Merge tag 'android14-6.1.78_r00' into branch android14-6.1

This brings the android14-6.1 branch up to date with the 6.1.78 LTS
release.  Included in here are the following commits:

* 4b97573495 Revert "hrtimer: Report offline hrtimer enqueue"
*   0e5af42a0a Merge 6.1.78 into android14-6.1-lts
|\
| * 8b4118fabd Linux 6.1.78
| * 1296c110c5 netfilter: nft_set_rbtree: skip end interval element from gc
| * d89a80e482 net: stmmac: xgmac: fix a typo of register name in DPP safety handling
| * 7b430fb924 ALSA: usb-audio: Sort quirk table entries
| * 06040fadbf net: stmmac: xgmac: use #define for string constants
| * 499e6e9f07 clocksource: Skip watchdog check for large watchdog intervals
| * 492e0aba08 block: treat poll queue enter similarly to timeouts
| * cf3d57ad6f f2fs: add helper to check compression level
| * 9f74b3d718 RDMA/irdma: Fix support for 64k pages
| * 4675661672 vhost: use kzalloc() instead of kmalloc() followed by memset()
| * d8712c6c6a Revert "ASoC: amd: Add new dmi entries for acp5x platform"
| * fbd77ce1d1 io_uring/net: fix sr->len for IORING_OP_RECV with MSG_WAITALL and buffers
| * 08249dc3d9 Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
| * 315075ac73 Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
| * a94d303bea hrtimer: Report offline hrtimer enqueue
| * 8b380ad970 usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
| * f2cf6db285 usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
| * 041cb58f54 USB: serial: cp210x: add ID for IMST iM871A-USB
| * 36ef5b7b4f USB: serial: option: add Fibocom FM101-GL variant
| * 234099ab7f USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
| * 39fbca505f ALSA: usb-audio: add quirk for RODE NT-USB+
| * 2552f6b1bd ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
| * b8259a5023 ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
| * 82761993d4 mtd: parsers: ofpart: add workaround for #size-cells 0
| * b478e414cf fs: dlm: don't put dlm_local_addrs on heap
| * e5dc63f01e blk-iocost: Fix an UBSAN shift-out-of-bounds warning
| * 1ebd75cefa scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
| * ec1bedd797 fs/ntfs3: Fix an NULL dereference bug
| * a442ff5405 netfilter: nft_set_pipapo: remove scratch_aligned pointer
| * fac3478d5b netfilter: nft_set_pipapo: add helper to release pcpu scratch area
| * 3eaab7d565 netfilter: nft_set_pipapo: store index in scratch maps
| * 181dade251 netfilter: nft_ct: reject direction for ct id
| * efdd665ce1 drm/amd/display: Implement bounds check for stream encoder creation in DCN301
| * a060da3235 netfilter: nft_compat: restrict match/target protocol to u16
| * 8762bcc927 netfilter: nft_compat: reject unused compat flag
| * e79ef7966e netfilter: nft_compat: narrow down revision to unsigned 8-bits
| * 69d66d493b selftests: cmsg_ipv6: repeat the exact packet
| * 4e2c4846b2 ppp_async: limit MRU to 64K
| * e0e09186d8 af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
| * 3d3a5b31b4 tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
| * cf6b97e183 rxrpc: Fix response to PING RESPONSE ACKs to a dead call
| * 05a4d0e166 drm/i915/gvt: Fix uninitialized variable in handle_mmio()
| * 5453875221 inet: read sk->sk_family once in inet_recv_error()
| * 3fa78ee0e3 hwmon: (coretemp) Fix bogus core_id to attr name mapping
| * 9bce694192 hwmon: (coretemp) Fix out-of-bounds memory access
| * a3156be201 hwmon: (aspeed-pwm-tacho) mutex for tach reading
| * 4065746686 octeontx2-pf: Fix a memleak otx2_sq_init
| * cbf2e16602 atm: idt77252: fix a memleak in open_card_ubr0
| * e37cde7a57 tunnels: fix out of bounds access when building IPv6 PMTU error
| * 90fe47743a selftests: net: avoid just another constant wait
| * 7f484179c5 selftests: net: cut more slack for gro fwd tests.
| * 466ceebe48 net: atlantic: Fix DMA mapping for PTP hwts ring
| * 0193e0660c netdevsim: avoid potential loop in nsim_dev_trap_report_work()
| * bcabbf8ab5 wifi: mac80211: fix waiting for beacons logic
| * e42ff0844f net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
| * fb8bfc6ea3 drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup
| * 42939a1ea6 drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
| * d2b7e247f3 drm/msms/dp: fixed link clock divider bits be over written in BPC unknown case
| * cbc53148cc cifs: failure to add channel on iface should bump up weight
| * 0430bfcd46 phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
| * 296fb308f4 dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
| * ed3bb52a05 phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
| * 25ab4d72eb dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
| * 13535ae766 dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
| * 908939b8e8 dmaengine: ti: k3-udma: Report short packet errors
| * a1d7ca71ba dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
| * 78327acd4c ext4: regenerate buddy after block freeing failed if under fc replay
* | 19c319d14d Revert "drm/mipi-dsi: Fix detach call without attach"
* | 20b90d46a0 Merge 6.1.77 into android14-6.1-lts
|\|
| * f1bb70486c Linux 6.1.77
| * d78690bb5d drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()'
| * f086c50a98 ASoC: codecs: wsa883x: fix PA volume control
| * ac86261fa8 ASoC: codecs: lpass-wsa-macro: fix compander volume hack
| * 2386ee6cba bonding: remove print in bond_verify_device_path
| * e1edd8e6c0 gve: Fix use-after-free vulnerability
| * 9e584ea101 LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init()
| * 98c392a91a drm/msm/dsi: Enable runtime PM
| * befdb0a8a1 Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again"
| * dc904345e3 mm, kmsan: fix infinite recursion due to RCU critical section
| * c5a12dfbfa arm64: irq: set the correct node for shadow call stack
| * ddd367ebc4 selftests: bonding: Check initial state
| * 7ebe20e632 selftests: team: Add missing config options
| * aaa8f76845 net: sysfs: Fix /sys/class/net/<iface> path
| * bea0fbf857 selftests: net: fix available tunnels detection
| * a2104f4387 af_unix: fix lockdep positive in sk_diag_dump_icons()
| * fde3d47efe net: ipv4: fix a memleak in ip_setup_cork
| * 0f501dae16 netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
| * 9ff981cd65 netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
| * 67f0ca0a4c netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
| * 8a51dbf7b7 netfilter: conntrack: correct window scaling with retransmitted SYN
| * cd091ca44c selftests: net: add missing config for GENEVE
| * 04a553d8ac bridge: mcast: fix disabled snooping after long uptime
| * 9c333d9891 llc: call sock_orphan() at release time
| * c59ed6592f ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
| * 2f3d9829f7 net: dsa: qca8k: fix illegal usage of GPIO
| * 1e4c227805 ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
| * 3b84b7000c ixgbe: Refactor overtemp event handling
| * 9c8eafc5e9 ixgbe: Refactor returning internal error codes
| * b383d4ea27 tcp: add sanity checks to rx zerocopy
| * 046260ce7c net: lan966x: Fix port configuration when using SGMII interface
| * d2f1b7fe74 ipmr: fix kernel panic when forwarding mcast packets
| * 03dc5b73af ipv4: raw: add drop reasons
| * d54e4da98b ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
| * 262caadfa9 selftests: net: give more time for GRO aggregation
| * 53e94ec530 HID: hidraw: fix a problem of memory leak in hidraw_release()
| * db6338f459 scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
| * 81e92f0c97 regulator: ti-abb: don't use devm_platform_ioremap_resource_byname for shared interrupt register
| * 7eb86ddaf1 scsi: isci: Fix an error code problem in isci_io_request_build()
| * 206dcd2624 drm: using mul_u32_u32() requires linux/math64.h
| * a2f30104fe wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
| * 071d98d5ee perf: Fix the nr_addr_filters fix
| * 8eea7e1d69 drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
| * 7513f0906c drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
| * af8e292615 drm/amdgpu: Fix with right return code '-EIO' in 'amdgpu_gmc_vram_checking()'
| * d282ea0703 drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
| * 3fbfeb8536 ceph: fix invalid pointer access if get_quota_realm return ERR_PTR
| * 7f2649c942 ceph: fix deadlock or deadcode of misusing dget()
| * 692ead237d ceph: reinitialize mds feature bit even when session in open
| * 1d9c777d3e blk-mq: fix IO hang from sbitmap wakeup race
| * 1f7a018857 virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
| * b602f098f7 drm/amdkfd: Fix lock dependency warning with srcu
| * 8b25d39716 drm/amdkfd: Fix lock dependency warning
| * 49a7b708da libsubcmd: Fix memory leak in uniq()
| * 2c1164ad92 misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback
| * 91f1977487 9p: Fix initialisation of netfs_inode for 9p
| * fc557b76dc PCI/AER: Decode Requester ID when no error info found
| * 83c895561a PCI: Fix 64GT/s effective data rate calculation
| * 521f28eedd spmi: mediatek: Fix UAF on device remove
| * 089ebfab24 fs/kernfs/dir: obey S_ISGID
| * c13bcbdb84 tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
| * d8d7ffefc0 selftests/sgx: Fix linker script asserts
| * fa3f6cd20d usb: hub: Add quirk to decrease IN-ep poll interval for Microchip USB491x hub
| * 9cdf5ddb06 usb: hub: Replace hardcoded quirk value with BIT() macro
| * 4c8ca96124 perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
| * 1d83c85922 PCI: switchtec: Fix stdev_release() crash after surprise hot remove
| * 5e0160dab1 PCI: Only override AMD USB controller if required
| * 26b8a35fef mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
| * 6e8c0eda6c mfd: ti_am335x_tscadc: Fix TI SoC dependencies
| * 52e7f05549 xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
| * e827364bc1 i3c: master: cdns: Update maximum prescaler value for i2c clock
| * 4f7dad73df um: time-travel: fix time corruption
| * d8512cc8ac um: net: Fix return type of uml_net_start_xmit()
| * d8264ce2f8 um: Don't use vfprintf() for os_info()
| * a95e52af36 um: Fix naming clash between UML and scheduler
| * 7d1c4e5809 leds: trigger: panic: Don't register panic notifier if creating the trigger failed
| * 2cb659ef0a ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
| * 05a0900bd7 drm/amdkfd: Fix iterator used outside loop in 'kfd_add_peer_prop()'
| * 34bb1b97c3 drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
| * 66d38977e2 drm/amdgpu: Fix '*fw' from request_firmware() not released in 'amdgpu_ucode_request()'
| * da08dbb647 drm/amdgpu: Let KFD sync with VM fences
| * adae24c5b3 drm/amdgpu: Fix ecc irq enable/disable unpaired
| * aade0a0760 clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
| * 7294b1bbaa drm/amd/display: make flip_timestamp_in_us a 64-bit variable
| * c95d2144be watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
| * ec74a45e80 clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
| * 14992bc77f clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
| * d443fb67ca drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
| * fe7e8ec072 drm/msm/dpu: fix writeback programming for YUV cases
| * 7593e62702 drm/msm/dpu: Ratelimit framedone timeout msgs
| * fb017c3e6a drm/amd/display: For prefetch mode > 0, extend prefetch if possible
| * 4ef53b7e30 media: i2c: imx335: Fix hblank min/max values
| * 5008bde32c media: ddbridge: fix an error code problem in ddb_probe
| * 6408851d05 media: amphion: remove mutext lock in condition of wait_event
| * 5108a2dc2d IB/ipoib: Fix mcast list locking
| * fe80290b2a drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
| * 7c972c8945 f2fs: fix to tag gcing flag on page during block migration
| * fb55c3cee6 hwmon: (nct6775) Fix fan speed set failure in automatic mode
| * bf808f5868 media: rkisp1: Fix IRQ disable race issue
| * f0d0fe3787 media: rkisp1: Store IRQ lines
| * fb71b54856 media: rkisp1: Fix IRQ handler return values
| * 1c51b6b0c6 media: rkisp1: Drop IRQF_SHARED
| * c3f77c5d63 ALSA: hda: Intel: add HDA_ARL PCI ID support
| * 3b28da57d0 PCI: add INTEL_HDA_ARL to pci_ids.h
| * 16786b7090 media: rockchip: rga: fix swizzling for RGB formats
| * 1ef8beb4bf media: stk1160: Fixed high volume of stk1160_dbg messages
| * 25eaa9f999 drm/mipi-dsi: Fix detach call without attach
| * f3e41cc260 drm/framebuffer: Fix use of uninitialized variable
| * 406f8d5bad drm/drm_file: fix use of uninitialized variable
| * 48ad42cd95 ASoC: amd: Add new dmi entries for acp5x platform
| * b6ca70f06e f2fs: fix write pointers on zoned device after roll forward
| * 9773a96eac drm/amd/display: Fix tiled display misalignment
| * 126543736f drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms
| * 3c2bd20dc9 drm/panel-edp: Add override_edid_mode quirk for generic edp
| * 055c849724 RDMA/IPoIB: Fix error code return in ipoib_mcast_join
| * c4cb42824e fast_dput(): handle underflows gracefully
| * 0ee8e0a183 ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
| * 52e25a323c ALSA: hda: Refer to correct stream index at loops
| * b1020a5467 f2fs: fix to check return value of f2fs_reserve_new_block()
| * 332a7c108e net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure
| * 0438a985de octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
| * 95173204b1 i40e: Fix VF disable behavior to block all traffic
| * 9f9ac39adb bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
| * a243e0818e net/smc: disable SEID on non-s390 archs where virtual ISM may be used
| * 388736c62b Bluetooth: L2CAP: Fix possible multiple reject send
| * 6d95ade9e6 Bluetooth: hci_sync: fix BR/EDR wakeup bug
| * a836b1c333 Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
| * da1a6e9f01 wifi: cfg80211: free beacon_ies when overridden from hidden BSS
| * 3bb09b9af1 wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
| * 12473265f5 libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
| * 68ef19417a wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
| * e15fa0c67e arm64: dts: amlogic: fix format for s4 uart node
| * 9e8338b72b ice: fix pre-shifted bit usage
| * 9c5541f3f0 arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
| * 2fdbf9d9a0 arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
| * fd9a2c7003 md: Whenassemble the array, consult the superblock of the freshest device
| * 8ae4201900 block: prevent an integer overflow in bvec_try_merge_hw_page
| * 44f6b75c09 net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
| * 0edb3ae8bf net: atlantic: eliminate double free in error handling logic
| * ea12794ea6 ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values
| * d4560c11c3 scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM
| * dc15b313f3 ARM: dts: imx23/28: Fix the DMA controller node name
| * 9388665a12 ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
| * fb8e41af95 ARM: dts: imx27-apf27dev: Fix LED name
| * 6ebe86575b ARM: dts: imx25/27: Pass timing0
| * 68b2e26225 ARM: dts: imx25: Fix the iim compatible string
| * af7bbdac89 block/rnbd-srv: Check for unlikely string overflow
| * 238ec612a2 ionic: bypass firmware cmds when stuck in reset
| * 434fcaf372 ionic: pass opcode to devcmd_wait
| * 7dc0fefd37 net: phy: at803x: fix passing the wrong reference for config_intr
| * e7398f3e45 ARM: dts: imx1: Fix sram node
| * 7721a55c02 ARM: dts: imx27: Fix sram node
| * 8a0285ed7e ARM: dts: imx: Use flash@0,0 pattern
| * 8953b37bb1 ARM: dts: imx25/27-eukrea: Fix RTC node name
| * 1acdaf9f29 ARM: dts: rockchip: fix rk3036 hdmi ports node
| * 574dcd3126 wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
| * 5a44a664ab bpf: Set uattr->batch.count as zero before batched update or deletion
| * 7719e56b20 scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
| * 73fe92ddf9 scsi: libfc: Don't schedule abort twice
| * d6d6fe4bb1 bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
| * c07965d1a7 wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early
| * 25c6f49ef5 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
| * db30f469ae ARM: dts: imx7s: Fix nand-controller #size-cells
| * 6fa750d62f ARM: dts: imx7s: Fix lcdif compatible
| * c9c2a35820 ARM: dts: imx7d: Fix coresight funnel ports
| * 89fdf0a2c7 scsi: arcmsr: Support new PCI device IDs 1883 and 1886
| * 61c859bd66 scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
| * 5c4cbec510 net: usb: ax88179_178a: avoid two consecutive device resets
| * cd4cdad9bd bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
| * c0d5a69322 PCI: Add no PM reset quirk for NVIDIA Spectrum devices
| * 04dcef4a78 scsi: lpfc: Fix possible file string name overflow when updating firmware
| * c0a96adce2 soc: xilinx: fix unhandled SGI warning message
| * 01946c3c83 soc: xilinx: Fix for call trace due to the usage of smp_processor_id()
| * fd937767d5 selftests/bpf: Fix issues in setup_classid_environment()
| * f58cfb63e4 wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
| * ad0e7bbc0b selftests/bpf: Fix pyperf180 compilation failure with clang18
| * 76ab331d6d selftests/bpf: satisfy compiler by having explicit return in btf test
| * 739b3ccd94 wifi: rt2x00: restart beacon queue when hardware reset
| * 6d2cbf517d ext4: avoid online resizing failures due to oversized flex bg
| * dd10f82ece ext4: remove unnecessary check from alloc_flex_gd()
| * 60292a12a0 ext4: unify the type of flexbg_size to unsigned int
| * 069ede0475 ext4: fix inconsistent between segment fstrim and full fstrim
| * 80cab9dad5 ecryptfs: Reject casefold directory inodes
| * e8ca3e7330 SUNRPC: Fix a suspicious RCU usage warning
| * 0671f42a9c KVM: s390: fix setting of fpc register
| * 7a4d6481fb s390/ptrace: handle setting of fpc register correctly
| * 08f65c9067 s390/vfio-ap: fix sysfs status attribute for AP queue devices
| * d6c8d8ab76 arch: consolidate arch_irq_work_raise prototypes
| * 3537f92cd2 jfs: fix array-index-out-of-bounds in diNewExt
| * b03d76cc66 rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
| * ea4eb77c53 afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
| * eef7c4cd98 afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
| * 91256fcd57 crypto: stm32/crc32 - fix parsing list of devices
| * e0e78522b4 erofs: fix ztailpacking for subpage compressed blocks
| * 6c7bdb97d4 crypto: octeontx2 - Fix cptvf driver cleanup
| * 75b0f71b26 pstore/ram: Fix crash when setting number of cpus to an odd number
| * 32e8f2d955 jfs: fix uaf in jfs_evict_inode
| * 70780914cb jfs: fix array-index-out-of-bounds in dbAdjTree
| * cab0c265ba jfs: fix slab-out-of-bounds Read in dtSearch
| * e4cbc857d7 UBSAN: array-index-out-of-bounds in dtSplitRoot
| * 42f433785f FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
| * 185d97e5be ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
| * 31569995fc PM / devfreq: Synchronize devfreq_monitor_[start/stop]
| * 7633b7a036 ACPI: NUMA: Fix the logic of getting the fake_pxm value
| * 33650372e3 ACPI: extlog: fix NULL pointer dereference check
| * 431c1a4921 PNP: ACPI: fix fortify warning
| * 81eb8b56e7 ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
| * 4d4e06eaa2 audit: Send netlink ACK before setting connection in auditd_set
| * 3430936a01 regulator: core: Only increment use_count when enable_count changes
| * b3ae38966d debugobjects: Stop accessing objects after releasing hash bucket lock
| * 74ec093dba perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
| * d67e43be0e x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
| * abd26515d4 powerpc/lib: Validate size for vector operations
| * 0be5614f26 powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
| * d4908b3431 x86/boot: Ignore NMIs during very early boot
| * a6fd14db75 powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
| * cf3256c431 powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
| * 7ad4b2a6b2 powerpc: Fix build error due to is_valid_bugaddr()
| * d87d9a23a1 drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
| * 4431284f4a arm64: irq: set the correct node for VMAP stack
| * d482d61025 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
| * 9e5c37e0fa asm-generic: make sparse happy with odd-sized put_unaligned_*()
* | f28d3f0d96 Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
* | 7a8376be74 ANDROID: use reserved cpucaps for new capability
* | c801066eca Revert "mm/sparsemem: fix race in accessing memory_section->usage"
* | 2dbddbe358 Merge 6.1.76 into android-6.1
|\|
| * e5c3b988b8 Linux 6.1.76
| * d7dc6a8604 net/mlx5e: Handle hardware IPsec limits events
| * e90c7d26ca serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
| * c02d3872c8 x86/entry/ia32: Ensure s32 is sign extended to s64
| * cf0b4ba4b0 tick/sched: Preserve number of idle sleeps across CPU hotplug events
| * e333bbb557 mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
| * ec745eeff4 cxl/region：Fix overflow issue in alloc_hpa()
| * 1111abee59 MIPS: lantiq: register smp_ops on non-smp platforms
| * b086f6d979 spi: fix finalize message on error return
| * 598af91f62 spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
| * a2fa86e2bb drm/bridge: anx7625: Ensure bridge is suspended in disable()
| * 9564767b67 block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
| * 4b84411165 gpio: eic-sprd: Clear interrupt after set the interrupt type
| * 23cf4cf429 drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
| * ba930885bf drm/exynos: fix accidental on-stack copy of exynos_drm_plane
| * c1cd4f9da5 drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the error case
| * 6ba690e7f7 drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()
| * 279f1cc562 drm/bridge: sii902x: Fix audio codec unregistration
| * e0f83c234e drm/bridge: sii902x: Fix probing race issue
| * c46f9c7f93 drm/bridge: sii902x: Use devm_regulator_bulk_get_enable()
| * ed555f5b5c drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
| * 6b7fb2903a drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer
| * f9a4c401bf Revert "powerpc/64s: Increase default stack size to 32KB"
| * ec5e692cba drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing
| * f91c77d2c3 btrfs: zoned: optimize hint byte for zoned allocator
| * 4c45143447 btrfs: zoned: factor out prepare_allocation_zoned()
| * b168029d67 serial: sc16is7xx: fix unconditional activation of THRI interrupt
| * 49d733c4bb serial: sc16is7xx: Use port lock wrappers
| * 4fd9a02121 serial: core: Provide port lock wrappers
| * e11dea8f50 dlm: use kernel_connect() and kernel_bind()
| * fd7c2ffa0e ARM: dts: qcom: sdx55: fix USB SS wakeup
| * ecf87621b4 ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
| * 34d2c909c7 ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
| * bba1320ef2 ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
| * 46cd7ef69f ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
| * b87a1229d8 pipe: wakeup wr_wait after setting max_usage
| * 6f5c4aaddd fs/pipe: move check to pipe_has_watch_queue()
| * 28f010dc50 thermal: intel: hfi: Add syscore callbacks for system-wide PM
| * b2517d1412 thermal: intel: hfi: Disable an HFI instance when all its CPUs go offline
| * a8056e821c thermal: intel: hfi: Refactor enabling code into helper functions
| * e1c9d32c98 PM: sleep: Fix possible deadlocks in core system-wide PM code
| * a9dbf8ca31 PM: core: Remove unnecessary (void *) conversions
| * ea3357c6cf bus: mhi: ep: Do not allocate event ring element on stack
| * 512fc4d735 media: ov13b10: Enable runtime PM before registering async sub-device
| * a14c2431e5 media: ov13b10: Support device probe in non-zero ACPI D state
| * 33bf23c994 erofs: fix lz4 inplace decompression
| * 2197389e1a erofs: get rid of the remaining kmap_atomic()
| * 471ab2e8b7 drm/amdgpu/pm: Fix the power source flag error
| * b4cbd01832 drm/amd/display: Port DENTIST hang and TDR fixes to OTG disable W/A
| * 7960f14fca drm/bridge: nxp-ptn3460: simplify some error checking
| * 6341140b04 platform/x86: intel-uncore-freq: Fix types in sysfs callbacks
| * 85d16c03dd drm/amd/display: Disable PSR-SU on Parade 0803 TCON again
| * b5fcb340b7 drm/tidss: Fix atomic_flush check
| * 2a81e844d1 drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
| * 62f2e79cf9 drm: Don't unref the same fb many times by mistake due to deadlock handling
| * 635e996e6e cpufreq: intel_pstate: Refine computation of P-state for given frequency
| * 242996f500 gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
| * 6c495c84e2 xfs: read only mounts with fsopen mount API are busted
| * 7f95f6997f firmware: arm_scmi: Check mailbox/SMT channel for consistency
| * 2c939c74ef ksmbd: fix global oob in ksmbd_nl_policy
| * 2841631a03 platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
| * 8e34430e33 netfilter: nf_tables: reject QUEUE/DROP verdict parameters
| * af149a4689 netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
| * 5e7d8ddf2a hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
| * aa2cc93639 wifi: iwlwifi: fix a memory corruption
| * dcc54a54de exec: Fix error handling in begin_new_exec()
| * 4646445756 rbd: don't move requests to the running list on errors
| * 6e6bca99e8 btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
| * 52e02f26d0 btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
| * 86aff7c5f7 btrfs: don't warn if discard range is not aligned to sector
| * b60f748a2f btrfs: tree-checker: fix inline ref size in error messages
| * c91c247be4 btrfs: ref-verify: free ref cache before clearing mount opt
| * 9ebd514fbd btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted
| * d9c54763e5 nbd: always initialize struct msghdr completely
| * 0a5a083c2b net: fec: fix the unhandled context fault from smmu
| * 5b1086d226 fjes: fix memleaks in fjes_hw_setup
| * 4b4dcb3f42 selftests: netdevsim: fix the udp_tunnel_nic test
| * cec65f09c4 net: mvpp2: clear BM pool before initialization
| * acb6eaf2ea net: stmmac: Wait a bit for the reset to take effect
| * 67ee37360d netfilter: nf_tables: validate NFPROTO_* family
| * ed5b62bbd4 netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
| * c25d7922ef btrfs: fix race between reading a directory and adding entries to it
| * fd968e683b btrfs: refresh dir last index during a rewinddir(3) call
| * a045b6b197 btrfs: set last dir index to the current last index when opening dir
| * 2aa515b5b5 btrfs: fix infinite directory reads
| * bc6e242bb7 netfilter: nft_limit: reject configurations that cause integer overflow
| * c817f5c016 rcu: Defer RCU kthreads wakeup when CPU is dying
| * b2fa86b2ac net/mlx5e: fix a potential double-free in fs_any_create_groups
| * 42876db001 net/mlx5e: fix a double-free in arfs_create_groups
| * 890881d10f net/mlx5e: Allow software parsing when IPsec crypto is enabled
| * 62ce16005e net/mlx5: Use mlx5 device constant for selecting CQ period mode for ASO
| * 75d9ed4930 net/mlx5: DR, Can't go to uplink vport on RX rule
| * e54aedd4d0 net/mlx5: DR, Use the right GVMI number for drop action
| * f11792c389 ipv6: init the accept_queue's spinlocks in inet6_create
| * de061604f8 netlink: fix potential sleeping issue in mqueue_flush_file
| * 90fba981ca tcp: Add memory barrier to tcp_push()
| * ab49164c60 afs: Hide silly-rename files from userspace
| * f4f7e696db tracing: Ensure visibility when inserting an element into tracing_map
| * 82a9bc343b netfs, fscache: Prevent Oops in fscache_put_cache()
| * 71024928b3 net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
| * fcb0b4b6bc net: micrel: Fix PTP frame parsing for lan8814
| * 7a581f597a tun: add missing rx stats accounting in tun_xdp_act
| * 41e7decdad tun: fix missing dropped counter in tun_xdp_act
| * a2232f29bf net: fix removing a namespace with conflicting altnames
| * 6646145be9 udp: fix busy polling
| * 660c3053d9 llc: Drop support for ETH_P_TR_802_2.
| * 6d53b813ff llc: make llc_ui_sendmsg() more robust against bonding changes
| * c5e7fa4f9d vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
| * 4ee0613868 bnxt_en: Wait for FLR to complete during probe
| * b1e0a68a0c tcp: make sure init the accept_queue's spinlocks once
| * 6994dba063 net/smc: fix illegal rmb_desc access in SMC-D connection dump
| * 49aaeb8c53 wifi: mac80211: fix potential sta-link leak
| * b59e08c872 drm/amd/display: pbn_div need be updated for hotplug event
| * a5046e5eb8 Revert "drm/amd: Enable PCIe PME from D3"
| * b1c06ee2d1 ksmbd: Add missing set_freezable() for freezable kthread
| * 844dfef316 ksmbd: send lease break notification on FILE_RENAME_INFORMATION
| * de603a52af ksmbd: don't increment epoch if current state and request state are same
| * e61fc656ce ksmbd: fix potential circular locking issue in smb2_set_ea()
| * 8fa25e67fd ksmbd: set v2 lease version on lease upgrade
| * 3101b9fd74 mm: page_alloc: unreserve highatomic page blocks before oom
| * 1d15da5601 LoongArch/smp: Call rcutree_report_cpu_starting() earlier
| * 0e0653d53a serial: sc16is7xx: improve do/while loop in sc16is7xx_irq()
| * 80beb4424d serial: sc16is7xx: remove obsolete loop in sc16is7xx_port_irq()
| * de8e41f78f serial: sc16is7xx: fix invalid sc16is7xx_lines bitfield in case of probe error
| * 416b10d281 serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
| * 4b068e55bf serial: sc16is7xx: change EFR lock to operate on each channels
| * f6c58552a8 serial: sc16is7xx: remove unused line structure member
| * 6dca71e6e1 serial: sc16is7xx: remove global regmap from struct sc16is7xx_port
| * 9bcb019aee serial: sc16is7xx: remove wasteful static buffer in sc16is7xx_regmap_name()
| * 45ec1b7acc serial: sc16is7xx: improve regmap debugfs by using one regmap per port
| * 362be9ec32 rename(): fix the locking of subdirectories
| * 68ed9e3332 mm/sparsemem: fix race in accessing memory_section->usage
| * 367a47ef4c mm/rmap: fix misplaced parenthesis of a likely()
| * 5d01dcda81 ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
| * 13a6ceeb5b nouveau/vmm: don't set addr on the fail path to avoid warning
| * 40c23b5e07 rtc: Extend timeout for waiting for UIP to clear to 1s
| * 7971389316 rtc: Add support for configuring the UIP timeout for RTC reads
| * fd1f5396be rtc: mc146818-lib: Adjust failure return code for mc146818_get_time()
| * 911e7206c8 rtc: Adjust failure return code for cmos_set_alarm()
| * aca1ea92f5 rtc: cmos: Use ACPI alarm for non-Intel x86 systems too
| * 2b1dc0666e arm64: Rename ARM64_WORKAROUND_2966298
| * 9fec4db7ff media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
| * a33fbb8b6d mmc: mmc_spi: remove custom DMA mapped buffers
| * c4edcd134b mmc: core: Use mrq.sbc in close-ended ffu
| * d78fac87c6 media: videobuf2-dma-sg: fix vmap callback
| * c160f2ac85 scripts/get_abi: fix source path leak
| * efe3ec7066 docs: kernel_abi.py: fix command injection
| * c014490c0b lsm: new security_file_ioctl_compat() hook
| * 2647770eac arm64: dts: qcom: sm8150: fix USB DP/DM HS PHY interrupts
| * 0168530568 arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
| * 69ee126bba arm64: dts: qcom: sc7280: fix usb_1 wakeup interrupt types
| * eec1f92949 arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
| * 595d35c6ae arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
| * 8191aa4146 arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
| * 9f29c5d2bf scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
| * 2ab32986a0 dmaengine: fix NULL pointer in channel unregistration function
| * 0c8ada71d9 iio: adc: ad7091r: Enable internal vref if external vref is not supplied
| * fcf8e37152 async: Introduce async_schedule_dev_nocall()
| * 6e8aab4de7 async: Split async_schedule_node_domain()
| * b37c1b0db1 parisc/power: Fix power soft-off button emulation on qemu
| * 71602d95ae parisc/firmware: Fix F-extend for PDC addresses
| * 0b093176fd bus: mhi: host: Add spinlock to protect WP access when queueing TREs
| * 3c5ec66b4b bus: mhi: host: Drop chan lock before queuing buffers
| * 2df39ac8f8 bus: mhi: host: Add alignment check for event ring read pointer
| * 574f69b46b mips: Fix max_mapnr being uninitialized on early stages
| * 6690a0acbb s390/vfio-ap: let on_scan_complete() callback filter matrix and update guest's APCB
| * baf3fcb268 s390/vfio-ap: loop over the shadow APCB when filtering guest's AP configuration
| * d6b8d034b5 s390/vfio-ap: always filter entire AP matrix
| * 51a7c02bc7 media: ov9734: Enable runtime PM before registering async sub-device
| * f4bb1d5daf rpmsg: virtio: Free driver_override when rpmsg_remove()
| * e8757cd139 media: imx355: Enable runtime PM before registering async sub-device
| * 8a7729cda2 PM / devfreq: Fix buffer overflow in trans_stat_show
| * f4518de40a s390/vfio-ap: unpin pages on gisc registration failure
| * dbc9a791a7 crypto: s390/aes - Fix buffer overread in CTR mode
| * aa8aa16ed9 hwrng: core - Fix page fault dead lock on mmap-ed hwrng
| * 3a081586c7 PM: hibernate: Enforce ordering during image compression/decompression
| * 680eb0a993 crypto: api - Disallow identical driver names
| * 562850a008 btrfs: sysfs: validate scrub_speed_max value
| * 29e2da3eab OPP: Pass rounded rate to _set_opp()
| * 4b5f8a187f arm64: properly install vmlinuz.efi
| * 852b6b2a2f ext4: allow for the last group to be marked as trimmed
| * 137568aa54 iio: adc: ad7091r: Allow users to configure device events
| * 6f57121e9c iio: adc: ad7091r: Set alert bit in config register
| * fafda9f08a Revert "nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB"
| * c519a9054b usb: dwc3: gadget: Handle EP0 request dequeuing properly
| * c8fe8ce07f usb: dwc3: gadget: Queue PM runtime idle on disconnect event
| * ce27046883 usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
* 0eac7b614d Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
* 63040ce8e9 Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
* 50fe3d2012 ANDROID: Add symbols for IIO SCMI module
* e666b8755f ANDROID: Update symbols list for open-dice.ko

Change-Id: Icb970da9bfba44d188465ce8c8148858a4a2fb1a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Documentation/ABI/testing/sysfs-class-devfreq

@@ -52,6 +52,9 @@ Description:
 
 			echo 0 > /sys/class/devfreq/.../trans_stat
 
+		If the transition table is bigger than PAGE_SIZE, reading
+		this will return an -EFBIG error.
+
 What:		/sys/class/devfreq/.../available_frequencies
 Date:		October 2012
 Contact:	Nishanth Menon <nm@ti.com>

Documentation/ABI/testing/sysfs-class-net-queues

@@ -1,4 +1,4 @@
-What:		/sys/class/<iface>/queues/rx-<queue>/rps_cpus
+What:		/sys/class/net/<iface>/queues/rx-<queue>/rps_cpus
 Date:		March 2010
 KernelVersion:	2.6.35
 Contact:	netdev@vger.kernel.org
@@ -8,7 +8,7 @@ Description:
 		network device queue. Possible values depend on the number
 		of available CPU(s) in the system.
 
-What:		/sys/class/<iface>/queues/rx-<queue>/rps_flow_cnt
+What:		/sys/class/net/<iface>/queues/rx-<queue>/rps_flow_cnt
 Date:		April 2010
 KernelVersion:	2.6.35
 Contact:	netdev@vger.kernel.org
@@ -16,7 +16,7 @@ Description:
 		Number of Receive Packet Steering flows being currently
 		processed by this particular network device receive queue.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/tx_timeout
+What:		/sys/class/net/<iface>/queues/tx-<queue>/tx_timeout
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -24,7 +24,7 @@ Description:
 		Indicates the number of transmit timeout events seen by this
 		network interface transmit queue.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/tx_maxrate
+What:		/sys/class/net/<iface>/queues/tx-<queue>/tx_maxrate
 Date:		March 2015
 KernelVersion:	4.1
 Contact:	netdev@vger.kernel.org
@@ -32,7 +32,7 @@ Description:
 		A Mbps max-rate set for the queue, a value of zero means disabled,
 		default is disabled.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/xps_cpus
+What:		/sys/class/net/<iface>/queues/tx-<queue>/xps_cpus
 Date:		November 2010
 KernelVersion:	2.6.38
 Contact:	netdev@vger.kernel.org
@@ -42,7 +42,7 @@ Description:
 		network device transmit queue. Possible vaules depend on the
 		number of available CPU(s) in the system.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/xps_rxqs
+What:		/sys/class/net/<iface>/queues/tx-<queue>/xps_rxqs
 Date:		June 2018
 KernelVersion:	4.18.0
 Contact:	netdev@vger.kernel.org
@@ -53,7 +53,7 @@ Description:
 		number of available receive queue(s) in the network device.
 		Default is disabled.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -62,7 +62,7 @@ Description:
 		of this particular network device transmit queue.
 		Default value is 1000.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/inflight
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/inflight
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -70,7 +70,7 @@ Description:
 		Indicates the number of bytes (objects) in flight on this
 		network device transmit queue.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -79,7 +79,7 @@ Description:
 		on this network device transmit queue. This value is clamped
 		to be within the bounds defined by limit_max and limit_min.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -88,7 +88,7 @@ Description:
 		queued on this network device transmit queue. See
 		include/linux/dynamic_queue_limits.h for the default value.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org

Documentation/admin-guide/abi-obsolete.rst

@@ -7,5 +7,5 @@ marked to be removed at some later point in time.
 The description of the interface will document the reason why it is
 obsolete and when it can be expected to be removed.
 
-.. kernel-abi:: $srctree/Documentation/ABI/obsolete
+.. kernel-abi:: ABI/obsolete
    :rst:

Documentation/admin-guide/abi-removed.rst

@@ -1,5 +1,5 @@
 ABI removed symbols
 ===================
 
-.. kernel-abi:: $srctree/Documentation/ABI/removed
+.. kernel-abi:: ABI/removed
    :rst:

Documentation/admin-guide/abi-stable.rst

@@ -10,5 +10,5 @@ for at least 2 years.
 Most interfaces (like syscalls) are expected to never change and always
 be available.
 
-.. kernel-abi:: $srctree/Documentation/ABI/stable
+.. kernel-abi:: ABI/stable
    :rst:

Documentation/admin-guide/abi-testing.rst

@@ -16,5 +16,5 @@ Programs that use these interfaces are strongly encouraged to add their
 name to the description of these interfaces, so that the kernel
 developers can easily notify them if any changes occur.
 
-.. kernel-abi:: $srctree/Documentation/ABI/testing
+.. kernel-abi:: ABI/testing
    :rst:

Documentation/filesystems/directory-locking.rst

@@ -22,13 +22,16 @@ exclusive.
 3) object removal.  Locking rules: caller locks parent, finds victim,
 locks victim and calls the method.  Locks are exclusive.
 
-4) rename() that is _not_ cross-directory.  Locking rules: caller locks the
+4) rename() that is _not_ cross-directory.  Locking rules: caller locks
-parent and finds source and target.  We lock both (provided they exist).  If we
+the parent and finds source and target.  Then we decide which of the
-need to lock two inodes of different type (dir vs non-dir), we lock directory
+source and target need to be locked.  Source needs to be locked if it's a
-first.  If we need to lock two inodes of the same type, lock them in inode
+non-directory; target - if it's a non-directory or about to be removed.
-pointer order.  Then call the method.  All locks are exclusive.
+Take the locks that need to be taken, in inode pointer order if need
-NB: we might get away with locking the source (and target in exchange
+to take both (that can happen only when both source and target are
-case) shared.
+non-directories - the source because it wouldn't be locked otherwise
+and the target because mixing directory and non-directory is allowed
+only with RENAME_EXCHANGE, and that won't be removing the target).
+After the locks had been taken, call the method.  All locks are exclusive.
 
 5) link creation.  Locking rules:
 
@@ -44,20 +47,17 @@ rules:
 
 	* lock the filesystem
 	* lock parents in "ancestors first" order. If one is not ancestor of
-	  the other, lock them in inode pointer order.
+	  the other, lock the parent of source first.
 	* find source and target.
 	* if old parent is equal to or is a descendent of target
 	  fail with -ENOTEMPTY
 	* if new parent is equal to or is a descendent of source
 	  fail with -ELOOP
-	* Lock both the source and the target provided they exist. If we
+	* Lock subdirectories involved (source before target).
-	  need to lock two inodes of different type (dir vs non-dir), we lock
+	* Lock non-directories involved, in inode pointer order.
-	  the directory first. If we need to lock two inodes of the same type,
-	  lock them in inode pointer order.
 	* call the method.
 
-All ->i_rwsem are taken exclusive.  Again, we might get away with locking
+All ->i_rwsem are taken exclusive.
-the source (and target in exchange case) shared.
 
 The rules above obviously guarantee that all directories that are going to be
 read, modified or removed by method will be locked by caller.
@@ -67,6 +67,7 @@ If no directory is its own ancestor, the scheme above is deadlock-free.
 
 Proof:
 
+[XXX: will be updated once we are done massaging the lock_rename()]
 	First of all, at any moment we have a linear ordering of the
 	objects - A < B iff (A is an ancestor of B) or (B is not an ancestor
         of A and ptr(A) < ptr(B)).

Documentation/filesystems/locking.rst

@@ -99,7 +99,7 @@ symlink:	exclusive
 mkdir:		exclusive
 unlink:		exclusive (both)
 rmdir:		exclusive (both)(see below)
-rename:		exclusive (all)	(see below)
+rename:		exclusive (both parents, some children)	(see below)
 readlink:	no
 get_link:	no
 setattr:	exclusive
@@ -119,6 +119,9 @@ fileattr_set:	exclusive
 	Additionally, ->rmdir(), ->unlink() and ->rename() have ->i_rwsem
 	exclusive on victim.
 	cross-directory ->rename() has (per-superblock) ->s_vfs_rename_sem.
+	->unlink() and ->rename() have ->i_rwsem exclusive on all non-directories
+	involved.
+	->rename() has ->i_rwsem exclusive on any subdirectory that changes parent.
 
 See Documentation/filesystems/directory-locking.rst for more detailed discussion
 of the locking scheme for directory operations.

Documentation/filesystems/porting.rst

@@ -943,3 +943,21 @@ file pointer instead of struct dentry pointer.  d_tmpfile() is similarly
 changed to simplify callers.  The passed file is in a non-open state and on
 success must be opened before returning (e.g. by calling
 finish_open_simple()).
+
+---
+
+**mandatory**
+
+If ->rename() update of .. on cross-directory move needs an exclusion with
+directory modifications, do *not* lock the subdirectory in question in your
+->rename() - it's done by the caller now [that item should've been added in
+28eceeda130f "fs: Lock moved directories"].
+
+---
+
+**mandatory**
+
+On same-directory ->rename() the (tautological) update of .. is not protected
+by any locks; just don't do it if the old parent is the same as the new one.
+We really can't lock two subdirectories in same-directory rename - not without
+deadlocks.

Documentation/sound/soc/dapm.rst

@@ -234,7 +234,7 @@ corresponding soft power control. In this case it is necessary to create
 a virtual widget - a widget with no control bits e.g.
 ::
 
-  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_DAPM_NOPM, 0, 0, NULL, 0),
+  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_NOPM, 0, 0, NULL, 0),
 
 This can be used to merge to signal paths together in software.
 

Documentation/sphinx/kernel_abi.py

@@ -39,8 +39,6 @@ import sys
 import re
 import kernellog
 
-from os import path
-
 from docutils import nodes, statemachine
 from docutils.statemachine import ViewList
 from docutils.parsers.rst import directives, Directive
@@ -73,60 +71,26 @@ class KernelCmd(Directive):
     }
 
     def run(self):
-
         doc = self.state.document
         if not doc.settings.file_insertion_enabled:
             raise self.warning("docutils: file insertion disabled")
 
-        env = doc.settings.env
+        srctree = os.path.abspath(os.environ["srctree"])
-        cwd = path.dirname(doc.current_source)
+
-        cmd = "get_abi.pl rest --enable-lineno --dir "
+        args = [
-        cmd += self.arguments[0]
+            os.path.join(srctree, 'scripts/get_abi.pl'),
+            'rest',
+            '--enable-lineno',
+            '--dir', os.path.join(srctree, 'Documentation', self.arguments[0]),
+        ]
 
         if 'rst' in self.options:
-            cmd += " --rst-source"
+            args.append('--rst-source')
 
-        srctree = path.abspath(os.environ["srctree"])
+        lines = subprocess.check_output(args, cwd=os.path.dirname(doc.current_source)).decode('utf-8')
-
-        fname = cmd
-
-        # extend PATH with $(srctree)/scripts
-        path_env = os.pathsep.join([
-            srctree + os.sep + "scripts",
-            os.environ["PATH"]
-        ])
-        shell_env = os.environ.copy()
-        shell_env["PATH"]    = path_env
-        shell_env["srctree"] = srctree
-
-        lines = self.runCmd(cmd, shell=True, cwd=cwd, env=shell_env)
         nodeList = self.nestedParse(lines, self.arguments[0])
         return nodeList
 
-    def runCmd(self, cmd, **kwargs):
-        u"""Run command ``cmd`` and return its stdout as unicode."""
-
-        try:
-            proc = subprocess.Popen(
-                cmd
-                , stdout = subprocess.PIPE
-                , stderr = subprocess.PIPE
-                , **kwargs
-            )
-            out, err = proc.communicate()
-
-            out, err = codecs.decode(out, 'utf-8'), codecs.decode(err, 'utf-8')
-
-            if proc.returncode != 0:
-                raise self.severe(
-                    u"command '%s' failed with return code %d"
-                    % (cmd, proc.returncode)
-                )
-        except OSError as exc:
-            raise self.severe(u"problems with '%s' directive: %s."
-                              % (self.name, ErrorString(exc)))
-        return out
-
     def nestedParse(self, lines, fname):
         env = self.state.document.settings.env
         content = ViewList()

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 75
+SUBLEVEL = 78
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/alpha/kernel/rtc.c

@@ -80,7 +80,7 @@ init_rtc_epoch(void)
 static int
 alpha_rtc_read_time(struct device *dev, struct rtc_time *tm)
 {
-	int ret = mc146818_get_time(tm);
+	int ret = mc146818_get_time(tm, 10);
 
 	if (ret < 0) {
 		dev_err_ratelimited(dev, "unable to read current time\n");

arch/arm/boot/dts/exynos4210-i9100.dts

@@ -521,6 +521,14 @@ vtcam_reg: LDO12 {
 				regulator-name = "VT_CAM_1.8V";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
+
+				/*
+				 * Force-enable this regulator; otherwise the
+				 * kernel hangs very early in the boot process
+				 * for about 12 seconds, without apparent
+				 * reason.
+				 */
+				regulator-always-on;
 			};
 
 			vcclcd_reg: LDO13 {

arch/arm/boot/dts/imx1-ads.dts

@@ -65,7 +65,7 @@ &weim {
 	pinctrl-0 = <&pinctrl_weim>;
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		compatible = "cfi-flash";
 		reg = <0 0x00000000 0x02000000>;
 		bank-width = <4>;

arch/arm/boot/dts/imx1-apf9328.dts

@@ -45,7 +45,7 @@ &weim {
 	pinctrl-0 = <&pinctrl_weim>;
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		compatible = "cfi-flash";
 		reg = <0 0x00000000 0x02000000>;
 		bank-width = <2>;

arch/arm/boot/dts/imx1.dtsi

@@ -268,9 +268,12 @@ weim: weim@220000 {
 			status = "disabled";
 		};
 
-		esram: esram@300000 {
+		esram: sram@300000 {
 			compatible = "mmio-sram";
 			reg = <0x00300000 0x20000>;
+			ranges = <0 0x00300000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 		};
 	};
 };

arch/arm/boot/dts/imx23-sansa.dts

@@ -175,10 +175,8 @@ i2c-0 {
 		#address-cells = <1>;
 		#size-cells = <0>;
 		compatible = "i2c-gpio";
-		gpios = <
+		sda-gpios = <&gpio1 24 0>;
-			&gpio1 24 0		/* SDA */
+		scl-gpios = <&gpio1 22 0>;
-			&gpio1 22 0		/* SCL */
-		>;
 		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
 	};
 
@@ -186,10 +184,8 @@ i2c-1 {
 		#address-cells = <1>;
 		#size-cells = <0>;
 		compatible = "i2c-gpio";
-		gpios = <
+		sda-gpios = <&gpio0 31 0>;
-			&gpio0 31 0		/* SDA */
+		scl-gpios = <&gpio0 30 0>;
-			&gpio0 30 0		/* SCL */
-		>;
 		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
 
 		touch: touch@20 {

arch/arm/boot/dts/imx23.dtsi

@@ -414,7 +414,7 @@ emi@80020000 {
 				status = "disabled";
 			};
 
-			dma_apbx: dma-apbx@80024000 {
+			dma_apbx: dma-controller@80024000 {
 				compatible = "fsl,imx23-dma-apbx";
 				reg = <0x80024000 0x2000>;
 				interrupts = <7 5 9 26

arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi

@@ -27,7 +27,7 @@ &i2c1 {
 	pinctrl-0 = <&pinctrl_i2c1>;
 	status = "okay";
 
-	pcf8563@51 {
+	rtc@51 {
 		compatible = "nxp,pcf8563";
 		reg = <0x51>;
 	};

arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts

@@ -16,7 +16,7 @@ cmo_qvga: display {
 		bus-width = <18>;
 		display-timings {
 			native-mode = <&qvga_timings>;
-			qvga_timings: 320x240 {
+			qvga_timings: timing0 {
 				clock-frequency = <6500000>;
 				hactive = <320>;
 				vactive = <240>;

arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts

@@ -16,7 +16,7 @@ dvi_svga: display {
 		bus-width = <18>;
 		display-timings {
 			native-mode = <&dvi_svga_timings>;
-			dvi_svga_timings: 800x600 {
+			dvi_svga_timings: timing0 {
 				clock-frequency = <40000000>;
 				hactive = <800>;
 				vactive = <600>;

arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts

@@ -16,7 +16,7 @@ dvi_vga: display {
 		bus-width = <18>;
 		display-timings {
 			native-mode = <&dvi_vga_timings>;
-			dvi_vga_timings: 640x480 {
+			dvi_vga_timings: timing0 {
 				clock-frequency = <31250000>;
 				hactive = <640>;
 				vactive = <480>;

arch/arm/boot/dts/imx25-pdk.dts

@@ -78,7 +78,7 @@ wvga: display {
 		bus-width = <18>;
 		display-timings {
 			native-mode = <&wvga_timings>;
-			wvga_timings: 640x480 {
+			wvga_timings: timing0 {
 				hactive = <640>;
 				vactive = <480>;
 				hback-porch = <45>;

arch/arm/boot/dts/imx25.dtsi

@@ -543,7 +543,7 @@ pwm1: pwm@53fe0000 {
 			};
 
 			iim: efuse@53ff0000 {
-				compatible = "fsl,imx25-iim", "fsl,imx27-iim";
+				compatible = "fsl,imx25-iim";
 				reg = <0x53ff0000 0x4000>;
 				interrupts = <19>;
 				clocks = <&clks 99>;

arch/arm/boot/dts/imx27-apf27dev.dts

@@ -16,7 +16,7 @@ display: display {
 		fsl,pcr = <0xfae80083>;	/* non-standard but required */
 		display-timings {
 			native-mode = <&timing0>;
-			timing0: 800x480 {
+			timing0: timing0 {
 				clock-frequency = <33000033>;
 				hactive = <800>;
 				vactive = <480>;
@@ -47,7 +47,7 @@ leds {
 		pinctrl-names = "default";
 		pinctrl-0 = <&pinctrl_gpio_leds>;
 
-		user {
+		led-user {
 			label = "Heartbeat";
 			gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
 			linux,default-trigger = "heartbeat";

arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi

@@ -33,7 +33,7 @@ &i2c1 {
 	pinctrl-0 = <&pinctrl_i2c1>;
 	status = "okay";
 
-	pcf8563@51 {
+	rtc@51 {
 		compatible = "nxp,pcf8563";
 		reg = <0x51>;
 	};
@@ -90,7 +90,7 @@ &usbotg {
 &weim {
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		#address-cells = <1>;
 		#size-cells = <1>;
 		compatible = "cfi-flash";

arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts

@@ -16,7 +16,7 @@ display0: CMO-QVGA {
 
 		display-timings {
 			native-mode = <&timing0>;
-			timing0: 320x240 {
+			timing0: timing0 {
 				clock-frequency = <6500000>;
 				hactive = <320>;
 				vactive = <240>;

arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts

@@ -19,7 +19,7 @@ display: display {
 		fsl,pcr = <0xf0c88080>;	/* non-standard but required */
 		display-timings {
 			native-mode = <&timing0>;
-			timing0: 640x480 {
+			timing0: timing0 {
 				hactive = <640>;
 				vactive = <480>;
 				hback-porch = <112>;

arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts

@@ -19,7 +19,7 @@ display0: LQ035Q7 {
 
 		display-timings {
 			native-mode = <&timing0>;
-			timing0: 240x320 {
+			timing0: timing0 {
 				clock-frequency = <5500000>;
 				hactive = <240>;
 				vactive = <320>;

arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi

@@ -322,7 +322,7 @@ &usbotg {
 &weim {
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		compatible = "cfi-flash";
 		reg = <0 0x00000000 0x02000000>;
 		bank-width = <2>;

arch/arm/boot/dts/imx27.dtsi

@@ -588,6 +588,9 @@ weim: weim@d8002000 {
 		iram: sram@ffff4c00 {
 			compatible = "mmio-sram";
 			reg = <0xffff4c00 0xb400>;
+			ranges = <0 0xffff4c00 0xb400>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 		};
 	};
 };

arch/arm/boot/dts/imx28.dtsi

@@ -994,7 +994,7 @@ etm: etm@80022000 {
 				status = "disabled";
 			};
 
-			dma_apbx: dma-apbx@80024000 {
+			dma_apbx: dma-controller@80024000 {
 				compatible = "fsl,imx28-dma-apbx";
 				reg = <0x80024000 0x2000>;
 				interrupts = <78 79 66 0

arch/arm/boot/dts/imx7d.dtsi

@@ -208,9 +208,6 @@ fec2: ethernet@30bf0000 {
 };
 
 &ca_funnel_in_ports {
-	#address-cells = <1>;
-	#size-cells = <0>;
-
 	port@1 {
 		reg = <1>;
 		ca_funnel_in_port1: endpoint {

arch/arm/boot/dts/imx7s.dtsi

@@ -190,7 +190,11 @@ funnel@30041000 {
 			clock-names = "apb_pclk";
 
 			ca_funnel_in_ports: in-ports {
-				port {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
 					ca_funnel_in_port0: endpoint {
 						remote-endpoint = <&etm0_out_port>;
 					};
@@ -814,7 +818,7 @@ csi_from_csi_mux: endpoint {
 			};
 
 			lcdif: lcdif@30730000 {
-				compatible = "fsl,imx7d-lcdif", "fsl,imx28-lcdif";
+				compatible = "fsl,imx7d-lcdif", "fsl,imx6sx-lcdif";
 				reg = <0x30730000 0x10000>;
 				interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
@@ -1279,7 +1283,7 @@ dma_apbh: dma-apbh@33000000 {
 		gpmi: nand-controller@33002000{
 			compatible = "fsl,imx7d-gpmi-nand";
 			#address-cells = <1>;
-			#size-cells = <1>;
+			#size-cells = <0>;
 			reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
 			reg-names = "gpmi-nand", "bch";
 			interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;

arch/arm/boot/dts/qcom-sdx55.dtsi

@@ -495,10 +495,10 @@ usb: usb@a6f8800 {
 					  <&gcc GCC_USB30_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 51 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>,
-				     <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>;
+					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
 					  "dm_hs_phy_irq", "dp_hs_phy_irq";
 
@@ -522,7 +522,7 @@ pdc: interrupt-controller@b210000 {
 			compatible = "qcom,sdx55-pdc", "qcom,pdc";
 			reg = <0x0b210000 0x30000>;
 			qcom,pdc-ranges = <0 179 52>;
-			#interrupt-cells = <3>;
+			#interrupt-cells = <2>;
 			interrupt-parent = <&intc>;
 			interrupt-controller;
 		};

arch/arm/boot/dts/rk3036.dtsi

@@ -402,12 +402,20 @@ hdmi: hdmi@20034000 {
 		pinctrl-0 = <&hdmi_ctl>;
 		status = "disabled";
 
-		hdmi_in: port {
+		ports {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			hdmi_in_vop: endpoint@0 {
+
+			hdmi_in: port@0 {
 				reg = <0>;
-				remote-endpoint = <&vop_out_hdmi>;
+
+				hdmi_in_vop: endpoint {
+					remote-endpoint = <&vop_out_hdmi>;
+				};
+			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
 			};
 		};
 	};

arch/arm/include/asm/irq_work.h

@@ -9,6 +9,4 @@ static inline bool arch_irq_work_has_interrupt(void)
 	return is_smp();
 }
 
-extern void arch_irq_work_raise(void);
-
 #endif /* _ASM_ARM_IRQ_WORK_H */

arch/arm64/Kconfig

@@ -970,6 +970,23 @@ config ARM64_ERRATUM_2457168
 
 	  If unsure, say Y.
 
+config ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
+	bool
+
+config ARM64_ERRATUM_2966298
+	bool "Cortex-A520: 2966298: workaround for speculatively executed unprivileged load"
+	select ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
+	default y
+	help
+	  This option adds the workaround for ARM Cortex-A520 erratum 2966298.
+
+	  On an affected Cortex-A520 core, a speculatively executed unprivileged
+	  load might leak data from a privileged level via a cache side channel.
+
+	  Work around this problem by executing a TLBI before returning to EL0.
+
+	  If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
 	bool "Cavium erratum 22375, 24313"
 	default y

arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts

@@ -15,7 +15,7 @@ / {
 	#size-cells = <2>;
 
 	aliases {
-		serial0 = &uart_B;
+		serial0 = &uart_b;
 	};
 
 	memory@0 {
@@ -25,6 +25,6 @@ memory@0 {
 
 };
 
-&uart_B {
+&uart_b {
 	status = "okay";
 };

arch/arm64/boot/dts/amlogic/meson-s4.dtsi

@@ -118,14 +118,14 @@ gpio_intc: interrupt-controller@4080 {
 					<10 11 12 13 14 15 16 17 18 19 20 21>;
 			};
 
-			uart_B: serial@7a000 {
+			uart_b: serial@7a000 {
 				compatible = "amlogic,meson-s4-uart",
 					     "amlogic,meson-ao-uart";
 				reg = <0x0 0x7a000 0x0 0x18>;
 				interrupts = <GIC_SPI 169 IRQ_TYPE_EDGE_RISING>;
-				status = "disabled";
 				clocks = <&xtal>, <&xtal>, <&xtal>;
 				clock-names = "xtal", "pclk", "baud";
+				status = "disabled";
 			};
 
 			reset: reset-controller@2000 {

arch/arm64/boot/dts/qcom/msm8996.dtsi

@@ -390,6 +390,19 @@ memory@80000000 {
 		reg = <0x0 0x80000000 0x0 0x0>;
 	};
 
+	etm {
+		compatible = "qcom,coresight-remote-etm";
+
+		out-ports {
+			port {
+				modem_etm_out_funnel_in2: endpoint {
+					remote-endpoint =
+					  <&funnel_in2_in_modem_etm>;
+				};
+			};
+		};
+	};
+
 	psci {
 		compatible = "arm,psci-1.0";
 		method = "smc";
@@ -2565,6 +2578,14 @@ funnel@3023000 {
 			clocks = <&rpmcc RPM_QDSS_CLK>, <&rpmcc RPM_QDSS_A_CLK>;
 			clock-names = "apb_pclk", "atclk";
 
+			in-ports {
+				port {
+					funnel_in2_in_modem_etm: endpoint {
+						remote-endpoint =
+						  <&modem_etm_out_funnel_in2>;
+					};
+				};
+			};
 
 			out-ports {
 				port {

arch/arm64/boot/dts/qcom/msm8998.dtsi

@@ -1903,9 +1903,11 @@ etm5: etm@7c40000 {
 
 			cpu = <&CPU4>;
 
-			port{
+			out-ports {
-				etm4_out: endpoint {
+				port{
-					remote-endpoint = <&apss_funnel_in4>;
+					etm4_out: endpoint {
+						remote-endpoint = <&apss_funnel_in4>;
+					};
 				};
 			};
 		};
@@ -1920,9 +1922,11 @@ etm6: etm@7d40000 {
 
 			cpu = <&CPU5>;
 
-			port{
+			out-ports {
-				etm5_out: endpoint {
+				port{
-					remote-endpoint = <&apss_funnel_in5>;
+					etm5_out: endpoint {
+						remote-endpoint = <&apss_funnel_in5>;
+					};
 				};
 			};
 		};
@@ -1937,9 +1941,11 @@ etm7: etm@7e40000 {
 
 			cpu = <&CPU6>;
 
-			port{
+			out-ports {
-				etm6_out: endpoint {
+				port{
-					remote-endpoint = <&apss_funnel_in6>;
+					etm6_out: endpoint {
+						remote-endpoint = <&apss_funnel_in6>;
+					};
 				};
 			};
 		};
@@ -1954,9 +1960,11 @@ etm8: etm@7f40000 {
 
 			cpu = <&CPU7>;
 
-			port{
+			out-ports {
-				etm7_out: endpoint {
+				port{
-					remote-endpoint = <&apss_funnel_in7>;
+					etm7_out: endpoint {
+						remote-endpoint = <&apss_funnel_in7>;
+					};
 				};
 			};
 		};

arch/arm64/boot/dts/qcom/sc7180.dtsi

@@ -2769,8 +2769,8 @@ usb_1: usb@a6f8800 {
 
 			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 6 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 8 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 9 IRQ_TYPE_LEVEL_HIGH>;
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
 					  "dm_hs_phy_irq", "dp_hs_phy_irq";
 

arch/arm64/boot/dts/qcom/sc7280.dtsi

@@ -3664,9 +3664,9 @@ usb_1: usb@a6f8800 {
 			assigned-clock-rates = <19200000>, <200000000>;
 
 			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 14 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 17 IRQ_TYPE_EDGE_BOTH>;
+					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "hs_phy_irq",
 					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",

arch/arm64/boot/dts/qcom/sdm845.dtsi

@@ -4048,10 +4048,10 @@ usb_1: usb@a6f8800 {
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <150000000>;
 
-			interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 488 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc_intc 8 IRQ_TYPE_EDGE_BOTH>,
-				     <GIC_SPI 489 IRQ_TYPE_LEVEL_HIGH>;
+					      <&pdc_intc 9 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
 					  "dm_hs_phy_irq", "dp_hs_phy_irq";
 
@@ -4099,10 +4099,10 @@ usb_2: usb@a8f8800 {
 					  <&gcc GCC_USB30_SEC_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <150000000>;
 
-			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 490 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc_intc 10 IRQ_TYPE_EDGE_BOTH>,
-				     <GIC_SPI 491 IRQ_TYPE_LEVEL_HIGH>;
+					      <&pdc_intc 11 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
 					  "dm_hs_phy_irq", "dp_hs_phy_irq";
 

arch/arm64/boot/dts/qcom/sm8150.dtsi

@@ -3628,10 +3628,10 @@ usb_1: usb@a6f8800 {
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 488 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
-				     <GIC_SPI 489 IRQ_TYPE_LEVEL_HIGH>;
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
 					  "dm_hs_phy_irq", "dp_hs_phy_irq";
 
@@ -3677,10 +3677,10 @@ usb_2: usb@a8f8800 {
 					  <&gcc GCC_USB30_SEC_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 490 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
-				     <GIC_SPI 491 IRQ_TYPE_LEVEL_HIGH>;
+					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
 					  "dm_hs_phy_irq", "dp_hs_phy_irq";
 

arch/arm64/boot/install.sh

@@ -17,7 +17,8 @@
 #   $3 - kernel map file
 #   $4 - default install path (blank if root directory)
 
-if [ "$(basename $2)" = "Image.gz" ]; then
+if [ "$(basename $2)" = "Image.gz" ] || [ "$(basename $2)" = "vmlinuz.efi" ]
+then
 # Compressed install
   echo "Installing compressed kernel"
   base=vmlinuz

arch/arm64/include/asm/irq_work.h

@@ -2,8 +2,6 @@
 #ifndef __ASM_IRQ_WORK_H
 #define __ASM_IRQ_WORK_H
 
-extern void arch_irq_work_raise(void);
-
 static inline bool arch_irq_work_has_interrupt(void)
 {
 	return true;

arch/arm64/kernel/cpu_errata.c

@@ -723,6 +723,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 		.cpu_enable = cpu_clear_bf16_from_user_emulation,
 	},
 #endif
+#ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
+	{
+		.desc = "ARM erratum 2966298",
+		.capability = ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD,
+		/* Cortex-A520 r0p0 - r0p1 */
+		ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A520, 0, 0, 1),
+	},
+#endif
 #ifdef CONFIG_AMPERE_ERRATUM_AC03_CPU_38
 	{
 		.desc = "AmpereOne erratum AC03_CPU_38",

arch/arm64/kernel/entry.S

@@ -419,6 +419,10 @@ alternative_else_nop_endif
 	ldp	x28, x29, [sp, #16 * 14]
 
 	.if	\el == 0
+alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
+	tlbi	vale1, xzr
+	dsb	nsh
+alternative_else_nop_endif
 alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0
 	ldr	lr, [sp, #S_LR]
 	add	sp, sp, #PT_REGS_SIZE		// restore sp

arch/arm64/kernel/irq.c

@@ -22,6 +22,7 @@
 #include <linux/vmalloc.h>
 #include <asm/daifflags.h>
 #include <asm/exception.h>
+#include <asm/numa.h>
 #include <asm/vmap_stack.h>
 #include <asm/softirq_stack.h>
 
@@ -46,17 +47,17 @@ static void init_irq_scs(void)
 
 	for_each_possible_cpu(cpu)
 		per_cpu(irq_shadow_call_stack_ptr, cpu) =
-			scs_alloc(cpu_to_node(cpu));
+			scs_alloc(early_cpu_to_node(cpu));
 }
 
 #ifdef CONFIG_VMAP_STACK
-static void init_irq_stacks(void)
+static void __init init_irq_stacks(void)
 {
 	int cpu;
 	unsigned long *p;
 
 	for_each_possible_cpu(cpu) {
-		p = arch_alloc_vmap_stack(IRQ_STACK_SIZE, cpu_to_node(cpu));
+		p = arch_alloc_vmap_stack(IRQ_STACK_SIZE, early_cpu_to_node(cpu));
 		per_cpu(irq_stack_ptr, cpu) = p;
 	}
 }

arch/arm64/kernel/perf_event.c

@@ -168,7 +168,11 @@ armv8pmu_events_sysfs_show(struct device *dev,
 	PMU_EVENT_ATTR_ID(name, armv8pmu_events_sysfs_show, config)
 
 static struct attribute *armv8_pmuv3_event_attrs[] = {
-	ARMV8_EVENT_ATTR(sw_incr, ARMV8_PMUV3_PERFCTR_SW_INCR),
+	/*
+	 * Don't expose the sw_incr event in /sys. It's not usable as writes to
+	 * PMSWINC_EL0 will trap as PMUSERENR.{SW,EN}=={0,0} and event rotation
+	 * means we don't have a fixed event<->counter relationship regardless.
+	 */
 	ARMV8_EVENT_ATTR(l1i_cache_refill, ARMV8_PMUV3_PERFCTR_L1I_CACHE_REFILL),
 	ARMV8_EVENT_ATTR(l1i_tlb_refill, ARMV8_PMUV3_PERFCTR_L1I_TLB_REFILL),
 	ARMV8_EVENT_ATTR(l1d_cache_refill, ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL),

arch/arm64/tools/cpucaps

@@ -86,7 +86,7 @@ WORKAROUND_NXP_ERR050104
 WORKAROUND_QCOM_FALKOR_E1003
 WORKAROUND_REPEAT_TLBI
 WORKAROUND_SPECULATIVE_AT
-ANDROID_KABI_RESERVE_01
+WORKAROUND_SPECULATIVE_UNPRIV_LOAD
 ANDROID_KABI_RESERVE_02
 ANDROID_KABI_RESERVE_03
 ANDROID_KABI_RESERVE_04

arch/csky/include/asm/irq_work.h

@@ -7,5 +7,5 @@ static inline bool arch_irq_work_has_interrupt(void)
 {
 	return true;
 }
-extern void arch_irq_work_raise(void);
+
 #endif /* __ASM_CSKY_IRQ_WORK_H */

arch/loongarch/kernel/smp.c

@@ -471,7 +471,7 @@ asmlinkage void start_secondary(void)
 	unsigned int cpu;
 
 	sync_counter();
-	cpu = smp_processor_id();
+	cpu = raw_smp_processor_id();
 	set_my_cpu_offset(per_cpu_offset(cpu));
 
 	cpu_probe();

arch/loongarch/mm/tlb.c

@@ -271,12 +271,16 @@ void setup_tlb_handler(int cpu)
 		set_handler(EXCCODE_TLBNR * VECSIZE, handle_tlb_protect, VECSIZE);
 		set_handler(EXCCODE_TLBNX * VECSIZE, handle_tlb_protect, VECSIZE);
 		set_handler(EXCCODE_TLBPE * VECSIZE, handle_tlb_protect, VECSIZE);
-	}
+	} else {
+		int vec_sz __maybe_unused;
+		void *addr __maybe_unused;
+		struct page *page __maybe_unused;
+
+		/* Avoid lockdep warning */
+		rcu_cpu_starting(cpu);
+
 #ifdef CONFIG_NUMA
-	else {
+		vec_sz = sizeof(exception_handlers);
-		void *addr;
-		struct page *page;
-		const int vec_sz = sizeof(exception_handlers);
 
 		if (pcpu_handlers[cpu])
 			return;
@@ -292,8 +296,8 @@ void setup_tlb_handler(int cpu)
 		csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_EENTRY);
 		csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_MERRENTRY);
 		csr_write64(pcpu_handlers[cpu] + 80*VECSIZE, LOONGARCH_CSR_TLBRENTRY);
-	}
 #endif
+	}
 }
 
 void tlb_init(int cpu)

arch/mips/kernel/elf.c

@@ -11,6 +11,7 @@
 
 #include <asm/cpu-features.h>
 #include <asm/cpu-info.h>
+#include <asm/fpu.h>
 
 #ifdef CONFIG_MIPS_FP_SUPPORT
 
@@ -309,6 +310,11 @@ void mips_set_personality_nan(struct arch_elf_state *state)
 	struct cpuinfo_mips *c = &boot_cpu_data;
 	struct task_struct *t = current;
 
+	/* Do this early so t->thread.fpu.fcr31 won't be clobbered in case
+	 * we are preempted before the lose_fpu(0) in start_thread.
+	 */
+	lose_fpu(0);
+
 	t->thread.fpu.fcr31 = c->fpu_csr31;
 	switch (state->nan_2008) {
 	case 0:

arch/mips/lantiq/prom.c

@@ -114,10 +114,9 @@ void __init prom_init(void)
 	prom_init_cmdline();
 
 #if defined(CONFIG_MIPS_MT_SMP)
-	if (cpu_has_mipsmt) {
+	lantiq_smp_ops = vsmp_smp_ops;
-		lantiq_smp_ops = vsmp_smp_ops;
+	if (cpu_has_mipsmt)
 		lantiq_smp_ops.init_secondary = lantiq_init_secondary;
-		register_smp_ops(&lantiq_smp_ops);
+	register_smp_ops(&lantiq_smp_ops);
-	}
 #endif
 }

arch/mips/mm/init.c

@@ -417,7 +417,12 @@ void __init paging_init(void)
 		       (highend_pfn - max_low_pfn) << (PAGE_SHIFT - 10));
 		max_zone_pfns[ZONE_HIGHMEM] = max_low_pfn;
 	}
+
+	max_mapnr = highend_pfn ? highend_pfn : max_low_pfn;
+#else
+	max_mapnr = max_low_pfn;
 #endif
+	high_memory = (void *) __va(max_low_pfn << PAGE_SHIFT);
 
 	free_area_init(max_zone_pfns);
 }
@@ -453,13 +458,6 @@ void __init mem_init(void)
 	 */
 	BUILD_BUG_ON(IS_ENABLED(CONFIG_32BIT) && (_PFN_SHIFT > PAGE_SHIFT));
 
-#ifdef CONFIG_HIGHMEM
-	max_mapnr = highend_pfn ? highend_pfn : max_low_pfn;
-#else
-	max_mapnr = max_low_pfn;
-#endif
-	high_memory = (void *) __va(max_low_pfn << PAGE_SHIFT);
-
 	maar_init();
 	memblock_free_all();
 	setup_zero_pages();	/* Setup zeroed pages.  */

arch/parisc/kernel/firmware.c

@@ -123,10 +123,10 @@ static unsigned long f_extend(unsigned long address)
 #ifdef CONFIG_64BIT
 	if(unlikely(parisc_narrow_firmware)) {
 		if((address & 0xff000000) == 0xf0000000)
-			return 0xf0f0f0f000000000UL | (u32)address;
+			return (0xfffffff0UL << 32) | (u32)address;
 
 		if((address & 0xf0000000) == 0xf0000000)
-			return 0xffffffff00000000UL | (u32)address;
+			return (0xffffffffUL << 32) | (u32)address;
 	}
 #endif
 	return address;

arch/powerpc/Kconfig

@@ -806,7 +806,6 @@ config THREAD_SHIFT
 	int "Thread shift" if EXPERT
 	range 13 15
 	default "15" if PPC_256K_PAGES
-	default "15" if PPC_PSERIES || PPC_POWERNV
 	default "14" if PPC64
 	default "13"
 	help

arch/powerpc/include/asm/irq_work.h

@@ -6,6 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void)
 {
 	return true;
 }
-extern void arch_irq_work_raise(void);
 
 #endif /* _ASM_POWERPC_IRQ_WORK_H */

arch/powerpc/include/asm/mmu.h

@@ -417,5 +417,9 @@ extern void *abatron_pteptrs[2];
 #include <asm/nohash/mmu.h>
 #endif
 
+#if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP)
+#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
+#endif
+
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_MMU_H_ */

arch/powerpc/include/asm/mmzone.h

@@ -42,14 +42,6 @@ u64 memory_hotplug_max(void);
 #else
 #define memory_hotplug_max() memblock_end_of_DRAM()
 #endif /* CONFIG_NUMA */
-#ifdef CONFIG_FA_DUMP
-#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
-#endif
-
-#ifdef CONFIG_MEMORY_HOTPLUG
-extern int create_section_mapping(unsigned long start, unsigned long end,
-				  int nid, pgprot_t prot);
-#endif
 
 #endif /* __KERNEL__ */
 #endif /* _ASM_MMZONE_H_ */

arch/powerpc/kernel/traps.c

@@ -1439,10 +1439,12 @@ static int emulate_instruction(struct pt_regs *regs)
 	return -EINVAL;
 }
 
+#ifdef CONFIG_GENERIC_BUG
 int is_valid_bugaddr(unsigned long addr)
 {
 	return is_kernel_addr(addr);
 }
+#endif
 
 #ifdef CONFIG_MATH_EMULATION
 static int emulate_math(struct pt_regs *regs)

arch/powerpc/lib/sstep.c

@@ -586,6 +586,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea,
 	} u;
 
 	nb = GETSIZE(op->type);
+	if (nb > sizeof(u))
+		return -EINVAL;
 	if (!address_ok(regs, ea, nb))
 		return -EFAULT;
 	rn = op->reg;
@@ -636,6 +638,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea,
 	} u;
 
 	nb = GETSIZE(op->type);
+	if (nb > sizeof(u))
+		return -EINVAL;
 	if (!address_ok(regs, ea, nb))
 		return -EFAULT;
 	rn = op->reg;
@@ -680,6 +684,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,
 		u8 b[sizeof(__vector128)];
 	} u = {};
 
+	if (size > sizeof(u))
+		return -EINVAL;
+
 	if (!address_ok(regs, ea & ~0xfUL, 16))
 		return -EFAULT;
 	/* align to multiple of size */
@@ -707,6 +714,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,
 		u8 b[sizeof(__vector128)];
 	} u;
 
+	if (size > sizeof(u))
+		return -EINVAL;
+
 	if (!address_ok(regs, ea & ~0xfUL, 16))
 		return -EFAULT;
 	/* align to multiple of size */

arch/powerpc/mm/book3s64/pgtable.c

@@ -463,6 +463,7 @@ void ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr,
 	set_pte_at(vma->vm_mm, addr, ptep, pte);
 }
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
 /*
  * For hash translation mode, we use the deposited table to store hash slot
  * information and they are stored at PTRS_PER_PMD offset from related pmd
@@ -484,6 +485,7 @@ int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
 
 	return true;
 }
+#endif
 
 /*
  * Does the CPU support tlbie?

arch/powerpc/mm/init-common.c

@@ -126,7 +126,7 @@ void pgtable_cache_add(unsigned int shift)
 	 * as to leave enough 0 bits in the address to contain it. */
 	unsigned long minalign = max(MAX_PGTABLE_INDEX_SIZE + 1,
 				     HUGEPD_SHIFT_MASK + 1);
-	struct kmem_cache *new;
+	struct kmem_cache *new = NULL;
 
 	/* It would be nice if this was a BUILD_BUG_ON(), but at the
 	 * moment, gcc doesn't seem to recognize is_power_of_2 as a
@@ -139,7 +139,8 @@ void pgtable_cache_add(unsigned int shift)
 
 	align = max_t(unsigned long, align, minalign);
 	name = kasprintf(GFP_KERNEL, "pgtable-2^%d", shift);
-	new = kmem_cache_create(name, table_size, align, 0, ctor(shift));
+	if (name)
+		new = kmem_cache_create(name, table_size, align, 0, ctor(shift));
 	if (!new)
 		panic("Could not allocate pgtable cache for order %d", shift);
 

arch/powerpc/mm/mmu_decl.h

@@ -179,3 +179,8 @@ static inline bool debug_pagealloc_enabled_or_kfence(void)
 {
 	return IS_ENABLED(CONFIG_KFENCE) || debug_pagealloc_enabled();
 }
+
+#ifdef CONFIG_MEMORY_HOTPLUG
+int create_section_mapping(unsigned long start, unsigned long end,
+			   int nid, pgprot_t prot);
+#endif

arch/riscv/include/asm/irq_work.h

@@ -6,5 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void)
 {
 	return IS_ENABLED(CONFIG_SMP);
 }
-extern void arch_irq_work_raise(void);
+
 #endif /* _ASM_RISCV_IRQ_WORK_H */

arch/s390/crypto/aes_s390.c

@@ -601,7 +601,9 @@ static int ctr_aes_crypt(struct skcipher_request *req)
 	 * final block may be < AES_BLOCK_SIZE, copy only nbytes
 	 */
 	if (nbytes) {
-		cpacf_kmctr(sctx->fc, sctx->key, buf, walk.src.virt.addr,
+		memset(buf, 0, AES_BLOCK_SIZE);
+		memcpy(buf, walk.src.virt.addr, nbytes);
+		cpacf_kmctr(sctx->fc, sctx->key, buf, buf,
 			    AES_BLOCK_SIZE, walk.iv);
 		memcpy(walk.dst.virt.addr, buf, nbytes);
 		crypto_inc(walk.iv, AES_BLOCK_SIZE);

arch/s390/crypto/paes_s390.c

@@ -688,9 +688,11 @@ static int ctr_paes_crypt(struct skcipher_request *req)
 	 * final block may be < AES_BLOCK_SIZE, copy only nbytes
 	 */
 	if (nbytes) {
+		memset(buf, 0, AES_BLOCK_SIZE);
+		memcpy(buf, walk.src.virt.addr, nbytes);
 		while (1) {
 			if (cpacf_kmctr(ctx->fc, &param, buf,
-					walk.src.virt.addr, AES_BLOCK_SIZE,
+					buf, AES_BLOCK_SIZE,
 					walk.iv) == AES_BLOCK_SIZE)
 				break;
 			if (__paes_convert_key(ctx))

arch/s390/include/asm/irq_work.h

@@ -7,6 +7,4 @@ static inline bool arch_irq_work_has_interrupt(void)
 	return true;
 }
 
-void arch_irq_work_raise(void);
-
 #endif /* _ASM_S390_IRQ_WORK_H */

arch/s390/kernel/ptrace.c

@@ -385,6 +385,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
 		/*
 		 * floating point control reg. is in the thread structure
 		 */
+		save_fpu_regs();
 		if ((unsigned int) data != 0 ||
 		    test_fp_ctl(data >> (BITS_PER_LONG - 32)))
 			return -EINVAL;
@@ -741,6 +742,7 @@ static int __poke_user_compat(struct task_struct *child,
 		/*
 		 * floating point control reg. is in the thread structure
 		 */
+		save_fpu_regs();
 		if (test_fp_ctl(tmp))
 			return -EINVAL;
 		child->thread.fpu.fpc = data;
@@ -904,9 +906,7 @@ static int s390_fpregs_set(struct task_struct *target,
 	int rc = 0;
 	freg_t fprs[__NUM_FPRS];
 
-	if (target == current)
+	save_fpu_regs();
-		save_fpu_regs();
-
 	if (MACHINE_HAS_VX)
 		convert_vx_to_fp(fprs, target->thread.fpu.vxrs);
 	else

arch/s390/kvm/kvm-s390.c

@@ -4138,10 +4138,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
 
 	vcpu_load(vcpu);
 
-	if (test_fp_ctl(fpu->fpc)) {
-		ret = -EINVAL;
-		goto out;
-	}
 	vcpu->run->s.regs.fpc = fpu->fpc;
 	if (MACHINE_HAS_VX)
 		convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
@@ -4149,7 +4145,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
 	else
 		memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs));
 
-out:
 	vcpu_put(vcpu);
 	return ret;
 }

arch/um/drivers/net_kern.c

@@ -204,7 +204,7 @@ static int uml_net_close(struct net_device *dev)
 	return 0;
 }
 
-static int uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct uml_net_private *lp = netdev_priv(dev);
 	unsigned long flags;

arch/um/include/shared/kern_util.h

@@ -50,7 +50,7 @@ extern void do_uml_exitcalls(void);
  * Are we disallowed to sleep? Used to choose between GFP_KERNEL and
  * GFP_ATOMIC.
  */
-extern int __cant_sleep(void);
+extern int __uml_cant_sleep(void);
 extern int get_current_pid(void);
 extern int copy_from_user_proc(void *to, void *from, int size);
 extern char *uml_strdup(const char *string);

arch/um/kernel/process.c

@@ -220,7 +220,7 @@ void arch_cpu_idle(void)
 	raw_local_irq_enable();
 }
 
-int __cant_sleep(void) {
+int __uml_cant_sleep(void) {
 	return in_atomic() || irqs_disabled() || in_interrupt();
 	/* Is in_interrupt() really needed? */
 }

arch/um/kernel/time.c

@@ -432,9 +432,29 @@ static void time_travel_update_time(unsigned long long next, bool idle)
 	time_travel_del_event(&ne);
 }
 
+static void time_travel_update_time_rel(unsigned long long offs)
+{
+	unsigned long flags;
+
+	/*
+	 * Disable interrupts before calculating the new time so
+	 * that a real timer interrupt (signal) can't happen at
+	 * a bad time e.g. after we read time_travel_time but
+	 * before we've completed updating the time.
+	 */
+	local_irq_save(flags);
+	time_travel_update_time(time_travel_time + offs, false);
+	local_irq_restore(flags);
+}
+
 void time_travel_ndelay(unsigned long nsec)
 {
-	time_travel_update_time(time_travel_time + nsec, false);
+	/*
+	 * Not strictly needed to use _rel() version since this is
+	 * only used in INFCPU/EXT modes, but it doesn't hurt and
+	 * is more readable too.
+	 */
+	time_travel_update_time_rel(nsec);
 }
 EXPORT_SYMBOL(time_travel_ndelay);
 
@@ -568,7 +588,11 @@ static void time_travel_set_start(void)
 #define time_travel_time 0
 #define time_travel_ext_waiting 0
 
-static inline void time_travel_update_time(unsigned long long ns, bool retearly)
+static inline void time_travel_update_time(unsigned long long ns, bool idle)
+{
+}
+
+static inline void time_travel_update_time_rel(unsigned long long offs)
 {
 }
 
@@ -720,9 +744,7 @@ static u64 timer_read(struct clocksource *cs)
 		 */
 		if (!irqs_disabled() && !in_interrupt() && !in_softirq() &&
 		    !time_travel_ext_waiting)
-			time_travel_update_time(time_travel_time +
+			time_travel_update_time_rel(TIMER_MULTIPLIER);
-						TIMER_MULTIPLIER,
-						false);
 		return time_travel_time / TIMER_MULTIPLIER;
 	}
 

arch/um/os-Linux/helper.c

@@ -46,7 +46,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
 	unsigned long stack, sp;
 	int pid, fds[2], ret, n;
 
-	stack = alloc_stack(0, __cant_sleep());
+	stack = alloc_stack(0, __uml_cant_sleep());
 	if (stack == 0)
 		return -ENOMEM;
 
@@ -70,7 +70,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
 	data.pre_data = pre_data;
 	data.argv = argv;
 	data.fd = fds[1];
-	data.buf = __cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
+	data.buf = __uml_cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
 					uml_kmalloc(PATH_MAX, UM_GFP_KERNEL);
 	pid = clone(helper_child, (void *) sp, CLONE_VM, &data);
 	if (pid < 0) {
@@ -121,7 +121,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
 	unsigned long stack, sp;
 	int pid, status, err;
 
-	stack = alloc_stack(0, __cant_sleep());
+	stack = alloc_stack(0, __uml_cant_sleep());
 	if (stack == 0)
 		return -ENOMEM;
 

arch/um/os-Linux/util.c

@@ -173,23 +173,38 @@ __uml_setup("quiet", quiet_cmd_param,
 "quiet\n"
 "    Turns off information messages during boot.\n\n");
 
+/*
+ * The os_info/os_warn functions will be called by helper threads. These
+ * have a very limited stack size and using the libc formatting functions
+ * may overflow the stack.
+ * So pull in the kernel vscnprintf and use that instead with a fixed
+ * on-stack buffer.
+ */
+int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
+
 void os_info(const char *fmt, ...)
 {
+	char buf[256];
 	va_list list;
+	int len;
 
 	if (quiet_info)
 		return;
 
 	va_start(list, fmt);
-	vfprintf(stderr, fmt, list);
+	len = vscnprintf(buf, sizeof(buf), fmt, list);
+	fwrite(buf, len, 1, stderr);
 	va_end(list);
 }
 
 void os_warn(const char *fmt, ...)
 {
+	char buf[256];
 	va_list list;
+	int len;
 
 	va_start(list, fmt);
-	vfprintf(stderr, fmt, list);
+	len = vscnprintf(buf, sizeof(buf), fmt, list);
+	fwrite(buf, len, 1, stderr);
 	va_end(list);
 }

arch/x86/boot/compressed/ident_map_64.c

@@ -393,3 +393,8 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code)
 	 */
 	kernel_add_identity_map(address, end);
 }
+
+void do_boot_nmi_trap(struct pt_regs *regs, unsigned long error_code)
+{
+	/* Empty handler to ignore NMI during early boot */
+}

arch/x86/boot/compressed/idt_64.c

@@ -61,6 +61,7 @@ void load_stage2_idt(void)
 	boot_idt_desc.address = (unsigned long)boot_idt;
 
 	set_idt_entry(X86_TRAP_PF, boot_page_fault);
+	set_idt_entry(X86_TRAP_NMI, boot_nmi_trap);
 
 #ifdef CONFIG_AMD_MEM_ENCRYPT
 	/*

arch/x86/boot/compressed/idt_handlers_64.S

@@ -70,6 +70,7 @@ SYM_FUNC_END(\name)
 	.code64
 
 EXCEPTION_HANDLER	boot_page_fault do_boot_page_fault error_code=1
+EXCEPTION_HANDLER	boot_nmi_trap do_boot_nmi_trap error_code=0
 
 #ifdef CONFIG_AMD_MEM_ENCRYPT
 EXCEPTION_HANDLER	boot_stage1_vc do_vc_no_ghcb		error_code=1

arch/x86/boot/compressed/misc.h

@@ -190,6 +190,7 @@ static inline void cleanup_exception_handling(void) { }
 
 /* IDT Entry Points */
 void boot_page_fault(void);
+void boot_nmi_trap(void);
 void boot_stage1_vc(void);
 void boot_stage2_vc(void);
 

arch/x86/include/asm/irq_work.h

@@ -9,7 +9,6 @@ static inline bool arch_irq_work_has_interrupt(void)
 {
 	return boot_cpu_has(X86_FEATURE_APIC);
 }
-extern void arch_irq_work_raise(void);
 #else
 static inline bool arch_irq_work_has_interrupt(void)
 {

arch/x86/include/asm/kmsan.h

@@ -64,6 +64,7 @@ static inline bool kmsan_virt_addr_valid(void *addr)
 {
 	unsigned long x = (unsigned long)addr;
 	unsigned long y = x - __START_KERNEL_map;
+	bool ret;
 
 	/* use the carry flag to determine if x was < __START_KERNEL_map */
 	if (unlikely(x > y)) {
@@ -79,7 +80,21 @@ static inline bool kmsan_virt_addr_valid(void *addr)
 			return false;
 	}
 
-	return pfn_valid(x >> PAGE_SHIFT);
+	/*
+	 * pfn_valid() relies on RCU, and may call into the scheduler on exiting
+	 * the critical section. However, this would result in recursion with
+	 * KMSAN. Therefore, disable preemption here, and re-enable preemption
+	 * below while suppressing reschedules to avoid recursion.
+	 *
+	 * Note, this sacrifices occasionally breaking scheduling guarantees.
+	 * Although, a kernel compiled with KMSAN has already given up on any
+	 * performance guarantees due to being heavily instrumented.
+	 */
+	preempt_disable();
+	ret = pfn_valid(x >> PAGE_SHIFT);
+	preempt_enable_no_resched();
+
+	return ret;
 }
 
 #endif /* !MODULE */

arch/x86/include/asm/syscall_wrapper.h

@@ -58,12 +58,29 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs);
 		,,regs->di,,regs->si,,regs->dx				\
 		,,regs->r10,,regs->r8,,regs->r9)			\
 
+
+/* SYSCALL_PT_ARGS is Adapted from s390x */
+#define SYSCALL_PT_ARG6(m, t1, t2, t3, t4, t5, t6)			\
+	SYSCALL_PT_ARG5(m, t1, t2, t3, t4, t5), m(t6, (regs->bp))
+#define SYSCALL_PT_ARG5(m, t1, t2, t3, t4, t5)				\
+	SYSCALL_PT_ARG4(m, t1, t2, t3, t4),  m(t5, (regs->di))
+#define SYSCALL_PT_ARG4(m, t1, t2, t3, t4)				\
+	SYSCALL_PT_ARG3(m, t1, t2, t3),  m(t4, (regs->si))
+#define SYSCALL_PT_ARG3(m, t1, t2, t3)					\
+	SYSCALL_PT_ARG2(m, t1, t2), m(t3, (regs->dx))
+#define SYSCALL_PT_ARG2(m, t1, t2)					\
+	SYSCALL_PT_ARG1(m, t1), m(t2, (regs->cx))
+#define SYSCALL_PT_ARG1(m, t1) m(t1, (regs->bx))
+#define SYSCALL_PT_ARGS(x, ...) SYSCALL_PT_ARG##x(__VA_ARGS__)
+
+#define __SC_COMPAT_CAST(t, a)						\
+	(__typeof(__builtin_choose_expr(__TYPE_IS_L(t), 0, 0U)))	\
+	(unsigned int)a
+
 /* Mapping of registers to parameters for syscalls on i386 */
 #define SC_IA32_REGS_TO_ARGS(x, ...)					\
-	__MAP(x,__SC_ARGS						\
+	SYSCALL_PT_ARGS(x, __SC_COMPAT_CAST,				\
-	      ,,(unsigned int)regs->bx,,(unsigned int)regs->cx		\
+			__MAP(x, __SC_TYPE, __VA_ARGS__))		\
-	      ,,(unsigned int)regs->dx,,(unsigned int)regs->si		\
-	      ,,(unsigned int)regs->di,,(unsigned int)regs->bp)
 
 #define __SYS_STUB0(abi, name)						\
 	long __##abi##_##name(const struct pt_regs *regs);		\

arch/x86/kernel/cpu/mce/core.c

@@ -44,6 +44,7 @@
 #include <linux/sync_core.h>
 #include <linux/task_work.h>
 #include <linux/hardirq.h>
+#include <linux/kexec.h>
 
 #include <asm/intel-family.h>
 #include <asm/processor.h>
@@ -239,6 +240,7 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)
 	struct llist_node *pending;
 	struct mce_evt_llist *l;
 	int apei_err = 0;
+	struct page *p;
 
 	/*
 	 * Allow instrumentation around external facilities usage. Not that it
@@ -292,6 +294,20 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)
 	if (!fake_panic) {
 		if (panic_timeout == 0)
 			panic_timeout = mca_cfg.panic_timeout;
+
+		/*
+		 * Kdump skips the poisoned page in order to avoid
+		 * touching the error bits again. Poison the page even
+		 * if the error is fatal and the machine is about to
+		 * panic.
+		 */
+		if (kexec_crash_loaded()) {
+			if (final && (final->status & MCI_STATUS_ADDRV)) {
+				p = pfn_to_online_page(final->addr >> PAGE_SHIFT);
+				if (p)
+					SetPageHWPoison(p);
+			}
+		}
 		panic(msg);
 	} else
 		pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg);

arch/x86/kernel/hpet.c

@@ -1436,7 +1436,7 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
 	memset(&curr_time, 0, sizeof(struct rtc_time));
 
 	if (hpet_rtc_flags & (RTC_UIE | RTC_AIE)) {
-		if (unlikely(mc146818_get_time(&curr_time) < 0)) {
+		if (unlikely(mc146818_get_time(&curr_time, 10) < 0)) {
 			pr_err_ratelimited("unable to read current time from RTC\n");
 			return IRQ_HANDLED;
 		}

arch/x86/kernel/rtc.c

@@ -67,7 +67,7 @@ void mach_get_cmos_time(struct timespec64 *now)
 		return;
 	}
 
-	if (mc146818_get_time(&tm)) {
+	if (mc146818_get_time(&tm, 1000)) {
 		pr_err("Unable to read current time from RTC\n");
 		now->tv_sec = now->tv_nsec = 0;
 		return;

arch/x86/kvm/svm/nested.c

@@ -239,18 +239,6 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu *vcpu, u64 pa, u32 size)
 	    kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1);
 }
 
-static bool nested_svm_check_tlb_ctl(struct kvm_vcpu *vcpu, u8 tlb_ctl)
-{
-	/* Nested FLUSHBYASID is not supported yet.  */
-	switch(tlb_ctl) {
-		case TLB_CONTROL_DO_NOTHING:
-		case TLB_CONTROL_FLUSH_ALL_ASID:
-			return true;
-		default:
-			return false;
-	}
-}
-
 static bool __nested_vmcb_check_controls(struct kvm_vcpu *vcpu,
 					 struct vmcb_ctrl_area_cached *control)
 {
@@ -270,8 +258,6 @@ static bool __nested_vmcb_check_controls(struct kvm_vcpu *vcpu,
 					   IOPM_SIZE)))
 		return false;
 
-	if (CC(!nested_svm_check_tlb_ctl(vcpu, control->tlb_ctl)))
-		return false;
 
 	return true;
 }

block/bio.c

@@ -930,7 +930,7 @@ static bool bio_try_merge_hw_seg(struct request_queue *q, struct bio *bio,
 
 	if ((addr1 | mask) != (addr2 | mask))
 		return false;
-	if (bv->bv_len + len > queue_max_segment_size(q))
+	if (len > queue_max_segment_size(q) - bv->bv_len)
 		return false;
 	return __bio_try_merge_page(bio, page, len, offset, same_page);
 }

block/blk-core.c

@@ -873,7 +873,16 @@ int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags)
 	 */
 	blk_flush_plug(current->plug, false);
 
-	if (bio_queue_enter(bio))
+	/*
+	 * We need to be able to enter a frozen queue, similar to how
+	 * timeouts also need to do that. If that is blocked, then we can
+	 * have pending IO when a queue freeze is started, and then the
+	 * wait for the freeze to finish will wait for polled requests to
+	 * timeout as the poller is preventer from entering the queue and
+	 * completing them. As long as we prevent new IO from being queued,
+	 * that should be all that matters.
+	 */
+	if (!percpu_ref_tryget(&q->q_usage_counter))
 		return 0;
 	if (queue_is_mq(q)) {
 		ret = blk_mq_poll(q, cookie, iob, flags);

block/blk-iocost.c

@@ -1337,6 +1337,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)
 
 	lockdep_assert_held(&iocg->waitq.lock);
 
+	/*
+	 * If the delay is set by another CPU, we may be in the past. No need to
+	 * change anything if so. This avoids decay calculation underflow.
+	 */
+	if (time_before64(now->now, iocg->delay_at))
+		return false;
+
 	/* calculate the current delay in effect - 1/2 every second */
 	tdelta = now->now - iocg->delay_at;
 	if (iocg->delay)

block/blk-mq.c

@@ -1857,6 +1857,22 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
 	wait->flags &= ~WQ_FLAG_EXCLUSIVE;
 	__add_wait_queue(wq, wait);
 
+	/*
+	 * Add one explicit barrier since blk_mq_get_driver_tag() may
+	 * not imply barrier in case of failure.
+	 *
+	 * Order adding us to wait queue and allocating driver tag.
+	 *
+	 * The pair is the one implied in sbitmap_queue_wake_up() which
+	 * orders clearing sbitmap tag bits and waitqueue_active() in
+	 * __sbitmap_queue_wake_up(), since waitqueue_active() is lockless
+	 *
+	 * Otherwise, re-order of adding wait queue and getting driver tag
+	 * may cause __sbitmap_queue_wake_up() to wake up nothing because
+	 * the waitqueue_active() may not observe us in wait queue.
+	 */
+	smp_mb();
+
 	/*
 	 * It's possible that a tag was freed in the window between the
 	 * allocation failure and adding the hardware queue to the wait

block/ioctl.c

@@ -20,8 +20,6 @@ static int blkpg_do_ioctl(struct block_device *bdev,
 	struct blkpg_partition p;
 	sector_t start, length;
 
-	if (disk->flags & GENHD_FL_NO_PART)
-		return -EINVAL;
 	if (!capable(CAP_SYS_ADMIN))
 		return -EACCES;
 	if (copy_from_user(&p, upart, sizeof(struct blkpg_partition)))

block/partitions/core.c

@@ -453,6 +453,11 @@ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start,
 		goto out;
 	}
 
+	if (disk->flags & GENHD_FL_NO_PART) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	if (partition_overlaps(disk, start, length, -1)) {
 		ret = -EBUSY;
 		goto out;

crypto/algapi.c

@@ -329,6 +329,7 @@ __crypto_register_alg(struct crypto_alg *alg, struct list_head *algs_to_put)
 		}
 
 		if (!strcmp(q->cra_driver_name, alg->cra_name) ||
+		    !strcmp(q->cra_driver_name, alg->cra_driver_name) ||
 		    !strcmp(q->cra_name, alg->cra_driver_name))
 			goto err;
 	}