6.10.13-rc1 review

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kang Yang <[email protected]>

[ Upstream commit 177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3 ]

Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") from Feb 28, 2024 (linux-next), leads to the following Smatch static checker warning:

drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()
warn: sleeping in atomic context

The reason is that ath11k_bcn_tx_status_event() will directly call might sleep function ath11k_wmi_cmd_send() during RCU read-side critical sections. The call trace is like:

ath11k_bcn_tx_status_event()
-> rcu_read_lock()
-> ath11k_mac_bcn_tx_event()

	-> ath11k_mac_setup_bcn_tmpl()
	……
		-> ath11k_wmi_bcn_tmpl()
			-> ath11k_wmi_cmd_send()

-> rcu_read_unlock()

Commit 886433a98425 ("ath11k: add support for BSS color change") added the ath11k_mac_bcn_tx_event(), commit 01e782c89108 ("ath11k: fix warning of RCU usage for ath11k_mac_get_arvif_by_vdev_id()") added the RCU lock to avoid warning but also introduced this BUG.

Use work queue to avoid directly calling ath11k_mac_bcn_tx_event() during RCU critical sections. No need to worry about the deletion of vif because cancel_work_sync() will drop the work if it doesn't start or block vif deletion until the running work is done.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30

---
 drivers/net/wireless/ath/ath11k/core.h |  1 +
 drivers/net/wireless/ath/ath11k/mac.c  | 12 ++++++++++++
 drivers/net/wireless/ath/ath11k/wmi.c  |  4 +++-
 3 files changed, 16 insertions(+), 1 deletion(-)

index 141ba4487cb42..9d2d3a86abf17 100644
@@ -396,6 +396,7 @@ struct ath11k_vif {
 	u8 bssid[ETH_ALEN];
 	struct cfg80211_bitrate_mask bitrate_mask;
 	struct delayed_work connection_loss_work;
+	struct work_struct bcn_tx_work;
 	int num_legacy_stations;
 	int rtscts_prot_mode;
 	int txpower;

index eaa53bc39ab2c..74719cb78888b 100644
@@ -6599,6 +6599,16 @@ static int ath11k_mac_vdev_delete(struct ath11k *ar, struct ath11k_vif *arvif)
 	return ret;
 }
 
+static void ath11k_mac_bcn_tx_work(struct work_struct *work)
+{
+	struct ath11k_vif *arvif = container_of(work, struct ath11k_vif,
+						bcn_tx_work);
+
+	mutex_lock(&arvif->ar->conf_mutex);
+	ath11k_mac_bcn_tx_event(arvif);
+	mutex_unlock(&arvif->ar->conf_mutex);
+}
+
 static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
 				       struct ieee80211_vif *vif)
 {

@@ -6637,6 +6647,7 @@ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
 	arvif->vif = vif;
 
 	INIT_LIST_HEAD(&arvif->list);
+	INIT_WORK(&arvif->bcn_tx_work, ath11k_mac_bcn_tx_work);
 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
 			  ath11k_mac_vif_sta_connection_loss_work);
 

@@ -6879,6 +6890,7 @@ static void ath11k_mac_op_remove_interface(struct ieee80211_hw *hw,
 	int i;
 
 	cancel_delayed_work_sync(&arvif->connection_loss_work);
+	cancel_work_sync(&arvif->bcn_tx_work);
 
 	mutex_lock(&ar->conf_mutex);
 

index 6ff01c45f1659..f50a4c0d4b2ba 100644
@@ -7404,7 +7404,9 @@ static void ath11k_bcn_tx_status_event(struct ath11k_base *ab, struct sk_buff *s
 		rcu_read_unlock();
 		return;
 	}
-	ath11k_mac_bcn_tx_event(arvif);
+
+	queue_work(ab->workqueue, &arvif->bcn_tx_work);
+
 	rcu_read_unlock();
 }
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arend van Spriel <[email protected]>

[ Upstream commit c6002b6c05f3edfa12fd25990cc637281f200442 ]

When the firmware interface layer was refactored it provided various "get" and "set" functions. For the "get" in some cases a parameter needed to be passed down to firmware as a key indicating what to "get" turning the output parameter of the "get" function into an input parameter as well. To accommodate this the "get" function blindly copies the parameter which in some places resulted in an uninitialized warnings from the compiler. These have been fixed by initializing the input parameter in the past. Recently another batch of similar fixes were submitted to address clang static checker warnings [1].

Proposing another solution by introducing a "query" variant which is used when the (input) parameter is needed by firmware. The "get" variant will only fill the (output) parameter with the result received from firmware taking care of proper endianess conversion.

[1] https://lore.kernel.org/all/[email protected]/

---
 .../broadcom/brcm80211/brcmfmac/btcoex.c      |  2 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 30 +++++++-------
 .../broadcom/brcm80211/brcmfmac/core.c        |  2 +-
 .../broadcom/brcm80211/brcmfmac/feature.c     |  2 +-
 .../broadcom/brcm80211/brcmfmac/fwil.h        | 40 ++++++++++++++-----
 5 files changed, 48 insertions(+), 28 deletions(-)

index 7ea2631b80692..00794086cc7c9 100644
@@ -123,7 +123,7 @@ static s32 brcmf_btcoex_params_read(struct brcmf_if *ifp, u32 addr, u32 *data)
 {
 	*data = addr;
 
-	return brcmf_fil_iovar_int_get(ifp, "btc_params", data);
+	return brcmf_fil_iovar_int_query(ifp, "btc_params", data);
 }
 
 /**

index 826b768196e28..ccc069ae5e9d8 100644
@@ -663,8 +663,8 @@ static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
 	/* interface_create version 3+ */
 	/* get supported version from firmware side */
 	iface_create_ver = 0;
-	err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
-				       &iface_create_ver);
+	err = brcmf_fil_bsscfg_int_query(ifp, "interface_create",
+					 &iface_create_ver);
 	if (err) {
 		brcmf_err("fail to get supported version, err=%d\n", err);
 		return -EOPNOTSUPP;

@@ -756,8 +756,8 @@ static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 	/* interface_create version 3+ */
 	/* get supported version from firmware side */
 	iface_create_ver = 0;
-	err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
-				       &iface_create_ver);
+	err = brcmf_fil_bsscfg_int_query(ifp, "interface_create",
+					 &iface_create_ver);
 	if (err) {
 		brcmf_err("fail to get supported version, err=%d\n", err);
 		return -EOPNOTSUPP;

@@ -2101,7 +2101,8 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
 	if (!sme->crypto.n_akm_suites)
 		return 0;
 
-	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
+	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
+				       "wpa_auth", &val);
 	if (err) {
 		bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
 		return err;

@@ -2680,7 +2681,7 @@ brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
 	struct brcmf_pub *drvr = cfg->pub;
-	s32 qdbm = 0;
+	s32 qdbm;
 	s32 err;
 
 	brcmf_dbg(TRACE, "Enter\n");

@@ -3067,7 +3068,7 @@ brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
 	struct brcmf_scb_val_le scbval;
 	struct brcmf_pktcnt_le pktcnt;
 	s32 err;
-	u32 rate = 0;
+	u32 rate;
 	u32 rssi;
 
 	/* Get the current tx rate */

@@ -7046,8 +7047,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
 			ch.bw = BRCMU_CHAN_BW_20;
 			cfg->d11inf.encchspec(&ch);
 			chaninfo = ch.chspec;
-			err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
-						       &chaninfo);
+			err = brcmf_fil_bsscfg_int_query(ifp, "per_chan_info",
+							 &chaninfo);
 			if (!err) {
 				if (chaninfo & WL_CHAN_RADAR)
 					channel->flags |=

@@ -7081,7 +7082,7 @@ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
 
 	/* verify support for bw_cap command */
 	val = WLC_BAND_5G;
-	err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
+	err = brcmf_fil_iovar_int_query(ifp, "bw_cap", &val);
 
 	if (!err) {
 		/* only set 2G bandwidth using bw_cap command */

@@ -7157,11 +7158,11 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
 	int err;
 
 	band = WLC_BAND_2G;
-	err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+	err = brcmf_fil_iovar_int_query(ifp, "bw_cap", &band);
 	if (!err) {
 		bw_cap[NL80211_BAND_2GHZ] = band;
 		band = WLC_BAND_5G;
-		err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+		err = brcmf_fil_iovar_int_query(ifp, "bw_cap", &band);
 		if (!err) {
 			bw_cap[NL80211_BAND_5GHZ] = band;
 			return;

@@ -7170,7 +7171,6 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
 		return;
 	}
 	brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
-	mimo_bwcap = 0;
 	err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
 	if (err)
 		/* assume 20MHz if firmware does not give a clue */

@@ -7266,10 +7266,10 @@ static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
 	struct brcmf_pub *drvr = cfg->pub;
 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
-	u32 nmode = 0;
+	u32 nmode;
 	u32 vhtmode = 0;
 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
-	u32 rxchain = 0;
+	u32 rxchain;
 	u32 nchain;
 	int err;
 	s32 i;

index bf91b1e1368f0..df53dd1d7e748 100644
@@ -691,7 +691,7 @@ static int brcmf_net_mon_open(struct net_device *ndev)
 {
 	struct brcmf_if *ifp = netdev_priv(ndev);
 	struct brcmf_pub *drvr = ifp->drvr;
-	u32 monitor = 0;
+	u32 monitor;
 	int err;
 
 	brcmf_dbg(TRACE, "Enter\n");

index f23310a77a5d1..0d9ae197fa1ec 100644
@@ -184,7 +184,7 @@ static void brcmf_feat_wlc_version_overrides(struct brcmf_pub *drv)
 static void brcmf_feat_iovar_int_get(struct brcmf_if *ifp,
 				     enum brcmf_feat_id id, char *name)
 {
-	u32 data = 0;
+	u32 data;
 	int err;
 
 	/* we need to know firmware error */

index a315a7fac6a06..31e080e4da669 100644
@@ -96,15 +96,22 @@ static inline
 s32 brcmf_fil_cmd_int_get(struct brcmf_if *ifp, u32 cmd, u32 *data)
 {
 	s32 err;
-	__le32 data_le = cpu_to_le32(*data);
 
-	err = brcmf_fil_cmd_data_get(ifp, cmd, &data_le, sizeof(data_le));
+	err = brcmf_fil_cmd_data_get(ifp, cmd, data, sizeof(*data));
 	if (err == 0)
-		*data = le32_to_cpu(data_le);
+		*data = le32_to_cpu(*(__le32 *)data);
 	brcmf_dbg(FIL, "ifidx=%d, cmd=%d, value=%d\n", ifp->ifidx, cmd, *data);
 
 	return err;
 }
+static inline
+s32 brcmf_fil_cmd_int_query(struct brcmf_if *ifp, u32 cmd, u32 *data)
+{
+	__le32 *data_le = (__le32 *)data;
+
+	*data_le = cpu_to_le32(*data);
+	return brcmf_fil_cmd_int_get(ifp, cmd, data);
+}
 
 s32 brcmf_fil_iovar_data_set(struct brcmf_if *ifp, const char *name,
 			     const void *data, u32 len);

@@ -120,14 +127,21 @@ s32 brcmf_fil_iovar_int_set(struct brcmf_if *ifp, const char *name, u32 data)
 static inline
 s32 brcmf_fil_iovar_int_get(struct brcmf_if *ifp, const char *name, u32 *data)
 {
-	__le32 data_le = cpu_to_le32(*data);
 	s32 err;
 
-	err = brcmf_fil_iovar_data_get(ifp, name, &data_le, sizeof(data_le));
+	err = brcmf_fil_iovar_data_get(ifp, name, data, sizeof(*data));
 	if (err == 0)
-		*data = le32_to_cpu(data_le);
+		*data = le32_to_cpu(*(__le32 *)data);
 	return err;
 }
+static inline
+s32 brcmf_fil_iovar_int_query(struct brcmf_if *ifp, const char *name, u32 *data)
+{
+	__le32 *data_le = (__le32 *)data;
+
+	*data_le = cpu_to_le32(*data);
+	return brcmf_fil_iovar_int_get(ifp, name, data);
+}
 
 
 s32 brcmf_fil_bsscfg_data_set(struct brcmf_if *ifp, const char *name,

@@ -145,15 +159,21 @@ s32 brcmf_fil_bsscfg_int_set(struct brcmf_if *ifp, const char *name, u32 data)
 static inline
 s32 brcmf_fil_bsscfg_int_get(struct brcmf_if *ifp, const char *name, u32 *data)
 {
-	__le32 data_le = cpu_to_le32(*data);
 	s32 err;
 
-	err = brcmf_fil_bsscfg_data_get(ifp, name, &data_le,
-					sizeof(data_le));
+	err = brcmf_fil_bsscfg_data_get(ifp, name, data, sizeof(*data));
 	if (err == 0)
-		*data = le32_to_cpu(data_le);
+		*data = le32_to_cpu(*(__le32 *)data);
 	return err;
 }
+static inline
+s32 brcmf_fil_bsscfg_int_query(struct brcmf_if *ifp, const char *name, u32 *data)
+{
+	__le32 *data_le = (__le32 *)data;
+
+	*data_le = cpu_to_le32(*data);
+	return brcmf_fil_bsscfg_int_get(ifp, name, data);
+}
 
 s32 brcmf_fil_xtlv_data_set(struct brcmf_if *ifp, const char *name, u16 id,
 			    void *data, u32 len);

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Toke Høiland-Jørgensen <[email protected]>

[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]

We should not be checking the return values from debugfs creation at all: the debugfs functions are designed to handle errors of previously called functions and just transparently abort the creation of debugfs entries when debugfs is disabled. If we check the return value and abort driver initialisation, we break the driver if debugfs is disabled (such as when booting with debugfs=off).

Earlier versions of ath9k accidentally did the right thing by checking the return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two commits referenced below, breaking ath9k with debugfs=off starting from the 6.6 kernel (as reported in the Bugzilla linked below).

Restore functionality by just getting rid of the return value check entirely.

---
 drivers/net/wireless/ath/ath9k/debug.c         | 2 --
 drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 --
 2 files changed, 4 deletions(-)

index d84e3ee7b5d90..bf3da631c69fd 100644
@@ -1380,8 +1380,6 @@ int ath9k_init_debug(struct ath_hw *ah)
 
 	sc->debug.debugfs_phy = debugfs_create_dir("ath9k",
 						   sc->hw->wiphy->debugfsdir);
-	if (IS_ERR(sc->debug.debugfs_phy))
-		return -ENOMEM;
 
 #ifdef CONFIG_ATH_DEBUG
 	debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,

index f7c6d9bc93119..9437d69877cc5 100644
@@ -486,8 +486,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
 
 	priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
 					     priv->hw->wiphy->debugfsdir);
-	if (IS_ERR(priv->debug.debugfs_phy))
-		return -ENOMEM;
 
 	ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: P Praneesh <[email protected]>

[ Upstream commit 59529c982f85047650fd473db903b23006a796c6 ]

Currently, the firmware returns incorrect pdev_id information in WMI_PDEV_BSS_CHAN_INFO_EVENTID, leading to incorrect filling of the pdev's survey information.

To prevent this issue, when requesting BSS channel information through WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID, firmware expects pdev_id as one of the arguments in this WMI command.

Add pdev_id to the struct wmi_pdev_bss_chan_info_req_cmd and fill it during ath12k_wmi_pdev_bss_chan_info_request(). This resolves the issue of sending the correct pdev_id in WMI_PDEV_BSS_CHAN_INFO_EVENTID.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

---
 drivers/net/wireless/ath/ath12k/wmi.c | 1 +
 drivers/net/wireless/ath/ath12k/wmi.h | 1 +
 2 files changed, 2 insertions(+)

index ef775af25093c..55230dd00d0c7 100644
@@ -1528,6 +1528,7 @@ int ath12k_wmi_pdev_bss_chan_info_request(struct ath12k *ar,
 	cmd->tlv_header = ath12k_wmi_tlv_cmd_hdr(WMI_TAG_PDEV_BSS_CHAN_INFO_REQUEST,
 						 sizeof(*cmd));
 	cmd->req_type = cpu_to_le32(type);
+	cmd->pdev_id = cpu_to_le32(ar->pdev->pdev_id);
 
 	ath12k_dbg(ar->ab, ATH12K_DBG_WMI,
 		   "WMI bss chan info req type %d\n", type);

index 742fe0b36cf20..e26fe504ce28b 100644
@@ -3104,6 +3104,7 @@ struct wmi_pdev_bss_chan_info_req_cmd {
 	__le32 tlv_header;
 	/* ref wmi_bss_chan_info_req_type */
 	__le32 req_type;
+	__le32 pdev_id;
 } __packed;
 
 struct wmi_ap_ps_peer_cmd {

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: P Praneesh <[email protected]>

[ Upstream commit dd98d54db29fb553839f43ade5f547baa93392c8 ]

struct wmi_pdev_bss_chan_info_event is not similar to the firmware struct definition, this will cause some random failures.

Fix by matching the struct wmi_pdev_bss_chan_info_event with the firmware structure definition.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

---
 drivers/net/wireless/ath/ath12k/wmi.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index e26fe504ce28b..e947d646353c3 100644
@@ -4054,7 +4054,6 @@ struct wmi_vdev_stopped_event {
 } __packed;
 
 struct wmi_pdev_bss_chan_info_event {
-	__le32 pdev_id;
 	__le32 freq;	/* Units in MHz */
 	__le32 noise_floor;	/* units are dBm */
 	/* rx clear - how often the channel was unused */

@@ -4072,6 +4071,7 @@ struct wmi_pdev_bss_chan_info_event {
 	/*rx_cycle cnt for my bss in 64bits format */
 	__le32 rx_bss_cycle_count_low;
 	__le32 rx_bss_cycle_count_high;
+	__le32 pdev_id;
 } __packed;
 
 #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Baochen Qiang <[email protected]>

[ Upstream commit a66de2d0f22b1740f3f9777776ad98c4bee62dff ]

Currently ampdu_factor is wrongly calculated in ath12k_peer_assoc_h_he(), fix it.

This is found during code review.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4

---
 drivers/net/wireless/ath/ath12k/mac.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

index 7037004ce9771..818ee74cf7a05 100644
@@ -1948,9 +1948,8 @@ static void ath12k_peer_assoc_h_he(struct ath12k *ar,
 	 * request, then use MAX_AMPDU_LEN_FACTOR as 16 to calculate max_ampdu
 	 * length.
 	 */
-	ampdu_factor = (he_cap->he_cap_elem.mac_cap_info[3] &
-			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK) >>
-			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK;
+	ampdu_factor = u8_get_bits(he_cap->he_cap_elem.mac_cap_info[3],
+				   IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK);
 
 	if (ampdu_factor) {
 		if (sta->deflink.vht_cap.vht_supported)

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yanteng Si <[email protected]>

[ Upstream commit c70f3163681381c15686bdd2fe56bf4af9b8aaaa ]

Reference and PTP clocks rate of the Loongson GMAC devices is 125MHz. (So is in the GNET devices which support is about to be added.) Set the respective plat_stmmacenet_data field up in accordance with that so to have the coalesce command and timestamping work correctly.

---
 drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 +++
 1 file changed, 3 insertions(+)

index 9e40c28d453ab..ee3604f58def5 100644
@@ -35,6 +35,9 @@ static int loongson_default_data(struct plat_stmmacenet_data *plat)
 	/* Disable RX queues routing by default */
 	plat->rx_queues_cfg[0].pkt_route = 0x0;
 
+	plat->clk_ref_rate = 125000000;
+	plat->clk_ptp_rate = 125000000;
+
 	/* Default to phy auto-detection */
 	plat->phy_addr = -1;
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dave Martin <[email protected]>

[ Upstream commit fc2220c9b15828319b09384e68399b4afc6276d9 ]

A few SME-related sigcontext UAPI macros leave an argument unprotected from misparsing during macro expansion.

Add parentheses around references to macro arguments where appropriate.

---
 arch/arm64/include/uapi/asm/sigcontext.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 8a45b7a411e04..57f76d82077ea 100644
@@ -320,10 +320,10 @@ struct zt_context {
 	((sizeof(struct za_context) + (__SVE_VQ_BYTES - 1))	\
 		/ __SVE_VQ_BYTES * __SVE_VQ_BYTES)
 
-#define ZA_SIG_REGS_SIZE(vq) ((vq * __SVE_VQ_BYTES) * (vq * __SVE_VQ_BYTES))
+#define ZA_SIG_REGS_SIZE(vq) (((vq) * __SVE_VQ_BYTES) * ((vq) * __SVE_VQ_BYTES))
 
 #define ZA_SIG_ZAV_OFFSET(vq, n) (ZA_SIG_REGS_OFFSET + \
-				  (SVE_SIG_ZREG_SIZE(vq) * n))
+				  (SVE_SIG_ZREG_SIZE(vq) * (n)))
 
 #define ZA_SIG_CONTEXT_SIZE(vq) \
 		(ZA_SIG_REGS_OFFSET + ZA_SIG_REGS_SIZE(vq))

@@ -334,7 +334,7 @@ struct zt_context {
 
 #define ZT_SIG_REGS_OFFSET sizeof(struct zt_context)
 
-#define ZT_SIG_REGS_SIZE(n) (ZT_SIG_REG_BYTES * n)
+#define ZT_SIG_REGS_SIZE(n) (ZT_SIG_REG_BYTES * (n))
 
 #define ZT_SIG_CONTEXT_SIZE(n) \
 	(sizeof(struct zt_context) + ZT_SIG_REGS_SIZE(n))

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ping-Ke Shih <[email protected]>

[ Upstream commit 56310ddb50b190b3390fdc974aec455d0a516bd2 ]

The handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't implemented, but driver expects number of handlers is NUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by removing ID.

Addresses-Coverity-ID: 1598775 ("Out-of-bounds read")

---
 drivers/net/wireless/realtek/rtw89/mac.h | 1 -
 1 file changed, 1 deletion(-)

index a580cb7192337..755a55c8bc20b 100644
@@ -421,7 +421,6 @@ enum rtw89_mac_c2h_mrc_func {
 
 enum rtw89_mac_c2h_wow_func {
 	RTW89_MAC_C2H_FUNC_AOAC_REPORT,
-	RTW89_MAC_C2H_FUNC_READ_WOW_CAM,
 
 	NUM_OF_RTW89_MAC_C2H_FUNC_WOW,
 };

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Kandybka <[email protected]>

[ Upstream commit 77c977327dfaa9ae2e154964cdb89ceb5c7b7cf1 ]

In 'rtw_coex_action_bt_a2dp_pan', 'wl_cpt_test' and 'bt_cpt_test' are hardcoded to false, so corresponding 'table_case' and 'tdma_case' assignments are never met.
Also 'rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1])' is never executed. Assuming that CPT was never fully implemented, remove lookalike leftovers. Compile tested only.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

---
 drivers/net/wireless/realtek/rtw88/coex.c | 38 ++++++-----------------
 1 file changed, 10 insertions(+), 28 deletions(-)

index de3332eb7a227..a99776af56c27 100644
@@ -2194,7 +2194,6 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)
 	struct rtw_coex_stat *coex_stat = &coex->stat;
 	struct rtw_efuse *efuse = &rtwdev->efuse;
 	u8 table_case, tdma_case;
-	bool wl_cpt_test = false, bt_cpt_test = false;
 
 	rtw_dbg(rtwdev, RTW_DBG_COEX, "[BTCoex], %s()\n", __func__);
 

@@ -2202,29 +2201,16 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)
 	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
 	if (efuse->share_ant) {
 		/* Shared-Ant */
-		if (wl_cpt_test) {
-			if (coex_stat->wl_gl_busy) {
-				table_case = 20;
-				tdma_case = 17;
-			} else {
-				table_case = 10;
-				tdma_case = 15;
-			}
-		} else if (bt_cpt_test) {
-			table_case = 26;
-			tdma_case = 26;
-		} else {
-			if (coex_stat->wl_gl_busy &&
-			    coex_stat->wl_noisy_level == 0)
-				table_case = 14;
-			else
-				table_case = 10;
+		if (coex_stat->wl_gl_busy &&
+		    coex_stat->wl_noisy_level == 0)
+			table_case = 14;
+		else
+			table_case = 10;
 
-			if (coex_stat->wl_gl_busy)
-				tdma_case = 15;
-			else
-				tdma_case = 20;
-		}
+		if (coex_stat->wl_gl_busy)
+			tdma_case = 15;
+		else
+			tdma_case = 20;
 	} else {
 		/* Non-Shared-Ant */
 		table_case = 112;

@@ -2235,11 +2221,7 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)
 			tdma_case = 120;
 	}
 
-	if (wl_cpt_test)
-		rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1]);
-	else
-		rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
-
+	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
 	rtw_coex_table(rtwdev, false, table_case);
 	rtw_coex_tdma(rtwdev, false, tdma_case);
 }

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrew Jones <[email protected]>

[ Upstream commit 6b7b282e6baea06ba65b55ae7d38326ceb79cebf ]

When forwarding SBI calls to userspace ensure sbiret.error is initialized to SBI_ERR_NOT_SUPPORTED first, in case userspace neglects to set it to anything. If userspace neglects it then we can't be sure it did anything else either, so we just report it didn't do or try anything. Just init sbiret.value to zero, which is the preferred value to return when nothing special is specified.

KVM was already initializing both sbiret.error and sbiret.value, but the values used appear to come from a copy+paste of the __sbi_ecall() implementation, i.e. a0 and a1, which don't apply prior to the call being executed, nor at all when forwarding to userspace.

---
 arch/riscv/kvm/vcpu_sbi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 62f409d4176e4..7de128be8db9b 100644
@@ -127,8 +127,8 @@ void kvm_riscv_vcpu_sbi_forward(struct kvm_vcpu *vcpu, struct kvm_run *run)
 	run->riscv_sbi.args[3] = cp->a3;
 	run->riscv_sbi.args[4] = cp->a4;
 	run->riscv_sbi.args[5] = cp->a5;
-	run->riscv_sbi.ret[0] = cp->a0;
-	run->riscv_sbi.ret[1] = cp->a1;
+	run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
+	run->riscv_sbi.ret[1] = 0;
 }
 
 void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shubhrajyoti Datta <[email protected]>

[ Upstream commit 35e6dbfe1846caeafabb49b7575adb36b0aa2269 ]

The Zynq UltraScale+ MPSoC DDR has a disjoint memory from 2GB to 32GB. The DDR host interface has a contiguous memory so while injecting errors, the driver should remove the hole else the injection fails as the address translation is incorrect.

Introduce a get_mem_info() function pointer and set it for Zynq UltraScale+ platform to return host address.

---
 drivers/edac/synopsys_edac.c | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

index ea7a9a342dd30..d7416166fd8a4 100644
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/spinlock.h>
+#include <linux/sizes.h>
 #include <linux/interrupt.h>
 #include <linux/of.h>
 

@@ -337,6 +338,7 @@ struct synps_edac_priv {
  * @get_mtype:		Get mtype.
  * @get_dtype:		Get dtype.
  * @get_ecc_state:	Get ECC state.
+ * @get_mem_info:	Get EDAC memory info
  * @quirks:		To differentiate IPs.
  */
 struct synps_platform_data {

@@ -344,6 +346,9 @@ struct synps_platform_data {
 	enum mem_type (*get_mtype)(const void __iomem *base);
 	enum dev_type (*get_dtype)(const void __iomem *base);
 	bool (*get_ecc_state)(void __iomem *base);
+#ifdef CONFIG_EDAC_DEBUG
+	u64 (*get_mem_info)(struct synps_edac_priv *priv);
+#endif
 	int quirks;
 };
 

@@ -402,6 +407,25 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)
 	return 0;
 }
 
+#ifdef CONFIG_EDAC_DEBUG
+/**
+ * zynqmp_get_mem_info - Get the current memory info.
+ * @priv:	DDR memory controller private instance data.
+ *
+ * Return: host interface address.
+ */
+static u64 zynqmp_get_mem_info(struct synps_edac_priv *priv)
+{
+	u64 hif_addr = 0, linear_addr;
+
+	linear_addr = priv->poison_addr;
+	if (linear_addr >= SZ_32G)
+		linear_addr = linear_addr - SZ_32G + SZ_2G;
+	hif_addr = linear_addr >> 3;
+	return hif_addr;
+}
+#endif
+
 /**
  * zynqmp_get_error_info - Get the current ECC error info.
  * @priv:	DDR memory controller private instance data.

@@ -922,6 +946,9 @@ static const struct synps_platform_data zynqmp_edac_def = {
 	.get_mtype	= zynqmp_get_mtype,
 	.get_dtype	= zynqmp_get_dtype,
 	.get_ecc_state	= zynqmp_get_ecc_state,
+#ifdef CONFIG_EDAC_DEBUG
+	.get_mem_info	= zynqmp_get_mem_info,
+#endif
 	.quirks         = (DDR_ECC_INTR_SUPPORT
 #ifdef CONFIG_EDAC_DEBUG
 			  | DDR_ECC_DATA_POISON_SUPPORT

@@ -975,10 +1002,16 @@ MODULE_DEVICE_TABLE(of, synps_edac_match);
 static void ddr_poison_setup(struct synps_edac_priv *priv)
 {
 	int col = 0, row = 0, bank = 0, bankgrp = 0, rank = 0, regval;
+	const struct synps_platform_data *p_data;
 	int index;
 	ulong hif_addr = 0;
 
-	hif_addr = priv->poison_addr >> 3;
+	p_data = priv->p_data;
+
+	if (p_data->get_mem_info)
+		hif_addr = p_data->get_mem_info(priv);
+	else
+		hif_addr = priv->poison_addr >> 3;
 
 	for (index = 0; index < DDR_MAX_ROW_SHIFT; index++) {
 		if (priv->row_shift[index])

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anup Patel <[email protected]>

[ Upstream commit 47d40d93292d9cff8dabb735bed83d930fa03950 ]

With the latest Linux-6.11-rc3, the below NULL pointer crash is observed when SBI PMU snapshot is enabled for the guest and the guest is forcefully powered-off.

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000508
  Oops [#1]
  Modules linked in: kvm
  CPU: 0 UID: 0 PID: 61 Comm: term-poll Not tainted 6.11.0-rc3-00018-g44d7178dd77a #3
  Hardware name: riscv-virtio,qemu (DT)
  epc : __kvm_write_guest_page+0x94/0xa6 [kvm]
   ra : __kvm_write_guest_page+0x54/0xa6 [kvm]
  epc : ffffffff01590e98 ra : ffffffff01590e58 sp : ffff8f80001f39b0
   gp : ffffffff81512a60 tp : ffffaf80024872c0 t0 : ffffaf800247e000
   t1 : 00000000000007e0 t2 : 0000000000000000 s0 : ffff8f80001f39f0
   s1 : 00007fff89ac4000 a0 : ffffffff015dd7e8 a1 : 0000000000000086
   a2 : 0000000000000000 a3 : ffffaf8000000000 a4 : ffffaf80024882c0
   a5 : 0000000000000000 a6 : ffffaf800328d780 a7 : 00000000000001cc
   s2 : ffffaf800197bd00 s3 : 00000000000828c4 s4 : ffffaf800248c000
   s5 : ffffaf800247d000 s6 : 0000000000001000 s7 : 0000000000001000
   s8 : 0000000000000000 s9 : 00007fff861fd500 s10: 0000000000000001
   s11: 0000000000800000 t3 : 00000000000004d3 t4 : 00000000000004d3
   t5 : ffffffff814126e0 t6 : ffffffff81412700
  status: 0000000200000120 badaddr: 0000000000000508 cause: 000000000000000d
  [<ffffffff01590e98>] __kvm_write_guest_page+0x94/0xa6 [kvm]
  [<ffffffff015943a6>] kvm_vcpu_write_guest+0x56/0x90 [kvm]
  [<ffffffff015a175c>] kvm_pmu_clear_snapshot_area+0x42/0x7e [kvm]
  [<ffffffff015a1972>] kvm_riscv_vcpu_pmu_deinit.part.0+0xe0/0x14e [kvm]
  [<ffffffff015a2ad0>] kvm_riscv_vcpu_pmu_deinit+0x1a/0x24 [kvm]
  [<ffffffff0159b344>] kvm_arch_vcpu_destroy+0x28/0x4c [kvm]
  [<ffffffff0158e420>] kvm_destroy_vcpus+0x5a/0xda [kvm]
  [<ffffffff0159930c>] kvm_arch_destroy_vm+0x14/0x28 [kvm]
  [<ffffffff01593260>] kvm_destroy_vm+0x168/0x2a0 [kvm]
  [<ffffffff015933d4>] kvm_put_kvm+0x3c/0x58 [kvm]
  [<ffffffff01593412>] kvm_vm_release+0x22/0x2e [kvm]

Clearly, the kvm_vcpu_write_guest() function is crashing because it is being called from kvm_pmu_clear_snapshot_area() upon guest tear down.

To address the above issue, simplify the kvm_pmu_clear_snapshot_area() to not zero-out PMU snapshot area from kvm_pmu_clear_snapshot_area() because the guest is anyway being tore down.

The kvm_pmu_clear_snapshot_area() is also called when guest changes PMU snapshot area of a VCPU but even in this case the previous PMU snaphsot area must not be zeroed-out because the guest might have reclaimed the pervious PMU snapshot area for some other purpose.

---
 arch/riscv/kvm/vcpu_pmu.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

index bcf41d6e0df0e..2707a51b082ca 100644
@@ -391,19 +391,9 @@ int kvm_riscv_vcpu_pmu_read_hpm(struct kvm_vcpu *vcpu, unsigned int csr_num,
 static void kvm_pmu_clear_snapshot_area(struct kvm_vcpu *vcpu)
 {
 	struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
-	int snapshot_area_size = sizeof(struct riscv_pmu_snapshot_data);
 
-	if (kvpmu->sdata) {
-		if (kvpmu->snapshot_addr != INVALID_GPA) {
-			memset(kvpmu->sdata, 0, snapshot_area_size);
-			kvm_vcpu_write_guest(vcpu, kvpmu->snapshot_addr,
-					     kvpmu->sdata, snapshot_area_size);
-		} else {
-			pr_warn("snapshot address invalid\n");
-		}
-		kfree(kvpmu->sdata);
-		kvpmu->sdata = NULL;
-	}
+	kfree(kvpmu->sdata);
+	kvpmu->sdata = NULL;
 	kvpmu->snapshot_addr = INVALID_GPA;
 }
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Atish Patra <[email protected]>

[ Upstream commit 7d1ffc8b087e97dbe1985912c7a2d00e53cea169 ]

Currently, KVM traps & emulates PMU counter access only if SBI PMU is available as the guest can only configure/read PMU counters via SBI only. However, if SBI PMU is not enabled in the host, the guest will fallback to the legacy PMU which will try to access cycle/instret and result in an illegal instruction trap which is not desired.

KVM can allow dummy emulation of cycle/instret only for the guest if SBI PMU is not enabled in the host. The dummy emulation will still return zero as we don't to expose the host counter values from a guest using legacy PMU.

---
 arch/riscv/include/asm/kvm_vcpu_pmu.h | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

index fa0f535bbbf02..c309daa2d75a8 100644
@@ -10,6 +10,7 @@
 #define __KVM_VCPU_RISCV_PMU_H
 
 #include <linux/perf/riscv_pmu.h>
+#include <asm/kvm_vcpu_insn.h>
 #include <asm/sbi.h>
 
 #ifdef CONFIG_RISCV_PMU_SBI

@@ -104,8 +105,20 @@ void kvm_riscv_vcpu_pmu_reset(struct kvm_vcpu *vcpu);
 struct kvm_pmu {
 };
 
+static inline int kvm_riscv_vcpu_pmu_read_legacy(struct kvm_vcpu *vcpu, unsigned int csr_num,
+						 unsigned long *val, unsigned long new_val,
+						 unsigned long wr_mask)
+{
+	if (csr_num == CSR_CYCLE || csr_num == CSR_INSTRET) {
+		*val = 0;
+		return KVM_INSN_CONTINUE_NEXT_SEPC;
+	} else {
+		return KVM_INSN_ILLEGAL_TRAP;
+	}
+}
+
 #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \
-{.base = 0,	.count = 0,	.func = NULL },
+{.base = CSR_CYCLE,	.count = 3,	.func = kvm_riscv_vcpu_pmu_read_legacy },
 
 static inline void kvm_riscv_vcpu_pmu_init(struct kvm_vcpu *vcpu) {}
 static inline int kvm_riscv_vcpu_pmu_incr_fw(struct kvm_vcpu *vcpu, unsigned long fid)

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Atish Patra <[email protected]>

[ Upstream commit 5aa09297a3dcc798d038bd7436f8c90f664045a6 ]

The csr_fun defines a count parameter which defines the total number CSRs emulated in KVM starting from the base. This value should be equal to total number of counters possible for trap/emulation (32).

---
 arch/riscv/include/asm/kvm_vcpu_pmu.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index c309daa2d75a8..1d85b66175088 100644
@@ -65,11 +65,11 @@ struct kvm_pmu {
 
 #if defined(CONFIG_32BIT)
 #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \
-{.base = CSR_CYCLEH,	.count = 31,	.func = kvm_riscv_vcpu_pmu_read_hpm }, \
-{.base = CSR_CYCLE,	.count = 31,	.func = kvm_riscv_vcpu_pmu_read_hpm },
+{.base = CSR_CYCLEH,	.count = 32,	.func = kvm_riscv_vcpu_pmu_read_hpm }, \
+{.base = CSR_CYCLE,	.count = 32,	.func = kvm_riscv_vcpu_pmu_read_hpm },
 #else
 #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \
-{.base = CSR_CYCLE,	.count = 31,	.func = kvm_riscv_vcpu_pmu_read_hpm },
+{.base = CSR_CYCLE,	.count = 32,	.func = kvm_riscv_vcpu_pmu_read_hpm },
 #endif
 
 int kvm_riscv_vcpu_pmu_incr_fw(struct kvm_vcpu *vcpu, unsigned long fid);

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Olaf Hering <[email protected]>

[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]

If no page could be allocated, an error pointer was used as format string in pr_warn.

Rearrange the code to return early in case of OOM. Also add a check for the return value of d_path.

---
 fs/namespace.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

index e1ced589d8357..a6675c2a23839 100644
@@ -2801,8 +2801,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *
 	if (!__mnt_is_readonly(mnt) &&
 	   (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
 	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
-		char *buf = (char *)__get_free_page(GFP_KERNEL);
-		char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
+		char *buf, *mntpath;
+
+		buf = (char *)__get_free_page(GFP_KERNEL);
+		if (buf)
+			mntpath = d_path(mountpoint, buf, PAGE_SIZE);
+		else
+			mntpath = ERR_PTR(-ENOMEM);
+		if (IS_ERR(mntpath))
+			mntpath = "(unknown)";
 
 		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
 			sb->s_type->name,

@@ -2810,8 +2817,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *
 			mntpath, &sb->s_time_max,
 			(unsigned long long)sb->s_time_max);
 
-		free_page((unsigned long)buf);
 		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
+		if (buf)
+			free_page((unsigned long)buf);
 	}
 }
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aleksa Sarai <[email protected]>

[ Upstream commit 6a64c5220c5df235448b846aeff3c0660d4cc83e ]

If you pass an fd using FSCONFIG_SET_FD, autofs_parse_fd() "steals" the param->file and so the fs_context infrastructure will not do fput() for us.

---
 fs/autofs/inode.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index 1f5db68636631..bb404bfce036b 100644
@@ -172,8 +172,7 @@ static int autofs_parse_fd(struct fs_context *fc, struct autofs_sb_info *sbi,
 	ret = autofs_check_pipe(pipe);
 	if (ret < 0) {
 		errorf(fc, "Invalid/unusable pipe");
-		if (param->type != fs_value_is_file)
-			fput(pipe);
+		fput(pipe);
 		return -EBADF;
 	}
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Calvin Owens <[email protected]>

[ Upstream commit 89a906dfa8c3b21b3e5360f73c49234ac1eb885b ]

Floating point instructions in userspace can crash some arm kernels built with clang/LLD 17.0.6:

    BUG: unsupported FP instruction in kernel mode
    FPEXC == 0xc0000780
    Internal error: Oops - undefined instruction: 0 [#1] ARM
    CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1
    Hardware name: BCM2835
    PC is at vfp_support_entry+0xc8/0x2cc
    LR is at do_undefinstr+0xa8/0x250
    pc : [<c0101d50>]    lr : [<c010a80c>]    psr: a0000013
    sp : dc8d1f68  ip : 60000013  fp : bedea19c
    r10: ec532b17  r9 : 00000010  r8 : 0044766c
    r7 : c0000780  r6 : ec532b17  r5 : c1c13800  r4 : dc8d1fb0
    r3 : c10072c4  r2 : c0101c88  r1 : ec532b17  r0 : 0044766c
    Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    Control: 00c5387d  Table: 0251c008  DAC: 00000051
    Register r0 information: non-paged memory
    Register r1 information: vmalloc memory
    Register r2 information: non-slab/vmalloc memory
    Register r3 information: non-slab/vmalloc memory
    Register r4 information: 2-page vmalloc region
    Register r5 information: slab kmalloc-cg-2k
    Register r6 information: vmalloc memory
    Register r7 information: non-slab/vmalloc memory
    Register r8 information: non-paged memory
    Register r9 information: zero-size pointer
    Register r10 information: vmalloc memory
    Register r11 information: non-paged memory
    Register r12 information: non-paged memory
    Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)
    Stack: (0xdc8d1f68 to 0xdc8d2000)
    1f60:                   0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0
    1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010
    1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188
    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c
    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000
    Call trace:
    [<c0101d50>] (vfp_support_entry) from [<c010a80c>] (do_undefinstr+0xa8/0x250)
    [<c010a80c>] (do_undefinstr) from [<c0100f10>] (__und_usr+0x70/0x80)
    Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)
    1fa0:                                     b6f68af8 00448fc0 00000000 bedea188
    1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c
    1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff
    Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)
    ---[ end trace 0000000000000000 ]---
    Kernel panic - not syncing: Fatal exception in interrupt
    ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

This is a minimal userspace reproducer on a Raspberry Pi Zero W:

    #include <stdio.h>
    #include <math.h>

    int main(void)
    {
            double v = 1.0;
            printf("%fn", NAN + *(volatile double *)&v);
            return 0;
    }

Another way to consistently trigger the oops is:

calvin@raspberry-pi-zero-w ~$ python -c "import json"

The bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n, because the pr_debug() calls act as barriers even when not activated.

This is the output from the same kernel source built with the same compiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as expected:

    VFP: bounce: trigger ec532b17 fpexc c0000780
    VFP: emulate: INST=0xee377b06 SCR=0x00000000
    VFP: bounce: trigger eef1fa10 fpexc c0000780
    VFP: emulate: INST=0xeeb40b40 SCR=0x00000000
    VFP: raising exceptions 30000000

    calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer
    nan

Crudely grepping for vmsr/vmrs instructions in the otherwise nearly idential text for vfp_support_entry() makes the problem obvious:

    vmlinux.llvm.good [0xc0101cb8] <+48>:  vmrs   r7, fpexc
    vmlinux.llvm.good [0xc0101cd8] <+80>:  vmsr   fpexc, r0
    vmlinux.llvm.good [0xc0101d20] <+152>: vmsr   fpexc, r7
    vmlinux.llvm.good [0xc0101d38] <+176>: vmrs   r4, fpexc
    vmlinux.llvm.good [0xc0101d6c] <+228>: vmrs   r0, fpscr
    vmlinux.llvm.good [0xc0101dc4] <+316>: vmsr   fpexc, r0
    vmlinux.llvm.good [0xc0101dc8] <+320>: vmrs   r0, fpsid
    vmlinux.llvm.good [0xc0101dcc] <+324>: vmrs   r6, fpscr
    vmlinux.llvm.good [0xc0101e10] <+392>: vmrs   r10, fpinst
    vmlinux.llvm.good [0xc0101eb8] <+560>: vmrs   r10, fpinst2

    vmlinux.llvm.bad  [0xc0101cb8] <+48>:  vmrs   r7, fpexc
    vmlinux.llvm.bad  [0xc0101cd8] <+80>:  vmsr   fpexc, r0
    vmlinux.llvm.bad  [0xc0101d20] <+152>: vmsr   fpexc, r7
    vmlinux.llvm.bad  [0xc0101d30] <+168>: vmrs   r0, fpscr
    vmlinux.llvm.bad  [0xc0101d50] <+200>: vmrs   r6, fpscr  <== BOOM!
    vmlinux.llvm.bad  [0xc0101d6c] <+228>: vmsr   fpexc, r0
    vmlinux.llvm.bad  [0xc0101d70] <+232>: vmrs   r0, fpsid
    vmlinux.llvm.bad  [0xc0101da4] <+284>: vmrs   r10, fpinst
    vmlinux.llvm.bad  [0xc0101df8] <+368>: vmrs   r4, fpexc
    vmlinux.llvm.bad  [0xc0101e5c] <+468>: vmrs   r10, fpinst2

I think LLVM's reordering is valid as the code is currently written: the compiler doesn't know the instructions have side effects in hardware.

Fix by using "asm volatile" in fmxr() and fmrx(), so they cannot be reordered with respect to each other. The original compiler now produces working kernels on my hardware with DYNAMIC_DEBUG=n.

This is the relevant piece of the diff of the vfp_support_entry() text, from the original oopsing kernel to a working kernel with this patch:

         vmrs r0, fpscr
         tst r0, #4096
         bne 0xc0101d48
         tst r0, #458752
         beq 0xc0101ecc
         orr r7, r7, #536870912
         ldr r0, [r4, #0x3c]
         mov r9, #16
        -vmrs r6, fpscr
         orr r9, r9, #251658240
         add r0, r0, #4
         str r0, [r4, #0x3c]
         mvn r0, #159
         sub r0, r0, #-1207959552
         and r0, r7, r0
         vmsr fpexc, r0
         vmrs r0, fpsid
        +vmrs r6, fpscr
         and r0, r0, #983040
         cmp r0, #65536
         bne 0xc0101d88

---
 arch/arm/vfp/vfpinstr.h | 48 ++++++++++++++++++++++-------------------
 1 file changed, 26 insertions(+), 22 deletions(-)

index 3c7938fd40aad..32090b0fb250b 100644
@@ -64,33 +64,37 @@
 
 #ifdef CONFIG_AS_VFP_VMRS_FPINST
 
-#define fmrx(_vfp_) ({			\
-	u32 __v;			\
-	asm(".fpu	vfpv2\n"	\
-	    "vmrs	%0, " #_vfp_	\
-	    : "=r" (__v) : : "cc");	\
-	__v;				\
- })
-
-#define fmxr(_vfp_,_var_)		\
-	asm(".fpu	vfpv2\n"	\
-	    "vmsr	" #_vfp_ ", %0"	\
-	   : : "r" (_var_) : "cc")
+#define fmrx(_vfp_) ({				\
+	u32 __v;				\
+	asm volatile (".fpu	vfpv2\n"	\
+		      "vmrs	%0, " #_vfp_	\
+		     : "=r" (__v) : : "cc");	\
+	__v;					\
+})
+
+#define fmxr(_vfp_, _var_) ({			\
+	asm volatile (".fpu	vfpv2\n"	\
+		      "vmsr	" #_vfp_ ", %0"	\
+		     : : "r" (_var_) : "cc");	\
+})
 
 #else
 
 #define vfpreg(_vfp_) #_vfp_
 
-#define fmrx(_vfp_) ({			\
-	u32 __v;			\
-	asm("mrc p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmrx	%0, " #_vfp_	\
-	    : "=r" (__v) : : "cc");	\
-	__v;				\
- })
-
-#define fmxr(_vfp_,_var_)		\
-	asm("mcr p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmxr	" #_vfp_ ", %0"	\
-	   : : "r" (_var_) : "cc")
+#define fmrx(_vfp_) ({						\
+	u32 __v;						\
+	asm volatile ("mrc p10, 7, %0, " vfpreg(_vfp_) ","	\
+		      "cr0, 0 @ fmrx	%0, " #_vfp_		\
+		     : "=r" (__v) : : "cc");			\
+	__v;							\
+})
+
+#define fmxr(_vfp_, _var_) ({					\
+	asm volatile ("mcr p10, 7, %0, " vfpreg(_vfp_) ","	\
+		      "cr0, 0 @ fmxr	" #_vfp_ ", %0"		\
+		     : : "r" (_var_) : "cc");			\
+})
 
 #endif
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

[ Upstream commit 95f6580352a7225e619551febb83595bcb77ab17 ]

The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one access.

---
 drivers/powercap/intel_rapl_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 8e7f4c0473ab9..9bf9ed9a6a54f 100644
@@ -740,7 +740,7 @@ static struct rapl_primitive_info *get_rpi(struct rapl_package *rp, int prim)
 {
 	struct rapl_primitive_info *rpi = rp->priv->rpi;
 
-	if (prim < 0 || prim > NR_RAPL_PRIMITIVES || !rpi)
+	if (prim < 0 || prim >= NR_RAPL_PRIMITIVES || !rpi)
 		return NULL;
 
 	return &rpi[prim];

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andre Przywara <[email protected]>

[ Upstream commit 5225b6562b9a7dc808d5a1e465aaf5e2ebb220cd ]

Currently a number of SVE/SME related tests have almost identical functions to enumerate all supported vector lengths. However over time the copy&pasted code has diverged, allowing some bugs to creep in:
- fake_sigreturn_sme_change_vl reports a failure, not a SKIP if only one vector length is supported (but the SVE version is fine)
- fake_sigreturn_sme_change_vl tries to set the SVE vector length, not the SME one (but the other SME tests are fine)
- za_no_regs keeps iterating forever if only one vector length is supported (but za_regs is correct)

Since those bugs seem to be mostly copy&paste ones, let's consolidate the enumeration loop into one shared function, and just call that from each test. That should fix the above bugs, and prevent similar issues from happening again.

---
 tools/testing/selftests/arm64/signal/Makefile |  2 +-
 .../selftests/arm64/signal/sve_helpers.c      | 56 +++++++++++++++++++
 .../selftests/arm64/signal/sve_helpers.h      | 21 +++++++
 .../testcases/fake_sigreturn_sme_change_vl.c  | 32 +++--------
 .../testcases/fake_sigreturn_sve_change_vl.c  | 30 ++--------
 .../arm64/signal/testcases/ssve_regs.c        | 36 +++---------
 .../arm64/signal/testcases/ssve_za_regs.c     | 36 +++---------
 .../arm64/signal/testcases/sve_regs.c         | 32 +++--------
 .../arm64/signal/testcases/za_no_regs.c       | 32 +++--------
 .../arm64/signal/testcases/za_regs.c          | 36 +++---------
 10 files changed, 132 insertions(+), 181 deletions(-)
 create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.c
 create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.h

index 8f5febaf1a9a2..edb3613513b8a 100644
@@ -23,7 +23,7 @@ $(TEST_GEN_PROGS): $(PROGS)
 # Common test-unit targets to build common-layout test-cases executables
 # Needs secondary expansion to properly include the testcase c-file in pre-reqs
 COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \
-	signals.S
+	signals.S sve_helpers.c
 COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h
 
 .SECONDEXPANSION:

new file mode 100644
index 0000000000000..50948ce471cc6
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2024 ARM Limited
+ *
+ * Common helper functions for SVE and SME functionality.
+ */
+
+#ifndef __SVE_HELPERS_H__
+#define __SVE_HELPERS_H__
+
+#include <stdbool.h>
+
+#define VLS_USE_SVE	false
+#define VLS_USE_SME	true
+
+extern unsigned int vls[];
+extern unsigned int nvls;
+
+int sve_fill_vls(bool use_sme, int min_vls);
+
+#endif

index ebd5815b54bba..cb8c051b5c8f2 100644
@@ -6,44 +6,28 @@
  * handler, this is not supported and is expected to segfault.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 struct fake_sigframe sf;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 2);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SVE_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
+	if (!res)
+		return true;
 
-		vl &= PR_SME_VL_LEN_MASK;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least two VLs */
-	if (nvls < 2) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
-
-	return true;
+	return false;
 }
 
 static int fake_sigreturn_ssve_change_vl(struct tdescr *td,

index e2a452190511f..e1ccf8f85a70c 100644
@@ -12,40 +12,22 @@
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 struct fake_sigframe sf;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sve_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SVE, 2);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SVE_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
+	if (!res)
+		return true;
 
-		vl &= PR_SVE_VL_LEN_MASK;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least two VLs */
-	if (nvls < 2) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
+	if (res == KSFT_SKIP)
 		td->result = KSFT_SKIP;
-		return false;
-	}
 
-	return true;
+	return false;
 }
 
 static int fake_sigreturn_sve_change_vl(struct tdescr *td,

index 3d37daafcff51..6dbe48cf8b09e 100644
@@ -6,51 +6,31 @@
  * set up as expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 64];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Did we find the lowest supported VL? */
-		if (vq < sve_vq_from_vl(vl))
-			break;
+	if (!res)
+		return true;
 
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-	return true;
+	return false;
 }
 
 static void setup_ssve_regs(void)

index 9dc5f128bbc0d..5557e116e9736 100644
@@ -6,51 +6,31 @@
  * signal frames is set up as expected when enabled simultaneously.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 128];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Did we find the lowest supported VL? */
-		if (vq < sve_vq_from_vl(vl))
-			break;
+	if (!res)
+		return true;
 
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-	return true;
+	return false;
 }
 
 static void setup_regs(void)

index 8b16eabbb7697..8143eb1c58c18 100644
@@ -6,47 +6,31 @@
  * expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 64];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sve_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SVE, 1);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SVE_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SVE_VL_LEN_MASK;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
+	if (!res)
+		return true;
 
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-	return true;
+	return false;
 }
 
 static void setup_sve_regs(void)

index 4d6f94b6178f3..ce26e9c2fa5e3 100644
@@ -6,47 +6,31 @@
  * expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 128];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SME_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
+	if (!res)
+		return true;
 
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-	return true;
+	return false;
 }
 
 static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,

index 174ad66566964..b9e13f27f1f9a 100644
@@ -6,51 +6,31 @@
  * expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 128];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SME_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Did we find the lowest supported VL? */
-		if (vq < sve_vq_from_vl(vl))
-			break;
+	if (!res)
+		return true;
 
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-	return true;
+	return false;
 }
 
 static void setup_za_regs(void)

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Douglas Anderson <[email protected]>

[ Upstream commit fdfa588124b6356cd08e5d3f0c3643c4ec3d6887 ]

When testing hard lockup handling on my sc7180-trogdor-lazor device with pseudo-NMI enabled, with serial console enabled and with kgdb disabled, I found that the stack crawls printed to the serial console ended up as a jumbled mess. After rebooting, the pstore-based console looked fine though. Also, enabling kgdb to trap the panic made the console look fine and avoided the mess.

After a bit of tracking down, I came to the conclusion that this was what was happening:
1. The panic path was stopping all other CPUs with panic_other_cpus_shutdown().
2. At least one of those other CPUs was in the middle of printing to the serial console and holding the console port's lock, which is grabbed with "irqsave". ...but since we were stopping with an NMI we didn't care about the "irqsave" and interrupted anyway.
3. Since we stopped the CPU while it was holding the lock it would never release it.
4. All future calls to output to the console would end up failing to get the lock in qcom_geni_serial_console_write(). This isn't _totally_ unexpected at panic time but it's a code path that's not well tested, hard to get right, and apparently doesn't work terribly well on the Qualcomm geni serial driver.

The Qualcomm geni serial driver was fixed to be a bit better in commit 9e957a155005 ("serial: qcom-geni: Don't cancel/abort if we can't get the port lock") but it's nice not to get into this situation in the first place.

Taking a page from what x86 appears to do in native_stop_other_cpus(), do this:
1. First, try to stop other CPUs with a normal IPI and wait a second. This gives them a chance to leave critical sections.
2. If CPUs fail to stop then retry with an NMI, but give a much lower timeout since there's no good reason for a CPU not to react quickly to a NMI.

This works well and avoids the corrupted console and (presumably) could help avoid other similar issues.

In order to do this, we need to do a little re-organization of our IPIs since we don't have any more free IDs. Do what was suggested in previous conversations and combine "stop" and "crash stop". That frees up an IPI so now we can have a "stop" and "stop NMI".

In order to do this we also need a slight change in the way we keep track of which CPUs still need to be stopped. We need to know specifically which CPUs haven't stopped yet when we fall back to NMI but in the "crash stop" case the "cpu_online_mask" isn't updated as CPUs go down. This is why that code path had an atomic of the number of CPUs left. Solve this by also updating the "cpu_online_mask" for crash stops.

All of the above lets us combine the logic for "stop" and "crash stop" code, which appeared to have a bunch of arbitrary implementation differences.

Aside from the above change where we try a normal IPI and then an NMI, the combined function has a few subtle differences:
* In the normal smp_send_stop(), if we fail to stop one or more CPUs then we won't include the current CPU (the one running smp_send_stop()) in the error message.
* In crash_smp_send_stop(), if we fail to stop some CPUs we'll print the CPUs that we failed to stop instead of printing all _but_ the current running CPU.
* In crash_smp_send_stop(), we will now only print "SMP: stopping secondary CPUs" if (system_state <= SYSTEM_RUNNING).

---
 arch/arm64/kernel/smp.c | 160 ++++++++++++++++++++++++----------------
 1 file changed, 97 insertions(+), 63 deletions(-)

index 05688f6a275f1..d36b9160e9346 100644
@@ -71,7 +71,7 @@ enum ipi_msg_type {
 	IPI_RESCHEDULE,
 	IPI_CALL_FUNC,
 	IPI_CPU_STOP,
-	IPI_CPU_CRASH_STOP,
+	IPI_CPU_STOP_NMI,
 	IPI_TIMER,
 	IPI_IRQ_WORK,
 	NR_IPI,

@@ -88,6 +88,8 @@ static int ipi_irq_base __ro_after_init;
 static int nr_ipi __ro_after_init = NR_IPI;
 static struct irq_desc *ipi_desc[MAX_IPI] __ro_after_init;
 
+static bool crash_stop;
+
 static void ipi_setup(int cpu);
 
 #ifdef CONFIG_HOTPLUG_CPU

@@ -773,7 +775,7 @@ static const char *ipi_types[MAX_IPI] __tracepoint_string = {
 	[IPI_RESCHEDULE]	= "Rescheduling interrupts",
 	[IPI_CALL_FUNC]		= "Function call interrupts",
 	[IPI_CPU_STOP]		= "CPU stop interrupts",
-	[IPI_CPU_CRASH_STOP]	= "CPU stop (for crash dump) interrupts",
+	[IPI_CPU_STOP_NMI]	= "CPU stop NMIs",
 	[IPI_TIMER]		= "Timer broadcast interrupts",
 	[IPI_IRQ_WORK]		= "IRQ work interrupts",
 	[IPI_CPU_BACKTRACE]	= "CPU backtrace interrupts",

@@ -817,9 +819,9 @@ void arch_irq_work_raise(void)
 }
 #endif
 
-static void __noreturn local_cpu_stop(void)
+static void __noreturn local_cpu_stop(unsigned int cpu)
 {
-	set_cpu_online(smp_processor_id(), false);
+	set_cpu_online(cpu, false);
 
 	local_daif_mask();
 	sdei_mask_local_cpu();

@@ -833,21 +835,26 @@ static void __noreturn local_cpu_stop(void)
  */
 void __noreturn panic_smp_self_stop(void)
 {
-	local_cpu_stop();
+	local_cpu_stop(smp_processor_id());
 }
 
-#ifdef CONFIG_KEXEC_CORE
-static atomic_t waiting_for_crash_ipi = ATOMIC_INIT(0);
-#endif
-
 static void __noreturn ipi_cpu_crash_stop(unsigned int cpu, struct pt_regs *regs)
 {
 #ifdef CONFIG_KEXEC_CORE
+	/*
+	 * Use local_daif_mask() instead of local_irq_disable() to make sure
+	 * that pseudo-NMIs are disabled. The "crash stop" code starts with
+	 * an IRQ and falls back to NMI (which might be pseudo). If the IRQ
+	 * finally goes through right as we're timing out then the NMI could
+	 * interrupt us. It's better to prevent the NMI and let the IRQ
+	 * finish since the pt_regs will be better.
+	 */
+	local_daif_mask();
+
 	crash_save_cpu(regs, cpu);
 
-	atomic_dec(&waiting_for_crash_ipi);
+	set_cpu_online(cpu, false);
 
-	local_irq_disable();
 	sdei_mask_local_cpu();
 
 	if (IS_ENABLED(CONFIG_HOTPLUG_CPU))

@@ -912,14 +919,12 @@ static void do_handle_IPI(int ipinr)
 		break;
 
 	case IPI_CPU_STOP:
-		local_cpu_stop();
-		break;
-
-	case IPI_CPU_CRASH_STOP:
-		if (IS_ENABLED(CONFIG_KEXEC_CORE)) {
+	case IPI_CPU_STOP_NMI:
+		if (IS_ENABLED(CONFIG_KEXEC_CORE) && crash_stop) {
 			ipi_cpu_crash_stop(cpu, get_irq_regs());
-
 			unreachable();
+		} else {
+			local_cpu_stop(cpu);
 		}
 		break;
 

@@ -974,8 +979,7 @@ static bool ipi_should_be_nmi(enum ipi_msg_type ipi)
 		return false;
 
 	switch (ipi) {
-	case IPI_CPU_STOP:
-	case IPI_CPU_CRASH_STOP:
+	case IPI_CPU_STOP_NMI:
 	case IPI_CPU_BACKTRACE:
 	case IPI_KGDB_ROUNDUP:
 		return true;

@@ -1088,79 +1092,109 @@ static inline unsigned int num_other_online_cpus(void)
 
 void smp_send_stop(void)
 {
+	static unsigned long stop_in_progress;
+	cpumask_t mask;
 	unsigned long timeout;
 
-	if (num_other_online_cpus()) {
-		cpumask_t mask;
+	/*
+	 * If this cpu is the only one alive at this point in time, online or
+	 * not, there are no stop messages to be sent around, so just back out.
+	 */
+	if (num_other_online_cpus() == 0)
+		goto skip_ipi;
 
-		cpumask_copy(&mask, cpu_online_mask);
-		cpumask_clear_cpu(smp_processor_id(), &mask);
+	/* Only proceed if this is the first CPU to reach this code */
+	if (test_and_set_bit(0, &stop_in_progress))
+		return;
 
-		if (system_state <= SYSTEM_RUNNING)
-			pr_crit("SMP: stopping secondary CPUs\n");
-		smp_cross_call(&mask, IPI_CPU_STOP);
-	}
+	/*
+	 * Send an IPI to all currently online CPUs except the CPU running
+	 * this code.
+	 *
+	 * NOTE: we don't do anything here to prevent other CPUs from coming
+	 * online after we snapshot `cpu_online_mask`. Ideally, the calling code
+	 * should do something to prevent other CPUs from coming up. This code
+	 * can be called in the panic path and thus it doesn't seem wise to
+	 * grab the CPU hotplug mutex ourselves. Worst case:
+	 * - If a CPU comes online as we're running, we'll likely notice it
+	 *   during the 1 second wait below and then we'll catch it when we try
+	 *   with an NMI (assuming NMIs are enabled) since we re-snapshot the
+	 *   mask before sending an NMI.
+	 * - If we leave the function and see that CPUs are still online we'll
+	 *   at least print a warning. Especially without NMIs this function
+	 *   isn't foolproof anyway so calling code will just have to accept
+	 *   the fact that there could be cases where a CPU can't be stopped.
+	 */
+	cpumask_copy(&mask, cpu_online_mask);
+	cpumask_clear_cpu(smp_processor_id(), &mask);
 
-	/* Wait up to one second for other CPUs to stop */
+	if (system_state <= SYSTEM_RUNNING)
+		pr_crit("SMP: stopping secondary CPUs\n");
+
+	/*
+	 * Start with a normal IPI and wait up to one second for other CPUs to
+	 * stop. We do this first because it gives other processors a chance
+	 * to exit critical sections / drop locks and makes the rest of the
+	 * stop process (especially console flush) more robust.
+	 */
+	smp_cross_call(&mask, IPI_CPU_STOP);
 	timeout = USEC_PER_SEC;
 	while (num_other_online_cpus() && timeout--)
 		udelay(1);
 
-	if (num_other_online_cpus())
+	/*
+	 * If CPUs are still online, try an NMI. There's no excuse for this to
+	 * be slow, so we only give them an extra 10 ms to respond.
+	 */
+	if (num_other_online_cpus() && ipi_should_be_nmi(IPI_CPU_STOP_NMI)) {
+		smp_rmb();
+		cpumask_copy(&mask, cpu_online_mask);
+		cpumask_clear_cpu(smp_processor_id(), &mask);
+
+		pr_info("SMP: retry stop with NMI for CPUs %*pbl\n",
+			cpumask_pr_args(&mask));
+
+		smp_cross_call(&mask, IPI_CPU_STOP_NMI);
+		timeout = USEC_PER_MSEC * 10;
+		while (num_other_online_cpus() && timeout--)
+			udelay(1);
+	}
+
+	if (num_other_online_cpus()) {
+		smp_rmb();
+		cpumask_copy(&mask, cpu_online_mask);
+		cpumask_clear_cpu(smp_processor_id(), &mask);
+
 		pr_warn("SMP: failed to stop secondary CPUs %*pbl\n",
-			cpumask_pr_args(cpu_online_mask));
+			cpumask_pr_args(&mask));
+	}
 
+skip_ipi:
 	sdei_mask_local_cpu();
 }
 
 #ifdef CONFIG_KEXEC_CORE
 void crash_smp_send_stop(void)
 {
-	static int cpus_stopped;
-	cpumask_t mask;
-	unsigned long timeout;
-
 	/*
 	 * This function can be called twice in panic path, but obviously
 	 * we execute this only once.
+	 *
+	 * We use this same boolean to tell whether the IPI we send was a
+	 * stop or a "crash stop".
 	 */
-	if (cpus_stopped)
+	if (crash_stop)
 		return;
+	crash_stop = 1;
 
-	cpus_stopped = 1;
+	smp_send_stop();
 
-	/*
-	 * If this cpu is the only one alive at this point in time, online or
-	 * not, there are no stop messages to be sent around, so just back out.
-	 */
-	if (num_other_online_cpus() == 0)
-		goto skip_ipi;
-
-	cpumask_copy(&mask, cpu_online_mask);
-	cpumask_clear_cpu(smp_processor_id(), &mask);
-
-	atomic_set(&waiting_for_crash_ipi, num_other_online_cpus());
-
-	pr_crit("SMP: stopping secondary CPUs\n");
-	smp_cross_call(&mask, IPI_CPU_CRASH_STOP);
-
-	/* Wait up to one second for other CPUs to stop */
-	timeout = USEC_PER_SEC;
-	while ((atomic_read(&waiting_for_crash_ipi) > 0) && timeout--)
-		udelay(1);
-
-	if (atomic_read(&waiting_for_crash_ipi) > 0)
-		pr_warn("SMP: failed to stop secondary CPUs %*pbl\n",
-			cpumask_pr_args(&mask));
-
-skip_ipi:
-	sdei_mask_local_cpu();
 	sdei_handler_abort();
 }
 
 bool smp_crash_stop_failed(void)
 {
-	return (atomic_read(&waiting_for_crash_ipi) > 0);
+	return num_other_online_cpus() != 0;
 }
 #endif
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Antipov <[email protected]>

[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]

In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.

---
 drivers/net/wireless/realtek/rtw88/main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

index 7ab7a988b123f..33a7577557a56 100644
@@ -1313,20 +1313,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev)
 {
 	const struct rtw_chip_info *chip = rtwdev->chip;
 	struct rtw_fw_state *fw;
+	int ret = 0;
 
 	fw = &rtwdev->fw;
 	wait_for_completion(&fw->completion);
 	if (!fw->firmware)
-		return -EINVAL;
+		ret = -EINVAL;
 
 	if (chip->wow_fw_name) {
 		fw = &rtwdev->wow_fw;
 		wait_for_completion(&fw->completion);
 		if (!fw->firmware)
-			return -EINVAL;
+			ret = -EINVAL;
 	}
 
-	return 0;
+	return ret;
 }
 
 static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Helge Deller <[email protected]>

[ Upstream commit ab9a244c396aae4aaa34b2399b82fc15ec2df8c1 ]

Commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking") switched from using jiffies to ktime-based performance benchmarking.

This works nicely on machines which have a fine-grained ktime() clocksource as e.g. x86 machines with TSC.
But other machines, e.g. my 4-way HP PARISC server, don't have such fine-grained clocksources, which is why it seems that 800 xor loops take zero seconds, which then shows up in the logs as:

xor: measuring software checksum speed

    8regs           : -1018167296 MB/sec
    8regs_prefetch  : -1018167296 MB/sec
    32regs          : -1018167296 MB/sec
    32regs_prefetch : -1018167296 MB/sec

Fix this with some small modifications to the existing code to improve the algorithm to always produce correct results without introducing major delays for architectures with a fine-grained ktime() clocksource:
a) Delay start of the timing until ktime() just advanced. On machines with a fast ktime() this should be just one additional ktime() call.
b) Count the number of loops. Run at minimum 800 loops and finish earliest when the ktime() counter has progressed.

With that the throughput can now be calculated more accurately under all conditions.

v2:
- clean up coding style (noticed & suggested by Herbert Xu)
- rephrased & fixed typo in commit message

---
 crypto/xor.c | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

index 8e72e5d5db0de..56aa3169e8717 100644
@@ -83,33 +83,30 @@ static void __init
 do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2)
 {
 	int speed;
-	int i, j;
-	ktime_t min, start, diff;
+	unsigned long reps;
+	ktime_t min, start, t0;
 
 	tmpl->next = template_list;
 	template_list = tmpl;
 
 	preempt_disable();
 
-	min = (ktime_t)S64_MAX;
-	for (i = 0; i < 3; i++) {
-		start = ktime_get();
-		for (j = 0; j < REPS; j++) {
-			mb(); /* prevent loop optimization */
-			tmpl->do_2(BENCH_SIZE, b1, b2);
-			mb();
-		}
-		diff = ktime_sub(ktime_get(), start);
-		if (diff < min)
-			min = diff;
-	}
+	reps = 0;
+	t0 = ktime_get();
+	/* delay start until time has advanced */
+	while ((start = ktime_get()) == t0)
+		cpu_relax();
+	do {
+		mb(); /* prevent loop optimization */
+		tmpl->do_2(BENCH_SIZE, b1, b2);
+		mb();
+	} while (reps++ < REPS || (t0 = ktime_get()) == start);
+	min = ktime_sub(t0, start);
 
 	preempt_enable();
 
 	// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s]
-	if (!min)
-		min = 1;
-	speed = (1000 * REPS * BENCH_SIZE) / (unsigned int)ktime_to_ns(min);
+	speed = (1000 * reps * BENCH_SIZE) / (unsigned int)ktime_to_ns(min);
 	tmpl->speed = speed;
 
 	pr_info("   %-16s: %5d MB/sec\n", tmpl->name, speed);

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Witwicki <[email protected]>

[ Upstream commit b6c7d36292d50627dbe6a57fa344f87c776971e6 ]

Disabling IOV has the side effect of re-enabling the AEs that might attempt to do DMAs into the heartbeat buffers.
Move the disable_iov() function in adf_dev_stop() before the AEs are stopped.

---
 drivers/crypto/intel/qat/qat_common/adf_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 74f0818c07034..55f1ff1e0b322 100644
@@ -323,6 +323,8 @@ static void adf_dev_stop(struct adf_accel_dev *accel_dev)
 	if (hw_data->stop_timer)
 		hw_data->stop_timer(accel_dev);
 
+	hw_data->disable_iov(accel_dev);
+
 	if (wait)
 		msleep(100);
 

@@ -386,8 +388,6 @@ static void adf_dev_shutdown(struct adf_accel_dev *accel_dev)
 
 	adf_tl_shutdown(accel_dev);
 
-	hw_data->disable_iov(accel_dev);
-
 	if (test_bit(ADF_STATUS_IRQ_ALLOCATED, &accel_dev->status)) {
 		hw_data->free_irq(accel_dev);
 		clear_bit(ADF_STATUS_IRQ_ALLOCATED, &accel_dev->status);

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Witwicki <[email protected]>

[ Upstream commit 6f1b5236348fced7e7691a933327694b4106bc39 ]

When the PFVF protocol was updated to support version 5, i.e. ADF_PFVF_COMPAT_FALLBACK, the compatibility version for the VF was updated without supporting the message RESTARTING_COMPLETE required for such version.

Add support for the ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE message in the VF drivers. This message is sent by the VF driver to the PF to notify the completion of the shutdown flow.

---
 .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c  | 14 ++++++++++++++
 .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h  |  1 +
 drivers/crypto/intel/qat/qat_common/adf_vf_isr.c   |  2 ++
 3 files changed, 17 insertions(+)

index 1141258db4b65..10c91e56d6be3 100644
@@ -48,6 +48,20 @@ void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
 }
 EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown);
 
+void adf_vf2pf_notify_restart_complete(struct adf_accel_dev *accel_dev)
+{
+	struct pfvf_message msg = { .type = ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE };
+
+	/* Check compatibility version */
+	if (accel_dev->vf.pf_compat_ver < ADF_PFVF_COMPAT_FALLBACK)
+		return;
+
+	if (adf_send_vf2pf_msg(accel_dev, msg))
+		dev_err(&GET_DEV(accel_dev),
+			"Failed to send Restarting complete event to PF\n");
+}
+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_restart_complete);
+
 int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev)
 {
 	u8 pf_version;

index 71bc0e3f1d933..d79340ab3134f 100644
@@ -6,6 +6,7 @@
 #if defined(CONFIG_PCI_IOV)
 int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev);
 void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev);
+void adf_vf2pf_notify_restart_complete(struct adf_accel_dev *accel_dev);
 int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev);
 int adf_vf2pf_get_capabilities(struct adf_accel_dev *accel_dev);
 int adf_vf2pf_get_ring_to_svc(struct adf_accel_dev *accel_dev);

index cdbb2d687b1b0..4ab9ac3315195 100644
@@ -13,6 +13,7 @@
 #include "adf_cfg.h"
 #include "adf_cfg_strings.h"
 #include "adf_cfg_common.h"
+#include "adf_pfvf_vf_msg.h"
 #include "adf_transport_access_macros.h"
 #include "adf_transport_internal.h"
 

@@ -75,6 +76,7 @@ static void adf_dev_stop_async(struct work_struct *work)
 
 	/* Re-enable PF2VF interrupts */
 	adf_enable_pf2vf_interrupts(accel_dev);
+	adf_vf2pf_notify_restart_complete(accel_dev);
 	kfree(stop_data);
 }
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Witwicki <[email protected]>

[ Upstream commit cd8d2d74292c199b433ef77762bb1d28a4821784 ]

In the process of sending the ADF_PF2VF_MSGTYPE_RESTARTING message to Virtual Functions (VFs), the Physical Function (PF) should set the vf->restarting flag to true before dispatching the message. This change is necessary to prevent a race condition where the handling of the ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE message (which sets the vf->restarting flag to false) runs immediately after the message is sent, but before the flag is set to true.

Set the vf->restarting to true before sending the message ADF_PF2VF_MSGTYPE_RESTARTING, if supported by the version of the protocol and if the VF is started.

---
 drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

index 0e31f4b41844e..0cee3b23dee90 100644
@@ -18,14 +18,17 @@ void adf_pf2vf_notify_restarting(struct adf_accel_dev *accel_dev)
 
 	dev_dbg(&GET_DEV(accel_dev), "pf2vf notify restarting\n");
 	for (i = 0, vf = accel_dev->pf.vf_info; i < num_vfs; i++, vf++) {
-		vf->restarting = false;
+		if (vf->init && vf->vf_compat_ver >= ADF_PFVF_COMPAT_FALLBACK)
+			vf->restarting = true;
+		else
+			vf->restarting = false;
+
 		if (!vf->init)
 			continue;
+
 		if (adf_send_pf2vf_msg(accel_dev, i, msg))
 			dev_err(&GET_DEV(accel_dev),
 				"Failed to send restarting msg to VF%d\n", i);
-		else if (vf->vf_compat_ver >= ADF_PFVF_COMPAT_FALLBACK)
-			vf->restarting = true;
 	}
 }
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

[ Upstream commit e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209 ]

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the ->free() function and the use after free happens in dead code. But, with this fix, when something does implement it, we'll be ready. :)

---
 drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index e810d286ee8c4..237f870000702 100644
@@ -495,10 +495,10 @@ static void remove_device_compression_modes(struct iaa_device *iaa_device)
 		if (!device_mode)
 			continue;
 
-		free_device_compression_mode(iaa_device, device_mode);
-		iaa_device->compression_modes[i] = NULL;
 		if (iaa_compression_modes[i]->free)
 			iaa_compression_modes[i]->free(device_mode);
+		free_device_compression_mode(iaa_device, device_mode);
+		iaa_device->compression_modes[i] = NULL;
 	}
 }
 

2.43.0

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aleksandr Mishin <[email protected]>

[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]

In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.

Fix this issue by removing unneeded check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

---
 drivers/acpi/pmic/tps68470_pmic.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

index ebd03e4729555..0d1a82eeb4b0b 100644
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)
 	struct tps68470_pmic_opregion *opregion;
 	acpi_status status;
 
-	if (!dev || !tps68470_regmap) {
-		dev_warn(dev, "dev or regmap is NULL\n");
-		return -EINVAL;
-	}
+	if (!tps68470_regmap)
+		return dev_err_probe(dev, -EINVAL, "regmap is missing\n");
 
 	if (!handle) {
 		dev_warn(dev, "acpi handle is NULL\n");

2.43.0

This is the start of the stable review cycle for the 6.10.13 release. There are 634 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 04 Oct 2024 12:56:13 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.13-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.10.13-rc1

Oleg Nesterov <[email protected]>
bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()

Paolo Bonzini <[email protected]>
Documentation: KVM: fix warning in "make htmldocs"

Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'

Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs

Liam R. Howlett <[email protected]>
mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu read lock

Vishal Moola (Oracle) <[email protected]>
mm: change vmf_anon_prepare() to __vmf_anon_prepare()

Miaohe Lin <[email protected]>
mm/huge_memory: ensure huge_zero_folio won't have large_rmappable flag set

Vishal Moola (Oracle) <[email protected]>
mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway

Kexy Biscuit <[email protected]>
tpm: export tpm2_sessions_init() to fix ibmvtpm building

Jason Andryuk <[email protected]>

    fbdev: xen-fbfront: Assign fb_info->device

Dmitry Vyukov <[email protected]>
module: Fix KCOV-ignored file name

Haibo Chen <[email protected]>
spi: fspi: add support for imx8ulp

David Gow <[email protected]>
mm: only enforce minimum stack gap size if it's sensible

Vasily Gorbik <[email protected]>
s390/ftrace: Avoid calling unwinder in ftrace_return_address()

Yu Zhao <[email protected]>
mm/hugetlb_vmemmap: batch HVO work when demoting

Daniel Yang <[email protected]>
exfat: resolve memory leak from exfat_create_upcase_table()

Zhiguo Niu <[email protected]>
lockdep: fix deadlock issue between lockdep and rcu

Tiezhu Yang <[email protected]>
compiler.h: specify correct attribute for .rodata..c_jump_table

Mikulas Patocka <[email protected]>
dm-verity: restart or panic on an I/O error

Song Liu <[email protected]>
bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0

Casey Schaufler <[email protected]>
lsm: infrastructure management of the sock security

Marc Aurèle La France <[email protected]>
debugfs show actual source in /proc/mounts

Eric Sandeen <[email protected]>
debugfs: Convert to new uid/gid option parsing helpers

Eric Sandeen <[email protected]>
fs_parse: add uid & gid option option parsing helpers

Michal Kubiak <[email protected]>
idpf: fix netdev Tx queue stop/wake

Alexander Lobakin <[email protected]>
idpf: merge singleq and splitq &net_device_ops

Alexander Lobakin <[email protected]>
idpf: split &idpf_queue into 4 strictly-typed queue structures

Alexander Lobakin <[email protected]>
idpf: stop using macros for accessing queue descriptors

Johan Hovold <[email protected]>
serial: qcom-geni: fix console corruption

Douglas Anderson <[email protected]>
serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield()

Douglas Anderson <[email protected]>
serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit()

Douglas Anderson <[email protected]>
soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers

Pawel Laszczak <[email protected]>
usb: xhci: fix loss of data on Cadence xHC

Daehwan Jung <[email protected]>
xhci: Add a quirk for writing ERST in high-low order

Alexey Gladkov (Intel) <[email protected]>
x86/tdx: Fix "in-kernel MMIO" check

Kirill A. Shutemov <[email protected]>
x86/tdx: Convert shared memory back to private on kexec

Kirill A. Shutemov <[email protected]>
x86/mm: Add callbacks to prepare encrypted memory for kexec

Kirill A. Shutemov <[email protected]>
x86/tdx: Account shared memory

Kirill A. Shutemov <[email protected]>
x86/mm: Make x86_platform.guest.enc_status_change_*() return an error

Sean Christopherson <[email protected]>
KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)

Sean Christopherson <[email protected]>
KVM: x86: Make x2APIC ID 100% readonly

Hou Wenlong <[email protected]>
KVM: x86: Drop unused check_apicv_inhibit_reasons() callback definition

Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove

Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove

Thomas Weißschuh <[email protected]>
tools/nolibc: include arch.h from string.h

Krzysztof Kozlowski <[email protected]>
ARM: dts: imx6ull-seeed-npi: fix fsl,pins property in tscgrp pinctrl

Krzysztof Kozlowski <[email protected]>
ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl

Haibo Chen <[email protected]>
dt-bindings: spi: nxp-fspi: add imx8ulp support

Haibo Chen <[email protected]>
spi: fspi: involve lut_num for struct nxp_fspi_devtype_data

Paul Moore <[email protected]>
lsm: add the inode_free_security_rcu() LSM implementation hook

VanGiang Nguyen <[email protected]>
padata: use integer wrap around to prevent deadlock on seq_nr overflow

Krzysztof Kozlowski <[email protected]>
cpuidle: riscv-sbi: Use scoped device node handling to fix missing of_node_put

Yu Kuai <[email protected]>
md: Don't flush sync_work in md_write_start()

Martin Karsten <[email protected]>
eventpoll: Annotate data-race of busy_poll_usecs

Eric Dumazet <[email protected]>
icmp: change the order of rate limits

Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix conversion of system address to physical memory address

Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim

Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies

Baokun Li <[email protected]>
netfs: Delete subtree of 'fs/netfs' when netfs module exits

Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()

Dragan Simic <[email protected]>
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity

Qingqing Zhou <[email protected]>
arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent

Dragan Simic <[email protected]>
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola: Disable DPI display interface

D Scott Phillips <[email protected]>
arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a

Anastasia Belova <[email protected]>
arm64: esr: Define ESR_ELx_EC_* constants as UL

Gaosheng Cui <[email protected]>
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume

Gaosheng Cui <[email protected]>
hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init

Guoqing Jiang <[email protected]>
hwrng: mtk - Use devm_pm_runtime_enable

Chao Yu <[email protected]>
f2fs: fix to check atomic_file in f2fs ioctl interfaces

Shin'ichiro Kawasaki <[email protected]>
f2fs: check discard support for conventional zones

Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls

Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()

Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()

Nikita Zhandarovich <[email protected]>
f2fs: fix several potential integer overflows in file offsets

Luca Stefani <[email protected]>
btrfs: always update fstrim_range on failure in FITRIM ioctl

Qu Wenruo <[email protected]>
btrfs: tree-checker: fix the wrong output of data backref objectid

Filipe Manana <[email protected]>
btrfs: fix race setting file private on concurrent lseek using same fd

Zhen Lei <[email protected]>
debugobjects: Fix conditions in fill_pool()

Ma Ke <[email protected]>
wifi: mt76: mt7615: check devm_kasprintf() returned value

Bitterblue Smith <[email protected]>
wifi: rtw88: 8703b: Fix reported RX band width

Bitterblue Smith <[email protected]>
wifi: rtw88: 8822c: Fix reported RX band width

Nick Morrow <[email protected]>

    wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c

Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc

Ma Ke <[email protected]>
wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he

Ma Ke <[email protected]>
wifi: mt76: mt7915: check devm_kasprintf() returned value

Ma Ke <[email protected]>
wifi: mt76: mt7921: Check devm_kasprintf() returned value

Qu Wenruo <[email protected]>
btrfs: subpage: fix the bitmap dump which can cause bitmap corruption

Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix sampling synchronization

Kan Liang <[email protected]>
perf/x86/intel: Allow to setup LBR for counting event for BPF

Dmitry Vyukov <[email protected]>
x86/entry: Remove unwanted instrumentation in common_interrupt()

Ard Biesheuvel <[email protected]>
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption

Werner Sembach <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx

Li Chen <[email protected]>
ACPI: resource: Do IRQ override on MECHREV GM7XG0M

Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method

Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation

Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()

Pavan Kumar Paluri <[email protected]>
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure

Brian Masney <[email protected]>
crypto: qcom-rng - fix support for ACPI-based systems

Johan Hovold <[email protected]>
serial: qcom-geni: fix false console tx restart

Johan Hovold <[email protected]>
serial: qcom-geni: fix fifo polling timeout

Mathias Nyman <[email protected]>
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.

Jiri Slaby (SUSE) <[email protected]>
serial: don't use uninitialized value in uart_poll_init()

Ma Ke <[email protected]>
pps: add an error check in parport_attach

Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges

Jann Horn <[email protected]>
firmware_loader: Block path traversal

Fabio Porcedda <[email protected]>
bus: mhi: host: pci_generic: Fix the name for the Telit FE990A

Krzysztof Kozlowski <[email protected]>
bus: integrator-lm: fix OF node leak in probe()

Tomas Marek <[email protected]>
usb: dwc2: drd: fix clock gating on USB role switch

Andrey Konovalov <[email protected]>
usb: gadget: dummy_hcd: execute hrtimer callback in softirq context

WangYuli <[email protected]>
usb: xHCI: add XHCI_RESET_ON_RESUME quirk for Phytium xHCI host

Pawel Laszczak <[email protected]>
usb: cdnsp: Fix incorrect usb_request status

Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write

Oliver Neukum <[email protected]>
USB: class: CDC-ACM: fix race between get_serial and set_serial

Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer

Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler

Chen-Yu Tsai <[email protected]>

    arm64: dts: mediatek: mt8395-nio-12l: Mark USB 3.0 on xhci1 as disabled

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled

Oliver Neukum <[email protected]>
usbnet: fix cyclical race on disconnect with work queue

Bitterblue Smith <[email protected]>
wifi: rtw88: Fix USB/SDIO devices not transmitting beacons

Stefan Mätje <[email protected]>
can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD

Finn Thain <[email protected]>
scsi: mac_scsi: Disallow bus errors during PDMA send

Finn Thain <[email protected]>
scsi: mac_scsi: Refactor polling loop

Finn Thain <[email protected]>
scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages

Justin Tee <[email protected]>
scsi: lpfc: Restrict support for 32 byte CDBs to specific HBAs

Manish Pandey <[email protected]>
scsi: ufs: qcom: Update MODE_MAX cfg_bw value

Martin Wilck <[email protected]>
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()

Damien Le Moal <[email protected]>
ata: libata-scsi: Fix ata_msense_control() CDL page reporting

Namjae Jeon <[email protected]>
ksmbd: handle caseless file creation

Namjae Jeon <[email protected]>
ksmbd: allow write with FILE_APPEND_DATA

Hobin Woo <[email protected]>
ksmbd: make __dir_empty() compatible with POSIX

Michael Ellerman <[email protected]>
powerpc/atomic: Use YZ constraints for DS-form instructions

Roman Smirnov <[email protected]>
KEYS: prevent NULL pointer dereference in find_asymmetric_key()

Tiezhu Yang <[email protected]>
objtool: Handle frame pointer related instructions

Huacai Chen <[email protected]>
Revert "LoongArch: KVM: Invalidate guest steal time address on vCPU reset"

Zhikai Zhai <[email protected]>
drm/amd/display: Skip to enable dsc if it has been off

Yihan Zhu <[email protected]>
drm/amd/display: Enable DML2 override_det_buffer_size_kbytes

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Block dynamic IPS2 on DCN35 for incompatible FW versions

Sung Joon Kim <[email protected]>
drm/amd/display: Disable SYMCLK32_LE root clock gating

Mario Limonciello <[email protected]>
drm/amd/display: Validate backlight caps are sane

Martin Tsai <[email protected]>
drm/amd/display: Clean up dsc blocks in accelerated mode

Robin Chen <[email protected]>
drm/amd/display: Round calculated vtotal

Leo Ma <[email protected]>
drm/amd/display: Add HDMI DSC native YCbCr422 support

Saleemkhan Jamadar <[email protected]>
drm/amdgpu/vcn: enable AV1 on both instances

Alex Deucher <[email protected]>
drm/amdgpu/mes11: reduce timeout

Fangzhi Zuo <[email protected]>
drm/amd/display: Skip Recompute DSC Params if no Stream on Link

Sean Christopherson <[email protected]>
KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock

Sean Christopherson <[email protected]>
KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()

Sean Christopherson <[email protected]>
KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits

Snehal Koukuntla <[email protected]>
KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer

Werner Sembach <[email protected]>
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line

Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table

Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table

Nuno Sa <[email protected]>
Input: adp5588-keys - fix check on return code

Jason Gunthorpe <[email protected]>
iommufd: Protect against overflow of ALIGN() during iova allocation

Eliav Bar-ilan <[email protected]>
iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all()

Roman Smirnov <[email protected]>
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"

Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path

Herve Codina <[email protected]>
soc: fsl: cpm1: tsa: Fix tsa_write8()

Herve Codina <[email protected]>
soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode

Ma Ke <[email protected]>
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error

Dmitry Baryshkov <[email protected]>
Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"

Siddharth Vadapalli <[email protected]>
PCI: dra7xx: Fix error handling when IRQ request fails in probe

Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler

Maciej W. Rozycki <[email protected]>
PCI: Use an error code with PCIe failed link retraining

Maciej W. Rozycki <[email protected]>
PCI: Correct error reporting with PCIe failed link retraining

Richard Zhu <[email protected]>
PCI: imx6: Fix i.MX8MP PCIe EP's occasional failure to trigger MSI

Richard Zhu <[email protected]>
PCI: imx6: Fix establish link failure in EP mode for i.MX8MM and i.MX8MP

Frank Li <[email protected]>
PCI: imx6: Fix missing call to phy_power_off() in error handling

Siddharth Vadapalli <[email protected]>
PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ

Maciej W. Rozycki <[email protected]>
PCI: Clear the LBMS bit after a link retrain

Maciej W. Rozycki <[email protected]>
PCI: Revert to the original speed after PCIe failed link retraining

Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore

Eduard Zingerman <[email protected]>
selftests/bpf: correctly move 'log' upon successful match

Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not put cpumask on stack

Jens Axboe <[email protected]>
io_uring/sqpoll: retain test for whether the CPU is valid

Juergen Gross <[email protected]>
xen: allow mapping ACPI data using a different physical address

Juergen Gross <[email protected]>
xen: move checks for e820 conflicts further up

Fangzhi Zuo <[email protected]>
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination

Shu Han <[email protected]>
mm: call the security_mmap_file() LSM hook in remap_file_pages()

Jeongjun Park <[email protected]>
mm: migrate: annotate data-race in migrate_folio_unmap()

yangyun <[email protected]>
fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set

Jens Axboe <[email protected]>
io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL

Jens Axboe <[email protected]>
io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN

Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not allow pinning outside of cpuset

Phil Sutter <[email protected]>
selftests: netfilter: Avoid hanging ipvs.sh

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing objects with no memcg accounting

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path

Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS

Phil Sutter <[email protected]>
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU

Furong Xu <[email protected]>
net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled

Wenbo Li <[email protected]>
virtio_net: Fix mismatched buf address when unmapping for small packets

Jiwon Kim <[email protected]>
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()

Paul Barker <[email protected]>
net: ravb: Fix R-Car RX frame size limit

Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting

Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()

Thomas Weißschuh <[email protected]>
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL

Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition

Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

Sean Anderson <[email protected]>
net: xilinx: axienet: Fix packet counting

Sean Anderson <[email protected]>
net: xilinx: axienet: Schedule NAPI in two steps

Mikulas Patocka <[email protected]>
Revert "dm: requeue IO if mapping table not yet available"

Dan Carpenter <[email protected]>
ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()

Jason Wang <[email protected]>
vhost_vdpa: assign irq bypass producer token correctly

Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix invalid mr resource destroy

Yanfei Xu <[email protected]>
cxl/pci: Fix to record only non-zero ranges

Dmitry Baryshkov <[email protected]>
interconnect: qcom: sm8250: Enable sync_state

Kees Cook <[email protected]>
interconnect: icc-clk: Add missed num_nodes initialization

Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table

Jie Gan <[email protected]>
Coresight: Set correct cs_mode for dummy source to fix disable issue

Jie Gan <[email protected]>
Coresight: Set correct cs_mode for TPDM to fix disable issue

Markus Schneider-Pargmann <[email protected]>
serial: 8250: omap: Cleanup on error in request_irq

Jinjie Ruan <[email protected]>
driver core: Fix a potential null-ptr-deref in module_add_driver()

Krzysztof Kozlowski <[email protected]>
dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible

Krzysztof Kozlowski <[email protected]>
iio: magnetometer: ak8975: drop incorrect AK09116 compatible

Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix read/write ops to device by adding mutexes

Antoniu Miclaus <[email protected]>
ABI: testing: fix admv8818 attr description

Zijun Hu <[email protected]>
driver core: Fix error handling in driver API device_rename()

Guillaume Stols <[email protected]>
iio: adc: ad7606: fix standby gpio state to match the documentation

Guillaume Stols <[email protected]>
iio: adc: ad7606: fix oversampling gpio array

Hannes Reinecke <[email protected]>
nvme-multipath: system fails to create generic nvme device

Alexander Dahl <[email protected]>
spi: atmel-quadspi: Avoid overwriting delay register settings

Lorenzo Bianconi <[email protected]>
spi: airoha: remove read cache in airoha_snand_dirmap_read()

Ming Lei <[email protected]>
lib/sbitmap: define swap_lock as raw_spinlock_t

Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time

Jinjie Ruan <[email protected]>
spi: atmel-quadspi: Undo runtime PM changes at driver exit time

Lorenzo Bianconi <[email protected]>
spi: airoha: fix airoha_snand_{write,read}_data data_len estimation

Lorenzo Bianconi <[email protected]>
spi: airoha: fix dirmap_{read,write} operations

Chao Yu <[email protected]>
f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()

Chao Yu <[email protected]>
f2fs: get rid of online repaire on corrupted directory

Daeho Jeong <[email protected]>
f2fs: prevent atomic file from being dirtied before commit

Yeongjin Gil <[email protected]>
f2fs: compress: don't redirty sparse cluster during {,de}compress

Chao Yu <[email protected]>
f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()

Chao Yu <[email protected]>
f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation

Chao Yu <[email protected]>
f2fs: fix to wait page writeback before setting gcing flag

Yeongjin Gil <[email protected]>
f2fs: Create COW inode from parent dentry for atomic write

Chao Yu <[email protected]>
f2fs: fix to avoid racing in between read and OPU dio write

Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency

Chao Yu <[email protected]>
f2fs: atomic: fix to avoid racing w/ GC

Danny Tsen <[email protected]>
crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10

Herbert Xu <[email protected]>
crypto: caam - Pad SG length when allocating hash edesc

Jeff Layton <[email protected]>
nfsd: fix initial getattr on write delegation

NeilBrown <[email protected]>
nfsd: untangle code in nfsd4_deleg_getattr_conflict()

Li Lingfeng <[email protected]>
nfsd: return -EINVAL when namelen is 0

Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL

Dave Jiang <[email protected]>
ntb: Force physically contiguous allocation of rx ring buffers

Max Hawking <[email protected]>
ntb_perf: Fix printk format

Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()

Vitaliy Shevtsov <[email protected]>
RDMA/irdma: fix error message in irdma_modify_qp_roce()

Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid

Junxian Huang <[email protected]>
RDMA/hns: Fix ah error counter in sw stat not increasing

Jinjie Ruan <[email protected]>
riscv: Fix fp alignment bug in perf_callchain_user()

Manivannan Sadhasivam <[email protected]>
PCI: qcom-ep: Enable controller resources like PHY only after refclk is available

Mark Bloch <[email protected]>
RDMA/mlx5: Obtain upper net device only when needed

Junxian Huang <[email protected]>
RDMA/hns: Fix restricted __le16 degrades to integer issue

Junxian Huang <[email protected]>
RDMA/hns: Optimize hem allocation performance

Chengchang Tang <[email protected]>
RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS

Junxian Huang <[email protected]>
RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler

Chengchang Tang <[email protected]>
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled

wenglianfa <[email protected]>
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()

wenglianfa <[email protected]>
RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08

Junxian Huang <[email protected]>
RDMA/hns: Don't modify rq next block addr in HIP09 QPC

Jonas Blixt <[email protected]>
watchdog: imx_sc_wdt: Don't disable WDT in suspend

Michael Guralnik <[email protected]>
RDMA/mlx5: Fix MR cache temp entries cleanup

Michael Guralnik <[email protected]>
RDMA/mlx5: Drop redundant work canceling from clean_keys()

Michael Guralnik <[email protected]>
RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache

Michael Guralnik <[email protected]>
RDMA/mlx5: Fix counter update on MR cache mkey creation

Cheng Xu <[email protected]>
RDMA/erdma: Return QP state in erdma_query_qp

Alexandra Diupina <[email protected]>
PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()

Jason Gunthorpe <[email protected]>
iommufd: Check the domain owner of the parent before creating a nesting domain

Frank Li <[email protected]>
dt-bindings: PCI: layerscape-pci: Replace fsl,lx2160a-pcie with fsl,lx2160ar2-pcie

Patrisious Haddad <[email protected]>
IB/core: Fix ib_cache_setup_one error flow cleanup

Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function

Jeff Layton <[email protected]>
nfsd: fix refcount leak when file is unhashed after being found

Jeff Layton <[email protected]>
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire

Alexander Shiyan <[email protected]>

    clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p

Yuntao Liu <[email protected]>
clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage

David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes

Md Haris Iqbal <[email protected]>
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

Jack Wang <[email protected]>
RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer

Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 stateless decoder smatch warning

Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning

Yunfei Dong <[email protected]>
media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning

Jason Gunthorpe <[email protected]>
iommufd/selftest: Fix buffer read overrrun in the dirty test

Claudiu Beznea <[email protected]>
clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs

Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()

Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

Biju Das <[email protected]>
media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE

Kees Cook <[email protected]>
leds: gpio: Set num_leds after allocation

Sean Anderson <[email protected]>
PCI: xilinx-nwl: Clean up clock on probe failure/removal

Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling

Li Zhijian <[email protected]>
nvdimm: Fix devs leaks in scan_labels()

Samasth Norway Ananda <[email protected]>
x86/PCI: Check pcie_find_root_port() return for NULL

Javier Carrasco <[email protected]>
leds: pca995x: Fix device child node usage in pca995x_probe()

Javier Carrasco <[email protected]>
leds: pca995x: Use device_for_each_child_node() to access device child nodes

Pieterjan Camerlynck <[email protected]>
leds: leds-pca995x: Add support for NXP PCA9956B

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL

Varadarajan Narayanan <[email protected]>
clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src

Uwe Kleine-König <[email protected]>
media: staging: media: starfive: camss: Drop obsolete return value documentation

Dan Carpenter <[email protected]>
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()

Takashi Sakamoto <[email protected]>
firewire: core: correct range of block for case of switch statement

Ilpo Järvinen <[email protected]>
PCI: Wait for Link before restoring Downstream Buses

Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error

Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error

Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - add report id message validation

Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - avoid wrong input subsystem sync

Cristian Ciocaltea <[email protected]>
phy: phy-rockchip-samsung-hdptx: Explicitly include pm_runtime.h

Christophe JAILLET <[email protected]>
pinctrl: ti: ti-iodelay: Fix some error handling paths

Peng Fan <[email protected]>
pinctrl: ti: iodelay: Use scope based of_node_put() cleanups

Javier Carrasco <[email protected]>
leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8650: Update the GDSC flags

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8550: fix several supposed typos

Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228

Peng Fan <[email protected]>
remoteproc: imx_rproc: Initialize workqueue earlier

Peng Fan <[email protected]>
remoteproc: imx_rproc: Correct ddr alias for i.MX8M

Kemeng Shi <[email protected]>
quota: avoid missing put_quota_format when DQUOT_SUSPENDED is passed

Peng Fan <[email protected]>
clk: imx: imx8qxp: Parent should be initialized earlier than the clock

Peng Fan <[email protected]>
clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk

Zhipeng Wang <[email protected]>
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks

Pengfei Li <[email protected]>
clk: imx: fracn-gppll: fix fractional part of PLL getting lost

Ye Li <[email protected]>
clk: imx: composite-7ulp: Check the PCC present bit

Jacky Bai <[email protected]>
clk: imx: composite-93: keep root clock on when mcore enabled

Peng Fan <[email protected]>
clk: imx: composite-8m: Enable gate clk with mcore_booted

Sebastien Laveze <[email protected]>
clk: imx: imx6ul: fix default parent for enet*_ref_sel

Shengjiu Wang <[email protected]>
clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll

Kan Liang <[email protected]>
perf mem: Fix missed p-core mem events on ADL and RPL

Kan Liang <[email protected]>
perf mem: Check mem_events for all eligible PMUs

Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing

Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time

Namhyung Kim <[email protected]>
perf dwarf-aux: Handle bitfield members from pointer access

Namhyung Kim <[email protected]>
perf annotate-data: Fix off-by-one in location range check

Namhyung Kim <[email protected]>
perf dwarf-aux: Check allowed location expressions when collecting variables

Yicong Yang <[email protected]>
perf stat: Display iostat headers correctly

Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()

Arnaldo Carvalho de Melo <[email protected]>
perf build: Fix up broken capstone feature detection fast path

Kan Liang <[email protected]>
perf report: Fix --total-cycles --stdio output error

Ian Rogers <[email protected]>
perf inject: Fix leader sampling inserting additional samples

Namhyung Kim <[email protected]>
perf lock contention: Change stack_id type to s32

Ian Rogers <[email protected]>
perf callchain: Fix stitch LBR memory leaks

Namhyung Kim <[email protected]>
perf mem: Free the allocated sort string, fixing a leak

James Clark <[email protected]>
perf scripts python cs-etm: Restore first sample log in verbose mode

Daniel Borkmann <[email protected]>
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error

Daniel Borkmann <[email protected]>
bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types

Daniel Borkmann <[email protected]>
bpf: Fix helper writes to read-only maps

Daniel Borkmann <[email protected]>
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit

Chen Yu <[email protected]>
sched/pelt: Use rq_clock_task() for hw_pressure

Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()

Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted

Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()

Yujie Liu <[email protected]>
sched/numa: Fix the vma scan starving issue

Ojaswin Mujoo <[email protected]>
ext4: check stripe size compatibility on remount as well

Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem

Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry

Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()

Kemeng Shi <[email protected]>
ext4: avoid potential buffer_head leak in __ext4_new_inode()

Kemeng Shi <[email protected]>
ext4: avoid buffer_head leak in ext4_mark_inode_used()

Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso

Huang Shijie <[email protected]>
sched/deadline: Fix schedstats vs deadline servers

yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard

Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen

Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018

Harald Freudenberger <[email protected]>
s390/ap: Fix deadlock caused by recursive lock of the AP bus scan mutex

Andrii Nakryiko <[email protected]>
libbpf: Fix bpf_object__open_skeleton()'s mishandling of options

Hao Ge <[email protected]>
selftests/bpf: Fix incorrect parameters in NULL pointer checking

Eduard Zingerman <[email protected]>
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos

Eduard Zingerman <[email protected]>
selftests/bpf: fix to avoid __msg tag de-duplication by clang

Eduard Zingerman <[email protected]>
selftests/bpf: __arch_* macro to limit test cases to specific archs

Eduard Zingerman <[email protected]>
selftests/bpf: allow checking xlated programs in verifier_* tests

Eduard Zingerman <[email protected]>

    selftests/bpf: extract test_loader->expect_msgs as a data structure

Eduard Zingerman <[email protected]>
selftests/bpf: no need to track next_match_pos in struct test_loader

Cupertino Miranda <[email protected]>
selftests/bpf: Support checks against a regular expression

Jiangshan Yi <[email protected]>
samples/bpf: Fix compilation errors with cf-protection option

Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling tc_redirect.c with musl libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compile if backtrace support missing in libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix redefinition errors compiling lwt_reroute.c

Tony Ambardar <[email protected]>
selftests/bpf: Fix C++ compile error from missing _Bool type

Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c

Tony Ambardar <[email protected]>
selftests/bpf: Fix arg parsing in veristat, test_progs

David Vernet <[email protected]>
libbpf: Don't take direct pointers into BTF data from st_ops

Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling crypto_sanity.c with musl libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling decap_sanity.c with musl libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling core_reloc.c with musl-libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling flow_dissector.c with musl-libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix include of <sys/fcntl.h>

Tony Ambardar <[email protected]>
selftests/bpf: Fix missing BUILD_BUG_ON() declaration

Tony Ambardar <[email protected]>
selftests/bpf: Fix missing UINT_MAX definitions in benchmarks

Tony Ambardar <[email protected]>
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c

Tony Ambardar <[email protected]>
selftests/bpf: Drop unneeded error.h includes

Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc

Tony Ambardar <[email protected]>
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c

Tony Ambardar <[email protected]>
selftests/bpf: Use pid_t consistently in test_progs.c

Yonghong Song <[email protected]>
bpf: Fail verification for sign-extension of packet data/data_end/data_meta

Tony Ambardar <[email protected]>
tools/runqslower: Fix LDFLAGS and add LDLIBS support

Tony Ambardar <[email protected]>
selftests/bpf: Fix wrong binary in Makefile log output

Tony Ambardar <[email protected]>
selftests/bpf: Fix error linking uprobe_multi on mips

Alexei Starovoitov <[email protected]>
selftests/bpf: Workaround strict bpf_lsm return value check.

Xu Kuohai <[email protected]>
bpf: Fix compare error in function retval_range_within

Xu Kuohai <[email protected]>
bpf, lsm: Add check for BPF LSM return value

Leon Hwang <[email protected]>
bpf, arm64: Fix tailcall hierarchy

Leon Hwang <[email protected]>
bpf, x64: Fix tailcall hierarchy

Tianchen Ding <[email protected]>
sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy

Jonathan McDowell <[email protected]>
tpm: Clean up TPM space after command failure

Juergen Gross <[email protected]>
xen/swiotlb: fix allocated size

Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers

Juergen Gross <[email protected]>
xen: tolerate ACPI NVS memory overlapping with Xen allocated memory

Juergen Gross <[email protected]>
xen: add capability to remap non-RAM pages to different PFNs

Juergen Gross <[email protected]>
xen: move max_pfn in xen_memory_setup() out of function scope

Juergen Gross <[email protected]>
xen: introduce generic helper checking for memory map conflicts

Linus Torvalds <[email protected]>
minmax: avoid overly complex min()/max() macro arguments in xen

Niklas Cassel <[email protected]>
ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data

Jason Gerecke <[email protected]>
HID: wacom: Do not warn about dropped packets for first packet

Jason Gerecke <[email protected]>
HID: wacom: Support sequence numbers smaller than 16-bit

Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking

Lang Yu <[email protected]>
drm/amdgpu: fix invalid fence handling in amdgpu_vm_tlb_flush

Yuesong Li <[email protected]>
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()

Nícolas F. R. A. Prado <[email protected]>
kselftest: dt: Ignore nodes that have ancestors disabled

Andy Shevchenko <[email protected]>
platform/x86: ideapad-laptop: Make the scope_guard() clear of its scope

Sherry Yang <[email protected]>
drm/msm: fix %s null argument error

Dmitry Baryshkov <[email protected]>
drm/msm/dsi: correct programming sequence for SM8350 / SM8450

Abhinav Kumar <[email protected]>
drm/msm/dp: enable widebus on all relevant chipsets

Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries

Vladimir Lypak <[email protected]>
drm/msm/a5xx: workaround early ring-buffer emptiness check

Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage

Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume

Vladimir Lypak <[email protected]>
drm/msm/a5xx: disable preemption in submits by default

Aleksandr Mishin <[email protected]>
drm/msm: Fix incorrect file name output in adreno_request_fw()

Connor Abbott <[email protected]>
drm/msm: Fix CP_BV_DRAW_STATE_ADDR name

Connor Abbott <[email protected]>
drm/msm: Dump correct dbgahb clusters on a750

Connor Abbott <[email protected]>
drm/msm: Use a7xx family directly in gpu_state

Christophe Leroy <[email protected]>
powerpc/vdso: Inconditionally use CFUNC macro

Christophe Leroy <[email protected]>
powerpc/8xx: Fix kernel vs user address comparison

Christophe Leroy <[email protected]>
powerpc/8xx: Fix initial memory mapping

Fei Shao <[email protected]>
drm/mediatek: Use spin_lock_irqsave() for CRTC event lock

Jason-JH.Lin <[email protected]>
drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()

Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()

Dan Carpenter <[email protected]>
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()

Stefan Wahren <[email protected]>
drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get

Liu Ying <[email protected]>
drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()

Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets

Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode

Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling

WangYuli <[email protected]>
drm/amd/amdgpu: Properly tune the size of struct

Finn Thain <[email protected]>
scsi: NCR5380: Check for phase match during PDMA fixup

Gilbert Wu <[email protected]>
scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly

Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing

Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func

Claudiu Beznea <[email protected]>
drm/stm: ltdc: check memory returned by devm_kzalloc()

Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()

Geert Uytterhoeven <[email protected]>
pmdomain: core: Harden inter-column space in debug summary

Dmitry Baryshkov <[email protected]>
iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660

Konrad Dybcio <[email protected]>
iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages

Marc Gonzalez <[email protected]>
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux

Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Fix init error path

Miquel Raynal <[email protected]>
mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips

Jinjie Ruan <[email protected]>
mtd: rawnand: mtk: Use for_each_child_of_node_scoped()

Frederic Weisbecker <[email protected]>
rcu/nocb: Fix RT throttling hrtimer armed from offline CPU

Charles Han <[email protected]>
mtd: powernv: Add check devm_kasprintf() returned value

Jason Gunthorpe <[email protected]>
iommu/amd: Do not set the D bit on AMD v2 table entries

Jason Gunthorpe <[email protected]>
iommu/amd: Set the pgsize_bitmap correctly

Jason Gunthorpe <[email protected]>
iommu/amd: Move allocation of the top table into v1_alloc_pgtable

Chen Ni <[email protected]>
iommu/amd: Convert comma to semicolon

Jason Gunthorpe <[email protected]>
iommu/amd: Allocate the page table root using GFP_KERNEL

Vasant Hegde <[email protected]>
iommu/amd: Handle error path in amd_iommu_probe_device()

Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()

Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense

Chris Morgan <[email protected]>

    power: supply: axp20x_battery: Remove design from min and max voltage

Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading

Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map

Guenter Roeck <[email protected]>
hwmon: (max16065) Fix alarm attributes

Andrew Davis <[email protected]>

    hwmon: (max16065) Remove use of i2c_match_id()

Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits

Shuah Khan <[email protected]>
selftests:resctrl: Fix build failure on archs without __cpuid_count()

Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Fix eventfs ownership testcase to find mount point

tangbin <[email protected]>
ASoC: loongson: fix error release

Finn Thain <[email protected]>
m68k: Fix kernel_clone_args.flags in m68k_clone()

Uros Bizjak <[email protected]>
x86/boot/64: Strip percpu address space when setting up GDT descriptors

Steven Rostedt (Google) <[email protected]>
selftests/ftrace: Fix test to handle both old and new kernels

Yuntao Liu <[email protected]>
ALSA: hda: cs35l41: fix module autoloading

Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Add required dependency for kprobe tests

Linus Walleij <[email protected]>
ASoC: tas2781-i2c: Get the right GPIO line

Linus Walleij <[email protected]>
ASoC: tas2781-i2c: Drop weird GPIO code

Rob Herring (Arm) <[email protected]>

    ASoC: tas2781: Use of_property_read_reg()

Ma Ke <[email protected]>
ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error

Yosry Ahmed <[email protected]>
x86/mm: Use IPIs to synchronize LAM enablement

Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*

Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()

Krzysztof Kozlowski <[email protected]>
reset: k210: fix OF node leak in probe() error path

Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path

Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare

MD Danish Anwar <[email protected]>
arm64: dts: ti: k3-am654-idk: Fix dtbs_check warning in ICSSG dmas

Krzysztof Kozlowski <[email protected]>
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property

Claudiu Beznea <[email protected]>
ARM: dts: microchip: sama7g5: Fix RTT clock

Abel Vesa <[email protected]>

    arm64: dts: qcom: x1e80100: Fix PHY for DP2

Jinjie Ruan <[email protected]>
spi: bcmbca-hsspi: Fix missing pm_runtime_disable()

Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations

Andrew Davis <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations

Jonas Karlman <[email protected]>
arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1

Jon Hunter <[email protected]>
arm64: tegra: Correct location of power-sensors for IGX Orin

Alexander Dahl <[email protected]>
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks

Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes

Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes

Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes

Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a08g045: Correct GICD and GICR sizes

Chen-Yu Tsai <[email protected]>
regulator: Return actual error in of_regulator_bulk_get_all()

Mukesh Ojha <[email protected]>
firmware: qcom: scm: Disable SDI and write no dump to dump mode

Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ

Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix double free in OPTEE transport

AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs

David Virag <[email protected]>
arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB

Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors

Riyan Dhiman <[email protected]>
block: fix potential invalid pointer dereference in blk_add_partition

Felix Moessbauer <[email protected]>
io_uring/io-wq: inherit cpuset of cgroup in io worker

Felix Moessbauer <[email protected]>
io_uring/io-wq: do not allow pinning outside of cpuset

Yu Kuai <[email protected]>
block, bfq: fix procress reference leakage for bfqq in merge chain

Yu Kuai <[email protected]>
block, bfq: fix uaf for accessing waker_bfqq after splitting

Gao Xiang <[email protected]>
erofs: handle overlapped pclusters out of crafted images properly

Gao Xiang <[email protected]>
erofs: tidy up struct z_erofs_bvec

Gao Xiang <[email protected]>
erofs: fix incorrect symlink detection in fast symlink

Wouter Verhelst <[email protected]>
nbd: correct the maximum value for discard sectors

David Howells <[email protected]>
cachefiles: Fix non-taking of sb_writers around set/removexattr

Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()

Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()

Yu Kuai <[email protected]>

    block, bfq: fix possible UAF for bfqq->bic with merge chain

Ming Lei <[email protected]>
nbd: fix race between timeout and normal completion

Ming Lei <[email protected]>
ublk: move zone report data out of request pdu

Eric Dumazet <[email protected]>
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()

Su Hui <[email protected]>
net: tipc: avoid possible garbage value

Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input

Heiner Kallweit <[email protected]>
r8169: disable ALDPS per default for RTL8125

Maciej Fijalkowski <[email protected]>
xsk: fix batch alloc API on non-coherent systems

Herbert Xu <[email protected]>
crypto: n2 - Set err to EINVAL if snprintf fails for hmac

Jinjie Ruan <[email protected]>
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()

Guillaume Nault <[email protected]>
bareudp: Pull inner IP header on xmit.

Guillaume Nault <[email protected]>
bareudp: Pull inner IP header in bareudp_udp_encap_recv().

Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer

Marc Kleine-Budde <[email protected]>
can: m_can: m_can_close(): stop clocks after device has been shut down

Jake Hamby <[email protected]>
can: m_can: enable NAPI before enabling interrupts

Kuniyuki Iwashima <[email protected]>

    can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().

Sebastian Andrzej Siewior <[email protected]>
net: hsr: Use the seqnr lock for frames received via interlink port.

Eric Dumazet <[email protected]>
sock_map: Add a cond_resched() in sock_hash_free()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED

Jiawei Ye <[email protected]>
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param

Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix uninitialized TLV data

Howard Hsu <[email protected]>
wifi: mt76: mt7915: fix rx filter setting for bfee functionality

Dmitry Antipov <[email protected]>

    wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()

Felix Fietkau <[email protected]>
wifi: mt76: mt7603: fix mixed declarations and code

Peter Chiu <[email protected]>
wifi: mt76: connac: fix checksum offload fields of connac3 RXD

Rex Lu <[email protected]>
wifi: mt76: mt7996: fix handling mbss enable/disable

Weili Qian <[email protected]>
crypto: hisilicon/qm - inject error before stopping queue

Weili Qian <[email protected]>
crypto: hisilicon/qm - reset device before enabling it

Weili Qian <[email protected]>
crypto: hisilicon/hpre - mask cluster timeout error

Amit Shah <[email protected]>
crypto: ccp - do not request interrupt on cmd completion when irqs disabled

John B. Wyatt IV <[email protected]>
pm:cpupower: Add missing powercap_set_enabled() stub function

Aaron Lu <[email protected]>
x86/sgx: Fix deadlock in SGX NUMA node search

Howard Hsu <[email protected]>
wifi: mt76: mt7996: fix EHT beamforming capability check

Howard Hsu <[email protected]>
wifi: mt76: mt7996: fix HE and EHT beamforming capabilities

Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix wmm set of station interface to 3

Peter Chiu <[email protected]>
wifi: mt76: mt7996: fix traffic delay when switching back to working channel

Peter Chiu <[email protected]>
wifi: mt76: mt7996: use hweight16 to get correct tx antenna

Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the channel usage

Bjørn Mork <[email protected]>

    wifi: mt76: mt7915: fix oops on non-dbdc mt7986

Rafael J. Wysocki <[email protected]>
thermal: gov_bang_bang: Adjust states of all uninitialized instances

Nishanth Menon <[email protected]>
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately

Robin Murphy <[email protected]>
perf/arm-cmn: Ensure dtm_idx is big enough

Robin Murphy <[email protected]>
perf/arm-cmn: Fix CCLA register offset

Robin Murphy <[email protected]>
perf/arm-cmn: Refactor node ID handling. Again.

Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: annotate data-races around set timeout

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove annotation to access set timeout while holding lock

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject expiration higher than timeout

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject element expiration with no timeout

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire

Clément Léger <[email protected]>
ACPI: CPPC: Fix MASK_VAL() usage

Zhang Changzhong <[email protected]>
can: j1939: use correct function name in comment

Mark Brown <[email protected]>
kselftest/arm64: Actually test SME vector length changes via sigreturn

Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting

Yicong Yang <[email protected]>
drivers/perf: hisi_pcie: Record hardware counts correctly

Kamlesh Gurudasani <[email protected]>
padata: Honor the caller's alignment in case of chunk_size 0

Vasily Khoruzhick <[email protected]>
ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec

Vasily Khoruzhick <[email protected]>
ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE

Ilan Peer <[email protected]>
wifi: mac80211: Check for missing VHT elements only for 5 GHz

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: allow ESR when we the ROC expires

Emmanuel Grumbach <[email protected]>
wifi: mac80211: fix the comeback long retry times

hhorace <[email protected]>
wifi: cfg80211: fix bug of mapping AF3x to incorrect User Priority

Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: increase the time between ranging measurements

Johannes Berg <[email protected]>
wifi: iwlwifi: config: label 'gl' devices as discrete

Golan Ben Ami <[email protected]>
wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL

Ping-Ke Shih <[email protected]>
wifi: mac80211: don't use rate mask for offchannel TX either

Esther Shimanovich <[email protected]>
ACPI: video: force native for Apple MacbookPro9,2

Orlando Chamberlain <[email protected]>
ACPI: video: force native for some T2 macbooks

Svyatoslav Pankratov <[email protected]>
crypto: qat - fix "Full Going True" macro definition

Krishna chaitanya chundru <[email protected]>
perf/dwc_pcie: Always register for PCIe bus notifier

Krishna chaitanya chundru <[email protected]>
perf/dwc_pcie: Fix registration issue in multi PCIe controller instances

Jing Zhang <[email protected]>
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing

Rafael J. Wysocki <[email protected]>
thermal: core: Fix rounding of delay jiffies

Rafael J. Wysocki <[email protected]>
thermal: core: Fold two functions into their respective callers

Douglas Anderson <[email protected]>
arm64: smp: smp_send_stop() and crash_smp_send_stop() should try non-NMI first

Andre Przywara <[email protected]>
kselftest/arm64: signal: fix/refactor SVE vector length enumeration

Dan Carpenter <[email protected]>
powercap: intel_rapl: Fix off by one in get_rpi()

Calvin Owens <[email protected]>
ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros

Aleksa Sarai <[email protected]>
autofs: fix missing fput for FSCONFIG_SET_FD

Olaf Hering <[email protected]>
mount: handle OOM on mnt_warn_timestamp_expiry

Atish Patra <[email protected]>
RISC-V: KVM: Fix to allow hpmcounter31 from the guest

Atish Patra <[email protected]>
RISC-V: KVM: Allow legacy PMU access from guest

Anup Patel <[email protected]>
RISC-V: KVM: Don't zero-out PMU snapshot area before freeing data

Andrew Jones <[email protected]>
RISC-V: KVM: Fix sbiret init before forwarding to userspace

Dmitry Kandybka <[email protected]>
wifi: rtw88: remove CPT execution branch never used

Ping-Ke Shih <[email protected]>
wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading

Dave Martin <[email protected]>
arm64: signal: Fix some under-bracketed UAPI macros

Yanteng Si <[email protected]>
net: stmmac: dwmac-loongson: Init ref and PTP clocks rate

Baochen Qiang <[email protected]>
wifi: ath12k: fix invalid AMPDU factor calculation in ath12k_peer_assoc_h_he()

P Praneesh <[email protected]>
wifi: ath12k: match WMI BSS chan info structure with firmware definition

P Praneesh <[email protected]>
wifi: ath12k: fix BSS chan info request WMI command

Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k: Remove error checks when creating debugfs entries

Arend van Spriel <[email protected]>
wifi: brcmfmac: introducing fwil query functions

Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()

Dan Carpenter <[email protected]>
crypto: iaa - Fix potential use after free bug

Michal Witwicki <[email protected]>
crypto: qat - ensure correct order in VF restarting handler

Michal Witwicki <[email protected]>
crypto: qat - fix recovery flow for VFs

Michal Witwicki <[email protected]>
crypto: qat - disable IOV in adf_dev_stop()

Helge Deller <[email protected]>
crypto: xor - fix template benchmarking

Dmitry Antipov <[email protected]>
wifi: rtw88: always wait for both firmware loading attempts

Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Fix error injection on Zynq UltraScale+

Kang Yang <[email protected]>
wifi: ath11k: use work queue to process beacon tx event

-------------

Diffstat:

 .gitignore                                         |   1 -
 .../ABI/testing/sysfs-bus-iio-filter-admv8818      |   2 +-
 Documentation/arch/arm64/silicon-errata.rst        |   2 +
 .../iio/magnetometer/asahi-kasei,ak8975.yaml       |   1 -
 .../bindings/pci/fsl,layerscape-pcie.yaml          |  26 +-
 .../devicetree/bindings/spi/spi-nxp-fspi.yaml      |   1 +
 Documentation/driver-api/ipmi.rst                  |   2 +-
 Documentation/filesystems/mount_api.rst            |   9 +-
 Documentation/virt/kvm/locking.rst                 |  33 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/microchip/sam9x60.dtsi           |   4 +-
 arch/arm/boot/dts/microchip/sama7g5.dtsi           |   2 +-
 arch/arm/boot/dts/nxp/imx/imx6ul-geam.dts          |   2 +-
 .../dts/nxp/imx/imx6ull-seeed-npi-dev-board.dtsi   |  12 +-
 arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts       |   2 +-
 arch/arm/mach-ep93xx/clock.c                       |   2 +-
 arch/arm/mach-versatile/platsmp-realview.c         |   1 +
 arch/arm/vfp/vfpinstr.h                            |  44 +-
 arch/arm64/Kconfig                                 |   2 +-
 .../boot/dts/exynos/exynos7885-jackpotlte.dts      |   2 +-
 arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi   |   3 +-
 arch/arm64/boot/dts/mediatek/mt8186.dtsi           |  12 +-
 arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi    |   1 +
 arch/arm64/boot/dts/mediatek/mt8195.dtsi           |  12 +-
 .../boot/dts/mediatek/mt8395-radxa-nio-12l.dts     |   1 +
 .../arm64/boot/dts/nvidia/tegra234-p3701-0008.dtsi |  33 -
 .../arm64/boot/dts/nvidia/tegra234-p3740-0002.dtsi |  33 +
 arch/arm64/boot/dts/qcom/sa8775p.dtsi              |   2 +
 arch/arm64/boot/dts/qcom/x1e80100.dtsi             |  10 +-
 arch/arm64/boot/dts/renesas/r9a07g043u.dtsi        |   4 +-
 arch/arm64/boot/dts/renesas/r9a07g044.dtsi         |   4 +-
 arch/arm64/boot/dts/renesas/r9a07g054.dtsi         |   4 +-
 arch/arm64/boot/dts/renesas/r9a08g045.dtsi         |   4 +-
 .../boot/dts/rockchip/rk3399-pinebook-pro.dts      |   4 +-
 arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts  |   2 +-
 arch/arm64/boot/dts/ti/k3-am654-idk.dtso           |   8 +-
 arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts |   4 +-
 arch/arm64/boot/dts/ti/k3-j721e-sk.dts             |   4 +-
 arch/arm64/include/asm/cputype.h                   |   2 +
 arch/arm64/include/asm/esr.h                       |  88 +-
 arch/arm64/include/uapi/asm/sigcontext.h           |   6 +-
 arch/arm64/kernel/cpu_errata.c                     |  10 +-
 arch/arm64/kernel/smp.c                            | 164 ++--
 arch/arm64/kvm/hyp/nvhe/ffa.c                      |  21 +-
 arch/arm64/net/bpf_jit_comp.c                      |  57 +-
 arch/loongarch/include/asm/kvm_vcpu.h              |   1 +
 arch/loongarch/kvm/timer.c                         |   7 +
 arch/loongarch/kvm/vcpu.c                          |   2 +-
 arch/m68k/kernel/process.c                         |   2 +-
 arch/powerpc/crypto/Kconfig                        |   1 +
 arch/powerpc/include/asm/asm-compat.h              |   6 +
 arch/powerpc/include/asm/atomic.h                  |   5 +-
 arch/powerpc/include/asm/uaccess.h                 |   7 +-
 arch/powerpc/kernel/head_8xx.S                     |   6 +-
 arch/powerpc/kernel/vdso/gettimeofday.S            |   4 -
 arch/powerpc/mm/nohash/8xx.c                       |   4 +-
 arch/riscv/include/asm/kvm_vcpu_pmu.h              |  21 +-
 arch/riscv/kernel/perf_callchain.c                 |   2 +-
 arch/riscv/kvm/vcpu_pmu.c                          |  14 +-
 arch/riscv/kvm/vcpu_sbi.c                          |   4 +-
 arch/s390/include/asm/ftrace.h                     |  17 +-
 arch/s390/kernel/stacktrace.c                      |  19 -
 arch/x86/coco/tdx/tdx.c                            | 127 ++-
 arch/x86/events/intel/core.c                       |   8 +-
 arch/x86/events/intel/pt.c                         |  15 +-
 arch/x86/hyperv/ivm.c                              |  22 +-
 arch/x86/include/asm/acpi.h                        |   8 +
 arch/x86/include/asm/hardirq.h                     |   8 +-
 arch/x86/include/asm/idtentry.h                    |   6 +-
 arch/x86/include/asm/kvm_host.h                    |   3 +-
 arch/x86/include/asm/pgtable.h                     |   5 +
 arch/x86/include/asm/set_memory.h                  |   3 +
 arch/x86/include/asm/x86_init.h                    |  14 +-
 arch/x86/kernel/acpi/boot.c                        |  11 +
 arch/x86/kernel/cpu/sgx/main.c                     |  27 +-
 arch/x86/kernel/crash.c                            |  12 +
 arch/x86/kernel/head64.c                           |   3 +-
 arch/x86/kernel/jailhouse.c                        |   1 +
 arch/x86/kernel/mmconf-fam10h_64.c                 |   1 +
 arch/x86/kernel/process_64.c                       |  29 +-
 arch/x86/kernel/reboot.c                           |  12 +
 arch/x86/kernel/smpboot.c                          |   1 +
 arch/x86/kernel/x86_init.c                         |   9 +-
 arch/x86/kvm/lapic.c                               |  95 +-
 arch/x86/kvm/svm/svm.c                             |   2 +
 arch/x86/kvm/vmx/main.c                            |   2 +
 arch/x86/kvm/vmx/x86_ops.h                         |   1 -
 arch/x86/mm/mem_encrypt_amd.c                      |   8 +-
 arch/x86/mm/pat/set_memory.c                       |  54 +-
 arch/x86/mm/tlb.c                                  |   7 +-
 arch/x86/net/bpf_jit_comp.c                        | 107 ++-
 arch/x86/pci/fixup.c                               |   4 +-
 arch/x86/xen/mmu_pv.c                              |   5 +-
 arch/x86/xen/p2m.c                                 |  98 ++
 arch/x86/xen/setup.c                               | 203 ++++-
 arch/x86/xen/xen-ops.h                             |   6 +-
 block/bfq-iosched.c                                |  81 +-
 block/partitions/core.c                            |   8 +-
 crypto/asymmetric_keys/asymmetric_type.c           |   7 +-
 crypto/xor.c                                       |  31 +-
 drivers/acpi/acpica/exsystem.c                     |  11 +-
 drivers/acpi/cppc_acpi.c                           |  43 +-
 drivers/acpi/device_sysfs.c                        |   5 +-
 drivers/acpi/pmic/tps68470_pmic.c                  |   6 +-
 drivers/acpi/resource.c                            |  12 +
 drivers/acpi/video_detect.c                        |  24 +
 drivers/ata/libata-eh.c                            |   8 +
 drivers/ata/libata-scsi.c                          |   5 +-
 drivers/base/core.c                                |  15 +-
 drivers/base/firmware_loader/main.c                |  30 +
 drivers/base/module.c                              |  14 +-
 drivers/block/drbd/drbd_main.c                     |   8 +-
 drivers/block/drbd/drbd_state.c                    |   2 +-
 drivers/block/nbd.c                                |  15 +-
 drivers/block/ublk_drv.c                           |  62 +-
 drivers/bluetooth/btusb.c                          |   5 +-
 drivers/bus/arm-integrator-lm.c                    |   1 +
 drivers/bus/mhi/host/pci_generic.c                 |  13 +-
 drivers/char/hw_random/bcm2835-rng.c               |   4 +-
 drivers/char/hw_random/cctrng.c                    |   1 +
 drivers/char/hw_random/mtk-rng.c                   |   2 +-
 drivers/char/tpm/tpm-dev-common.c                  |   2 +
 drivers/char/tpm/tpm2-sessions.c                   |   1 +
 drivers/char/tpm/tpm2-space.c                      |   3 +
 drivers/clk/at91/sama7g5.c                         |   5 +-
 drivers/clk/imx/clk-composite-7ulp.c               |   7 +
 drivers/clk/imx/clk-composite-8m.c                 |  51 +-
 drivers/clk/imx/clk-composite-93.c                 |  15 +-
 drivers/clk/imx/clk-fracn-gppll.c                  |   4 +
 drivers/clk/imx/clk-imx6ul.c                       |   4 +-
 drivers/clk/imx/clk-imx8mp-audiomix.c              |  13 +-
 drivers/clk/imx/clk-imx8mp.c                       |   4 +-
 drivers/clk/imx/clk-imx8qxp.c                      |  10 +-
 drivers/clk/qcom/clk-alpha-pll.c                   |  52 ++
 drivers/clk/qcom/clk-alpha-pll.h                   |   2 +
 drivers/clk/qcom/dispcc-sm8250.c                   |   9 +-
 drivers/clk/qcom/dispcc-sm8550.c                   |  14 +-
 drivers/clk/qcom/gcc-ipq5332.c                     |   1 +
 drivers/clk/rockchip/clk-rk3228.c                  |   2 +-
 drivers/clk/rockchip/clk-rk3588.c                  |   2 +-
 drivers/clk/starfive/clk-starfive-jh7110-vout.c    |   2 +-
 drivers/clk/ti/clk-dra7-atl.c                      |   1 +
 drivers/clocksource/timer-qcom.c                   |   7 +-
 drivers/cpufreq/ti-cpufreq.c                       |  10 +-
 drivers/cpuidle/cpuidle-riscv-sbi.c                |  21 +-
 drivers/crypto/caam/caamhash.c                     |   1 +
 drivers/crypto/ccp/sev-dev.c                       |  15 +-
 drivers/crypto/hisilicon/hpre/hpre_main.c          |  54 +-
 drivers/crypto/hisilicon/qm.c                      | 151 ++--
 drivers/crypto/hisilicon/sec2/sec_main.c           |  16 +-
 drivers/crypto/hisilicon/zip/zip_main.c            |  23 +-
 drivers/crypto/intel/iaa/iaa_crypto_main.c         |   4 +-
 .../crypto/intel/qat/qat_common/adf_gen4_hw_data.h |   2 +-
 drivers/crypto/intel/qat/qat_common/adf_init.c     |   4 +-
 .../crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c  |   9 +-
 .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c  |  14 +
 .../crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h  |   1 +
 drivers/crypto/intel/qat/qat_common/adf_vf_isr.c   |   2 +
 drivers/crypto/n2_core.c                           |   1 +
 drivers/crypto/qcom-rng.c                          |   4 +-
 drivers/cxl/core/pci.c                             |   8 +-
 drivers/edac/igen6_edac.c                          |   2 +-
 drivers/edac/synopsys_edac.c                       |  35 +-
 drivers/firewire/core-cdev.c                       |   2 +-
 drivers/firmware/arm_scmi/optee.c                  |   7 +
 drivers/firmware/efi/libstub/tpm.c                 |   2 +-
 drivers/firmware/qcom/qcom_scm.c                   |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   8 +-
 drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h        |   4 +-
 drivers/gpu/drm/amd/amdgpu/atombios_encoders.c     |  29 +-
 drivers/gpu/drm/amd/amdgpu/mes_v11_0.c             |   2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c            | 165 ----
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  16 +
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c    |   9 +-
 .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c   |   6 +
 drivers/gpu/drm/amd/display/dc/dc_dsc.h            |   3 +-
 drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c        |   5 +-
 .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c  |  50 ++
 .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c    |   6 +-
 .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c    |  14 +
 .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c    |  13 +
 .../amd/display/dc/resource/dcn35/dcn35_resource.c |   1 +
 .../display/dc/resource/dcn351/dcn351_resource.c   |   3 +-
 .../drm/amd/display/modules/freesync/freesync.c    |   2 +-
 drivers/gpu/drm/bridge/lontium-lt8912b.c           |  35 +-
 drivers/gpu/drm/exynos/exynos_drm_gsc.c            |   2 +-
 drivers/gpu/drm/mediatek/mtk_crtc.c                |  32 +-
 drivers/gpu/drm/msm/adreno/a5xx_gpu.c              |  12 +-
 drivers/gpu/drm/msm/adreno/a5xx_gpu.h              |   2 +
 drivers/gpu/drm/msm/adreno/a5xx_preempt.c          |  30 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c        |  46 +-
 .../gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h  |   2 +-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c            |   2 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c           |   2 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |  10 +-
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c          |  12 +-
 drivers/gpu/drm/radeon/evergreen_cs.c              |  62 +-
 drivers/gpu/drm/radeon/radeon_atombios.c           |  29 +-
 drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c        |   2 +
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c        |   4 +-
 drivers/gpu/drm/stm/drv.c                          |   4 +-
 drivers/gpu/drm/stm/ltdc.c                         |   2 +
 drivers/gpu/drm/vc4/vc4_hdmi.c                     |   8 +-
 drivers/hid/wacom_wac.c                            |  13 +-
 drivers/hid/wacom_wac.h                            |   2 +-
 drivers/hwmon/max16065.c                           |  27 +-
 drivers/hwmon/ntc_thermistor.c                     |   1 +
 drivers/hwtracing/coresight/coresight-dummy.c      |   4 +
 drivers/hwtracing/coresight/coresight-tmc-etr.c    |   2 +-
 drivers/hwtracing/coresight/coresight-tpdm.c       |   6 +
 drivers/i2c/busses/i2c-aspeed.c                    |  16 +-
 drivers/i2c/busses/i2c-isch.c                      |   3 +-
 drivers/iio/adc/ad7606.c                           |   8 +-
 drivers/iio/adc/ad7606_spi.c                       |   5 +-
 drivers/iio/chemical/bme680_core.c                 |   7 +
 drivers/iio/magnetometer/ak8975.c                  |   1 -
 drivers/infiniband/core/cache.c                    |   4 +-
 drivers/infiniband/core/iwcm.c                     |   2 +-
 drivers/infiniband/hw/cxgb4/cm.c                   |   5 +
 drivers/infiniband/hw/erdma/erdma_verbs.c          |  25 +-
 drivers/infiniband/hw/hns/hns_roce_ah.c            |  14 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |  22 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  33 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |  16 +-
 drivers/infiniband/hw/irdma/verbs.c                |   2 +-
 drivers/infiniband/hw/mlx5/main.c                  |   2 +-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |   2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |  99 +-
 drivers/infiniband/ulp/rtrs/rtrs-clt.c             |   9 +-
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |   1 +
 drivers/input/keyboard/adp5588-keys.c              |   2 +-
 drivers/input/serio/i8042-acpipnpio.h              |  37 +
 drivers/input/touchscreen/ilitek_ts_i2c.c          |  18 +-
 drivers/interconnect/icc-clk.c                     |   3 +-
 drivers/interconnect/qcom/sm8350.c                 |   1 +
 drivers/iommu/amd/io_pgtable.c                     |  14 +-
 drivers/iommu/amd/io_pgtable_v2.c                  |   4 +-
 drivers/iommu/amd/iommu.c                          |  57 +-
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c         |  28 +
 drivers/iommu/iommufd/hw_pagetable.c               |   3 +-
 drivers/iommu/iommufd/io_pagetable.c               |   8 +
 drivers/iommu/iommufd/selftest.c                   |   9 +-
 drivers/leds/leds-bd2606mvv.c                      |  23 +-
 drivers/leds/leds-gpio.c                           |   9 +-
 drivers/leds/leds-pca995x.c                        |  78 +-
 drivers/md/dm-rq.c                                 |   4 +-
 drivers/md/dm-verity-target.c                      |  23 +-
 drivers/md/dm.c                                    |  11 +-
 drivers/md/md.c                                    |   1 -
 drivers/media/dvb-frontends/rtl2830.c              |   2 +-
 drivers/media/dvb-frontends/rtl2832.c              |   2 +-
 .../vcodec/decoder/vdec/vdec_h264_req_if.c         |   9 +-
 .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c   |   9 +-
 .../mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c |  10 +-
 .../media/platform/renesas/rzg2l-cru/rzg2l-csi2.c  |   1 +
 drivers/media/tuners/tuner-i2c.h                   |   4 +-
 drivers/mtd/devices/powernv_flash.c                |   3 +
 drivers/mtd/devices/slram.c                        |   2 +
 drivers/mtd/nand/raw/mtk_nand.c                    |  36 +-
 drivers/net/bareudp.c                              |  26 +-
 drivers/net/bonding/bond_main.c                    |   6 +-
 drivers/net/can/m_can/m_can.c                      |  14 +-
 drivers/net/can/usb/esd_usb.c                      |   6 +-
 drivers/net/ethernet/freescale/enetc/enetc.c       |   3 +-
 drivers/net/ethernet/intel/idpf/idpf.h             |   4 +-
 drivers/net/ethernet/intel/idpf/idpf_ethtool.c     | 125 +--
 drivers/net/ethernet/intel/idpf/idpf_lan_txrx.h    |   2 +
 drivers/net/ethernet/intel/idpf/idpf_lib.c         |  72 +-
 .../net/ethernet/intel/idpf/idpf_singleq_txrx.c    | 195 ++--
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        | 993 ++++++++++++---------
 drivers/net/ethernet/intel/idpf/idpf_txrx.h        | 469 ++++++----
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c    |  73 +-
 drivers/net/ethernet/realtek/r8169_phy_config.c    |   2 +
 drivers/net/ethernet/renesas/ravb_main.c           |  12 +-
 drivers/net/ethernet/seeq/ether3.c                 |   2 +
 .../net/ethernet/stmicro/stmmac/dwmac-loongson.c   |   3 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   2 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  |  37 +-
 drivers/net/usb/usbnet.c                           |  37 +-
 drivers/net/virtio_net.c                           |  10 +-
 drivers/net/wireless/ath/ath11k/core.h             |   1 +
 drivers/net/wireless/ath/ath11k/mac.c              |  12 +
 drivers/net/wireless/ath/ath11k/wmi.c              |   4 +-
 drivers/net/wireless/ath/ath12k/mac.c              |   5 +-
 drivers/net/wireless/ath/ath12k/wmi.c              |   1 +
 drivers/net/wireless/ath/ath12k/wmi.h              |   3 +-
 drivers/net/wireless/ath/ath9k/debug.c             |   2 -
 drivers/net/wireless/ath/ath9k/htc_drv_debug.c     |   2 -
 .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c  |   2 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |  30 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/feature.c |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/fwil.h    |  40 +-
 drivers/net/wireless/intel/iwlwifi/cfg/bz.c        |  11 +
 drivers/net/wireless/intel/iwlwifi/iwl-config.h    |   1 +
 drivers/net/wireless/intel/iwlwifi/mvm/constants.h |   2 +-
 .../net/wireless/intel/iwlwifi/mvm/time-event.c    |  14 +-
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c      |  36 +-
 drivers/net/wireless/mediatek/mt76/mac80211.c      |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7603/dma.c    |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7615/init.c   |   3 +
 .../net/wireless/mediatek/mt76/mt76_connac3_mac.h  |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7915/init.c   |   2 +
 drivers/net/wireless/mediatek/mt76/mt7915/main.c   |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7921/init.c   |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |   3 +
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |  65 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7996/main.c   |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |  13 +-
 drivers/net/wireless/microchip/wilc1000/hif.c      |   4 +-
 drivers/net/wireless/realtek/rtw88/coex.c          |  38 +-
 drivers/net/wireless/realtek/rtw88/fw.c            |  13 +-
 drivers/net/wireless/realtek/rtw88/main.c          |   7 +-
 drivers/net/wireless/realtek/rtw88/rtw8821cu.c     |   2 -
 drivers/net/wireless/realtek/rtw88/rtw8822c.c      |  12 +-
 drivers/net/wireless/realtek/rtw88/rx.h            |   2 +-
 drivers/net/wireless/realtek/rtw89/mac.h           |   1 -
 drivers/ntb/hw/intel/ntb_hw_gen1.c                 |   2 +-
 drivers/ntb/ntb_transport.c                        |  23 +-
 drivers/ntb/test/ntb_perf.c                        |   2 +-
 drivers/nvdimm/namespace_devs.c                    |  34 +-
 drivers/nvme/host/multipath.c                      |   2 +-
 drivers/pci/controller/dwc/pci-dra7xx.c            |  11 +-
 drivers/pci/controller/dwc/pci-imx6.c              |  15 +-
 drivers/pci/controller/dwc/pci-keystone.c          |   2 +-
 drivers/pci/controller/dwc/pcie-kirin.c            |   4 +-
 drivers/pci/controller/dwc/pcie-qcom-ep.c          |  14 +-
 drivers/pci/controller/pcie-xilinx-nwl.c           |  39 +-
 drivers/pci/pci.c                                  |  20 +-
 drivers/pci/pci.h                                  |   6 +-
 drivers/pci/quirks.c                               |  31 +-
 drivers/perf/alibaba_uncore_drw_pmu.c              |   2 +-
 drivers/perf/arm-cmn.c                             | 109 ++-
 drivers/perf/dwc_pcie_pmu.c                        |  21 +-
 drivers/perf/hisilicon/hisi_pcie_pmu.c             |  16 +-
 drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c  |   1 +
 drivers/pinctrl/mvebu/pinctrl-dove.c               |  42 +-
 drivers/pinctrl/pinctrl-single.c                   |   3 +-
 drivers/pinctrl/ti/pinctrl-ti-iodelay.c            |  95 +-
 drivers/platform/x86/ideapad-laptop.c              |  48 +-
 drivers/pmdomain/core.c                            |   2 +-
 drivers/power/supply/axp20x_battery.c              |  16 +-
 drivers/power/supply/max17042_battery.c            |   5 +-
 drivers/powercap/intel_rapl_common.c               |   2 +-
 drivers/pps/clients/pps_parport.c                  |   8 +-
 drivers/regulator/of_regulator.c                   |   2 +-
 drivers/remoteproc/imx_rproc.c                     |   6 +-
 drivers/reset/reset-berlin.c                       |   3 +-
 drivers/reset/reset-k210.c                         |   3 +-
 drivers/s390/crypto/ap_bus.c                       |  17 +
 drivers/scsi/NCR5380.c                             |  78 +-
 drivers/scsi/elx/libefc/efc_nport.c                |   2 +-
 drivers/scsi/lpfc/lpfc_hw4.h                       |   3 +
 drivers/scsi/lpfc/lpfc_init.c                      |  21 +-
 drivers/scsi/lpfc/lpfc_scsi.c                      |   2 +-
 drivers/scsi/mac_scsi.c                            | 166 ++--
 drivers/scsi/sd.c                                  |   2 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |  20 +-
 drivers/soc/fsl/qe/qmc.c                           |  24 +-
 drivers/soc/fsl/qe/tsa.c                           |   2 +-
 drivers/soc/qcom/smd-rpm.c                         |  35 +-
 drivers/soc/versatile/soc-integrator.c             |   1 +
 drivers/soc/versatile/soc-realview.c               |  20 +-
 drivers/spi/atmel-quadspi.c                        |  15 +-
 drivers/spi/spi-airoha-snfi.c                      |  43 +-
 drivers/spi/spi-bcmbca-hsspi.c                     |   8 +-
 drivers/spi/spi-fsl-lpspi.c                        |   1 +
 drivers/spi/spi-nxp-fspi.c                         |  54 +-
 drivers/spi/spi-ppc4xx.c                           |   7 +-
 drivers/staging/media/starfive/camss/stf-camss.c   |   2 -
 drivers/thermal/gov_bang_bang.c                    |  14 +-
 drivers/thermal/thermal_core.c                     |  78 +-
 drivers/tty/serial/8250/8250_omap.c                |   2 +-
 drivers/tty/serial/qcom_geni_serial.c              | 101 +--
 drivers/tty/serial/rp2.c                           |   2 +-
 drivers/tty/serial/serial_core.c                   |  13 +-
 drivers/ufs/host/ufs-qcom.c                        |   2 +-
 drivers/usb/cdns3/cdnsp-ring.c                     |   6 +-
 drivers/usb/cdns3/host.c                           |   4 +-
 drivers/usb/class/cdc-acm.c                        |   2 +
 drivers/usb/dwc2/drd.c                             |   9 +
 drivers/usb/gadget/udc/dummy_hcd.c                 |  14 +-
 drivers/usb/host/xhci-mem.c                        |   5 +-
 drivers/usb/host/xhci-pci.c                        |  24 +-
 drivers/usb/host/xhci-ring.c                       |  14 +
 drivers/usb/host/xhci.h                            |   3 +
 drivers/usb/misc/appledisplay.c                    |  15 +-
 drivers/usb/misc/cypress_cy7c63.c                  |   4 +
 drivers/usb/misc/yurex.c                           |  10 +-
 drivers/vdpa/mlx5/core/mr.c                        |   3 +
 drivers/vhost/vdpa.c                               |  16 +-
 drivers/video/fbdev/hpfb.c                         |   1 +
 drivers/video/fbdev/xen-fbfront.c                  |   1 +
 drivers/watchdog/imx_sc_wdt.c                      |  24 -
 drivers/xen/swiotlb-xen.c                          |  10 +-
 fs/autofs/inode.c                                  |   3 +-
 fs/btrfs/btrfs_inode.h                             |   1 +
 fs/btrfs/ctree.h                                   |   2 +
 fs/btrfs/extent-tree.c                             |   4 +-
 fs/btrfs/file.c                                    |  34 +-
 fs/btrfs/ioctl.c                                   |   4 +-
 fs/btrfs/subpage.c                                 |  10 +-
 fs/btrfs/tree-checker.c                            |   2 +-
 fs/cachefiles/xattr.c                              |  34 +-
 fs/debugfs/inode.c                                 |  24 +-
 fs/erofs/inode.c                                   |  20 +-
 fs/erofs/zdata.c                                   | 136 +--
 fs/eventpoll.c                                     |   2 +-
 fs/exfat/nls.c                                     |   5 +-
 fs/ext4/ialloc.c                                   |  14 +-
 fs/ext4/inline.c                                   |  35 +-
 fs/ext4/mballoc.c                                  |  10 +-
 fs/ext4/super.c                                    |  29 +-
 fs/f2fs/compress.c                                 |  36 +-
 fs/f2fs/data.c                                     |  10 +-
 fs/f2fs/dir.c                                      |   3 +-
 fs/f2fs/extent_cache.c                             |   4 +-
 fs/f2fs/f2fs.h                                     |  37 +-
 fs/f2fs/file.c                                     | 101 ++-
 fs/f2fs/inode.c                                    |   5 +
 fs/f2fs/namei.c                                    |  68 --
 fs/f2fs/segment.c                                  |  15 +
 fs/f2fs/super.c                                    |  16 +-
 fs/f2fs/xattr.c                                    |  14 +-
 fs/fcntl.c                                         |  14 +-
 fs/fs_parser.c                                     |  34 +
 fs/fuse/file.c                                     |   2 +-
 fs/inode.c                                         |   4 +
 fs/jfs/jfs_dmap.c                                  |   4 +-
 fs/jfs/jfs_imap.c                                  |   2 +-
 fs/namespace.c                                     |  14 +-
 fs/netfs/main.c                                    |   4 +-
 fs/nfs/nfs4state.c                                 |   1 +
 fs/nfsd/filecache.c                                |   3 +-
 fs/nfsd/nfs4idmap.c                                |  13 +-
 fs/nfsd/nfs4recover.c                              |   8 +
 fs/nfsd/nfs4state.c                                | 170 ++--
 fs/nilfs2/btree.c                                  |  12 +-
 fs/quota/dquot.c                                   |   3 +-
 fs/smb/server/vfs.c                                |  19 +-
 include/acpi/acoutput.h                            |   5 +
 include/acpi/cppc_acpi.h                           |   2 +
 include/linux/bpf.h                                |   9 +-
 include/linux/bpf_lsm.h                            |   8 +
 include/linux/compiler.h                           |   2 +-
 include/linux/f2fs_fs.h                            |   2 +-
 include/linux/fs_parser.h                          |   6 +-
 include/linux/lsm_hook_defs.h                      |   1 +
 include/linux/lsm_hooks.h                          |   1 +
 include/linux/sbitmap.h                            |   2 +-
 include/linux/soc/qcom/geni-se.h                   |   9 +
 include/linux/usb/usbnet.h                         |  15 +
 include/net/bluetooth/hci_core.h                   |   4 +-
 include/net/ip.h                                   |   2 +
 include/net/mac80211.h                             |   7 +-
 include/net/tcp.h                                  |  21 +-
 include/sound/tas2781.h                            |   7 +-
 include/trace/events/f2fs.h                        |   3 +-
 io_uring/io-wq.c                                   |  25 +-
 io_uring/io_uring.c                                |   4 +-
 io_uring/rw.c                                      |   8 +
 io_uring/sqpoll.c                                  |  12 +
 kernel/bpf/bpf_lsm.c                               |  34 +-
 kernel/bpf/btf.c                                   |  13 +-
 kernel/bpf/helpers.c                               |  12 +-
 kernel/bpf/syscall.c                               |   4 +-
 kernel/bpf/verifier.c                              | 134 +--
 kernel/kthread.c                                   |  10 +-
 kernel/locking/lockdep.c                           |  50 +-
 kernel/module/Makefile                             |   2 +-
 kernel/padata.c                                    |   6 +-
 kernel/rcu/tree_nocb.h                             |   5 +-
 kernel/sched/deadline.c                            |  38 +-
 kernel/sched/fair.c                                |  34 +-
 kernel/trace/bpf_trace.c                           |  15 +-
 lib/debugobjects.c                                 |   5 +-
 lib/sbitmap.c                                      |   4 +-
 lib/xz/xz_crc32.c                                  |   2 +-
 lib/xz/xz_private.h                                |   4 -
 mm/damon/vaddr.c                                   |   2 +
 mm/huge_memory.c                                   |   2 +
 mm/hugetlb.c                                       | 206 +++--
 mm/internal.h                                      |  11 +-
 mm/memory.c                                        |   8 +-
 mm/migrate.c                                       |   2 +-
 mm/mmap.c                                          |   4 +
 mm/util.c                                          |   2 +-
 net/bluetooth/hci_conn.c                           |   6 +-
 net/bluetooth/hci_sync.c                           |   5 +-
 net/bluetooth/mgmt.c                               |  13 +-
 net/can/bcm.c                                      |   4 +-
 net/can/j1939/transport.c                          |   8 +-
 net/core/filter.c                                  |  71 +-
 net/core/sock_map.c                                |   1 +
 net/hsr/hsr_slave.c                                |  11 +-
 net/ipv4/icmp.c                                    | 103 ++-
 net/ipv6/Kconfig                                   |   1 +
 net/ipv6/icmp.c                                    |  28 +-
 net/ipv6/netfilter/nf_reject_ipv6.c                |  14 +-
 net/ipv6/route.c                                   |   2 +-
 net/ipv6/rpl_iptunnel.c                            |  12 +-
 net/mac80211/iface.c                               |  17 +-
 net/mac80211/mlme.c                                |  30 +-
 net/mac80211/offchannel.c                          |   1 +
 net/mac80211/rate.c                                |   2 +-
 net/mac80211/scan.c                                |   2 +-
 net/mac80211/tx.c                                  |   2 +-
 net/netfilter/nf_conntrack_netlink.c               |   7 +-
 net/netfilter/nf_tables_api.c                      |  18 +-
 net/netfilter/nft_compat.c                         |   6 +-
 net/netfilter/nft_dynset.c                         |   6 +-
 net/netfilter/nft_log.c                            |   2 +-
 net/netfilter/nft_meta.c                           |   2 +-
 net/netfilter/nft_numgen.c                         |   2 +-
 net/netfilter/nft_set_pipapo.c                     |  13 +-
 net/netfilter/nft_tunnel.c                         |   5 +-
 net/qrtr/af_qrtr.c                                 |   2 +-
 net/tipc/bcast.c                                   |   2 +-
 net/wireless/nl80211.c                             |   3 +-
 net/wireless/scan.c                                |   6 +-
 net/wireless/sme.c                                 |   3 +-
 net/wireless/util.c                                |  10 +-
 net/xdp/xsk_buff_pool.c                            |  29 +-
 samples/bpf/Makefile                               |   6 +-
 security/apparmor/include/net.h                    |   3 +-
 security/apparmor/lsm.c                            |  17 +-
 security/apparmor/net.c                            |   2 +-
 security/bpf/hooks.c                               |   1 -
 security/integrity/ima/ima.h                       |   2 +-
 security/integrity/ima/ima_iint.c                  |  20 +-
 security/integrity/ima/ima_main.c                  |   2 +-
 security/landlock/fs.c                             |   9 +-
 security/security.c                                |  68 +-
 security/selinux/hooks.c                           |  80 +-
 security/selinux/include/objsec.h                  |   5 +
 security/selinux/netlabel.c                        |  23 +-
 security/smack/smack.h                             |   5 +
 security/smack/smack_lsm.c                         |  70 +-
 security/smack/smack_netfilter.c                   |   4 +-
 security/smack/smackfs.c                           |   2 +-
 sound/pci/hda/cs35l41_hda_spi.c                    |   1 +
 sound/pci/hda/tas2781_hda_i2c.c                    |   2 +-
 sound/soc/codecs/rt5682.c                          |   4 +-
 sound/soc/codecs/rt5682s.c                         |   4 +-
 sound/soc/codecs/tas2781-comlib.c                  |   3 -
 sound/soc/codecs/tas2781-fmwlib.c                  |   1 -
 sound/soc/codecs/tas2781-i2c.c                     |  56 +-
 sound/soc/loongson/loongson_card.c                 |   4 +-
 tools/bpf/runqslower/Makefile                      |   3 +-
 tools/build/feature/test-all.c                     |   4 -
 tools/include/nolibc/string.h                      |   1 +
 tools/lib/bpf/libbpf.c                             |  75 +-
 tools/objtool/arch/loongarch/decode.c              |  11 +-
 tools/objtool/check.c                              |  23 +-
 tools/objtool/include/objtool/elf.h                |   1 +
 tools/perf/builtin-c2c.c                           |  14 +-
 tools/perf/builtin-inject.c                        |   1 +
 tools/perf/builtin-mem.c                           |  20 +-
 tools/perf/builtin-report.c                        |   3 +-
 tools/perf/builtin-sched.c                         |   8 +-
 tools/perf/scripts/python/arm-cs-trace-disasm.py   |   9 +-
 tools/perf/util/annotate-data.c                    |   2 +-
 tools/perf/util/bpf_skel/lock_data.h               |   4 +-
 tools/perf/util/bpf_skel/vmlinux/vmlinux.h         |   1 +
 tools/perf/util/dwarf-aux.c                        |  16 +-
 tools/perf/util/machine.c                          |  17 +-
 tools/perf/util/mem-events.c                       |  20 +-
 tools/perf/util/mem-events.h                       |   4 +-
 tools/perf/util/session.c                          |   3 +
 tools/perf/util/stat-display.c                     |   3 +-
 tools/perf/util/thread.c                           |   4 +
 tools/perf/util/thread.h                           |   1 +
 tools/perf/util/time-utils.c                       |   4 +-
 tools/perf/util/tool.h                             |   1 +
 tools/power/cpupower/lib/powercap.c                |   8 +
 tools/testing/selftests/arm64/signal/Makefile      |   2 +-
 tools/testing/selftests/arm64/signal/sve_helpers.c |  56 ++
 tools/testing/selftests/arm64/signal/sve_helpers.h |  21 +
 .../testcases/fake_sigreturn_sme_change_vl.c       |  46 +-
 .../testcases/fake_sigreturn_sve_change_vl.c       |  30 +-
 .../selftests/arm64/signal/testcases/ssve_regs.c   |  36 +-
 .../arm64/signal/testcases/ssve_za_regs.c          |  36 +-
 .../selftests/arm64/signal/testcases/sve_regs.c    |  32 +-
 .../selftests/arm64/signal/testcases/za_no_regs.c  |  32 +-
 .../selftests/arm64/signal/testcases/za_regs.c     |  36 +-
 tools/testing/selftests/bpf/Makefile               |  13 +-
 tools/testing/selftests/bpf/bench.c                |   1 +
 tools/testing/selftests/bpf/bench.h                |   1 +
 .../selftests/bpf/map_tests/sk_storage_map.c       |   2 +-
 .../selftests/bpf/prog_tests/bpf_iter_setsockopt.c |   2 +-
 .../testing/selftests/bpf/prog_tests/core_reloc.c  |   1 +
 .../selftests/bpf/prog_tests/crypto_sanity.c       |   1 -
 .../selftests/bpf/prog_tests/decap_sanity.c        |   1 -
 .../selftests/bpf/prog_tests/flow_dissector.c      |   2 +-
 tools/testing/selftests/bpf/prog_tests/kfree_skb.c |   1 +
 .../selftests/bpf/prog_tests/lwt_redirect.c        |   1 -
 .../testing/selftests/bpf/prog_tests/lwt_reroute.c |   1 +
 .../selftests/bpf/prog_tests/ns_current_pid_tgid.c |   2 +-
 .../selftests/bpf/prog_tests/parse_tcp_hdr_opt.c   |   1 +
 tools/testing/selftests/bpf/prog_tests/sk_lookup.c |   1 -
 .../testing/selftests/bpf/prog_tests/tc_redirect.c |  12 +-
 tools/testing/selftests/bpf/prog_tests/tcp_rtt.c   |   1 +
 .../selftests/bpf/prog_tests/user_ringbuf.c        |   1 +
 tools/testing/selftests/bpf/progs/bpf_misc.h       |  31 +-
 .../testing/selftests/bpf/progs/cg_storage_multi.h |   2 -
 .../bpf/progs/test_libbpf_get_fd_by_id_opts.c      |   1 +
 .../selftests/bpf/progs/verifier_spill_fill.c      |   8 +-
 tools/testing/selftests/bpf/test_cpp.cpp           |   4 +
 tools/testing/selftests/bpf/test_loader.c          | 309 +++++--
 tools/testing/selftests/bpf/test_lru_map.c         |   3 +-
 tools/testing/selftests/bpf/test_progs.c           |  18 +-
 tools/testing/selftests/bpf/test_progs.h           |   1 -
 tools/testing/selftests/bpf/testing_helpers.c      |   6 +-
 tools/testing/selftests/bpf/unpriv_helpers.c       |   1 -
 tools/testing/selftests/bpf/veristat.c             |   8 +-
 .../testing/selftests/dt/test_unprobed_devices.sh  |  15 +-
 .../ftrace/test.d/00basic/test_ownership.tc        |  12 +
 .../ftrace/test.d/ftrace/func_set_ftrace_file.tc   |   9 +-
 .../ftrace/test.d/kprobe/kprobe_args_char.tc       |   2 +-
 .../ftrace/test.d/kprobe/kprobe_args_string.tc     |   2 +-
 tools/testing/selftests/kselftest.h                |   2 +
 tools/testing/selftests/net/netfilter/ipvs.sh      |   2 +-
 tools/testing/selftests/resctrl/cat_test.c         |   7 +-
 virt/kvm/kvm_main.c                                |  31 +-
 626 files changed, 7228 insertions(+), 4500 deletions(-)

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit 8144dbe68c493baa412d78f41a57e90a6461f6c3 ]

Using round_jiffies() in thermal_set_delay_jiffies() is invalid because its argument should be time in the future in absolute jiffies and it computes the result with respect to the current jiffies value at the invocation time. Fortunately, in the majority of cases it does not make any difference due to the time_is_after_jiffies() check in round_jiffies_common().

While using round_jiffies_relative() instead of round_jiffies() might reflect the intent a bit better, it still would not be defensible because that function should be called when the timer is about to be set and it is not suitable for pre-computation of delay values.

Accordingly, drop thermal_set_delay_jiffies() altogether, simply convert polling_delay and passive_delay to jiffies during thermal zone initialization and make thermal_zone_device_set_polling() call round_jiffies_relative() on the delay if it is greather than 1 second.

---
 drivers/thermal/thermal_core.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

index 99a8c06f6964d..d0e71698b3562 100644
@@ -323,11 +323,15 @@ static void thermal_zone_broken_disable(struct thermal_zone_device *tz)
 static void thermal_zone_device_set_polling(struct thermal_zone_device *tz,
 					    unsigned long delay)
 {
-	if (delay)
-		mod_delayed_work(system_freezable_power_efficient_wq,
-				 &tz->poll_queue, delay);
-	else
+	if (!delay) {
 		cancel_delayed_work(&tz->poll_queue);
+		return;
+	}
+
+	if (delay > HZ)
+		delay = round_jiffies_relative(delay);
+
+	mod_delayed_work(system_freezable_power_efficient_wq, &tz->poll_queue, delay);
 }
 
 static void thermal_zone_recheck(struct thermal_zone_device *tz, int error)