.o kmsg_dump.o capflags.o skas/
 obj-y += load_file.o
 
 obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o

arch/um/kernel/maccess.c

@@ -1,19 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * Copyright (C) 2013 Richard Weinberger <richrd@nod.at>
- */
-
-#include <linux/uaccess.h>
-#include <linux/kernel.h>
-#include <os.h>
-
-bool copy_from_kernel_nofault_allowed(const void *src, size_t size)
-{
-	void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
-
-	if ((unsigned long)src < PAGE_SIZE || size <= 0)
-		return false;
-	if (os_mincore(psrc, size + src - psrc) <= 0)
-		return false;
-	return true;
-}

arch/um/os-Linux/process.c

@@ -223,57 +223,6 @@ out:
 	return ok;
 }
 
-static int os_page_mincore(void *addr)
-{
-	char vec[2];
-	int ret;
-
-	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
-	if (ret < 0) {
-		if (errno == ENOMEM || errno == EINVAL)
-			return 0;
-		else
-			return -errno;
-	}
-
-	return vec[0] & 1;
-}
-
-int os_mincore(void *addr, unsigned long len)
-{
-	char *vec;
-	int ret, i;
-
-	if (len <= UM_KERN_PAGE_SIZE)
-		return os_page_mincore(addr);
-
-	vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE);
-	if (!vec)
-		return -ENOMEM;
-
-	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
-	if (ret < 0) {
-		if (errno == ENOMEM || errno == EINVAL)
-			ret = 0;
-		else
-			ret = -errno;
-
-		goto out;
-	}
-
-	for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) {
-		if (!(vec[i] & 1)) {
-			ret = 0;
-			goto out;
-		}
-	}
-
-	ret = 1;
-out:
-	free(vec);
-	return ret;
-}
-
 void init_new_thread_signals(void)
 {
 	set_handler(SIGSEGV);

arch/x86/Kconfig

@@ -209,7 +209,7 @@ config X86
 	select HAVE_SAMPLE_FTRACE_DIRECT_MULTI	if X86_64
 	select HAVE_EBPF_JIT
 	select HAVE_EFFICIENT_UNALIGNED_ACCESS
-	select HAVE_EISA
+	select HAVE_EISA			if X86_32
 	select HAVE_EXIT_THREAD
 	select HAVE_FAST_GUP
 	select HAVE_FENTRY			if X86_64 || DYNAMIC_FTRACE
@@ -2507,7 +2507,8 @@ config CPU_IBPB_ENTRY
 	depends on CPU_SUP_AMD && X86_64
 	default y
 	help
-	  Compile the kernel with support for the retbleed=ibpb mitigation.
+	  Compile the kernel with support for the retbleed=ibpb and
+	  spec_rstack_overflow={ibpb,ibpb-vmexit} mitigations.
 
 config CPU_IBRS_ENTRY
 	bool "Enable IBRS on kernel entry"

arch/x86/entry/calling.h

@@ -70,6 +70,8 @@ For 32-bit we have the following conventions - kernel is built with
 	pushq	%rsi		/* pt_regs->si */
 	movq	8(%rsp), %rsi	/* temporarily store the return address in %rsi */
 	movq	%rdi, 8(%rsp)	/* pt_regs->di (overwriting original return address) */
+	/* We just clobbered the return address - use the IRET frame for unwinding: */
+	UNWIND_HINT_IRET_REGS offset=3*8
 	.else
 	pushq   %rdi		/* pt_regs->di */
 	pushq   %rsi		/* pt_regs->si */

arch/x86/events/core.c

@@ -621,7 +621,7 @@ int x86_pmu_hw_config(struct perf_event *event)
 	if (event->attr.type == event->pmu->type)
 		event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK;
 
-	if (event->attr.sample_period && x86_pmu.limit_period) {
+	if (!event->attr.freq && x86_pmu.limit_period) {
 		s64 left = event->attr.sample_period;
 		x86_pmu.limit_period(event, &left);
 		if (left > event->attr.sample_period)

arch/x86/events/intel/core.c

@@ -2689,28 +2689,33 @@ static u64 adl_update_topdown_event(struct perf_event *event)
 
 DEFINE_STATIC_CALL(intel_pmu_update_topdown_event, x86_perf_event_update);
 
-static void intel_pmu_read_topdown_event(struct perf_event *event)
-{
-	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
-
-	/* Only need to call update_topdown_event() once for group read. */
-	if ((cpuc->txn_flags & PERF_PMU_TXN_READ) &&
-	    !is_slots_event(event))
-		return;
-
-	perf_pmu_disable(event->pmu);
-	static_call(intel_pmu_update_topdown_event)(event);
-	perf_pmu_enable(event->pmu);
-}
-
 static void intel_pmu_read_event(struct perf_event *event)
 {
-	if (event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD)
+	if (event->hw.flags & (PERF_X86_EVENT_AUTO_RELOAD | PERF_X86_EVENT_TOPDOWN)) {
-		intel_pmu_auto_reload_read(event);
+		struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
-	else if (is_topdown_count(event))
+		bool pmu_enabled = cpuc->enabled;
-		intel_pmu_read_topdown_event(event);
+
-	else
+		/* Only need to call update_topdown_event() once for group read. */
-		x86_perf_event_update(event);
+		if (is_metric_event(event) && (cpuc->txn_flags & PERF_PMU_TXN_READ))
+			return;
+
+		cpuc->enabled = 0;
+		if (pmu_enabled)
+			intel_pmu_disable_all();
+
+		if (is_topdown_event(event))
+			static_call(intel_pmu_update_topdown_event)(event);
+		else
+			intel_pmu_drain_pebs_buffer();
+
+		cpuc->enabled = pmu_enabled;
+		if (pmu_enabled)
+			intel_pmu_enable_all(0);
+
+		return;
+	}
+
+	x86_perf_event_update(event);
 }
 
 static void intel_pmu_enable_fixed(struct perf_event *event)
@@ -2975,7 +2980,7 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status)
 
 		handled++;
 		x86_pmu_handle_guest_pebs(regs, &data);
-		x86_pmu.drain_pebs(regs, &data);
+		static_call(x86_pmu_drain_pebs)(regs, &data);
 		status &= intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI;
 
 		/*
@@ -3852,6 +3857,85 @@ static inline bool intel_pmu_has_cap(struct perf_event *event, int idx)
 	return test_bit(idx, (unsigned long *)&intel_cap->capabilities);
 }
 
+static u64 intel_pmu_freq_start_period(struct perf_event *event)
+{
+	int type = event->attr.type;
+	u64 config, factor;
+	s64 start;
+
+	/*
+	 * The 127 is the lowest possible recommended SAV (sample after value)
+	 * for a 4000 freq (default freq), according to the event list JSON file.
+	 * Also, assume the workload is idle 50% time.
+	 */
+	factor = 64 * 4000;
+	if (type != PERF_TYPE_HARDWARE && type != PERF_TYPE_HW_CACHE)
+		goto end;
+
+	/*
+	 * The estimation of the start period in the freq mode is
+	 * based on the below assumption.
+	 *
+	 * For a cycles or an instructions event, 1GHZ of the
+	 * underlying platform, 1 IPC. The workload is idle 50% time.
+	 * The start period = 1,000,000,000 * 1 / freq / 2.
+	 *		    = 500,000,000 / freq
+	 *
+	 * Usually, the branch-related events occur less than the
+	 * instructions event. According to the Intel event list JSON
+	 * file, the SAV (sample after value) of a branch-related event
+	 * is usually 1/4 of an instruction event.
+	 * The start period of branch-related events = 125,000,000 / freq.
+	 *
+	 * The cache-related events occurs even less. The SAV is usually
+	 * 1/20 of an instruction event.
+	 * The start period of cache-related events = 25,000,000 / freq.
+	 */
+	config = event->attr.config & PERF_HW_EVENT_MASK;
+	if (type == PERF_TYPE_HARDWARE) {
+		switch (config) {
+		case PERF_COUNT_HW_CPU_CYCLES:
+		case PERF_COUNT_HW_INSTRUCTIONS:
+		case PERF_COUNT_HW_BUS_CYCLES:
+		case PERF_COUNT_HW_STALLED_CYCLES_FRONTEND:
+		case PERF_COUNT_HW_STALLED_CYCLES_BACKEND:
+		case PERF_COUNT_HW_REF_CPU_CYCLES:
+			factor = 500000000;
+			break;
+		case PERF_COUNT_HW_BRANCH_INSTRUCTIONS:
+		case PERF_COUNT_HW_BRANCH_MISSES:
+			factor = 125000000;
+			break;
+		case PERF_COUNT_HW_CACHE_REFERENCES:
+		case PERF_COUNT_HW_CACHE_MISSES:
+			factor = 25000000;
+			break;
+		default:
+			goto end;
+		}
+	}
+
+	if (type == PERF_TYPE_HW_CACHE)
+		factor = 25000000;
+end:
+	/*
+	 * Usually, a prime or a number with less factors (close to prime)
+	 * is chosen as an SAV, which makes it less likely that the sampling
+	 * period synchronizes with some periodic event in the workload.
+	 * Minus 1 to make it at least avoiding values near power of twos
+	 * for the default freq.
+	 */
+	start = DIV_ROUND_UP_ULL(factor, event->attr.sample_freq) - 1;
+
+	if (start > x86_pmu.max_period)
+		start = x86_pmu.max_period;
+
+	if (x86_pmu.limit_period)
+		x86_pmu.limit_period(event, &start);
+
+	return start;
+}
+
 static int intel_pmu_hw_config(struct perf_event *event)
 {
 	int ret = x86_pmu_hw_config(event);
@@ -3863,6 +3947,12 @@ static int intel_pmu_hw_config(struct perf_event *event)
 	if (ret)
 		return ret;
 
+	if (event->attr.freq && event->attr.sample_freq) {
+		event->hw.sample_period = intel_pmu_freq_start_period(event);
+		event->hw.last_period = event->hw.sample_period;
+		local64_set(&event->hw.period_left, event->hw.sample_period);
+	}
+
 	if (event->attr.precise_ip) {
 		if ((event->attr.config & INTEL_ARCH_EVENT_MASK) == INTEL_FIXED_VLBR_EVENT)
 			return -EINVAL;

arch/x86/events/intel/ds.c

@@ -789,11 +789,11 @@ unlock:
 	return 1;
 }
 
-static inline void intel_pmu_drain_pebs_buffer(void)
+void intel_pmu_drain_pebs_buffer(void)
 {
 	struct perf_sample_data data;
 
-	x86_pmu.drain_pebs(NULL, &data);
+	static_call(x86_pmu_drain_pebs)(NULL, &data);
 }
 
 /*
@@ -1902,15 +1902,6 @@ get_next_pebs_record_by_bit(void *base, void *top, int bit)
 	return NULL;
 }
 
-void intel_pmu_auto_reload_read(struct perf_event *event)
-{
-	WARN_ON(!(event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD));
-
-	perf_pmu_disable(event->pmu);
-	intel_pmu_drain_pebs_buffer();
-	perf_pmu_enable(event->pmu);
-}
-
 /*
  * Special variant of intel_pmu_save_and_restart() for auto-reload.
  */

arch/x86/events/perf_event.h

@@ -1047,6 +1047,7 @@ extern struct x86_pmu x86_pmu __read_mostly;
 
 DECLARE_STATIC_CALL(x86_pmu_set_period, *x86_pmu.set_period);
 DECLARE_STATIC_CALL(x86_pmu_update,     *x86_pmu.update);
+DECLARE_STATIC_CALL(x86_pmu_drain_pebs,	*x86_pmu.drain_pebs);
 
 static __always_inline struct x86_perf_task_context_opt *task_context_opt(void *ctx)
 {
@@ -1535,7 +1536,7 @@ void intel_pmu_pebs_disable_all(void);
 
 void intel_pmu_pebs_sched_task(struct perf_event_context *ctx, bool sched_in);
 
-void intel_pmu_auto_reload_read(struct perf_event *event);
+void intel_pmu_drain_pebs_buffer(void);
 
 void intel_pmu_store_pebs_lbrs(struct lbr_entry *lbr);
 

arch/x86/include/asm/spec-ctrl.h

@@ -4,6 +4,7 @@
 
 #include <linux/thread_info.h>
 #include <asm/nospec-branch.h>
+#include <asm/msr.h>
 
 /*
  * On VMENTER we must preserve whatever view of the SPEC_CTRL MSR
@@ -76,6 +77,16 @@ static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn)
 	return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL;
 }
 
+/*
+ * This can be used in noinstr functions & should only be called in bare
+ * metal context.
+ */
+static __always_inline void __update_spec_ctrl(u64 val)
+{
+	__this_cpu_write(x86_spec_ctrl_current, val);
+	native_wrmsrl(MSR_IA32_SPEC_CTRL, val);
+}
+
 #ifdef CONFIG_SMP
 extern void speculative_store_bypass_ht_init(void);
 #else

arch/x86/include/asm/tlbflush.h

@@ -228,7 +228,7 @@ void flush_tlb_multi(const struct cpumask *cpumask,
 	flush_tlb_mm_range((vma)->vm_mm, start, end,			\
 			   ((vma)->vm_flags & VM_HUGETLB)		\
 				? huge_page_shift(hstate_vma(vma))	\
-				: PAGE_SHIFT, false)
+				: PAGE_SHIFT, true)
 
 extern void flush_tlb_all(void);
 extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,

arch/x86/kernel/amd_nb.c

@@ -342,7 +342,6 @@ bool __init early_is_amd_nb(u32 device)
 
 struct resource *amd_get_mmconfig_range(struct resource *res)
 {
-	u32 address;
 	u64 base, msr;
 	unsigned int segn_busn_bits;
 
@@ -350,13 +349,11 @@ struct resource *amd_get_mmconfig_range(struct resource *res)
 	    boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
 		return NULL;
 
-	/* assume all cpus from fam10h have mmconfig */
+	/* Assume CPUs from Fam10h have mmconfig, although not all VMs do */
-	if (boot_cpu_data.x86 < 0x10)
+	if (boot_cpu_data.x86 < 0x10 ||
+	    rdmsrl_safe(MSR_FAM10H_MMIO_CONF_BASE, &msr))
 		return NULL;
 
-	address = MSR_FAM10H_MMIO_CONF_BASE;
-	rdmsrl(address, msr);
-
 	/* mmconfig is not enabled */
 	if (!(msr & FAM10H_MMIO_CONF_ENABLE))
 		return NULL;

arch/x86/kernel/cpu/bugs.c

@@ -92,7 +92,7 @@ void update_spec_ctrl_cond(u64 val)
 		wrmsrl(MSR_IA32_SPEC_CTRL, val);
 }
 
-u64 spec_ctrl_current(void)
+noinstr u64 spec_ctrl_current(void)
 {
 	return this_cpu_read(x86_spec_ctrl_current);
 }
@@ -1092,6 +1092,8 @@ do_cmd_auto:
 
 	case RETBLEED_MITIGATION_IBPB:
 		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
+		mitigate_smt = true;
 
 		/*
 		 * IBPB on entry already obviates the need for
@@ -1101,8 +1103,6 @@ do_cmd_auto:
 		setup_clear_cpu_cap(X86_FEATURE_UNRET);
 		setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
 
-		mitigate_smt = true;
-
 		/*
 		 * There is no need for RSB filling: entry_ibpb() ensures
 		 * all predictions, including the RSB, are invalidated,
@@ -2607,6 +2607,7 @@ static void __init srso_select_mitigation(void)
 		if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
 			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB;
 
 				/*
@@ -2616,6 +2617,13 @@ static void __init srso_select_mitigation(void)
 				 */
 				setup_clear_cpu_cap(X86_FEATURE_UNRET);
 				setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
+
+				/*
+				 * There is no need for RSB filling: entry_ibpb() ensures
+				 * all predictions, including the RSB, are invalidated,
+				 * regardless of IBPB implementation.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
@@ -2624,8 +2632,8 @@ static void __init srso_select_mitigation(void)
 		break;
 
 	case SRSO_CMD_IBPB_ON_VMEXIT:
-		if (IS_ENABLED(CONFIG_CPU_SRSO)) {
+		if (IS_ENABLED(CONFIG_CPU_IBPB_ENTRY)) {
-			if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) {
+			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT;
 
@@ -2637,9 +2645,9 @@ static void __init srso_select_mitigation(void)
 				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
-			pr_err("WARNING: kernel not compiled with CPU_SRSO.\n");
+			pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
 			goto pred_cmd;
-                }
+		}
 		break;
 
 	default:

arch/x86/kernel/cpu/cacheinfo.c

@@ -801,7 +801,7 @@ void init_intel_cacheinfo(struct cpuinfo_x86 *c)
 			cpuid(2, &regs[0], &regs[1], &regs[2], &regs[3]);
 
 			/* If bit 31 is set, this is an unknown format */
-			for (j = 0 ; j < 3 ; j++)
+			for (j = 0 ; j < 4 ; j++)
 				if (regs[j] & (1 << 31))
 					regs[j] = 0;
 

arch/x86/kernel/cpu/cyrix.c

@@ -153,8 +153,8 @@ static void geode_configure(void)
 	u8 ccr3;
 	local_irq_save(flags);
 
-	/* Suspend on halt power saving and enable #SUSP pin */
+	/* Suspend on halt power saving */
-	setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
+	setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x08);
 
 	ccr3 = getCx86(CX86_CCR3);
 	setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);	/* enable MAPEN */

arch/x86/kernel/cpu/intel.c

@@ -784,26 +784,37 @@ static unsigned int intel_size_cache(struct cpuinfo_x86 *c, unsigned int size)
 }
 #endif
 
-#define TLB_INST_4K	0x01
+#define TLB_INST_4K		0x01
-#define TLB_INST_4M	0x02
+#define TLB_INST_4M		0x02
-#define TLB_INST_2M_4M	0x03
+#define TLB_INST_2M_4M		0x03
 
-#define TLB_INST_ALL	0x05
+#define TLB_INST_ALL		0x05
-#define TLB_INST_1G	0x06
+#define TLB_INST_1G		0x06
 
-#define TLB_DATA_4K	0x11
+#define TLB_DATA_4K		0x11
-#define TLB_DATA_4M	0x12
+#define TLB_DATA_4M		0x12
-#define TLB_DATA_2M_4M	0x13
+#define TLB_DATA_2M_4M		0x13
-#define TLB_DATA_4K_4M	0x14
+#define TLB_DATA_4K_4M		0x14
 
-#define TLB_DATA_1G	0x16
+#define TLB_DATA_1G		0x16
+#define TLB_DATA_1G_2M_4M	0x17
 
-#define TLB_DATA0_4K	0x21
+#define TLB_DATA0_4K		0x21
-#define TLB_DATA0_4M	0x22
+#define TLB_DATA0_4M		0x22
-#define TLB_DATA0_2M_4M	0x23
+#define TLB_DATA0_2M_4M		0x23
 
-#define STLB_4K		0x41
+#define STLB_4K			0x41
-#define STLB_4K_2M	0x42
+#define STLB_4K_2M		0x42
+
+/*
+ * All of leaf 0x2's one-byte TLB descriptors implies the same number of
+ * entries for their respective TLB types.  The 0x63 descriptor is an
+ * exception: it implies 4 dTLB entries for 1GB pages 32 dTLB entries
+ * for 2MB or 4MB pages.  Encode descriptor 0x63 dTLB entry count for
+ * 2MB/4MB pages here, as its count for dTLB 1GB pages is already at the
+ * intel_tlb_table[] mapping.
+ */
+#define TLB_0x63_2M_4M_ENTRIES	32
 
 static const struct _tlb_table intel_tlb_table[] = {
 	{ 0x01, TLB_INST_4K,		32,	" TLB_INST 4 KByte pages, 4-way set associative" },
@@ -825,7 +836,8 @@ static const struct _tlb_table intel_tlb_table[] = {
 	{ 0x5c, TLB_DATA_4K_4M,		128,	" TLB_DATA 4 KByte and 4 MByte pages" },
 	{ 0x5d, TLB_DATA_4K_4M,		256,	" TLB_DATA 4 KByte and 4 MByte pages" },
 	{ 0x61, TLB_INST_4K,		48,	" TLB_INST 4 KByte pages, full associative" },
-	{ 0x63, TLB_DATA_1G,		4,	" TLB_DATA 1 GByte pages, 4-way set associative" },
+	{ 0x63, TLB_DATA_1G_2M_4M,	4,	" TLB_DATA 1 GByte pages, 4-way set associative"
+						" (plus 32 entries TLB_DATA 2 MByte or 4 MByte pages, not encoded here)" },
 	{ 0x6b, TLB_DATA_4K,		256,	" TLB_DATA 4 KByte pages, 8-way associative" },
 	{ 0x6c, TLB_DATA_2M_4M,		128,	" TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" },
 	{ 0x6d, TLB_DATA_1G,		16,	" TLB_DATA 1 GByte pages, fully associative" },
@@ -925,6 +937,12 @@ static void intel_tlb_lookup(const unsigned char desc)
 		if (tlb_lld_4m[ENTRIES] < intel_tlb_table[k].entries)
 			tlb_lld_4m[ENTRIES] = intel_tlb_table[k].entries;
 		break;
+	case TLB_DATA_1G_2M_4M:
+		if (tlb_lld_2m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES)
+			tlb_lld_2m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES;
+		if (tlb_lld_4m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES)
+			tlb_lld_4m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES;
+		fallthrough;
 	case TLB_DATA_1G:
 		if (tlb_lld_1g[ENTRIES] < intel_tlb_table[k].entries)
 			tlb_lld_1g[ENTRIES] = intel_tlb_table[k].entries;
@@ -948,7 +966,7 @@ static void intel_detect_tlb(struct cpuinfo_x86 *c)
 		cpuid(2, &regs[0], &regs[1], &regs[2], &regs[3]);
 
 		/* If bit 31 is set, this is an unknown format */
-		for (j = 0 ; j < 3 ; j++)
+		for (j = 0 ; j < 4 ; j++)
 			if (regs[j] & (1 << 31))
 				regs[j] = 0;
 

arch/x86/kernel/cpu/microcode/amd.c

@@ -867,7 +867,7 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz
 		return ret;
 	}
 
-	for_each_node(nid) {
+	for_each_node_with_cpus(nid) {
 		cpu = cpumask_first(cpumask_of_node(nid));
 		c = &cpu_data(cpu);
 

arch/x86/kernel/cpu/mshyperv.c

@@ -16,7 +16,6 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/kexec.h>
-#include <linux/i8253.h>
 #include <linux/random.h>
 #include <linux/swiotlb.h>
 #include <asm/processor.h>
@@ -461,16 +460,6 @@ static void __init ms_hyperv_init_platform(void)
 	if (efi_enabled(EFI_BOOT))
 		x86_platform.get_nmi_reason = hv_get_nmi_reason;
 
-	/*
-	 * Hyper-V VMs have a PIT emulation quirk such that zeroing the
-	 * counter register during PIT shutdown restarts the PIT. So it
-	 * continues to interrupt @18.2 HZ. Setting i8253_clear_counter
-	 * to false tells pit_shutdown() not to zero the counter so that
-	 * the PIT really is shutdown. Generation 2 VMs don't have a PIT,
-	 * and setting this value has no effect.
-	 */
-	i8253_clear_counter_on_shutdown = false;
-
 #if IS_ENABLED(CONFIG_HYPERV)
 	/*
 	 * Setup the hook to get control post apic initialization.

arch/x86/kernel/cpu/sgx/driver.c

@@ -150,13 +150,15 @@ int __init sgx_drv_init(void)
 	u64 xfrm_mask;
 	int ret;
 
-	if (!cpu_feature_enabled(X86_FEATURE_SGX_LC))
+	if (!cpu_feature_enabled(X86_FEATURE_SGX_LC)) {
+		pr_info("SGX disabled: SGX launch control CPU feature is not available, /dev/sgx_enclave disabled.\n");
 		return -ENODEV;
+	}
 
 	cpuid_count(SGX_CPUID, 0, &eax, &ebx, &ecx, &edx);
 
 	if (!(eax & 1))  {
-		pr_err("SGX disabled: SGX1 instruction support not available.\n");
+		pr_info("SGX disabled: SGX1 instruction support not available, /dev/sgx_enclave disabled.\n");
 		return -ENODEV;
 	}
 
@@ -173,8 +175,10 @@ int __init sgx_drv_init(void)
 	}
 
 	ret = misc_register(&sgx_dev_enclave);
-	if (ret)
+	if (ret) {
+		pr_info("SGX disabled: Unable to register the /dev/sgx_enclave driver (%d).\n", ret);
 		return ret;
+	}
 
 	return 0;
 }

arch/x86/kernel/cpu/sgx/ioctl.c

@@ -64,6 +64,13 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
 	struct file *backing;
 	long ret;
 
+	/*
+	 * ECREATE would detect this too, but checking here also ensures
+	 * that the 'encl_size' calculations below can never overflow.
+	 */
+	if (!is_power_of_2(secs->size))
+		return -EINVAL;
+
 	va_page = sgx_encl_grow(encl, true);
 	if (IS_ERR(va_page))
 		return PTR_ERR(va_page);

arch/x86/kernel/dumpstack.c

@@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 	printk("%sCall Trace:\n", log_lvl);
 
 	unwind_start(&state, task, regs, stack);
+	stack = stack ?: get_stack_pointer(task, regs);
 	regs = unwind_get_entry_regs(&state, &partial);
 
 	/*
@@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 	 * - hardirq stack
 	 * - entry stack
 	 */
-	for (stack = stack ?: get_stack_pointer(task, regs);
+	for (; stack; stack = stack_info.next_sp) {
-	     stack;
-	     stack = stack_info.next_sp) {
 		const char *stack_name;
 
 		stack = PTR_ALIGN(stack, sizeof(long));

arch/x86/kernel/fpu/core.c

@@ -220,7 +220,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)
 	struct fpstate *fpstate;
 	unsigned int size;
 
-	size = fpu_user_cfg.default_size + ALIGN(offsetof(struct fpstate, regs), 64);
+	size = fpu_kernel_cfg.default_size + ALIGN(offsetof(struct fpstate, regs), 64);
 	fpstate = vzalloc(size);
 	if (!fpstate)
 		return false;
@@ -232,8 +232,8 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)
 	fpstate->is_guest	= true;
 
 	gfpu->fpstate		= fpstate;
-	gfpu->xfeatures		= fpu_user_cfg.default_features;
+	gfpu->xfeatures		= fpu_kernel_cfg.default_features;
-	gfpu->perm		= fpu_user_cfg.default_features;
+	gfpu->perm		= fpu_kernel_cfg.default_features;
 
 	/*
 	 * KVM sets the FP+SSE bits in the XSAVE header when copying FPU state

arch/x86/kernel/irq.c

@@ -23,8 +23,10 @@
 #include <asm/traps.h>
 #include <asm/thermal.h>
 
+#if defined(CONFIG_X86_LOCAL_APIC) || defined(CONFIG_X86_THERMAL_VECTOR)
 #define CREATE_TRACE_POINTS
 #include <asm/trace/irq_vectors.h>
+#endif
 
 DEFINE_PER_CPU_SHARED_ALIGNED(irq_cpustat_t, irq_stat);
 EXPORT_PER_CPU_SYMBOL(irq_stat);

arch/x86/kernel/process.c

@@ -87,7 +87,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);
  */
 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 {
-	memcpy(dst, src, arch_task_struct_size);
+	/* init_task is not dynamically sized (incomplete FPU state) */
+	if (unlikely(src == &init_task))
+		memcpy_and_pad(dst, arch_task_struct_size, src, sizeof(init_task), 0);
+	else
+		memcpy(dst, src, arch_task_struct_size);
+
 #ifdef CONFIG_VM86
 	dst->thread.vm86 = NULL;
 #endif

arch/x86/kernel/tsc.c

@@ -920,7 +920,7 @@ static unsigned long long cyc2ns_suspend;
 
 void tsc_save_sched_clock_state(void)
 {
-	if (!sched_clock_stable())
+	if (!static_branch_likely(&__use_tsc) && !sched_clock_stable())
 		return;
 
 	cyc2ns_suspend = sched_clock();
@@ -940,7 +940,7 @@ void tsc_restore_sched_clock_state(void)
 	unsigned long flags;
 	int cpu;
 
-	if (!sched_clock_stable())
+	if (!static_branch_likely(&__use_tsc) && !sched_clock_stable())
 		return;
 
 	local_irq_save(flags);

arch/x86/kvm/svm/svm.c

@@ -3039,6 +3039,18 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 				    __func__, data);
 			break;
 		}
+
+		/*
+		 * AMD changed the architectural behavior of bits 5:2.  On CPUs
+		 * without BusLockTrap, bits 5:2 control "external pins", but
+		 * on CPUs that support BusLockDetect, bit 2 enables BusLockTrap
+		 * and bits 5:3 are reserved-to-zero.  Sadly, old KVM allowed
+		 * the guest to set bits 5:2 despite not actually virtualizing
+		 * Performance-Monitoring/Breakpoint external pins.  Drop bits
+		 * 5:2 for backwards compatibility.
+		 */
+		data &= ~GENMASK(5, 2);
+
 		if (data & DEBUGCTL_RESERVED_BITS)
 			return 1;
 

arch/x86/kvm/svm/svm.h

@@ -539,7 +539,7 @@ static inline bool is_x2apic_msrpm_offset(u32 offset)
 /* svm.c */
 #define MSR_INVALID				0xffffffffU
 
-#define DEBUGCTL_RESERVED_BITS (~(0x3fULL))
+#define DEBUGCTL_RESERVED_BITS (~(DEBUGCTLMSR_BTF | DEBUGCTLMSR_LBR))
 
 extern bool dump_invalid_vmcb;
 

arch/x86/mm/init.c

@@ -269,28 +269,33 @@ static void __init probe_page_size_mask(void)
 }
 
 /*
- * INVLPG may not properly flush Global entries
+ * INVLPG may not properly flush Global entries on
- * on these CPUs when PCIDs are enabled.
+ * these CPUs.  New microcode fixes the issue.
  */
 static const struct x86_cpu_id invlpg_miss_ids[] = {
-	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE,      0),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE,      0x2e),
-	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L,    0),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L,    0x42c),
-	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N,    0),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N,    0x11),
-	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE,     0),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE,     0x118),
-	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P,   0),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P,   0x4117),
-	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S,   0),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S,   0x2e),
 	{}
 };
 
 static void setup_pcid(void)
 {
+	const struct x86_cpu_id *invlpg_miss_match;
+
 	if (!IS_ENABLED(CONFIG_X86_64))
 		return;
 
 	if (!boot_cpu_has(X86_FEATURE_PCID))
 		return;
 
-	if (x86_match_cpu(invlpg_miss_ids)) {
+	invlpg_miss_match = x86_match_cpu(invlpg_miss_ids);
+
+	if (invlpg_miss_match &&
+	    boot_cpu_data.microcode < invlpg_miss_match->driver_data) {
 		pr_info("Incomplete global flushes, disabling PCID");
 		setup_clear_cpu_cap(X86_FEATURE_PCID);
 		return;

arch/x86/mm/mem_encrypt_identity.c

@@ -588,7 +588,7 @@ void __head sme_enable(struct boot_params *bp)
 
 out:
 	RIP_REL_REF(sme_me_mask) = me_mask;
-	physical_mask &= ~me_mask;
+	RIP_REL_REF(physical_mask) &= ~me_mask;
-	cc_vendor = CC_VENDOR_AMD;
+	RIP_REL_REF(cc_vendor) = CC_VENDOR_AMD;
 	cc_set_mask(me_mask);
 }

arch/x86/mm/pat/cpa-test.c

@@ -183,7 +183,7 @@ static int pageattr_test(void)
 			break;
 
 		case 1:
-			err = change_page_attr_set(addrs, len[1], PAGE_CPA_TEST, 1);
+			err = change_page_attr_set(addrs, len[i], PAGE_CPA_TEST, 1);
 			break;
 
 		case 2:

block/bfq-cgroup.c

@@ -704,6 +704,46 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 	bfq_put_queue(bfqq);
 }
 
+static void bfq_sync_bfqq_move(struct bfq_data *bfqd,
+			       struct bfq_queue *sync_bfqq,
+			       struct bfq_io_cq *bic,
+			       struct bfq_group *bfqg,
+			       unsigned int act_idx)
+{
+	struct bfq_queue *bfqq;
+
+	if (!sync_bfqq->new_bfqq && !bfq_bfqq_coop(sync_bfqq)) {
+		/* We are the only user of this bfqq, just move it */
+		if (sync_bfqq->entity.sched_data != &bfqg->sched_data)
+			bfq_bfqq_move(bfqd, sync_bfqq, bfqg);
+		return;
+	}
+
+	/*
+	 * The queue was merged to a different queue. Check
+	 * that the merge chain still belongs to the same
+	 * cgroup.
+	 */
+	for (bfqq = sync_bfqq; bfqq; bfqq = bfqq->new_bfqq)
+		if (bfqq->entity.sched_data != &bfqg->sched_data)
+			break;
+	if (bfqq) {
+		/*
+		 * Some queue changed cgroup so the merge is not valid
+		 * anymore. We cannot easily just cancel the merge (by
+		 * clearing new_bfqq) as there may be other processes
+		 * using this queue and holding refs to all queues
+		 * below sync_bfqq->new_bfqq. Similarly if the merge
+		 * already happened, we need to detach from bfqq now
+		 * so that we cannot merge bio to a request from the
+		 * old cgroup.
+		 */
+		bfq_put_cooperator(sync_bfqq);
+		bic_set_bfqq(bic, NULL, true, act_idx);
+		bfq_release_process_ref(bfqd, sync_bfqq);
+	}
+}
+
 /**
  * __bfq_bic_change_cgroup - move @bic to @bfqg.
  * @bfqd: the queue descriptor.
@@ -714,60 +754,25 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
  * sure that the reference to cgroup is valid across the call (see
  * comments in bfq_bic_update_cgroup on this issue)
  */
-static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
+static void __bfq_bic_change_cgroup(struct bfq_data *bfqd,
 				     struct bfq_io_cq *bic,
 				     struct bfq_group *bfqg)
 {
-	struct bfq_queue *async_bfqq = bic_to_bfqq(bic, false);
+	unsigned int act_idx;
-	struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, true);
-	struct bfq_entity *entity;
 
-	if (async_bfqq) {
+	for (act_idx = 0; act_idx < bfqd->num_actuators; act_idx++) {
-		entity = &async_bfqq->entity;
+		struct bfq_queue *async_bfqq = bic_to_bfqq(bic, false, act_idx);
+		struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, true, act_idx);
 
-		if (entity->sched_data != &bfqg->sched_data) {
+		if (async_bfqq &&
-			bic_set_bfqq(bic, NULL, false);
+		    async_bfqq->entity.sched_data != &bfqg->sched_data) {
+			bic_set_bfqq(bic, NULL, false, act_idx);
 			bfq_release_process_ref(bfqd, async_bfqq);
 		}
+
+		if (sync_bfqq)
+			bfq_sync_bfqq_move(bfqd, sync_bfqq, bic, bfqg, act_idx);
 	}
-
-	if (sync_bfqq) {
-		if (!sync_bfqq->new_bfqq && !bfq_bfqq_coop(sync_bfqq)) {
-			/* We are the only user of this bfqq, just move it */
-			if (sync_bfqq->entity.sched_data != &bfqg->sched_data)
-				bfq_bfqq_move(bfqd, sync_bfqq, bfqg);
-		} else {
-			struct bfq_queue *bfqq;
-
-			/*
-			 * The queue was merged to a different queue. Check
-			 * that the merge chain still belongs to the same
-			 * cgroup.
-			 */
-			for (bfqq = sync_bfqq; bfqq; bfqq = bfqq->new_bfqq)
-				if (bfqq->entity.sched_data !=
-				    &bfqg->sched_data)
-					break;
-			if (bfqq) {
-				/*
-				 * Some queue changed cgroup so the merge is
-				 * not valid anymore. We cannot easily just
-				 * cancel the merge (by clearing new_bfqq) as
-				 * there may be other processes using this
-				 * queue and holding refs to all queues below
-				 * sync_bfqq->new_bfqq. Similarly if the merge
-				 * already happened, we need to detach from
-				 * bfqq now so that we cannot merge bio to a
-				 * request from the old cgroup.
-				 */
-				bfq_put_cooperator(sync_bfqq);
-				bic_set_bfqq(bic, NULL, true);
-				bfq_release_process_ref(bfqd, sync_bfqq);
-			}
-		}
-	}
-
-	return bfqg;
 }
 
 void bfq_bic_update_cgroup(struct bfq_io_cq *bic, struct bio *bio)

block/bfq-iosched.c

@@ -377,16 +377,23 @@ static const unsigned long bfq_late_stable_merging = 600;
 #define RQ_BIC(rq)		((struct bfq_io_cq *)((rq)->elv.priv[0]))
 #define RQ_BFQQ(rq)		((rq)->elv.priv[1])
 
-struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic, bool is_sync)
+struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic, bool is_sync,
+			      unsigned int actuator_idx)
 {
-	return bic->bfqq[is_sync];
+	if (is_sync)
+		return bic->bfqq[1][actuator_idx];
+
+	return bic->bfqq[0][actuator_idx];
 }
 
 static void bfq_put_stable_ref(struct bfq_queue *bfqq);
 
-void bic_set_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq, bool is_sync)
+void bic_set_bfqq(struct bfq_io_cq *bic,
+		  struct bfq_queue *bfqq,
+		  bool is_sync,
+		  unsigned int actuator_idx)
 {
-	struct bfq_queue *old_bfqq = bic->bfqq[is_sync];
+	struct bfq_queue *old_bfqq = bic->bfqq[is_sync][actuator_idx];
 
 	/* Clear bic pointer if bfqq is detached from this bic */
 	if (old_bfqq && old_bfqq->bic == bic)
@@ -405,7 +412,10 @@ void bic_set_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq, bool is_sync)
 	 * we cancel the stable merge if
 	 * bic->stable_merge_bfqq == bfqq.
 	 */
-	bic->bfqq[is_sync] = bfqq;
+	if (is_sync)
+		bic->bfqq[1][actuator_idx] = bfqq;
+	else
+		bic->bfqq[0][actuator_idx] = bfqq;
 
 	if (bfqq && bic->stable_merge_bfqq == bfqq) {
 		/*
@@ -571,23 +581,31 @@ static struct request *bfq_choose_req(struct bfq_data *bfqd,
 #define BFQ_LIMIT_INLINE_DEPTH 16
 
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-static bool bfqq_request_over_limit(struct bfq_queue *bfqq, int limit)
+static bool bfqq_request_over_limit(struct bfq_data *bfqd,
+				    struct bfq_io_cq *bic, blk_opf_t opf,
+				    unsigned int act_idx, int limit)
 {
-	struct bfq_data *bfqd = bfqq->bfqd;
-	struct bfq_entity *entity = &bfqq->entity;
 	struct bfq_entity *inline_entities[BFQ_LIMIT_INLINE_DEPTH];
 	struct bfq_entity **entities = inline_entities;
-	int depth, level, alloc_depth = BFQ_LIMIT_INLINE_DEPTH;
+	int alloc_depth = BFQ_LIMIT_INLINE_DEPTH;
-	int class_idx = bfqq->ioprio_class - 1;
 	struct bfq_sched_data *sched_data;
+	struct bfq_entity *entity;
+	struct bfq_queue *bfqq;
 	unsigned long wsum;
 	bool ret = false;
-
+	int depth;
-	if (!entity->on_st_or_in_serv)
+	int level;
-		return false;
 
 retry:
 	spin_lock_irq(&bfqd->lock);
+	bfqq = bic_to_bfqq(bic, op_is_sync(opf), act_idx);
+	if (!bfqq)
+		goto out;
+
+	entity = &bfqq->entity;
+	if (!entity->on_st_or_in_serv)
+		goto out;
+
 	/* +1 for bfqq entity, root cgroup not included */
 	depth = bfqg_to_blkg(bfqq_group(bfqq))->blkcg->css.cgroup->level + 1;
 	if (depth > alloc_depth) {
@@ -632,7 +650,7 @@ retry:
 			 * class.
 			 */
 			wsum = 0;
-			for (i = 0; i <= class_idx; i++) {
+			for (i = 0; i <= bfqq->ioprio_class - 1; i++) {
 				wsum = wsum * IOPRIO_BE_NR +
 					sched_data->service_tree[i].wsum;
 			}
@@ -655,7 +673,9 @@ out:
 	return ret;
 }
 #else
-static bool bfqq_request_over_limit(struct bfq_queue *bfqq, int limit)
+static bool bfqq_request_over_limit(struct bfq_data *bfqd,
+				    struct bfq_io_cq *bic, blk_opf_t opf,
+				    unsigned int act_idx, int limit)
 {
 	return false;
 }
@@ -680,9 +700,9 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
 {
 	struct bfq_data *bfqd = data->q->elevator->elevator_data;
 	struct bfq_io_cq *bic = bfq_bic_lookup(data->q);
-	struct bfq_queue *bfqq = bic ? bic_to_bfqq(bic, op_is_sync(opf)) : NULL;
 	int depth;
 	unsigned limit = data->q->nr_requests;
+	unsigned int act_idx;
 
 	/* Sync reads have full depth available */
 	if (op_is_sync(opf) && !op_is_write(opf)) {
@@ -692,14 +712,22 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
 		limit = (limit * depth) >> bfqd->full_depth_shift;
 	}
 
-	/*
+	for (act_idx = 0; bic && act_idx < bfqd->num_actuators; act_idx++) {
-	 * Does queue (or any parent entity) exceed number of requests that
+		/* Fast path to check if bfqq is already allocated. */
-	 * should be available to it? Heavily limit depth so that it cannot
+		if (!bic_to_bfqq(bic, op_is_sync(opf), act_idx))
-	 * consume more available requests and thus starve other entities.
+			continue;
-	 */
-	if (bfqq && bfqq_request_over_limit(bfqq, limit))
-		depth = 1;
 
+		/*
+		 * Does queue (or any parent entity) exceed number of
+		 * requests that should be available to it? Heavily
+		 * limit depth so that it cannot consume more
+		 * available requests and thus starve other entities.
+		 */
+		if (bfqq_request_over_limit(bfqd, bic, opf, act_idx, limit)) {
+			depth = 1;
+			break;
+		}
+	}
 	bfq_log(bfqd, "[%s] wr_busy %d sync %d depth %u",
 		__func__, bfqd->wr_busy_queues, op_is_sync(opf), depth);
 	if (depth)
@@ -1820,6 +1848,18 @@ static bool bfq_bfqq_higher_class_or_weight(struct bfq_queue *bfqq,
 	return bfqq_weight > in_serv_weight;
 }
 
+/*
+ * Get the index of the actuator that will serve bio.
+ */
+static unsigned int bfq_actuator_index(struct bfq_data *bfqd, struct bio *bio)
+{
+	/*
+	 * Multi-actuator support not complete yet, so always return 0
+	 * for the moment (to keep incomplete mechanisms off).
+	 */
+	return 0;
+}
+
 static bool bfq_better_to_idle(struct bfq_queue *bfqq);
 
 static void bfq_bfqq_handle_idle_busy_switch(struct bfq_data *bfqd,
@@ -2150,7 +2190,7 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 	 * We reset waker detection logic also if too much time has passed
  	 * since the first detection. If wakeups are rare, pointless idling
 	 * doesn't hurt throughput that much. The condition below makes sure
-	 * we do not uselessly idle blocking waker in more than 1/64 cases. 
+	 * we do not uselessly idle blocking waker in more than 1/64 cases.
 	 */
 	if (bfqd->last_completed_rq_bfqq !=
 	    bfqq->tentative_waker_bfqq ||
@@ -2486,7 +2526,8 @@ static bool bfq_bio_merge(struct request_queue *q, struct bio *bio,
 		 */
 		bfq_bic_update_cgroup(bic, bio);
 
-		bfqd->bio_bfqq = bic_to_bfqq(bic, op_is_sync(bio->bi_opf));
+		bfqd->bio_bfqq = bic_to_bfqq(bic, op_is_sync(bio->bi_opf),
+					     bfq_actuator_index(bfqd, bio));
 	} else {
 		bfqd->bio_bfqq = NULL;
 	}
@@ -3188,7 +3229,7 @@ static struct bfq_queue *bfq_merge_bfqqs(struct bfq_data *bfqd,
 	/*
 	 * Merge queues (that is, let bic redirect its requests to new_bfqq)
 	 */
-	bic_set_bfqq(bic, new_bfqq, true);
+	bic_set_bfqq(bic, new_bfqq, true, bfqq->actuator_idx);
 	bfq_mark_bfqq_coop(new_bfqq);
 	/*
 	 * new_bfqq now belongs to at least two bics (it is a shared queue):
@@ -4818,11 +4859,8 @@ check_queue:
 	 */
 	if (bfq_bfqq_wait_request(bfqq) ||
 	    (bfqq->dispatched != 0 && bfq_better_to_idle(bfqq))) {
-		struct bfq_queue *async_bfqq =
+		unsigned int act_idx = bfqq->actuator_idx;
-			bfqq->bic && bfqq->bic->bfqq[0] &&
+		struct bfq_queue *async_bfqq = NULL;
-			bfq_bfqq_busy(bfqq->bic->bfqq[0]) &&
-			bfqq->bic->bfqq[0]->next_rq ?
-			bfqq->bic->bfqq[0] : NULL;
 		struct bfq_queue *blocked_bfqq =
 			!hlist_empty(&bfqq->woken_list) ?
 			container_of(bfqq->woken_list.first,
@@ -4830,6 +4868,10 @@ check_queue:
 				     woken_list_node)
 			: NULL;
 
+		if (bfqq->bic && bfqq->bic->bfqq[0][act_idx] &&
+		    bfq_bfqq_busy(bfqq->bic->bfqq[0][act_idx]) &&
+		    bfqq->bic->bfqq[0][act_idx]->next_rq)
+			async_bfqq = bfqq->bic->bfqq[0][act_idx];
 		/*
 		 * The next four mutually-exclusive ifs decide
 		 * whether to try injection, and choose the queue to
@@ -4914,7 +4956,7 @@ check_queue:
 		    icq_to_bic(async_bfqq->next_rq->elv.icq) == bfqq->bic &&
 		    bfq_serv_to_charge(async_bfqq->next_rq, async_bfqq) <=
 		    bfq_bfqq_budget_left(async_bfqq))
-			bfqq = bfqq->bic->bfqq[0];
+			bfqq = bfqq->bic->bfqq[0][act_idx];
 		else if (bfqq->waker_bfqq &&
 			   bfq_bfqq_busy(bfqq->waker_bfqq) &&
 			   bfqq->waker_bfqq->next_rq &&
@@ -5375,48 +5417,54 @@ static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
 	bfq_release_process_ref(bfqd, bfqq);
 }
 
-static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync)
+static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync,
+			      unsigned int actuator_idx)
 {
-	struct bfq_queue *bfqq = bic_to_bfqq(bic, is_sync);
+	struct bfq_queue *bfqq = bic_to_bfqq(bic, is_sync, actuator_idx);
 	struct bfq_data *bfqd;
 
 	if (bfqq)
 		bfqd = bfqq->bfqd; /* NULL if scheduler already exited */
 
 	if (bfqq && bfqd) {
-		unsigned long flags;
+		bic_set_bfqq(bic, NULL, is_sync, actuator_idx);
-
-		spin_lock_irqsave(&bfqd->lock, flags);
-		bic_set_bfqq(bic, NULL, is_sync);
 		bfq_exit_bfqq(bfqd, bfqq);
-		spin_unlock_irqrestore(&bfqd->lock, flags);
 	}
 }
 
 static void bfq_exit_icq(struct io_cq *icq)
 {
 	struct bfq_io_cq *bic = icq_to_bic(icq);
+	struct bfq_data *bfqd = bic_to_bfqd(bic);
+	unsigned long flags;
+	unsigned int act_idx;
+	/*
+	 * If bfqd and thus bfqd->num_actuators is not available any
+	 * longer, then cycle over all possible per-actuator bfqqs in
+	 * next loop. We rely on bic being zeroed on creation, and
+	 * therefore on its unused per-actuator fields being NULL.
+	 */
+	unsigned int num_actuators = BFQ_MAX_ACTUATORS;
 
-	if (bic->stable_merge_bfqq) {
+	/*
-		struct bfq_data *bfqd = bic->stable_merge_bfqq->bfqd;
+	 * bfqd is NULL if scheduler already exited, and in that case
-
+	 * this is the last time these queues are accessed.
-		/*
+	 */
-		 * bfqd is NULL if scheduler already exited, and in
+	if (bfqd) {
-		 * that case this is the last time bfqq is accessed.
+		spin_lock_irqsave(&bfqd->lock, flags);
-		 */
+		num_actuators = bfqd->num_actuators;
-		if (bfqd) {
-			unsigned long flags;
-
-			spin_lock_irqsave(&bfqd->lock, flags);
-			bfq_put_stable_ref(bic->stable_merge_bfqq);
-			spin_unlock_irqrestore(&bfqd->lock, flags);
-		} else {
-			bfq_put_stable_ref(bic->stable_merge_bfqq);
-		}
 	}
 
-	bfq_exit_icq_bfqq(bic, true);
+	if (bic->stable_merge_bfqq)
-	bfq_exit_icq_bfqq(bic, false);
+		bfq_put_stable_ref(bic->stable_merge_bfqq);
+
+	for (act_idx = 0; act_idx < num_actuators; act_idx++) {
+		bfq_exit_icq_bfqq(bic, true, act_idx);
+		bfq_exit_icq_bfqq(bic, false, act_idx);
+	}
+
+	if (bfqd)
+		spin_unlock_irqrestore(&bfqd->lock, flags);
 }
 
 /*
@@ -5493,25 +5541,27 @@ static void bfq_check_ioprio_change(struct bfq_io_cq *bic, struct bio *bio)
 
 	bic->ioprio = ioprio;
 
-	bfqq = bic_to_bfqq(bic, false);
+	bfqq = bic_to_bfqq(bic, false, bfq_actuator_index(bfqd, bio));
 	if (bfqq) {
 		struct bfq_queue *old_bfqq = bfqq;
 
 		bfqq = bfq_get_queue(bfqd, bio, false, bic, true);
-		bic_set_bfqq(bic, bfqq, false);
+		bic_set_bfqq(bic, bfqq, false, bfq_actuator_index(bfqd, bio));
 		bfq_release_process_ref(bfqd, old_bfqq);
 	}
 
-	bfqq = bic_to_bfqq(bic, true);
+	bfqq = bic_to_bfqq(bic, true, bfq_actuator_index(bfqd, bio));
 	if (bfqq)
 		bfq_set_next_ioprio_data(bfqq, bic);
 }
 
 static void bfq_init_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
-			  struct bfq_io_cq *bic, pid_t pid, int is_sync)
+			  struct bfq_io_cq *bic, pid_t pid, int is_sync,
+			  unsigned int act_idx)
 {
 	u64 now_ns = ktime_get_ns();
 
+	bfqq->actuator_idx = act_idx;
 	RB_CLEAR_NODE(&bfqq->entity.rb_node);
 	INIT_LIST_HEAD(&bfqq->fifo);
 	INIT_HLIST_NODE(&bfqq->burst_list_node);
@@ -5762,7 +5812,7 @@ static struct bfq_queue *bfq_get_queue(struct bfq_data *bfqd,
 
 	if (bfqq) {
 		bfq_init_bfqq(bfqd, bfqq, bic, current->pid,
-			      is_sync);
+			      is_sync, bfq_actuator_index(bfqd, bio));
 		bfq_init_entity(&bfqq->entity, bfqg);
 		bfq_log_bfqq(bfqd, bfqq, "allocated");
 	} else {
@@ -6078,7 +6128,8 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq)
 		 * then complete the merge and redirect it to
 		 * new_bfqq.
 		 */
-		if (bic_to_bfqq(RQ_BIC(rq), 1) == bfqq) {
+		if (bic_to_bfqq(RQ_BIC(rq), true,
+				bfq_actuator_index(bfqd, rq->bio)) == bfqq) {
 			while (bfqq != new_bfqq)
 				bfqq = bfq_merge_bfqqs(bfqd, RQ_BIC(rq), bfqq);
 		}
@@ -6632,7 +6683,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
 		return bfqq;
 	}
 
-	bic_set_bfqq(bic, NULL, true);
+	bic_set_bfqq(bic, NULL, true, bfqq->actuator_idx);
 
 	bfq_put_cooperator(bfqq);
 
@@ -6646,7 +6697,8 @@ static struct bfq_queue *bfq_get_bfqq_handle_split(struct bfq_data *bfqd,
 						   bool split, bool is_sync,
 						   bool *new_queue)
 {
-	struct bfq_queue *bfqq = bic_to_bfqq(bic, is_sync);
+	unsigned int act_idx = bfq_actuator_index(bfqd, bio);
+	struct bfq_queue *bfqq = bic_to_bfqq(bic, is_sync, act_idx);
 
 	if (likely(bfqq && bfqq != &bfqd->oom_bfqq))
 		return bfqq;
@@ -6658,7 +6710,7 @@ static struct bfq_queue *bfq_get_bfqq_handle_split(struct bfq_data *bfqd,
 		bfq_put_queue(bfqq);
 	bfqq = bfq_get_queue(bfqd, bio, is_sync, bic, split);
 
-	bic_set_bfqq(bic, bfqq, is_sync);
+	bic_set_bfqq(bic, bfqq, is_sync, act_idx);
 	if (split && is_sync) {
 		if ((bic->was_in_burst_list && bfqd->large_burst) ||
 		    bic->saved_in_large_burst)
@@ -7139,8 +7191,10 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e)
 	 * Our fallback bfqq if bfq_find_alloc_queue() runs into OOM issues.
 	 * Grab a permanent reference to it, so that the normal code flow
 	 * will not attempt to free it.
+	 * Set zero as actuator index: we will pretend that
+	 * all I/O requests are for the same actuator.
 	 */
-	bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, NULL, 1, 0);
+	bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, NULL, 1, 0, 0);
 	bfqd->oom_bfqq.ref++;
 	bfqd->oom_bfqq.new_ioprio = BFQ_DEFAULT_QUEUE_IOPRIO;
 	bfqd->oom_bfqq.new_ioprio_class = IOPRIO_CLASS_BE;
@@ -7159,6 +7213,13 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e)
 
 	bfqd->queue = q;
 
+	/*
+	 * Multi-actuator support not complete yet, unconditionally
+	 * set to only one actuator for the moment (to keep incomplete
+	 * mechanisms off).
+	 */
+	bfqd->num_actuators = 1;
+
 	INIT_LIST_HEAD(&bfqd->dispatch);
 
 	hrtimer_init(&bfqd->idle_slice_timer, CLOCK_MONOTONIC,

block/bfq-iosched.h

@@ -33,6 +33,14 @@
  */
 #define BFQ_SOFTRT_WEIGHT_FACTOR	100
 
+/*
+ * Maximum number of actuators supported. This constant is used simply
+ * to define the size of the static array that will contain
+ * per-actuator data. The current value is hopefully a good upper
+ * bound to the possible number of actuators of any actual drive.
+ */
+#define BFQ_MAX_ACTUATORS 8
+
 struct bfq_entity;
 
 /**
@@ -225,12 +233,14 @@ struct bfq_ttime {
  * struct bfq_queue - leaf schedulable entity.
  *
  * A bfq_queue is a leaf request queue; it can be associated with an
- * io_context or more, if it  is  async or shared  between  cooperating
+ * io_context or more, if it is async or shared between cooperating
- * processes. @cgroup holds a reference to the cgroup, to be sure that it
+ * processes. Besides, it contains I/O requests for only one actuator
- * does not disappear while a bfqq still references it (mostly to avoid
+ * (an io_context is associated with a different bfq_queue for each
- * races between request issuing and task migration followed by cgroup
+ * actuator it generates I/O for). @cgroup holds a reference to the
- * destruction).
+ * cgroup, to be sure that it does not disappear while a bfqq still
- * All the fields are protected by the queue lock of the containing bfqd.
+ * references it (mostly to avoid races between request issuing and
+ * task migration followed by cgroup destruction).  All the fields are
+ * protected by the queue lock of the containing bfqd.
  */
 struct bfq_queue {
 	/* reference counter */
@@ -395,6 +405,9 @@ struct bfq_queue {
 	 * the woken queues when this queue exits.
 	 */
 	struct hlist_head woken_list;
+
+	/* index of the actuator this queue is associated with */
+	unsigned int actuator_idx;
 };
 
 /**
@@ -403,8 +416,17 @@ struct bfq_queue {
 struct bfq_io_cq {
 	/* associated io_cq structure */
 	struct io_cq icq; /* must be the first member */
-	/* array of two process queues, the sync and the async */
+	/*
-	struct bfq_queue *bfqq[2];
+	 * Matrix of associated process queues: first row for async
+	 * queues, second row sync queues. Each row contains one
+	 * column for each actuator. An I/O request generated by the
+	 * process is inserted into the queue pointed by bfqq[i][j] if
+	 * the request is to be served by the j-th actuator of the
+	 * drive, where i==0 or i==1, depending on whether the request
+	 * is async or sync. So there is a distinct queue for each
+	 * actuator.
+	 */
+	struct bfq_queue *bfqq[2][BFQ_MAX_ACTUATORS];
 	/* per (request_queue, blkcg) ioprio */
 	int ioprio;
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
@@ -768,6 +790,13 @@ struct bfq_data {
 	 */
 	unsigned int word_depths[2][2];
 	unsigned int full_depth_shift;
+
+	/*
+	 * Number of independent actuators. This is equal to 1 in
+	 * case of single-actuator drives.
+	 */
+	unsigned int num_actuators;
+
 };
 
 enum bfqq_state_flags {
@@ -964,8 +993,10 @@ struct bfq_group {
 
 extern const int bfq_timeout;
 
-struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic, bool is_sync);
+struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic, bool is_sync,
-void bic_set_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq, bool is_sync);
+				unsigned int actuator_idx);
+void bic_set_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq, bool is_sync,
+				unsigned int actuator_idx);
 struct bfq_data *bic_to_bfqd(struct bfq_io_cq *bic);
 void bfq_pos_tree_add_move(struct bfq_data *bfqd, struct bfq_queue *bfqq);
 void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_queue *bfqq,

block/bio.c

@@ -73,7 +73,7 @@ struct bio_slab {
 	struct kmem_cache *slab;
 	unsigned int slab_ref;
 	unsigned int slab_size;
-	char name[8];
+	char name[12];
 };
 static DEFINE_MUTEX(bio_slab_lock);
 static DEFINE_XARRAY(bio_slabs);

block/partitions/efi.c

@@ -682,7 +682,7 @@ static void utf16_le_to_7bit(const __le16 *in, unsigned int size, u8 *out)
 	out[size] = 0;
 
 	while (i < size) {
-		u8 c = le16_to_cpu(in[i]) & 0xff;
+		u8 c = le16_to_cpu(in[i]) & 0x7f;
 
 		if (c && !isprint(c))
 			c = '!';

drivers/acpi/nfit/core.c

@@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
 		cmd_mask = nd_desc->cmd_mask;
 		if (cmd == ND_CMD_CALL && call_pkg->nd_family) {
 			family = call_pkg->nd_family;
-			if (family > NVDIMM_BUS_FAMILY_MAX ||
+			if (call_pkg->nd_family > NVDIMM_BUS_FAMILY_MAX ||
 			    !test_bit(family, &nd_desc->bus_family_mask))
 				return -EINVAL;
 			family = array_index_nospec(family,

drivers/acpi/processor_idle.c

@@ -268,6 +268,10 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
 			 ACPI_CX_DESC_LEN, "ACPI P_LVL3 IOPORT 0x%x",
 			 pr->power.states[ACPI_STATE_C3].address);
 
+	if (!pr->power.states[ACPI_STATE_C2].address &&
+	    !pr->power.states[ACPI_STATE_C3].address)
+		return -ENODEV;
+
 	return 0;
 }
 

drivers/acpi/resource.c

@@ -439,6 +439,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
 		},
 	},
+	{
+		/* Asus Vivobook X1404VAP */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "X1404VAP"),
+		},
+	},
 	{
 		/* Asus Vivobook X1504VAP */
 		.matches = {
@@ -553,6 +560,12 @@ static const struct dmi_system_id maingear_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "RP-15"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."),
+			DMI_MATCH(DMI_BOARD_NAME, "MECH-17"),
+		},
+	},
 	{
 		/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */
 		.matches = {

drivers/base/core.c

@@ -2024,6 +2024,7 @@ static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle,
 out:
 	sup_handle->flags &= ~FWNODE_FLAG_VISITED;
 	put_device(sup_dev);
+	put_device(con_dev);
 	put_device(par_dev);
 	return ret;
 }

drivers/base/power/main.c

@@ -895,6 +895,9 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)
 	if (dev->power.syscore)
 		goto Complete;
 
+	if (!dev->power.is_suspended)
+		goto Complete;
+
 	if (dev->power.direct_complete) {
 		/* Match the pm_runtime_disable() in __device_suspend(). */
 		pm_runtime_enable(dev);
@@ -913,9 +916,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)
 	 */
 	dev->power.is_prepared = false;
 
-	if (!dev->power.is_suspended)
-		goto Unlock;
-
 	if (dev->pm_domain) {
 		info = "power domain ";
 		callback = pm_op(&dev->pm_domain->ops, state);
@@ -955,7 +955,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)
 	error = dpm_run_callback(callback, dev, state, info);
 	dev->power.is_suspended = false;
 
- Unlock:
 	device_unlock(dev);
 	dpm_watchdog_clear(&wd);
 
@@ -1239,14 +1238,13 @@ Skip:
 	dev->power.is_noirq_suspended = true;
 
 	/*
-	 * Skipping the resume of devices that were in use right before the
+	 * Devices must be resumed unless they are explicitly allowed to be left
-	 * system suspend (as indicated by their PM-runtime usage counters)
+	 * in suspend, but even in that case skipping the resume of devices that
-	 * would be suboptimal.  Also resume them if doing that is not allowed
+	 * were in use right before the system suspend (as indicated by their
-	 * to be skipped.
+	 * runtime PM usage counters and child counters) would be suboptimal.
 	 */
-	if (atomic_read(&dev->power.usage_count) > 1 ||
+	if (!(dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME) &&
-	    !(dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME) &&
+	      dev->power.may_skip_resume) || !pm_runtime_need_not_resume(dev))
-	      dev->power.may_skip_resume))
 		dev->power.must_resume = true;
 
 	if (dev->power.must_resume)
@@ -1644,6 +1642,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
 			pm_runtime_disable(dev);
 			if (pm_runtime_status_suspended(dev)) {
 				pm_dev_dbg(dev, state, "direct-complete ");
+				dev->power.is_suspended = true;
 				goto Complete;
 			}
 

drivers/base/power/runtime.c

@@ -1841,7 +1841,7 @@ void pm_runtime_drop_link(struct device_link *link)
 	pm_request_idle(link->supplier);
 }
 
-static bool pm_runtime_need_not_resume(struct device *dev)
+bool pm_runtime_need_not_resume(struct device *dev)
 {
 	return atomic_read(&dev->power.usage_count) <= 1 &&
 		(atomic_read(&dev->power.child_count) == 0 ||

drivers/block/ublk_drv.c

@@ -1873,9 +1873,12 @@ static int ublk_ctrl_set_params(struct ublk_device *ub,
 	if (ph.len > sizeof(struct ublk_params))
 		ph.len = sizeof(struct ublk_params);
 
-	/* parameters can only be changed when device isn't live */
 	mutex_lock(&ub->mutex);
-	if (ub->dev_info.state == UBLK_S_DEV_LIVE) {
+	if (test_bit(UB_STATE_USED, &ub->state)) {
+		/*
+		 * Parameters can only be changed when device hasn't
+		 * been started yet
+		 */
 		ret = -EACCES;
 	} else if (copy_from_user(&ub->params, argp, ph.len)) {
 		ret = -EFAULT;

drivers/bluetooth/btqca.c

@@ -246,6 +246,39 @@ int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
 }
 EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd);
 
+static bool qca_filename_has_extension(const char *filename)
+{
+	const char *suffix = strrchr(filename, '.');
+
+	/* File extensions require a dot, but not as the first or last character */
+	if (!suffix || suffix == filename || *(suffix + 1) == '\0')
+		return 0;
+
+	/* Avoid matching directories with names that look like files with extensions */
+	return !strchr(suffix, '/');
+}
+
+static bool qca_get_alt_nvm_file(char *filename, size_t max_size)
+{
+	char fwname[64];
+	const char *suffix;
+
+	/* nvm file name has an extension, replace with .bin */
+	if (qca_filename_has_extension(filename)) {
+		suffix = strrchr(filename, '.');
+		strscpy(fwname, filename, suffix - filename + 1);
+		snprintf(fwname + (suffix - filename),
+		       sizeof(fwname) - (suffix - filename), ".bin");
+		/* If nvm file is already the default one, return false to skip the retry. */
+		if (strcmp(fwname, filename) == 0)
+			return false;
+
+		snprintf(filename, max_size, "%s", fwname);
+		return true;
+	}
+	return false;
+}
+
 static int qca_tlv_check_data(struct hci_dev *hdev,
 			       struct qca_fw_config *config,
 			       u8 *fw_data, size_t fw_size,
@@ -543,6 +576,19 @@ static int qca_download_firmware(struct hci_dev *hdev,
 					   config->fwname, ret);
 				return ret;
 			}
+		}
+		/* If the board-specific file is missing, try loading the default
+		 * one, unless that was attempted already.
+		 */
+		else if (config->type == TLV_TYPE_NVM &&
+			 qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) {
+			bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
+			ret = request_firmware(&fw, config->fwname, &hdev->dev);
+			if (ret) {
+				bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
+					   config->fwname, ret);
+				return ret;
+			}
 		} else {
 			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
 				   config->fwname, ret);

drivers/bluetooth/btusb.c

@@ -3769,6 +3769,7 @@ static ssize_t force_poll_sync_write(struct file *file,
 }
 
 static const struct file_operations force_poll_sync_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= force_poll_sync_read,
 	.write		= force_poll_sync_write,

drivers/bus/mhi/host/pci_generic.c

@@ -824,8 +824,9 @@ static void mhi_pci_recovery_work(struct work_struct *work)
 err_unprepare:
 	mhi_unprepare_after_power_down(mhi_cntrl);
 err_try_reset:
-	if (pci_reset_function(pdev))
+	err = pci_try_reset_function(pdev);
-		dev_err(&pdev->dev, "Recovery failed\n");
+	if (err)
+		dev_err(&pdev->dev, "Recovery failed: %d\n", err);
 }
 
 static void health_check(struct timer_list *t)

drivers/char/tpm/eventlog/acpi.c

@@ -14,6 +14,7 @@
  * Access to the event log extended by the TCG BIOS of PC platform
  */
 
+#include <linux/device.h>
 #include <linux/seq_file.h>
 #include <linux/fs.h>
 #include <linux/security.h>
@@ -62,6 +63,11 @@ static bool tpm_is_tpm2_log(void *bios_event_log, u64 len)
 	return n == 0;
 }
 
+static void tpm_bios_log_free(void *data)
+{
+	kvfree(data);
+}
+
 /* read binary bios log */
 int tpm_read_log_acpi(struct tpm_chip *chip)
 {
@@ -135,7 +141,7 @@ int tpm_read_log_acpi(struct tpm_chip *chip)
 	}
 
 	/* malloc EventLog space */
-	log->bios_event_log = kmalloc(len, GFP_KERNEL);
+	log->bios_event_log = kvmalloc(len, GFP_KERNEL);
 	if (!log->bios_event_log)
 		return -ENOMEM;
 
@@ -161,10 +167,16 @@ int tpm_read_log_acpi(struct tpm_chip *chip)
 		goto err;
 	}
 
+	ret = devm_add_action(&chip->dev, tpm_bios_log_free, log->bios_event_log);
+	if (ret) {
+		log->bios_event_log = NULL;
+		goto err;
+	}
+
 	return format;
 
 err:
-	kfree(log->bios_event_log);
+	tpm_bios_log_free(log->bios_event_log);
 	log->bios_event_log = NULL;
 	return ret;
 }

drivers/char/tpm/eventlog/efi.c

@@ -6,6 +6,7 @@
  *      Thiebaud Weksteen <tweek@google.com>
  */
 
+#include <linux/device.h>
 #include <linux/efi.h>
 #include <linux/tpm_eventlog.h>
 
@@ -55,7 +56,7 @@ int tpm_read_log_efi(struct tpm_chip *chip)
 	}
 
 	/* malloc EventLog space */
-	log->bios_event_log = kmemdup(log_tbl->log, log_size, GFP_KERNEL);
+	log->bios_event_log = devm_kmemdup(&chip->dev, log_tbl->log, log_size, GFP_KERNEL);
 	if (!log->bios_event_log) {
 		ret = -ENOMEM;
 		goto out;
@@ -76,7 +77,7 @@ int tpm_read_log_efi(struct tpm_chip *chip)
 			     MEMREMAP_WB);
 	if (!final_tbl) {
 		pr_err("Could not map UEFI TPM final log\n");
-		kfree(log->bios_event_log);
+		devm_kfree(&chip->dev, log->bios_event_log);
 		ret = -ENOMEM;
 		goto out;
 	}
@@ -91,11 +92,11 @@ int tpm_read_log_efi(struct tpm_chip *chip)
 	 * Allocate memory for the 'combined log' where we will append the
 	 * 'final events log' to.
 	 */
-	tmp = krealloc(log->bios_event_log,
+	tmp = devm_krealloc(&chip->dev, log->bios_event_log,
-		       log_size + final_events_log_size,
+			    log_size + final_events_log_size,
-		       GFP_KERNEL);
+			    GFP_KERNEL);
 	if (!tmp) {
-		kfree(log->bios_event_log);
+		devm_kfree(&chip->dev, log->bios_event_log);
 		ret = -ENOMEM;
 		goto out;
 	}

drivers/char/tpm/eventlog/of.c

@@ -10,6 +10,7 @@
  * Read the event log created by the firmware on PPC64
  */
 
+#include <linux/device.h>
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/tpm_eventlog.h>
@@ -65,7 +66,7 @@ int tpm_read_log_of(struct tpm_chip *chip)
 		return -EIO;
 	}
 
-	log->bios_event_log = kmemdup(__va(base), size, GFP_KERNEL);
+	log->bios_event_log = devm_kmemdup(&chip->dev, __va(base), size, GFP_KERNEL);
 	if (!log->bios_event_log)
 		return -ENOMEM;
 

drivers/char/tpm/tpm-chip.c

@@ -267,7 +267,6 @@ static void tpm_dev_release(struct device *dev)
 	idr_remove(&dev_nums_idr, chip->dev_num);
 	mutex_unlock(&idr_lock);
 
-	kfree(chip->log.bios_event_log);
 	kfree(chip->work_space.context_buf);
 	kfree(chip->work_space.session_buf);
 	kfree(chip->allocated_banks);

drivers/clk/mediatek/clk-mt2701-bdp.c

@@ -31,6 +31,7 @@ static const struct mtk_gate_regs bdp1_cg_regs = {
 	GATE_MTK(_id, _name, _parent, &bdp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
 
 static const struct mtk_gate bdp_clks[] = {
+	GATE_DUMMY(CLK_DUMMY, "bdp_dummy"),
 	GATE_BDP0(CLK_BDP_BRG_BA, "brg_baclk", "mm_sel", 0),
 	GATE_BDP0(CLK_BDP_BRG_DRAM, "brg_dram", "mm_sel", 1),
 	GATE_BDP0(CLK_BDP_LARB_DRAM, "larb_dram", "mm_sel", 2),

drivers/clk/mediatek/clk-mt2701-img.c

@@ -22,6 +22,7 @@ static const struct mtk_gate_regs img_cg_regs = {
 	GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
 
 static const struct mtk_gate img_clks[] = {
+	GATE_DUMMY(CLK_DUMMY, "img_dummy"),
 	GATE_IMG(CLK_IMG_SMI_COMM, "img_smi_comm", "mm_sel", 0),
 	GATE_IMG(CLK_IMG_RESZ, "img_resz", "mm_sel", 1),
 	GATE_IMG(CLK_IMG_JPGDEC_SMI, "img_jpgdec_smi", "mm_sel", 5),

drivers/clk/mediatek/clk-mt2701-vdec.c

@@ -31,6 +31,7 @@ static const struct mtk_gate_regs vdec1_cg_regs = {
 	GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
 
 static const struct mtk_gate vdec_clks[] = {
+	GATE_DUMMY(CLK_DUMMY, "vdec_dummy"),
 	GATE_VDEC0(CLK_VDEC_CKGEN, "vdec_cken", "vdec_sel", 0),
 	GATE_VDEC1(CLK_VDEC_LARB, "vdec_larb_cken", "mm_sel", 0),
 };

drivers/clk/mediatek/clk-mtk.c

@@ -21,6 +21,22 @@
 #include "clk-gate.h"
 #include "clk-mux.h"
 
+const struct mtk_gate_regs cg_regs_dummy = { 0, 0, 0 };
+EXPORT_SYMBOL_GPL(cg_regs_dummy);
+
+static int mtk_clk_dummy_enable(struct clk_hw *hw)
+{
+	return 0;
+}
+
+static void mtk_clk_dummy_disable(struct clk_hw *hw) { }
+
+const struct clk_ops mtk_clk_dummy_ops = {
+	.enable		= mtk_clk_dummy_enable,
+	.disable	= mtk_clk_dummy_disable,
+};
+EXPORT_SYMBOL_GPL(mtk_clk_dummy_ops);
+
 static void mtk_init_clk_data(struct clk_hw_onecell_data *clk_data,
 			      unsigned int clk_num)
 {

drivers/clk/mediatek/clk-mtk.h

@@ -22,6 +22,25 @@
 
 struct platform_device;
 
+/*
+ * We need the clock IDs to start from zero but to maintain devicetree
+ * backwards compatibility we can't change bindings to start from zero.
+ * Only a few platforms are affected, so we solve issues given by the
+ * commonized MTK clocks probe function(s) by adding a dummy clock at
+ * the beginning where needed.
+ */
+#define CLK_DUMMY		0
+
+extern const struct clk_ops mtk_clk_dummy_ops;
+extern const struct mtk_gate_regs cg_regs_dummy;
+
+#define GATE_DUMMY(_id, _name) {				\
+		.id = _id,					\
+		.name = _name,					\
+		.regs = &cg_regs_dummy,				\
+		.ops = &mtk_clk_dummy_ops,			\
+	}
+
 struct mtk_fixed_clk {
 	int id;
 	const char *name;

drivers/clk/meson/g12a.c

@@ -1136,8 +1136,18 @@ static struct clk_regmap g12a_cpu_clk_div16_en = {
 	.hw.init = &(struct clk_init_data) {
 		.name = "cpu_clk_div16_en",
 		.ops = &clk_regmap_gate_ro_ops,
-		.parent_hws = (const struct clk_hw *[]) {
+		.parent_data = &(const struct clk_parent_data) {
-			&g12a_cpu_clk.hw
+			/*
+			 * Note:
+			 * G12A and G12B have different cpu clocks (with
+			 * different struct clk_hw). We fallback to the global
+			 * naming string mechanism so this clock picks
+			 * up the appropriate one. Same goes for the other
+			 * clock using cpu cluster A clock output and present
+			 * on both G12 variant.
+			 */
+			.name = "cpu_clk",
+			.index = -1,
 		},
 		.num_parents = 1,
 		/*
@@ -1202,7 +1212,10 @@ static struct clk_regmap g12a_cpu_clk_apb_div = {
 	.hw.init = &(struct clk_init_data){
 		.name = "cpu_clk_apb_div",
 		.ops = &clk_regmap_divider_ro_ops,
-		.parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw },
+		.parent_data = &(const struct clk_parent_data) {
+			.name = "cpu_clk",
+			.index = -1,
+		},
 		.num_parents = 1,
 	},
 };
@@ -1236,7 +1249,10 @@ static struct clk_regmap g12a_cpu_clk_atb_div = {
 	.hw.init = &(struct clk_init_data){
 		.name = "cpu_clk_atb_div",
 		.ops = &clk_regmap_divider_ro_ops,
-		.parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw },
+		.parent_data = &(const struct clk_parent_data) {
+			.name = "cpu_clk",
+			.index = -1,
+		},
 		.num_parents = 1,
 	},
 };
@@ -1270,7 +1286,10 @@ static struct clk_regmap g12a_cpu_clk_axi_div = {
 	.hw.init = &(struct clk_init_data){
 		.name = "cpu_clk_axi_div",
 		.ops = &clk_regmap_divider_ro_ops,
-		.parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw },
+		.parent_data = &(const struct clk_parent_data) {
+			.name = "cpu_clk",
+			.index = -1,
+		},
 		.num_parents = 1,
 	},
 };
@@ -1305,13 +1324,6 @@ static struct clk_regmap g12a_cpu_clk_trace_div = {
 		.name = "cpu_clk_trace_div",
 		.ops = &clk_regmap_divider_ro_ops,
 		.parent_data = &(const struct clk_parent_data) {
-			/*
-			 * Note:
-			 * G12A and G12B have different cpu_clks (with
-			 * different struct clk_hw). We fallback to the global
-			 * naming string mechanism so cpu_clk_trace_div picks
-			 * up the appropriate one.
-			 */
 			.name = "cpu_clk",
 			.index = -1,
 		},
@@ -4187,7 +4199,7 @@ static MESON_GATE(g12a_spicc_1,			HHI_GCLK_MPEG0,	14);
 static MESON_GATE(g12a_hiu_reg,			HHI_GCLK_MPEG0,	19);
 static MESON_GATE(g12a_mipi_dsi_phy,		HHI_GCLK_MPEG0,	20);
 static MESON_GATE(g12a_assist_misc,		HHI_GCLK_MPEG0,	23);
-static MESON_GATE(g12a_emmc_a,			HHI_GCLK_MPEG0,	4);
+static MESON_GATE(g12a_emmc_a,			HHI_GCLK_MPEG0,	24);
 static MESON_GATE(g12a_emmc_b,			HHI_GCLK_MPEG0,	25);
 static MESON_GATE(g12a_emmc_c,			HHI_GCLK_MPEG0,	26);
 static MESON_GATE(g12a_audio_codec,		HHI_GCLK_MPEG0,	28);

drivers/clk/meson/gxbb.c

@@ -1270,14 +1270,13 @@ static struct clk_regmap gxbb_cts_i958 = {
 	},
 };
 
+/*
+ * This table skips a clock named 'cts_slow_oscin' in the documentation
+ * This clock does not exist yet in this controller or the AO one
+ */
+static u32 gxbb_32k_clk_parents_val_table[] = { 0, 2, 3 };
 static const struct clk_parent_data gxbb_32k_clk_parent_data[] = {
 	{ .fw_name = "xtal", },
-	/*
-	 * FIXME: This clock is provided by the ao clock controller but the
-	 * clock is not yet part of the binding of this controller, so string
-	 * name must be use to set this parent.
-	 */
-	{ .name = "cts_slow_oscin", .index = -1 },
 	{ .hw = &gxbb_fclk_div3.hw },
 	{ .hw = &gxbb_fclk_div5.hw },
 };
@@ -1287,6 +1286,7 @@ static struct clk_regmap gxbb_32k_clk_sel = {
 		.offset = HHI_32K_CLK_CNTL,
 		.mask = 0x3,
 		.shift = 16,
+		.table = gxbb_32k_clk_parents_val_table,
 		},
 	.hw.init = &(struct clk_init_data){
 		.name = "32k_clk_sel",
@@ -1310,7 +1310,7 @@ static struct clk_regmap gxbb_32k_clk_div = {
 			&gxbb_32k_clk_sel.hw
 		},
 		.num_parents = 1,
-		.flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST,
+		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 

drivers/clk/qcom/gcc-msm8953.c

@@ -3771,7 +3771,7 @@ static struct clk_branch gcc_venus0_axi_clk = {
 
 static struct clk_branch gcc_venus0_core0_vcodec0_clk = {
 	.halt_reg = 0x4c02c,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x4c02c,
 		.enable_mask = BIT(0),